0180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x1200000000000000, 0x0, 0x0) [ 1907.572602][T28129] hid-generic 0000:0000:0000.0275: unknown main item tag 0x0 [ 1907.613148][T28129] hid-generic 0000:0000:0000.0275: unknown main item tag 0x0 [ 1907.648813][T28129] hid-generic 0000:0000:0000.0275: unknown main item tag 0x0 17:43:12 executing program 4: r0 = syz_io_uring_setup(0x0, &(0x7f0000000080)={0x0, 0x100000, 0x1, 0x4, 0xfffffffd}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xfffffffffffffeb8, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1907.696329][T28129] hid-generic 0000:0000:0000.0275: unknown main item tag 0x0 [ 1907.738507][T28129] hid-generic 0000:0000:0000.0275: unknown main item tag 0x0 [ 1907.788470][T28129] hid-generic 0000:0000:0000.0275: unknown main item tag 0x0 [ 1907.796147][T14409] netlink: 'syz-executor.0': attribute type 16 has an invalid length. [ 1907.830118][T14409] netlink: 'syz-executor.0': attribute type 16 has an invalid length. [ 1907.841133][T28129] hid-generic 0000:0000:0000.0275: unknown main item tag 0x0 17:43:12 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x8000000}, 0x0) [ 1907.882509][T28129] hid-generic 0000:0000:0000.0275: unknown main item tag 0x0 17:43:12 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe5b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:12 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x1300000000000000, 0x0, 0x0) [ 1907.922822][T28129] hid-generic 0000:0000:0000.0275: unknown main item tag 0x0 17:43:12 executing program 4: r0 = syz_io_uring_setup(0x0, &(0x7f0000000080)={0x0, 0x100000, 0x1, 0x4, 0xfffffffd}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xfffffffffffffeb8, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:12 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x3000000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) [ 1907.971173][T28129] hid-generic 0000:0000:0000.0275: unknown main item tag 0x0 [ 1908.000455][T28129] hid-generic 0000:0000:0000.0275: unknown main item tag 0x0 [ 1908.033706][T28129] hid-generic 0000:0000:0000.0275: unknown main item tag 0x0 [ 1908.088600][T28129] hid-generic 0000:0000:0000.0275: hidraw0: HID v0.00 Device [syz1] on %z5 [ 1908.221033][T14448] netlink: 'syz-executor.0': attribute type 16 has an invalid length. [ 1908.243211][T14450] netlink: 'syz-executor.3': attribute type 14 has an invalid length. [ 1908.262473][T14448] netlink: 'syz-executor.0': attribute type 16 has an invalid length. [ 1908.289555][T14450] netlink: 'syz-executor.3': attribute type 14 has an invalid length. [ 1908.737475][T28129] hid-generic 0000:0000:0000.0276: unknown main item tag 0x0 [ 1908.747520][T28129] hid-generic 0000:0000:0000.0276: unknown main item tag 0x0 [ 1908.763682][T28129] hid-generic 0000:0000:0000.0276: unknown main item tag 0x0 [ 1908.793074][T28129] hid-generic 0000:0000:0000.0276: unknown main item tag 0x0 [ 1908.803277][T28129] hid-generic 0000:0000:0000.0276: unknown main item tag 0x0 [ 1908.819549][T28129] hid-generic 0000:0000:0000.0276: unknown main item tag 0x0 [ 1908.832029][T28129] hid-generic 0000:0000:0000.0276: unknown main item tag 0x0 [ 1908.849040][T28129] hid-generic 0000:0000:0000.0276: unknown main item tag 0x0 [ 1908.859468][T28129] hid-generic 0000:0000:0000.0276: unknown main item tag 0x0 [ 1908.878801][T28129] hid-generic 0000:0000:0000.0276: unknown main item tag 0x0 [ 1908.886487][T28129] hid-generic 0000:0000:0000.0276: unknown main item tag 0x0 [ 1908.894888][T28129] hid-generic 0000:0000:0000.0276: unknown main item tag 0x0 [ 1908.902298][T28129] hid-generic 0000:0000:0000.0276: unknown main item tag 0x0 [ 1908.910822][T28129] hid-generic 0000:0000:0000.0276: unknown main item tag 0x0 [ 1908.921628][T28129] hid-generic 0000:0000:0000.0276: hidraw0: HID v0.00 Device [syz1] on %z5 17:43:13 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x1400000000000000, 0x0, 0x0) 17:43:13 executing program 4: r0 = syz_io_uring_setup(0x0, &(0x7f0000000080)={0x0, 0x100000, 0x1, 0x4, 0xfffffffd}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xfffffffffffffeb8, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:13 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x9000000}, 0x0) 17:43:13 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x4000000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:13 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:13 executing program 4: r0 = syz_io_uring_setup(0x82, 0x0, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xfffffffffffffeb8, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:13 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000680)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000090000000000000000000900000000000fbc7f5c7e5ca7810000d1a000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, 0xffffffffffffffff) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x3, 0x0) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)=ANY=[@ANYBLOB="03000000", @ANYRES16=0x0, @ANYBLOB="3f02000000000000000001000000000000000c41f0000005001473797a3100000000"], 0x28}, 0x1, 0xfffffff0}, 0x0) sendmsg$TIPC_CMD_SET_LINK_WINDOW(r5, &(0x7f0000000300)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x30, 0x0, 0x300, 0x4, 0x25dfdbfd, {{}, {}, {0x14, 0x18, {0x7fffffff, @bearer=@l2={'eth', 0x3a, 'caif0\x00'}}}}, ["", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x4001041}, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x40}, 0x0) getsockname$packet(r7, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=@newqdisc={0x148, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_red={{0x8, 0x1, 'red\x00'}, {0x11c, 0x2, [@TCA_RED_STAB={0x104, 0x2, "5fcea2720370debdcd7796d58f06204365cf0a7f6ec14f5e0f9985c451186950aacedbcbe8f6a3261d7e7e850aae5683e9a7045dea2dbc096e6c1bdd9536d8acf4c29b1458627f0b19c8869aad0e53d580eb8cea889860430f40d1c3e29166a8bb2709638caf0ab36da7f2f7b05221eebd323c73f2be7b30bd689717a3c6b23984f0cd4bcc67e34f576f4ea3d016abcd4819b7ed59fdb44820cb7b1fe6630ab67c2a1df18846d4892f10220761ee1647601f89474bdf251e5f982d49afe9b2aeeb930836775e51f0c131bfdc98fb918b1bd627a0b3f781794eab45b26913592c85e470b8345cefd3530bac20a9634f7ce8e9599c3d59e69afaffee9b6e03aeaf"}, @TCA_RED_PARMS={0x14}]}}]}, 0x148}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000a80)=@delchain={0x24, 0x2a, 0xd39, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x24}, 0xe}, 0x0) sendmsg$ETHTOOL_MSG_WOL_SET(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000040)={&(0x7f00000007c0)={0x11c8, 0x0, 0x228, 0x70bd2a, 0x25dfdbfc, {}, [@ETHTOOL_A_WOL_HEADER={0x40, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}, @ETHTOOL_A_WOL_SOPASS={0xed, 0x3, "66ebb42d5985b5706cfe96649f36c3e1691c46a787c887ebb4256e9f2edacaaffce2ea516eb4eedf7dfec5ce8ba0830369c717ffa31d74b8d7d3f16c7ab9e4ac5104f3b90d1ed77662072f8f21f0b6087fc80447b131d5581de11db8294464a6c5e044397108304c97c876c4f101c9a7f9a6e855e4adff3a1207933d8e7d604d177c392d6921f90d9b39b80562dd7a5d4bfb166d8c11e271a643d719f1324db3d5ce2e77afac3753a0a0a83182372c380bde54bb8816adaf5d8c9cb035fa23235ee3d5c28173f457d863f6f59b6d26e5735bd29a42e26236146e0195c020a2af58edc9e215d06fa9d7"}, @ETHTOOL_A_WOL_SOPASS={0x1004, 0x3, "367a41c88ce9b5bf8a1f2eab124e9fe5414bd47fde77eb0f9b03f1d45af6314d148c9c2a91616692e84ce1033861234da161e4a657a23630c3e1b44e11c7edfbbab7930be5cbfc73e18cf186ea07b06dd1fc08b096978f6ef8adc5f1e412fa47b6123d7c4301cfe5e442d9aa3a3c79101d457b2fd18945baf6012d4f8a968bef46c5ec9926626808ca31b7b0b6da555261578e15ce97a2b4cef6ab5b27fe6420ddc477e24c25ab440360c4d5379bbc756f24ad04869c3f39d17384cb71ef64ce4e8a8d438951bffbec00a82d775b4544d2cb5b6dffe6d1ad62a29eaf0021dc56fed1565dfcd559ecaece45848d3579221663473f3bee75c1f11136a3f1b2c332022327888138294c596eb51908d1ea71846c037f623806b31395a4109066e12b1ea758ebc870902792c7d65dccbd86c115f3a5e2dba04845b0657021f75df37466afbc2b2237bcb8f27a527b8a2e1569af774854b34701378e0069dc893149795f55ca85ce63e6ca3925ec00c19047e4aea1c66bd6c8b74052e3d83e4971005a793a8c22b69910316f1c6fcd7d65613aec28af3d08da514886c9f6863b565d58bb296f8db8ec0b5a8ca1e817d6e1e21072e1b831ef6afc21a70b9054f62851c4f43828f5b5b8719757b2903cf4b6540a942fcec6b491820c93b4776d1f7825ed3e79b4b151ade60bbf6935db3d7d822a6d7b0a84c71ece6788e7874be76bafd66d117ab4cb4dd0e66834e84f9424ff7707d0519f372d707cedf916e79b40fe227c63c0be0878e5b5119f3254458a89048a017d1b6c3b64e8fff5bdcbf83ae46b3471c64024bd037e5a1e6605e11700a2cc53799e40f2a7658f5d8fbcd4fd754ce3f040d43e68078c56bdac7b2b29168ac433d5a8fcb97382cd2bfa46f6f2dd5c704acc58cc3c5ba08c33e6119f6dbea1bb5ee0e4c5eccad413236b81946b601bf180349509054d32d57750e18eecc42f55c4d90625485a04085193cd2ad1289823b05efb32bf50e16480b6cb916f396f0a7067fa7efb72689984021bd37fa69acf80c8f4291d994d3d4b652d4775cb8745cc8e8248f461b4026ac55ddaa29e60eee55e57aa7262d2c84dbcbfe6a3e01ffb1b1500500b87a15aecff5a3ff8f34e019514daf0f7295d7d96278e43e184d0eed8d0c0a5d9254757af4f327622e088d6e05e79f0c52812b6457a4b01725cfacf7bb0022f9a7ef49090c158b8a54a02c6f4dcfad76a3f01d34476988ebf6ffab8e670a20c441b1b21facd3ce20c5434321d1e9d198ce0054aa488c6047cb4f34f162da7f815820b05fc54de6f92e12551778a031b81a4bc4e659ff5afaad5109339d5e7dd0a3cdc333f54da12d76524851f49a8690c12942af451555e71b6d73ae91b35c3eaffa2c43dbeff3c91c9b2a996921d948f2de2840952808034ba93c37fbed1cf7a66201633d1a084a5ce86b1b55a466f544eee56eb829c3ebcb31042a7174ec2a79409de58a2b2e73868d5572311cbb8c2a3de54ea29f4119303877dcf5bc96c7303bc12f403470668cfc34aa389226d8be5e4b08d8b8cb0f94d4e04e0652597bf2cb1fa3e9161b6b148ca0b492f7b50ff80e62979e0567cb81c51d31793142747e62dfbea2b12d88ce2ec5d79a5781af2fa2dba534f13c66b11de35af388bd97e75e0fa07708100e8e8e86516565264fb93dc296b0236f56f35ae79ca16cbf6c3e6341ade2273f325f6b901d30e134fe496929adfba7f0328622a575ac84661dd8fe0bf243b48473ccd26220641e8721f8a8cd6ab4e5e6cfb3285108a7a570a5f644006ef8ae6ebe150ab13f714c7d61dad3b986615608c49d4234b8abb808ec959573feab8ad6d6755d6c0a1a2490d1288f88a9423332220a77245be1e90c62b2b3c635606fc74b72ed30846c484e606c0410777224abcd1f0158fd825d216cf3fe84f75ea652e4e5a3c3462380f97fa91f4feb6fd770496d043e6204a8087d7a1dad229d31f4e6f061ee6e7f2840b50a463c322786ef45c5dd0c42d394a52403951dc0a86c636a7f4e7bf9429295002912c26755271f35de3b763151886ece3f0236deac3badc3f71fba255c4ed3535c4ba789176b033621faf9f71761a586b00b78d671b9c8c575d954776f8e1d342e2d98547eb40c5fc2f1d3d4fad3afdf42a8f882a89bdf14e2184fd9a8d96d9af1cb3a6a5e43a91c0f1e3e5e9dff1d212fae07aec402738f26d59429532258da15e834c913f161e233e8fbfdcd666340db54d3649945fc4ecd35009d8dcb220f30eaf45b5d686312e4af152c61894ff4d26d675d917a7f08a58a1caea1f952665bd95d3d2112822e15f9ce34bb1fab62b046f4ca169e5b06d6c2767f7ec02432ab5f5c5fc1de5b352f784ee42b15ff70f0db658c66a7fd7c420a7734e50a6d53825eadf679636bf84f5f8c824b9c1e87db38b6ab7d609223b27ee01939168856dca199d4d404072f89144133669ec351b63bfa4a4a44f3c154f7c2845ea900d5299ba0bdc7be2089e3692457f01d15f4823dde1f5c8ec29aee4943494a1123691d153fb8b617f2d26fc9a4e1366845abfe33691c819d85f8779f2b7f3fc2fd669a494bf356c444f9a1cc5b40adc94021c811da887d98752ec4a609601c44885bf998bf885a7005bf772e4db8330e6118434149fd09bc26881d95ee9668eeeb1ac88bf3d8a39a4f0c4ada42c866bad5f7fbcfc808b7f7f8f77b71f3e8695bf0c3f248f0470d48b0657dfb1e58588b22e6e67194ccbf8919ce12500cbb2c79765b750142e7b112650c8d9b07f9920667515207460c9ccc58419c0295b003451bc7971b241672fdba0f27f0d0f4b14184027489d42706d8fb07916782c06ba753dda7f26e21c1399ab9ae614aa62903cd147a475c491a2b189fd85f6276fa952d4f07549523467bc490c6548aa4d1a8ef626b53f3ebe453dbf9e229ff013019bba1e795cc808784c3a7f3719642d0e559bd62132fcdbd2f89cac30633bacebafd6e5f6066593c89f83820a87b0443cc13daf4e22b58242984f7c7c6f7f691a09952d38dab9840a2c835a65bf47c9576100ac8d03ab7eb172965d1ef03a5eabf84ebd03088dbfa29da3ce0777fb14ecc9ccc18c5ad898d09977d9a8e88ac138a8a63c1dadce23522abfe7d377c6e347c6e58c8ec5ee452202b1a969a39a9e2e47cb32abf34672f2efa7e4b6a4740cfbeb7dc1e9be53aa4ddf480c19e705fb4e5843f61c0d99605620e1a7fd04bbdd65b2844b91d8ed4c9beb5dcb415a62fa096674f63184dd5bc862367ff54e1ae03091cf877bdf01293d8af771fb67dc3cb69ffbc03f528c7ffeb83551e336d55a0036b71dde1e006d57b5618afc605f4ebe1ba834912c0e77bedb96d23f75e33d7e4af8f9c2d7fc2d7ff14d67173f1b525772520f0349ad17016fbf4b17cb83e5ed74c97964caa2d25c6ab4fc4d1db344f82dcaa5404d3817c2010cb222d3fa16f2ae15d0daab906746f48aee2f9e79bf5d7288664c84e080992b91e9bd836cbaa84a2dda50bd7d6ae6bbac9945bcdd55d1f8736d4bcb4f28ea13c75f4d952a064c8ec7882f2b7fc5f282675e03f42a09cb072aa150ed2e2836533728beff6c8dae7cc6ab0f69d992f2f20206a7c9b78275cb6ad55fbf53ff73ecb3367bc1f483617f7b956a924eaa204d7bf6a9514f4f32ec0b413abd473005dd7c777f0bb2f155f6c6435e82c3fa0fae314cca0f3c90cf3e103743c13b1406034f489ea6c2f08b8f624caa56beb12947d81cc866e48c90523b6d43150b63e9c9feb3b0c18c36e04d98074e4208f254c00ee1ea07df8480a79342d52dd21b1e97e9ec16b14ac1999404ebd73c280b105eae3d165e7fe6c6c9940bd73f3e5806c9779576dfe2b5819b22d78802062219e8a80d593cec86c33e7865b50a418897691512598d8535b6d2a40071f749009a8071e54f88f4d6fe9b4bca91bcea226395516ed6ff0917d398c9b6fc2985fec1ad2cdf1148c1a53555b9e458dd8d2cbcb2d9d57e6eacfe485a58f89a4e04760125961dda166023cb2db22789b1044099c731329b1e5e4a3aafaef4008e67940f4eea965e8407004998ece351f7e3191bf0562f5185eda2435489a10f310ed7ff63cf91a201a1cc56008694d087b186135fc7ce6be347151d60dab74d443f48ede13afa1a8cfe42d5db0ed859dbc106aa8a12f118c061dfbb38c47260d69a2ad18021e54c760008dd41c89517e6b4e7e6a630edb3f99cfd31bec356e3d36dbe4a54318ed491313a27d4ab2521361a0892d933bfd8dc21dafb8cb7dd2f58dd9df24c66622f0cd27e638078e54eaa0f0c02a73394b94a9ee784146c257621243016ee84800d4fbf67895bfe163bdcaa1e2a5297ea637d0269ef633009a1d64873e7694c1f925cc37ef7bcc8a3c4ea76ee89c884e3b2041cacb193b5e1520977f7c300263426c5272a526551fee22fb69de84676a896cb12b67d1044fb4d2a89d50b1df7fef80907626ead2ae960623082c3b39a4b529684024cd295f1261e31d2d38e56701fba337a0228a21474947444266a58b905cd7e53389c1f6c5b1dd5d1b5dcd7dc015451311ecc6f08339beaa12e20c8bf8c0f668b983f8e73ebd697dd2fbec2f95498862d4f6c2c066cef3757884807e15060c71187c0dbfa6729296ec9a1bb1ec7b761a2818ecf8d0a0273fc34db387c1479cd6b12676b4f2277b51f6ab0e44af3383064b0181f4365b57a2afa8e83fa5ff0054003ab33871942ffc306d25ff1275004c6a868c8e514e25edfdcfd7ba5ad179279509cbd399b0eeb106ffbaed46ca7da1b48fc5e479e3c2bda8c146ffd3330ddfbc21c1b4e28682d774b142687f15770480b36f49cd9da574687e5f3766ca40750bcc6a6c53765d931a759d07562b2ba4f2ffef91fa22b5fca9a04c0f18e7e056d2ab01da2a2dc2984921001b73e0dcdc7ec258070643e36f1c10c0b2861eef79486a76e7e394172ea04fdb16bc02ddcbd8b1ed45ffa9d5caa3cf68c2ddd9cada38d2923794bab382539c242226e4ea39ded959935d62930d4f9db93d3de29971cda46003063a52d447c55c185f31482aaaddbfc8336d65e9bc59b9e97448f356123746f0317d374c57f2b1d588c902a2c14aed154be334b929d3a9238cd482a00536045f73df180512b4260aab17f96f5fac8810be3aa1aedb7a38f671e0a8e5f2fb422d468c36d42c911947c4cf3976657c132572bd28658cae3ff8905f3c160ab3b409673214d3eafd30585d23023ff0d856a6bafae5463f92c3d83797e5f6be3e5e04c28192223cbc139e7b7b6a858d27bafffd1597911cb09b9978250c34bd83021cd9bee13420eb90a033169506642b090cee169c4369d9f4904024530288f210ffa7e2c6f2f399367ace81016b0cc2f3e970ec0ef5e90927c48efeca2dc3a0d02f452acfae5b0d0b894282f5bb5e8494f34cc4d465b6545154d9459a01bea3c4ee859cdb38d5a8894f230cabd85ce4f7bdbf24f2afc0d860c6db854a2b1ecf0a9397de7a21433585859ef2eebac8e23ed50fab1edb42c63bf74247feba85d6618a38299c9849d9cee829f4f6f3f784ff88789e3ee67d04c0bf36c51339b128a494b9a2b968d2a2ad526da0aba69c873205479d2002a3b2b78b29d64aa739bcabf05799bbec45ea700a92a549aa868412c7f8953f4af373abe6d1794b16a74eecad767ffd1c526f191aaeff398ce81cccdfaa8f2349b28022f77a839ba0d2ce875c834ba9b6b906d14abb6bc9560268940b226ddf70a33fa84f52aee7e4060e9d2e1733744826f9149ba55bd"}, @ETHTOOL_A_WOL_HEADER={0x80, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_bond\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bridge\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_team\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_vlan\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'geneve1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}]}, 0x11c8}, 0x1, 0x0, 0x0, 0x4}, 0x800) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) 17:43:13 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x1500000000000000, 0x0, 0x0) [ 1909.154026][T14491] netlink: 'syz-executor.3': attribute type 14 has an invalid length. 17:43:13 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0xa000000}, 0x0) 17:43:13 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x5000000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:13 executing program 4: r0 = syz_io_uring_setup(0x82, 0x0, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xfffffffffffffeb8, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:13 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x2, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:13 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x1600000000000000, 0x0, 0x0) 17:43:13 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0xb000000}, 0x0) 17:43:13 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x6000000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:13 executing program 4: r0 = syz_io_uring_setup(0x82, 0x0, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xfffffffffffffeb8, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:13 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x3, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:13 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1, 0x4, 0xfffffffd}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xfffffffffffffeb8, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:14 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) r3 = eventfd(0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r7, 0xae60) r8 = eventfd(0x0) r9 = dup3(r7, r5, 0x0) ioctl$KVM_IRQFD(r9, 0x4020ae76, &(0x7f0000000100)={r3, 0x0, 0x0, r8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) write$UHID_CREATE2(r1, &(0x7f00000003c0)=ANY=[@ANYRESOCT=r0, @ANYRES64=r1, @ANYRESOCT=r2, @ANYRES32=r8, @ANYRES32=r6, @ANYRES64=r4, @ANYRESHEX, @ANYBLOB="da2886213224da8a3013a5abe700490f3f49486fe8f33000000000000028d5fb7c66c026085bb27e5010478ded46edcc633be2e8ce679d4f02e6130a4d6846c994dedf9f9d58b7b03d64fdac917e46c8344ac4d648d0569125c2b52bd3d612523e6075db82fe2caea8f3e8e9321a4aaf55de6e0f0e59b3111dca77a1e9b8c57e67220ece2b29e47b8ea5eeba5b1a33d5fe8bdd9ddcc9912fead6043a50b1fbb011cefb0ca3dcbd69d224fa971c2ea08a08584300df0ddf5973ce5b0d22e8a13a68909e0600d75e47005ca22bd66fd691658398f5837e7cdbf2ebeafe07eb935fcba52e5e9818dd5771"], 0x12e) r10 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r11 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0x0, 0x2) ioctl$VIDIOC_ENUM_FMT(r11, 0xc0405602, &(0x7f0000000040)={0x3, 0xb, 0x2, "8bdcfc2c550aed9d506e7a438a0dbd8528f52557b7acfe891228fdbbef4a2079", 0x30364d54}) dup2(r10, r2) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) 17:43:14 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x1700000000000000, 0x0, 0x0) 17:43:14 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x7000000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:14 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0xc000000}, 0x0) 17:43:14 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x4, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:14 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x4, 0xfffffffd}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xfffffffffffffeb8, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:14 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x4, 0xfffffffd}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xfffffffffffffeb8, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:14 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x1800000000000000, 0x0, 0x0) 17:43:14 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x5, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:14 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x8000000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:14 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0xe000000}, 0x0) 17:43:14 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x4, 0xfffffffd}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xfffffffffffffeb8, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:14 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000680)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f000000000000000000000000000000000000000e0000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000000000000000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) 17:43:14 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x1900000000000000, 0x0, 0x0) 17:43:14 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x9000000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:14 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0xf000000}, 0x0) 17:43:14 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x6, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:14 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1, 0x0, 0xfffffffd}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xfffffffffffffeb8, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1910.574911][T14651] __nla_validate_parse: 53 callbacks suppressed [ 1910.574926][T14651] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'. 17:43:14 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x1a00000000000000, 0x0, 0x0) [ 1910.655402][T28129] hid-generic 0000:0000:0000.0277: unknown main item tag 0x0 [ 1910.662843][T28129] hid-generic 0000:0000:0000.0277: unknown main item tag 0x0 17:43:14 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xfffffffffffffeb8, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1910.702221][T28129] hid-generic 0000:0000:0000.0277: unknown main item tag 0x0 [ 1910.707979][T14648] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 1910.729333][T28129] hid-generic 0000:0000:0000.0277: unknown main item tag 0x0 [ 1910.748720][T28129] hid-generic 0000:0000:0000.0277: unknown main item tag 0x0 [ 1910.770239][T28129] hid-generic 0000:0000:0000.0277: unknown main item tag 0x0 [ 1910.795664][T14652] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1910.799613][T28129] hid-generic 0000:0000:0000.0277: unknown main item tag 0x0 [ 1910.813450][T28129] hid-generic 0000:0000:0000.0277: unknown main item tag 0x0 [ 1910.822484][T28129] hid-generic 0000:0000:0000.0277: unknown main item tag 0x0 [ 1910.851456][T28129] hid-generic 0000:0000:0000.0277: unknown main item tag 0x0 [ 1910.871383][T28129] hid-generic 0000:0000:0000.0277: unknown main item tag 0x0 [ 1910.875212][T14662] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'. [ 1910.894042][T28129] hid-generic 0000:0000:0000.0277: unknown main item tag 0x0 17:43:15 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0, &(0x7f0000000000)) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xfffffffffffffeb8, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1910.907106][T28129] hid-generic 0000:0000:0000.0277: unknown main item tag 0x0 [ 1910.926222][T14665] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1910.937243][T28129] hid-generic 0000:0000:0000.0277: unknown main item tag 0x0 17:43:15 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x1b00000000000000, 0x0, 0x0) [ 1910.952350][T14648] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 1910.985871][T28129] hid-generic 0000:0000:0000.0277: hidraw0: HID v0.00 Device [syz1] on %z5 17:43:15 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x10000000}, 0x0) 17:43:15 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0xa000000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) [ 1911.170803][T14712] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'. [ 1911.233028][T14713] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1911.267464][T14712] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'. [ 1911.297739][T14713] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'. 17:43:15 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) setsockopt$CAN_RAW_RECV_OWN_MSGS(r1, 0x65, 0x4, &(0x7f0000000000), 0x4) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000f500000000ecdf40e65cc7802200fa74e8dda6d1f59e0000000000100d37f50000000000000000000004000f0000000000000000000000000000000000000000000020000000000000000000000000000000000100004000000000000171793d3857af82ef269a7f00258d7a3500000000000000000000000000000200000000000000feffffff6f27f082000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000000000000000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac820000000000000000"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) r4 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x0, 0x0) openat$cgroup_ro(r4, &(0x7f0000000080)='pids.current\x00', 0x0, 0x0) 17:43:15 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x7, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:15 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0, &(0x7f0000000000)) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xfffffffffffffeb8, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:15 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x1c00000000000000, 0x0, 0x0) 17:43:15 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x11000000}, 0x0) 17:43:15 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0xb000000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:15 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0, &(0x7f0000000000)) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xfffffffffffffeb8, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:16 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x1d00000000000000, 0x0, 0x0) [ 1911.688604][T14726] validate_nla: 24 callbacks suppressed [ 1911.688617][T14726] netlink: 'syz-executor.3': attribute type 14 has an invalid length. [ 1911.718353][T14745] netlink: 'syz-executor.0': attribute type 16 has an invalid length. 17:43:16 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x60000000}, 0x0) [ 1911.738065][T14745] netlink: 'syz-executor.0': attribute type 16 has an invalid length. [ 1911.760194][T14749] netlink: 'syz-executor.3': attribute type 14 has an invalid length. 17:43:16 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0xc000000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:16 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), 0x0) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xfffffffffffffeb8, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:16 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x8, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) [ 1911.964950][T14780] netlink: 'syz-executor.0': attribute type 16 has an invalid length. [ 1912.000290][T14780] netlink: 'syz-executor.0': attribute type 16 has an invalid length. [ 1912.019400][T14779] netlink: 'syz-executor.3': attribute type 14 has an invalid length. [ 1912.054540][T14783] netlink: 'syz-executor.3': attribute type 14 has an invalid length. 17:43:16 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) r3 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uhid\x00', 0x802, 0x0) r4 = signalfd4(r3, &(0x7f0000000040)={[0x8]}, 0x8, 0x80000) write$UHID_CREATE2(r4, &(0x7f0000000680)=ANY=[], 0x12e) r5 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x2, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) getsockopt$bt_BT_DEFER_SETUP(0xffffffffffffffff, 0x112, 0x7, &(0x7f0000000140), &(0x7f0000000180)=0x4) ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) r9 = dup2(0xffffffffffffffff, r5) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) ioctl$EXT4_IOC_MOVE_EXT(r9, 0xc028660f, &(0x7f0000000080)={0x0, r2, 0xffff, 0x5, 0x7, 0xf6e}) 17:43:16 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), 0x0) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xfffffffffffffeb8, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:16 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x1e00000000000000, 0x0, 0x0) 17:43:16 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x65580000}, 0x0) 17:43:16 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0xe000000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:16 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x9, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:16 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x1f00000000000000, 0x0, 0x0) 17:43:16 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), 0x0) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xfffffffffffffeb8, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1912.401489][T14804] netlink: 'syz-executor.0': attribute type 16 has an invalid length. [ 1912.420730][T14808] netlink: 'syz-executor.3': attribute type 14 has an invalid length. 17:43:16 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x80170000}, 0x0) 17:43:16 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0xf000000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:16 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xfffffffffffffeb8, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:16 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0xa, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:17 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) r3 = openat$incfs(r1, &(0x7f0000000000)='.log\x00', 0x48002, 0x102) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x18, 0xa, &(0x7f00000004c0)=ANY=[@ANYBLOB="18000013619596fda4cfcfc14e0007000000000000e61b000004e8ff8400000088000000180000974292c9017413988e72e11300a9b8000000000000397ddf00236a30ff440000105419e0ff0800000018120000917a64f232bee52800f74605c29b8b14358372747d959ff4cd653eb283e80c23049b8e64eece70284c00f1ab27b59d202717c257ec6f530973d4f403bb7c62512b6cf3ceb6ee60905df7dd5316e2161202ee824ffddf05e8590ac89be40e041778793d6e0b044fe02fb8ba261049f662b7ed5689b9db631b8ce32bedb9481f1dafe18e3053d6b6b1fec9", @ANYRES32=r3, @ANYBLOB="00000000000000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x8001, 0xd3, &(0x7f0000000140)=""/211, 0x40f00, 0x19, [], 0x0, 0x0, r1, 0x8, &(0x7f0000000240)={0x0, 0x3}, 0x8, 0x10, &(0x7f0000000280)={0x1, 0x3, 0x5, 0x8001}, 0x10}, 0x78) write$UHID_CREATE2(r2, &(0x7f0000000680)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000000000000000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82"], 0x12e) rt_sigtimedwait(&(0x7f0000000340)={[0x7fff]}, &(0x7f0000000380), &(0x7f0000000400)={0x0, 0x989680}, 0x8) r4 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r4, r2) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) r5 = syz_open_dev$video4linux(&(0x7f0000000440)='/dev/v4l-subdev#\x00', 0x4, 0x200100) ioctl$VIDIOC_S_OUTPUT(r5, 0xc004562f, &(0x7f0000000480)=0x9) 17:43:17 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x2000000000000000, 0x0, 0x0) 17:43:17 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xfffffffffffffeb8, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:17 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0xc, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:17 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x81000000}, 0x0) 17:43:17 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x10000000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:17 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x2100000000000000, 0x0, 0x0) [ 1913.334943][ T17] hid-generic 0000:0000:0000.0278: unknown main item tag 0x0 [ 1913.342379][ T17] hid-generic 0000:0000:0000.0278: unknown main item tag 0x0 17:43:17 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x11000000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:17 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xfffffffffffffeb8, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:17 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0xe, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) [ 1913.410613][ T17] hid-generic 0000:0000:0000.0278: unknown main item tag 0x0 17:43:17 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x88a8ffff}, 0x0) [ 1913.455286][ T17] hid-generic 0000:0000:0000.0278: unknown main item tag 0x0 [ 1913.484169][ T17] hid-generic 0000:0000:0000.0278: unknown main item tag 0x0 [ 1913.491732][ T17] hid-generic 0000:0000:0000.0278: unknown main item tag 0x0 [ 1913.508994][ T17] hid-generic 0000:0000:0000.0278: unknown main item tag 0x0 [ 1913.522887][ T17] hid-generic 0000:0000:0000.0278: unknown main item tag 0x0 [ 1913.540305][ T17] hid-generic 0000:0000:0000.0278: unknown main item tag 0x0 [ 1913.551909][ T17] hid-generic 0000:0000:0000.0278: unknown main item tag 0x0 [ 1913.568353][ T17] hid-generic 0000:0000:0000.0278: unknown main item tag 0x0 [ 1913.578805][ T17] hid-generic 0000:0000:0000.0278: unknown main item tag 0x0 17:43:17 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0xf5ffffff00000000, 0x0, 0x0) [ 1913.622404][ T17] hid-generic 0000:0000:0000.0278: unknown main item tag 0x0 [ 1913.641888][ T17] hid-generic 0000:0000:0000.0278: unknown main item tag 0x0 [ 1913.655583][ T17] hid-generic 0000:0000:0000.0278: hidraw0: HID v0.00 Device [syz1] on %z5 17:43:18 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r1, 0x800c6613, &(0x7f00000002c0)=@v2={0x2, @aes256, 0x3, [], @auto="d0dbd324010a894348b7e72f2a9e9855"}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000680)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e6d25cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbf5ffff00000200000000010000000000030000cf0a000000000000000000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac000000000000000000"], 0x12e) sendmsg$NL80211_CMD_SET_PMKSA(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x24, 0x0, 0x800, 0x70bd2c, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_PMK_LIFETIME={0x8, 0x11f, 0x8b97}, @NL80211_ATTR_PMK_REAUTH_THRESHOLD={0x5, 0x120, 0x38}]}, 0x24}}, 0x40000801) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r4 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000140)='/dev/dlm-control\x00', 0x1, 0x0) move_mount(r4, &(0x7f0000000180)='./bus\x00', 0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x50) r5 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) r6 = accept$inet6(r3, &(0x7f0000000240)={0xa, 0x0, 0x0, @private2}, &(0x7f0000000280)=0x1c) dup2(r6, r5) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) 17:43:18 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x20000000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:18 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xfffffffffffffeb8, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:18 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0xffffffff00000000, 0x0, 0x0) 17:43:18 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0xf, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:18 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x9effffff}, 0x0) 17:43:18 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0xb9deedc4}, 0x0) 17:43:18 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xfffffffffffffeb8, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:18 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x2) 17:43:18 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x471903be, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:18 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x10, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:18 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xfffffffffffffeb8, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:19 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_sctp_SCTP_HMAC_IDENT(0xffffffffffffffff, 0x84, 0x16, &(0x7f00000000c0)={0x2, [0x5, 0x1]}, 0x8) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000680)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000000000000000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82"], 0x12e) r3 = accept$phonet_pipe(r1, &(0x7f0000000000), &(0x7f0000000040)=0x10) ioctl$FS_IOC_GETVERSION(r3, 0x80087601, &(0x7f0000000080)) r4 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r5 = dup2(r4, r2) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) setsockopt$kcm_KCM_RECV_DISABLE(r5, 0x119, 0x1, &(0x7f0000000140)=0x1, 0x4) 17:43:19 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, 0x0, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:19 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x48000000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:19 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x3) 17:43:19 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0xc4eddeb9}, 0x0) 17:43:19 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x48, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) [ 1914.989877][T28129] hid-generic 0000:0000:0000.0279: unknown main item tag 0x0 [ 1915.001979][T28129] hid-generic 0000:0000:0000.0279: unknown main item tag 0x0 17:43:19 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, 0x0, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1915.030587][T28129] hid-generic 0000:0000:0000.0279: unknown main item tag 0x0 [ 1915.069485][T28129] hid-generic 0000:0000:0000.0279: unknown main item tag 0x0 17:43:19 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x4c, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:19 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x4) 17:43:19 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0xf0ffffff}, 0x0) 17:43:19 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x4c000000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) [ 1915.097557][T28129] hid-generic 0000:0000:0000.0279: unknown main item tag 0x0 [ 1915.129078][T28129] hid-generic 0000:0000:0000.0279: unknown main item tag 0x0 17:43:19 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, 0x0, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1915.174139][T28129] hid-generic 0000:0000:0000.0279: unknown main item tag 0x0 [ 1915.189518][T28129] hid-generic 0000:0000:0000.0279: unknown main item tag 0x0 [ 1915.210572][T28129] hid-generic 0000:0000:0000.0279: unknown main item tag 0x0 [ 1915.219066][T28129] hid-generic 0000:0000:0000.0279: unknown main item tag 0x0 [ 1915.227579][T28129] hid-generic 0000:0000:0000.0279: unknown main item tag 0x0 [ 1915.235535][T28129] hid-generic 0000:0000:0000.0279: unknown main item tag 0x0 [ 1915.243013][T28129] hid-generic 0000:0000:0000.0279: unknown main item tag 0x0 [ 1915.252667][T28129] hid-generic 0000:0000:0000.0279: unknown main item tag 0x0 [ 1915.273772][T28129] hid-generic 0000:0000:0000.0279: hidraw0: HID v0.00 Device [syz1] on %z5 [ 1915.802462][T10759] hid-generic 0000:0000:0000.027A: unknown main item tag 0x0 [ 1915.813124][T10759] hid-generic 0000:0000:0000.027A: unknown main item tag 0x0 [ 1915.832700][T10759] hid-generic 0000:0000:0000.027A: unknown main item tag 0x0 [ 1915.841364][T10759] hid-generic 0000:0000:0000.027A: unknown main item tag 0x0 [ 1915.858953][T10759] hid-generic 0000:0000:0000.027A: unknown main item tag 0x0 [ 1915.878910][T10759] hid-generic 0000:0000:0000.027A: unknown main item tag 0x0 [ 1915.890295][T10759] hid-generic 0000:0000:0000.027A: unknown main item tag 0x0 [ 1915.904891][T10759] hid-generic 0000:0000:0000.027A: unknown main item tag 0x0 [ 1915.912300][T10759] hid-generic 0000:0000:0000.027A: unknown main item tag 0x0 [ 1915.929135][T10759] hid-generic 0000:0000:0000.027A: unknown main item tag 0x0 [ 1915.941542][T10759] hid-generic 0000:0000:0000.027A: unknown main item tag 0x0 [ 1915.959445][T10759] hid-generic 0000:0000:0000.027A: unknown main item tag 0x0 [ 1915.970333][T10759] hid-generic 0000:0000:0000.027A: unknown main item tag 0x0 [ 1915.987030][T10759] hid-generic 0000:0000:0000.027A: unknown main item tag 0x0 17:43:20 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) r2 = eventfd(0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) r7 = eventfd(0x0) r8 = dup3(r6, r4, 0x0) ioctl$KVM_IRQFD(r8, 0x4020ae76, &(0x7f0000000100)={r2, 0x0, 0x0, r7, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) ioctl$KVM_IRQFD(r8, 0x4020ae76, &(0x7f0000000100)={r2, 0x0, 0x2, r2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) ioctl$sock_SIOCSIFVLAN_SET_VLAN_NAME_TYPE_CMD(r8, 0x8983, &(0x7f0000000000)={0x6, 'macsec0\x00', {0x8}, 0x6}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r9 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r9, &(0x7f0000000240)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000ffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000000000000000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82", @ANYRESDEC, @ANYRES32=r1], 0x12e) r10 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r10, r9) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) 17:43:20 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xfffffffffffffeb8, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:20 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x5) 17:43:20 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x60000000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:20 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x60, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:20 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0xf1ffffff}, 0x0) [ 1916.008992][T10759] hid-generic 0000:0000:0000.027A: hidraw0: HID v0.00 Device [syz1] on %z5 [ 1916.094325][T15104] __nla_validate_parse: 58 callbacks suppressed [ 1916.094338][T15104] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1916.129385][T15105] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 1916.158224][T15108] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'. [ 1916.192560][T15105] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 17:43:20 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1916.206220][T15104] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1916.228154][T15108] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'. 17:43:20 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x6) 17:43:20 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x68, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:20 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x65580000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:20 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0xfcffffff}, 0x0) 17:43:20 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x7) [ 1916.450062][T15147] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 1916.535061][T15150] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1916.562135][T15151] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'. [ 1916.625705][T15150] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'. 17:43:21 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0a00000073797ac52f6b8785893ec6c1aa01e3c4a431000000000000000000000000000000009d0000000000fcf4000000ecdf40e65cc7802200000000000000000000000000000003001000000000004ef89a340004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200220000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000000000000000000900000000000fbc7f5c7e5ca781000c000000000073cf00000000001600000000000000000000e967ac82ccd8586b54b0585bb45faf4655f0910443063e538c37b10814317edbd7b6597c4fe6433a6e767ebedb6726eed9c7103fdd971df7e49fd634aa79661a1e59a40ba0eb2c5fe69f28f7eebe7fc94ea4e2d8c731039a63d66d6b3211764ec6d6f23f7236716cce3e7c32b450c57df84be682d70c01fedd94a88afb81dd1fec1dd16cc6a2be52345ef731eb089517204520750f5c10f3f5d4f41970e0bf27a037af7ff73e7e4a40f9af710f833b040d1518220d6abb19c55d40bceb321088c2b5dcae575f5a2d30c7b6486feaf74d422e5c969b3f7b7817b7c0b17ac419b5f6d227e2ab084e169ec75bc920bb6dc6ea0b8c73d3d6f580f3f6597e68fdc24c34913fa3aa98d48812b0ef2f7dc9cf843b6e7b2420b33261a7973edee0f3b7d1adf3214943fbd20ce7daf43c6cdee2e7faba53f0f84524a04f2dfb554b673ef0fb55fa0595ccb32fdda14599ab469dc664df8320ff13e18872bb09a614bf9dd3f80cf2f9c54f54e78cd078c5910ec2dcc6a1b836ec18d67a0ab1144d9bc33b15c993d1bdb8347239f9cf480ace184d315fe675ac850ccca62d3dba460d8e05d42e33f4650dba513d7f5b41cc0412e2b6245ce78f95b43f7cc711e6ed66a39a3eecf3cf3ce2437eb6446037c5e0a392873e0c58"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) 17:43:21 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:21 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x8) 17:43:21 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x68000000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:21 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x6c, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:21 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0xffffa888}, 0x0) [ 1916.943860][T15182] validate_nla: 37 callbacks suppressed [ 1916.943873][T15182] netlink: 'syz-executor.0': attribute type 16 has an invalid length. 17:43:21 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:21 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x9) [ 1917.053475][T15200] netlink: 'syz-executor.3': attribute type 14 has an invalid length. [ 1917.076026][T15199] netlink: 'syz-executor.0': attribute type 16 has an invalid length. 17:43:21 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0xfffff000}, 0x0) [ 1917.113103][T15200] netlink: 'syz-executor.3': attribute type 14 has an invalid length. 17:43:21 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x6c000000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:21 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x74, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:21 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0xa) [ 1917.311585][T15223] netlink: 'syz-executor.3': attribute type 14 has an invalid length. [ 1917.324223][T15231] netlink: 'syz-executor.3': attribute type 14 has an invalid length. [ 1917.345511][T15224] netlink: 'syz-executor.0': attribute type 16 has an invalid length. [ 1917.379670][T15240] netlink: 'syz-executor.0': attribute type 16 has an invalid length. 17:43:21 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000680)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000000000000000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) r4 = bpf$ITER_CREATE(0x21, &(0x7f0000000000)={r3}, 0x8) ioctl$IMGETCOUNT(r4, 0x80044943, &(0x7f0000000040)) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) 17:43:21 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:21 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x7a, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:21 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0xffffff7f}, 0x0) 17:43:21 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x74000000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:21 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0xb) 17:43:21 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, 0xffffffffffffffff, 0x0}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:22 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0xc) [ 1917.722799][T15267] netlink: 'syz-executor.0': attribute type 16 has an invalid length. [ 1917.742998][T28129] hid-generic 0000:0000:0000.027B: unknown main item tag 0x0 [ 1917.759353][T28129] hid-generic 0000:0000:0000.027B: unknown main item tag 0x0 17:43:22 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0xffffff9e}, 0x0) [ 1917.773937][T15268] netlink: 'syz-executor.3': attribute type 14 has an invalid length. [ 1917.801476][T28129] hid-generic 0000:0000:0000.027B: unknown main item tag 0x0 17:43:22 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x7a000000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:22 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0xf0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) [ 1917.829885][T28129] hid-generic 0000:0000:0000.027B: unknown main item tag 0x0 [ 1917.846405][T28129] hid-generic 0000:0000:0000.027B: unknown main item tag 0x0 [ 1917.864193][T28129] hid-generic 0000:0000:0000.027B: unknown main item tag 0x0 [ 1917.881656][T28129] hid-generic 0000:0000:0000.027B: unknown main item tag 0x0 [ 1917.890230][T28129] hid-generic 0000:0000:0000.027B: unknown main item tag 0x0 [ 1917.898733][T28129] hid-generic 0000:0000:0000.027B: unknown main item tag 0x0 [ 1917.907355][T28129] hid-generic 0000:0000:0000.027B: unknown main item tag 0x0 [ 1917.915693][T28129] hid-generic 0000:0000:0000.027B: unknown main item tag 0x0 [ 1917.923188][T28129] hid-generic 0000:0000:0000.027B: unknown main item tag 0x0 [ 1917.931229][T28129] hid-generic 0000:0000:0000.027B: unknown main item tag 0x0 [ 1917.939497][T28129] hid-generic 0000:0000:0000.027B: unknown main item tag 0x0 [ 1917.961844][T28129] hid-generic 0000:0000:0000.027B: hidraw0: HID v0.00 Device [syz1] on %z5 17:43:22 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, 0xffffffffffffffff, 0x0}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1918.489028][T10759] hid-generic 0000:0000:0000.027C: unknown main item tag 0x0 [ 1918.497965][T10759] hid-generic 0000:0000:0000.027C: unknown main item tag 0x0 [ 1918.506521][T10759] hid-generic 0000:0000:0000.027C: unknown main item tag 0x0 [ 1918.514361][T10759] hid-generic 0000:0000:0000.027C: unknown main item tag 0x0 [ 1918.521768][T10759] hid-generic 0000:0000:0000.027C: unknown main item tag 0x0 [ 1918.529749][T10759] hid-generic 0000:0000:0000.027C: unknown main item tag 0x0 [ 1918.537585][T10759] hid-generic 0000:0000:0000.027C: unknown main item tag 0x0 [ 1918.546568][T10759] hid-generic 0000:0000:0000.027C: unknown main item tag 0x0 [ 1918.554604][T10759] hid-generic 0000:0000:0000.027C: unknown main item tag 0x0 [ 1918.562009][T10759] hid-generic 0000:0000:0000.027C: unknown main item tag 0x0 [ 1918.570053][T10759] hid-generic 0000:0000:0000.027C: unknown main item tag 0x0 [ 1918.593860][T10759] hid-generic 0000:0000:0000.027C: unknown main item tag 0x0 [ 1918.601761][T10759] hid-generic 0000:0000:0000.027C: unknown main item tag 0x0 [ 1918.609723][T10759] hid-generic 0000:0000:0000.027C: unknown main item tag 0x0 [ 1918.634702][T10759] hid-generic 0000:0000:0000.027C: hidraw0: HID v0.00 Device [syz1] on %z5 17:43:22 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$sock_netdev_private(r0, 0x89fa, &(0x7f0000000000)="4d401a21d3990e80e25cce12e9457ed57b6bd780dfa3a7a6edeadfeaba1001de88489ad17a27dff0ce2a6b76a3c466ea9d7d316c2a68d9c125a0241ab12b8836c03777db558c4a73c56822adf41cf3dd8b14a374f7d4d86c3dbb868db3db4d11523baace9aebb4290feea8849d204f33650b89d8638d950e276977832abb0e7aaa3fd5b4263030958a7520b563a46e70f1f2e4b9ba20b59fc7b6361e4e90929ddbe8f6fa7834d187dd636b05d51a4a0f158277112968ab9c") ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000680)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000000000000000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) 17:43:22 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, 0xffffffffffffffff, 0x0}, 0x0) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:22 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0xd) 17:43:22 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0xfffffff0}, 0x0) 17:43:22 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x300, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:22 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x81000000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:23 executing program 4: syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) r0 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, 0xffffffffffffffff, 0x0}, 0x0) io_uring_enter(0xffffffffffffffff, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:23 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0xe) 17:43:23 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0xfffffff1}, 0x0) [ 1918.871524][T10759] hid-generic 0000:0000:0000.027D: unknown main item tag 0x0 [ 1918.902197][T10759] hid-generic 0000:0000:0000.027D: unknown main item tag 0x0 17:43:23 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x500, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) [ 1918.944568][T10759] hid-generic 0000:0000:0000.027D: unknown main item tag 0x0 17:43:23 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x82580000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) [ 1918.989236][T10759] hid-generic 0000:0000:0000.027D: unknown main item tag 0x0 [ 1919.011069][T10759] hid-generic 0000:0000:0000.027D: unknown main item tag 0x0 17:43:23 executing program 4: syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) r0 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, 0xffffffffffffffff, 0x0}, 0x0) io_uring_enter(0xffffffffffffffff, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1919.033170][T10759] hid-generic 0000:0000:0000.027D: unknown main item tag 0x0 [ 1919.060484][T10759] hid-generic 0000:0000:0000.027D: unknown main item tag 0x0 [ 1919.082936][T10759] hid-generic 0000:0000:0000.027D: unknown main item tag 0x0 [ 1919.110388][T10759] hid-generic 0000:0000:0000.027D: unknown main item tag 0x0 [ 1919.128413][T10759] hid-generic 0000:0000:0000.027D: unknown main item tag 0x0 [ 1919.145221][T10759] hid-generic 0000:0000:0000.027D: unknown main item tag 0x0 [ 1919.154092][T10759] hid-generic 0000:0000:0000.027D: unknown main item tag 0x0 [ 1919.161586][T10759] hid-generic 0000:0000:0000.027D: unknown main item tag 0x0 [ 1919.169881][T10759] hid-generic 0000:0000:0000.027D: unknown main item tag 0x0 [ 1919.192204][T10759] hid-generic 0000:0000:0000.027D: hidraw0: HID v0.00 Device [syz1] on %z5 [ 1919.730161][ T17] hid-generic 0000:0000:0000.027E: unknown main item tag 0x0 [ 1919.737746][ T17] hid-generic 0000:0000:0000.027E: unknown main item tag 0x0 [ 1919.754302][ T17] hid-generic 0000:0000:0000.027E: unknown main item tag 0x0 [ 1919.761755][ T17] hid-generic 0000:0000:0000.027E: unknown main item tag 0x0 [ 1919.784954][ T17] hid-generic 0000:0000:0000.027E: unknown main item tag 0x0 [ 1919.792478][ T17] hid-generic 0000:0000:0000.027E: unknown main item tag 0x0 [ 1919.800010][ T17] hid-generic 0000:0000:0000.027E: unknown main item tag 0x0 [ 1919.808940][ T17] hid-generic 0000:0000:0000.027E: unknown main item tag 0x0 [ 1919.816690][ T17] hid-generic 0000:0000:0000.027E: unknown main item tag 0x0 [ 1919.824194][ T17] hid-generic 0000:0000:0000.027E: unknown main item tag 0x0 [ 1919.833109][ T17] hid-generic 0000:0000:0000.027E: unknown main item tag 0x0 [ 1919.840616][ T17] hid-generic 0000:0000:0000.027E: unknown main item tag 0x0 [ 1919.848349][ T17] hid-generic 0000:0000:0000.027E: unknown main item tag 0x0 [ 1919.856646][ T17] hid-generic 0000:0000:0000.027E: unknown main item tag 0x0 [ 1919.870206][ T17] hid-generic 0000:0000:0000.027E: hidraw0: HID v0.00 Device [syz1] on %z5 17:43:24 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) ioctl$KVM_SET_XSAVE(r1, 0x5000aea5, &(0x7f00000007c0)={[0x5, 0x9, 0x1, 0xc3a6, 0x6, 0x6, 0x4, 0xffffffc1, 0x6, 0x2, 0x3, 0x5, 0x7, 0x7, 0xf8, 0x0, 0x3, 0x4, 0x0, 0xb189, 0x7af9d194, 0x38, 0x9, 0x400, 0x4, 0xf464, 0x5, 0x7, 0x64d136a0, 0x3, 0x400, 0x401, 0x8, 0xffffff54, 0x4, 0x9, 0x50, 0xfffffffd, 0x100, 0x6b2, 0x100, 0xec2b, 0x1, 0x6, 0x3282, 0xfffffffa, 0x8, 0x0, 0x80, 0x7fff, 0x80000000, 0x7, 0x10000000, 0x2, 0x1, 0x1, 0x0, 0x800, 0x7, 0x864, 0x3, 0x8001, 0x367, 0xff, 0x262e8, 0x81, 0xffff8c4b, 0x0, 0x3, 0x331d, 0x2, 0x7, 0x80, 0x7, 0x3, 0x8, 0xffff0000, 0x0, 0x5, 0x8, 0x800, 0x0, 0x2, 0x3f, 0x4, 0x5, 0xffffffe1, 0x40, 0x3, 0x400, 0x1cfb, 0xfc3, 0x7, 0xfff, 0x4, 0x5, 0x0, 0x4e, 0x0, 0x10000, 0x9, 0x4, 0x5, 0x1, 0x7fffffff, 0x9, 0x3, 0x401, 0x4, 0x6, 0x5, 0x2a392880, 0xc39b, 0x8, 0xfff, 0x81, 0x51c70710, 0x9, 0xbae, 0x1, 0x80, 0x6, 0x4, 0x4, 0x3, 0x401, 0x1, 0x5, 0x6, 0x1, 0x80000000, 0xfffffffa, 0x5, 0x9, 0x6, 0x7, 0x3, 0x3, 0x7, 0xffffffff, 0x0, 0x2, 0x7, 0x0, 0x7, 0x5, 0x101, 0x4, 0x7fffffff, 0x4, 0x400, 0x8, 0x80000000, 0x81, 0x2, 0x2, 0xfffffff7, 0x400, 0x8001, 0x4, 0x5, 0x3, 0x9, 0x3, 0x4, 0x100, 0x7, 0x3, 0x105, 0xffff, 0xae98, 0xb72, 0x0, 0x40, 0x10001, 0x8001, 0xc660, 0x7fff, 0x5, 0x5, 0x20, 0x5, 0x80000001, 0xc2, 0x3, 0x6, 0x200, 0x6, 0x4, 0x5, 0x7fff, 0x5, 0xb2d, 0x8, 0x5, 0x8000, 0x4, 0x7ff, 0x2, 0x10000, 0x2, 0xcdd4, 0x4, 0x1f, 0x800, 0x9, 0x2, 0x3, 0x0, 0xeb7, 0x100, 0x200, 0x2, 0xbd, 0xfffff800, 0x3, 0x9, 0x7ff, 0xffffffdf, 0x8, 0x8000, 0x9, 0x8000, 0x7ff, 0x8, 0x8, 0x6, 0x5, 0xdd3f, 0x7fffffff, 0x7, 0x8001, 0x3, 0x3, 0x1, 0x6, 0x9, 0x101, 0xff, 0x6, 0x8, 0x3, 0x6, 0x2, 0x0, 0x3000000, 0xfffffffd, 0x5, 0xb2b, 0xffffff01, 0xc00, 0x80000000, 0x1f, 0x100, 0x8, 0x5, 0x7ff, 0xa546, 0x3, 0x8d, 0x6cd, 0x1, 0xffffffff, 0x81, 0xffffff00, 0x5, 0x875, 0x7, 0xece4, 0xc3e3, 0x3, 0x7fff, 0x80, 0x0, 0x54, 0xbba4, 0x80000000, 0x100, 0x46, 0x2, 0x3, 0x800, 0x5, 0x4, 0x7fff, 0x0, 0x1, 0x3, 0x9c4, 0x7, 0xa26, 0x400, 0x7ff, 0x1, 0x1000000, 0x8, 0x3, 0x8, 0x3, 0x1, 0x6521, 0x9, 0x4, 0x7, 0x1, 0xffffffff, 0xffffffff, 0x7, 0x8, 0x0, 0x81, 0x2, 0x8, 0x7ff, 0x9, 0x3, 0x101, 0x3, 0x9236, 0x1b, 0x0, 0x6, 0x8, 0x1f, 0x9, 0x3, 0x8, 0x7, 0x3, 0x0, 0x7b4, 0x4, 0x0, 0x8, 0x8, 0x5, 0x1, 0x3, 0x8, 0x18e, 0x7fffffff, 0x0, 0xfffffffb, 0xc866, 0x0, 0x58, 0x74ba, 0x0, 0xee, 0x30, 0x2, 0x40, 0x10001, 0x5, 0x0, 0x9, 0x7fffffff, 0x13f, 0x4, 0x0, 0x7, 0x0, 0xffff, 0x3, 0x101, 0x4, 0x9, 0x3, 0x9d2, 0x5, 0x8, 0xc0, 0x7, 0x5, 0x9, 0x3ff, 0x7c, 0x57, 0x2, 0x0, 0x20, 0xfffffbff, 0xd, 0x7477, 0x1, 0xffffff9c, 0x4, 0x81, 0x400, 0x8, 0x9, 0x1ca9, 0xffff, 0xffff8000, 0x1, 0xb7, 0x8, 0x694e5111, 0xe9, 0x3ff, 0x8, 0xe0, 0x9, 0x6, 0xa7f8, 0x0, 0x958, 0x9, 0x3, 0x1, 0xffff, 0xffffffff, 0x100, 0xc98, 0x4, 0x80000001, 0xbac, 0x0, 0x101, 0x101, 0x1, 0xf000000, 0xf3f0, 0x8, 0x414, 0x2, 0x51, 0x8c, 0x0, 0x31d, 0x7, 0x7, 0x7, 0xfffffffb, 0x1000, 0x1, 0x1, 0x8, 0x6, 0x8c2, 0x1, 0x4c, 0x4, 0x0, 0x10001, 0x1, 0x40, 0xca, 0x787, 0x8001, 0xffffffff, 0x8000, 0x2, 0x8, 0x1, 0x7, 0xfffff001, 0x1, 0x4, 0xde, 0x0, 0x3, 0x2, 0x9, 0x4, 0x9, 0x2, 0x8000, 0x3, 0x0, 0x3, 0x7, 0x101, 0x4, 0x3fc00, 0x1c000000, 0x6, 0x6, 0x800, 0x7, 0xfffffffe, 0x8001, 0x7, 0x400, 0x3, 0x40f, 0x401, 0x4, 0x0, 0x10001, 0x5, 0x0, 0x7, 0x1, 0x2, 0x4db4, 0x2, 0x7, 0xfffffffc, 0x0, 0x0, 0x2, 0xe6, 0xf5b, 0x7, 0xfff, 0x2, 0x5, 0x4, 0x0, 0x8bea, 0x800, 0x8, 0x0, 0x4, 0x5, 0x0, 0x3, 0x6, 0x9, 0x10000, 0x4, 0x8, 0x10000, 0x1, 0x5, 0x0, 0x10001, 0x4, 0xfffffffc, 0x10000, 0x9, 0x8, 0x7, 0x7, 0x0, 0x8, 0x5, 0x25, 0x5, 0x516, 0x10001, 0x3, 0x2352, 0x7, 0x9, 0x1f1, 0x8, 0x846, 0x3, 0x0, 0x8, 0xff52, 0xfffff2ce, 0x800, 0x7, 0x9bb3, 0x0, 0x7ff, 0x8, 0x1, 0x7fffffff, 0x5, 0x6, 0x7, 0x7, 0x81cb, 0x401, 0x10001, 0x8, 0x10000, 0x4, 0x7, 0x77, 0x0, 0x4, 0xfffffffd, 0x9, 0x7f, 0x6, 0x247, 0x9, 0x2, 0xf4, 0x10000, 0x8001, 0x9, 0x61, 0xffffffff, 0x2, 0xfffffff7, 0xffff, 0x3, 0x9, 0x4000, 0x6, 0x17, 0x5, 0x5, 0x5, 0x400, 0x6b8, 0x2, 0x7, 0x7, 0x20, 0x8cc4, 0x10001, 0x6, 0x0, 0x9, 0x7, 0xb47, 0x7, 0x9, 0x3, 0x512e9846, 0x5, 0x4, 0x929d, 0xa3, 0x2, 0x53, 0x0, 0x80000000, 0x8, 0x10000, 0x200, 0x9, 0x4, 0x0, 0x9, 0x3, 0x200, 0x8000000, 0xc528, 0x4, 0x101, 0x8000, 0xffffff80, 0x6, 0x2, 0xfffffff9, 0x5, 0xaa, 0x2e214f62, 0x4, 0x100, 0xca54, 0x8f, 0x6, 0x3, 0x1, 0xffff9c15, 0x100, 0x1, 0x4, 0x82bf, 0x82b, 0xffff, 0x5, 0x6, 0x3, 0xf807, 0x69ce, 0x0, 0xe051, 0x1ff, 0x0, 0xfffffffe, 0x1, 0x9502, 0x9, 0x8c4, 0x10000, 0x6, 0xfffffffc, 0xffffffc0, 0x5, 0xffff, 0xff, 0x7fffffff, 0x9f, 0x1, 0x2, 0x6, 0x7, 0x3f, 0x5, 0x8, 0x3, 0x1, 0xffffffff, 0x401, 0x6, 0x8, 0x81, 0xbe6, 0x4, 0x101, 0xfffffffc, 0x3, 0x849, 0x4, 0x40, 0x691, 0xfff, 0xfffffffc, 0x80000000, 0x3, 0x3, 0x200, 0x4, 0x14c, 0x4, 0x3, 0x80000001, 0x0, 0x1, 0x101f, 0x7fff, 0x5, 0x3ec0cdd1, 0x80000001, 0x8, 0x3, 0x6655, 0x4, 0x1, 0x0, 0xffffeedb, 0x6, 0x7fffffff, 0x9, 0x601c, 0x78, 0x1, 0x1, 0x4, 0x1, 0x400, 0xf6e6, 0x1000, 0xeebd, 0x80, 0x73, 0x4, 0x100, 0x200, 0x81, 0x2, 0xd840, 0x438e2a98, 0x8, 0x7ff, 0x75abfa7e, 0x0, 0x9, 0xbb, 0x1, 0xfffffffc, 0x0, 0x4, 0x400, 0x9, 0x101, 0x9, 0xf99, 0x1102a724, 0x6, 0x0, 0x43, 0xffff, 0x8, 0x7f, 0xfffffffa, 0x7fff, 0x9, 0x6, 0x80000001, 0x3, 0xfff, 0x6de, 0x9, 0x200, 0x7, 0xed, 0x1ba, 0x0, 0x8, 0x8001, 0x80000001, 0x636f, 0xb3, 0x3, 0xa06, 0x9, 0xec7, 0x4, 0x9, 0x0, 0x4c3, 0x6, 0x1, 0x6, 0xfffffffe, 0x830, 0x6, 0xd15a, 0xc18e, 0x3f, 0x8001, 0x10000, 0x1, 0x10001, 0x0, 0x6, 0x5, 0x9, 0x8000, 0xfffffffe, 0x8, 0x9, 0x54, 0x394, 0x348, 0x2, 0x401, 0x8001, 0x7cb, 0x4, 0x0, 0x0, 0x6, 0x8, 0x9, 0x9e95, 0x82, 0x3f, 0x5, 0x0, 0x6, 0x5, 0xff, 0x76, 0x9, 0x4, 0x5, 0xa45b, 0x10, 0x400, 0x0, 0x3f, 0x5, 0x8, 0x7fff, 0x7f, 0x1f, 0x96, 0x3, 0xa7e5, 0x200, 0x3, 0xa43, 0x200, 0xfffff184, 0x0, 0x5, 0x5, 0x5, 0x1, 0x9, 0x9759, 0x8000, 0x7, 0x0, 0x676d0ee9, 0x1, 0xe4, 0x589, 0x399, 0xffffff81, 0x1, 0x32, 0x55a, 0x6, 0x3, 0x101, 0x8, 0xffff434c, 0x7, 0x400, 0x9fa, 0xaae6, 0x0, 0xffffff00, 0x27, 0x6, 0x3, 0x2, 0x40, 0xff, 0x2, 0x81, 0xd9c, 0x7ff, 0x5, 0x2000, 0x80000001, 0x3, 0x200, 0xe30a, 0x3, 0x7fff, 0x7, 0x0, 0xfb, 0x8001, 0xa04, 0x3, 0xb2ad, 0xa87, 0x1, 0x1, 0x1, 0x9, 0x400, 0x1ff, 0x8, 0x1, 0xded7, 0x7f, 0x6, 0x101, 0xffffffe1, 0x9, 0x2, 0x3ff, 0x8, 0x1, 0x20, 0x8000, 0x401, 0x5, 0x1f, 0x5, 0x7ff, 0x6, 0x4a58, 0x10001, 0xffff7fff, 0x8001, 0x401, 0x1f, 0x10000, 0xfffffffc, 0x3, 0xf8000, 0x7, 0x3d, 0x40, 0x7, 0x1, 0x1ff, 0x9, 0x1cbdace6, 0x0, 0x1, 0x1f, 0x6, 0x9, 0x2, 0x40, 0x1, 0x4, 0x2, 0x0, 0x7, 0x3, 0x6, 0x4, 0x7, 0x8, 0xffffffff, 0x400, 0x7, 0xee, 0x0, 0x3ff, 0x0, 0x8001, 0x7f, 0x9, 0x8, 0xfffffffe, 0x1, 0x9, 0x6dc, 0x400, 0x0, 0x7, 0x7fffffff, 0x2a, 0x7, 0x3, 0x1, 0x7ff, 0x2, 0x0, 0xde5, 0x7fffffff, 0x8, 0xffffffc1, 0x80000001, 0xfffffff8, 0x0, 0x6, 0x487, 0x6f, 0x8, 0x7, 0x2, 0x8c, 0x800]}) write$UHID_CREATE2(r2, &(0x7f0000000680)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000000000000000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) 17:43:24 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0xfffffffc}, 0x0) 17:43:24 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0xf) 17:43:24 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x600, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:24 executing program 4: syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) r0 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, 0xffffffffffffffff, 0x0}, 0x0) io_uring_enter(0xffffffffffffffff, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:24 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x88a8ffff, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:24 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, 0xffffffffffffffff, 0x0}, 0x0) io_uring_enter(r0, 0x0, 0x0, 0x0, 0x0, 0x0) [ 1920.117553][T10759] hid-generic 0000:0000:0000.027F: unknown main item tag 0x0 [ 1920.131125][T10759] hid-generic 0000:0000:0000.027F: unknown main item tag 0x0 17:43:24 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x10) [ 1920.161222][T10759] hid-generic 0000:0000:0000.027F: unknown main item tag 0x0 [ 1920.186372][T10759] hid-generic 0000:0000:0000.027F: unknown main item tag 0x0 [ 1920.196935][T10759] hid-generic 0000:0000:0000.027F: unknown main item tag 0x0 [ 1920.204773][T10759] hid-generic 0000:0000:0000.027F: unknown main item tag 0x0 17:43:24 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x9effffff, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:24 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x100015abe}, 0x0) 17:43:24 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x700, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) [ 1920.212487][T10759] hid-generic 0000:0000:0000.027F: unknown main item tag 0x0 [ 1920.221628][T10759] hid-generic 0000:0000:0000.027F: unknown main item tag 0x0 [ 1920.249948][T10759] hid-generic 0000:0000:0000.027F: unknown main item tag 0x0 [ 1920.289978][T10759] hid-generic 0000:0000:0000.027F: unknown main item tag 0x0 [ 1920.297927][T10759] hid-generic 0000:0000:0000.027F: unknown main item tag 0x0 [ 1920.305602][T10759] hid-generic 0000:0000:0000.027F: unknown main item tag 0x0 [ 1920.313110][T10759] hid-generic 0000:0000:0000.027F: unknown main item tag 0x0 [ 1920.321985][T10759] hid-generic 0000:0000:0000.027F: unknown main item tag 0x0 [ 1920.369195][T10759] hid-generic 0000:0000:0000.027F: hidraw0: HID v0.00 Device [syz1] on %z5 17:43:24 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, 0xffffffffffffffff, 0x0}, 0x0) io_uring_enter(r0, 0x0, 0x0, 0x0, 0x0, 0x0) [ 1920.925200][ T17] hid-generic 0000:0000:0000.0280: unknown main item tag 0x0 [ 1920.932651][ T17] hid-generic 0000:0000:0000.0280: unknown main item tag 0x0 [ 1920.967612][ T17] hid-generic 0000:0000:0000.0280: unknown main item tag 0x0 [ 1920.983245][ T17] hid-generic 0000:0000:0000.0280: unknown main item tag 0x0 [ 1921.000208][ T17] hid-generic 0000:0000:0000.0280: unknown main item tag 0x0 [ 1921.017370][ T17] hid-generic 0000:0000:0000.0280: unknown main item tag 0x0 [ 1921.033706][ T17] hid-generic 0000:0000:0000.0280: unknown main item tag 0x0 [ 1921.041139][ T17] hid-generic 0000:0000:0000.0280: unknown main item tag 0x0 [ 1921.063649][ T17] hid-generic 0000:0000:0000.0280: unknown main item tag 0x0 [ 1921.071095][ T17] hid-generic 0000:0000:0000.0280: unknown main item tag 0x0 [ 1921.093832][ T17] hid-generic 0000:0000:0000.0280: unknown main item tag 0x0 [ 1921.101262][ T17] hid-generic 0000:0000:0000.0280: unknown main item tag 0x0 [ 1921.108765][ T17] hid-generic 0000:0000:0000.0280: unknown main item tag 0x0 [ 1921.116396][ T17] hid-generic 0000:0000:0000.0280: unknown main item tag 0x0 [ 1921.124942][ T17] hid-generic 0000:0000:0000.0280: hidraw0: HID v0.00 Device [syz1] on %z5 17:43:25 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000680)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000000000000000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r4 = eventfd(0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r8, 0xae60) r9 = eventfd(0x0) ioctl$PERF_EVENT_IOC_DISABLE(0xffffffffffffffff, 0x2401, 0x6) r10 = dup3(r8, r6, 0x0) ioctl$KVM_IRQFD(r10, 0x4020ae76, &(0x7f0000000100)={r4, 0x0, 0x0, r9, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) ioctl$KVM_IRQFD(r10, 0x4020ae76, &(0x7f0000000100)={r4, 0x0, 0x2, r4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) sendmsg$IPVS_CMD_SET_INFO(r10, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000040)={&(0x7f0000000140)={0x138, 0x0, 0x100, 0x70bd26, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0xffffffffffffffbb, 0x5, 0x10001}, @IPVS_CMD_ATTR_DAEMON={0x84, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @ipv4={[], [], @multicast2}}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x101}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'vcan0\x00'}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'rose0\x00'}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'vlan0\x00'}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DAEMON={0x60, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x3}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e21}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x7}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x3}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x1}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @loopback}]}, @IPVS_CMD_ATTR_DAEMON={0x24, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @broadcast}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x7fff}, @IPVS_DAEMON_ATTR_STATE={0x8}]}]}, 0x138}, 0x1, 0x0, 0x0, 0x4000}, 0x0) dup2(r3, r2) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) 17:43:25 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x11) 17:43:25 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x900, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:25 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x178000000000}, 0x0) 17:43:25 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0xbe031947, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:25 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, 0xffffffffffffffff, 0x0}, 0x0) io_uring_enter(r0, 0x0, 0x0, 0x0, 0x0, 0x0) [ 1921.222897][T15494] __nla_validate_parse: 46 callbacks suppressed [ 1921.222909][T15494] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 1921.261009][T15497] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'. 17:43:25 executing program 4: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x1900000000000000, 0x0, 0x0) 17:43:25 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x12) [ 1921.321847][T15495] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'. [ 1921.378685][ T17] hid-generic 0000:0000:0000.0281: unknown main item tag 0x0 [ 1921.409920][ T17] hid-generic 0000:0000:0000.0281: unknown main item tag 0x0 [ 1921.425000][T15494] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 1921.464035][T15497] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1921.490827][ T17] hid-generic 0000:0000:0000.0281: unknown main item tag 0x0 [ 1921.503491][T15513] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'. 17:43:25 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x13) [ 1921.542215][ T17] hid-generic 0000:0000:0000.0281: unknown main item tag 0x0 17:43:25 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x4, 0xfffffffd}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xfffffffffffffeb8, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:25 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0xf0ffffff, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:25 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0xa00, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) [ 1921.587429][ T17] hid-generic 0000:0000:0000.0281: unknown main item tag 0x0 [ 1921.632416][ T17] hid-generic 0000:0000:0000.0281: unknown main item tag 0x0 [ 1921.663400][ T17] hid-generic 0000:0000:0000.0281: unknown main item tag 0x0 [ 1921.695336][ T17] hid-generic 0000:0000:0000.0281: unknown main item tag 0x0 [ 1921.726086][ T17] hid-generic 0000:0000:0000.0281: unknown main item tag 0x0 [ 1921.755237][ T17] hid-generic 0000:0000:0000.0281: unknown main item tag 0x0 [ 1921.779699][ T17] hid-generic 0000:0000:0000.0281: unknown main item tag 0x0 [ 1921.794311][ T17] hid-generic 0000:0000:0000.0281: unknown main item tag 0x0 [ 1921.813623][ T17] hid-generic 0000:0000:0000.0281: unknown main item tag 0x0 [ 1921.821121][ T17] hid-generic 0000:0000:0000.0281: unknown main item tag 0x0 [ 1921.835211][ T17] hid-generic 0000:0000:0000.0281: hidraw0: HID v0.00 Device [syz1] on %z5 [ 1921.951623][T15563] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1921.982732][T15564] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 1922.005040][T15563] validate_nla: 25 callbacks suppressed [ 1922.005054][T15563] netlink: 'syz-executor.0': attribute type 16 has an invalid length. [ 1922.030174][T15564] netlink: 'syz-executor.3': attribute type 14 has an invalid length. [ 1922.043071][T15563] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1922.056923][T15569] netlink: 'syz-executor.0': attribute type 16 has an invalid length. [ 1922.065801][T15564] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 1922.076484][T15570] netlink: 'syz-executor.3': attribute type 14 has an invalid length. 17:43:26 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="7a310000000000000000000000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d630000436b69fe2cf5997a797a10fbffffff00000200000000010000000000030000cf0a000000000000000000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82f330a6313139d432a50df4783692f4d6d129db15715b0d2405ecd2a29bb2a42e9a7ccd540f0000000000003a5cf41b1c365fa905d121358333597568433e81f441c9dfc6a7ba26334203a9ebb0f971f9bd7fcd62fb6324e7ae0302d0764aa37db22375de2ef0ada9df3f718dcbc894f9"], 0x12e) r3 = creat(&(0x7f0000000000)='./bus\x00', 0x0) dup2(r3, r2) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) 17:43:26 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x1000000000000}, 0x0) 17:43:26 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x14) 17:43:26 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0xf1ffffff, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:26 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x4, 0xfffffffd}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xfffffffffffffeb8, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:26 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0xc00, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:26 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x4, 0xfffffffd}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xfffffffffffffeb8, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:26 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x15) [ 1922.596144][T15593] netlink: 'syz-executor.3': attribute type 14 has an invalid length. [ 1922.621256][T15594] netlink: 'syz-executor.0': attribute type 16 has an invalid length. 17:43:26 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x40030000000000}, 0x0) [ 1922.652738][T15593] netlink: 'syz-executor.3': attribute type 14 has an invalid length. [ 1922.677716][T15594] netlink: 'syz-executor.0': attribute type 16 has an invalid length. 17:43:27 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x4, 0xfffffffd}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:27 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0xe00, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:27 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0xffffa888, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) [ 1922.857750][T15625] netlink: 'syz-executor.3': attribute type 14 has an invalid length. [ 1922.914964][T15632] netlink: 'syz-executor.3': attribute type 14 has an invalid length. 17:43:27 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000680)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000000000000000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r4 = signalfd4(r1, &(0x7f0000000000)={[0xf98]}, 0x8, 0x800) dup2(r3, r4) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) 17:43:27 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x16) 17:43:27 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0xf0ffffffffffff}, 0x0) 17:43:27 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x4, 0xfffffffd}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:27 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0xf00, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:27 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0xfffff000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:27 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x4, 0xfffffffd}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1923.237152][ T9806] hid-generic 0000:0000:0000.0282: unknown main item tag 0x0 [ 1923.258875][ T9806] hid-generic 0000:0000:0000.0282: unknown main item tag 0x0 17:43:27 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x17) 17:43:27 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x2000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:27 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x100000000000000}, 0x0) 17:43:27 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0xffffff7f, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) [ 1923.305775][ T9806] hid-generic 0000:0000:0000.0282: unknown main item tag 0x0 [ 1923.343461][ T9806] hid-generic 0000:0000:0000.0282: unknown main item tag 0x0 [ 1923.373332][ T9806] hid-generic 0000:0000:0000.0282: unknown main item tag 0x0 [ 1923.383121][ T9806] hid-generic 0000:0000:0000.0282: unknown main item tag 0x0 [ 1923.401261][ T9806] hid-generic 0000:0000:0000.0282: unknown main item tag 0x0 [ 1923.411748][ T9806] hid-generic 0000:0000:0000.0282: unknown main item tag 0x0 [ 1923.421196][ T9806] hid-generic 0000:0000:0000.0282: unknown main item tag 0x0 [ 1923.429152][ T9806] hid-generic 0000:0000:0000.0282: unknown main item tag 0x0 [ 1923.437365][ T9806] hid-generic 0000:0000:0000.0282: unknown main item tag 0x0 [ 1923.445265][ T9806] hid-generic 0000:0000:0000.0282: unknown main item tag 0x0 [ 1923.452675][ T9806] hid-generic 0000:0000:0000.0282: unknown main item tag 0x0 [ 1923.460695][ T9806] hid-generic 0000:0000:0000.0282: unknown main item tag 0x0 [ 1923.473721][ T9806] hid-generic 0000:0000:0000.0282: hidraw0: HID v0.00 Device [syz1] on %z5 17:43:27 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x4, 0xfffffffd}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) eventfd(0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xfffffffffffffeb8, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:28 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a3100000000000000b600000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000e80000000073797a10fbffffff00000200000000010000000000030000cf0a000000000000000000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac8247a566856f190d19e0b679ec5634c8facf7fc10b6e2013bf5c5952f8f2031fc2af423c8d479bc207b7aea3d188bfab16bf5bf542afdbbc4861b7087f1dfeff3e70c7173f55b0032e5edaf6ffc0e52fa390aea70a279538a1f1cdfc3fad3aed95da6c"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) 17:43:28 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0xffffff9e, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:28 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x18) 17:43:28 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x200000000000000}, 0x0) 17:43:28 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x4, 0xfffffffd}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) eventfd(0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xfffffffffffffeb8, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:28 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x4800, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:28 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x300000000000000}, 0x0) 17:43:28 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x4, 0xfffffffd}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) eventfd(0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xfffffffffffffeb8, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:28 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0xfffffff0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) [ 1924.160139][ T6101] hid (null): global environment stack underflow [ 1924.181295][ T6101] hid-generic 0000:0000:0000.0283: global environment stack underflow 17:43:28 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x4c00, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:28 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x19) [ 1924.231604][ T6101] hid-generic 0000:0000:0000.0283: item 0 2 1 11 parsing failed [ 1924.254692][ T6101] hid-generic: probe of 0000:0000:0000.0283 failed with error -22 17:43:28 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x4, 0xfffffffd}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xfffffffffffffeb8, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:29 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000680)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000000000000000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_CONNECT(r7, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)={0x2c, r5, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_SSID={0x5, 0x34, @random='T'}, @crypto_settings=[@NL80211_ATTR_CIPHER_SUITES_PAIRWISE={0x8, 0x49, [0xfac08]}]]}, 0x2c}}, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) r11 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_CONNECT(r11, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)={0x2c, r9, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r10}, @void}}, [@NL80211_ATTR_SSID={0x5, 0x34, @random='T'}, @crypto_settings=[@NL80211_ATTR_CIPHER_SUITES_PAIRWISE={0x8, 0x49, [0xfac08]}]]}, 0x2c}}, 0x0) sendmsg$NL80211_CMD_GET_KEY(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x6c, r5, 0x100, 0x70bd26, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r10}, @void}}, [@NL80211_ATTR_KEY_DEFAULT={0x4}, @NL80211_ATTR_KEY_DEFAULT_TYPES={0x20, 0x6e, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}]}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "4800d86860aca1b67a7f12c570"}, @NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x1}, @NL80211_ATTR_KEY_DEFAULT={0x4}, @NL80211_ATTR_KEY_IDX={0x5, 0x8, 0x3}, @NL80211_ATTR_KEY_DEFAULT={0x4}]}, 0x6c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000004) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) 17:43:29 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x4, 0xfffffffd}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xfffffffffffffeb8, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:29 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x400000000000000}, 0x0) 17:43:29 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x5865, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:29 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x1a) 17:43:29 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0xfffffff1, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:29 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x4, 0xfffffffd}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xfffffffffffffeb8, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1924.912261][T10759] hid-generic 0000:0000:0000.0284: unknown main item tag 0x0 [ 1924.945213][T10759] hid-generic 0000:0000:0000.0284: unknown main item tag 0x0 17:43:29 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x500000000000000}, 0x0) 17:43:29 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x6000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:29 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x1b) [ 1924.997802][T10759] hid-generic 0000:0000:0000.0284: unknown main item tag 0x0 [ 1925.031488][T10759] hid-generic 0000:0000:0000.0284: unknown main item tag 0x0 17:43:29 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0xffffffff, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) [ 1925.048803][T10759] hid-generic 0000:0000:0000.0284: unknown main item tag 0x0 [ 1925.084232][T10759] hid-generic 0000:0000:0000.0284: unknown main item tag 0x0 [ 1925.091667][T10759] hid-generic 0000:0000:0000.0284: unknown main item tag 0x0 [ 1925.099227][T10759] hid-generic 0000:0000:0000.0284: unknown main item tag 0x0 [ 1925.106969][T10759] hid-generic 0000:0000:0000.0284: unknown main item tag 0x0 [ 1925.114756][T10759] hid-generic 0000:0000:0000.0284: unknown main item tag 0x0 [ 1925.123035][T10759] hid-generic 0000:0000:0000.0284: unknown main item tag 0x0 [ 1925.130596][T10759] hid-generic 0000:0000:0000.0284: unknown main item tag 0x0 [ 1925.138175][T10759] hid-generic 0000:0000:0000.0284: unknown main item tag 0x0 [ 1925.146295][T10759] hid-generic 0000:0000:0000.0284: unknown main item tag 0x0 [ 1925.163728][T10759] hid-generic 0000:0000:0000.0284: hidraw0: HID v0.00 Device [syz1] on %z5 17:43:29 executing program 4: r0 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xfffffffffffffeb8, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(0xffffffffffffffff, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:30 executing program 5: ioctl$FS_IOC_GETFLAGS(0xffffffffffffffff, 0x80086601, &(0x7f0000000000)) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000040)=0x0) ptrace$getenv(0x4201, r0, 0x6, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r3, &(0x7f0000000680)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d00002a0000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f0000000000fbffffff0000000000000000000000000020000000000000009ce30885e9fa7d430001000000000000000000004000000000000100258c7a3500000000000000000000000000000200000000000000feffffff00000000005800f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000000000000000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82"], 0x12e) r4 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r4, r3) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) 17:43:30 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x1c) 17:43:30 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:30 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x600000000000000}, 0x0) 17:43:30 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x6558, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:30 executing program 4: r0 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xfffffffffffffeb8, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(0xffffffffffffffff, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:30 executing program 4: r0 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xfffffffffffffeb8, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(0xffffffffffffffff, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:30 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x1d) [ 1925.872901][T32372] hid-generic 0000:0000:0000.0285: unknown main item tag 0x0 [ 1925.895268][T32372] hid-generic 0000:0000:0000.0285: unknown main item tag 0x0 [ 1925.936398][T32372] hid-generic 0000:0000:0000.0285: unknown main item tag 0x0 17:43:30 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x700000000000000}, 0x0) 17:43:30 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x2, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) [ 1925.980415][T32372] hid-generic 0000:0000:0000.0285: unknown main item tag 0x0 [ 1926.009914][T32372] hid-generic 0000:0000:0000.0285: unknown main item tag 0x0 17:43:30 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x6800, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:30 executing program 4: r0 = syz_io_uring_setup(0x0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x4, 0xfffffffd}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xfffffffffffffeb8, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1926.050197][T32372] hid-generic 0000:0000:0000.0285: unknown main item tag 0x0 [ 1926.077949][T32372] hid-generic 0000:0000:0000.0285: unknown main item tag 0x0 [ 1926.113853][T32372] hid-generic 0000:0000:0000.0285: unknown main item tag 0x0 [ 1926.152283][T32372] hid-generic 0000:0000:0000.0285: unknown main item tag 0x0 [ 1926.195083][T32372] hid-generic 0000:0000:0000.0285: unknown main item tag 0x0 [ 1926.238379][T32372] hid-generic 0000:0000:0000.0285: unknown main item tag 0x0 [ 1926.268993][T32372] hid-generic 0000:0000:0000.0285: unknown main item tag 0x0 [ 1926.298061][T32372] hid-generic 0000:0000:0000.0285: unknown main item tag 0x0 [ 1926.324472][T32372] hid-generic 0000:0000:0000.0285: unknown main item tag 0x0 [ 1926.349218][T32372] hid-generic 0000:0000:0000.0285: hidraw0: HID v0.00 Device [syz1] on %z5 [ 1926.877689][ T7] hid-generic 0000:0000:0000.0286: unknown main item tag 0x0 [ 1926.891755][ T7] hid-generic 0000:0000:0000.0286: unknown main item tag 0x0 [ 1926.908533][ T7] hid-generic 0000:0000:0000.0286: unknown main item tag 0x0 [ 1926.924901][ T7] hid-generic 0000:0000:0000.0286: unknown main item tag 0x0 [ 1926.940396][ T7] hid-generic 0000:0000:0000.0286: unknown main item tag 0x0 [ 1926.949910][ T7] hid-generic 0000:0000:0000.0286: unknown main item tag 0x0 [ 1926.964990][ T7] hid-generic 0000:0000:0000.0286: unknown main item tag 0x0 [ 1926.981441][ T7] hid-generic 0000:0000:0000.0286: unknown main item tag 0x0 [ 1927.000838][ T7] hid-generic 0000:0000:0000.0286: unknown main item tag 0x0 [ 1927.010195][ T7] hid-generic 0000:0000:0000.0286: unknown main item tag 0x0 [ 1927.024866][ T7] hid-generic 0000:0000:0000.0286: unknown main item tag 0x0 [ 1927.040637][ T7] hid-generic 0000:0000:0000.0286: unknown main item tag 0x0 [ 1927.050395][ T7] hid-generic 0000:0000:0000.0286: unknown main item tag 0x0 [ 1927.066596][ T7] hid-generic 0000:0000:0000.0286: unknown main item tag 0x0 [ 1927.090613][ T7] hid-generic 0000:0000:0000.0286: hidraw0: HID v0.00 Device [syz1] on %z5 17:43:31 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) setsockopt$RDS_RECVERR(r1, 0x114, 0x5, &(0x7f0000000000)=0x5, 0x4) write$UHID_CREATE2(r2, &(0x7f0000000680)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000000000000000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) 17:43:31 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x1e) 17:43:31 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x800000000000000}, 0x0) 17:43:31 executing program 4: r0 = syz_io_uring_setup(0x0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x4, 0xfffffffd}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xfffffffffffffeb8, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:31 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x3, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:31 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x6c00, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) [ 1927.197620][T15946] __nla_validate_parse: 57 callbacks suppressed [ 1927.197633][T15946] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'. 17:43:31 executing program 4: r0 = syz_io_uring_setup(0x0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x4, 0xfffffffd}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xfffffffffffffeb8, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1927.245309][T15949] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'. [ 1927.278410][T15947] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 1927.285120][T22685] hid-generic 0000:0000:0000.0287: unknown main item tag 0x0 [ 1927.323361][T22685] hid-generic 0000:0000:0000.0287: unknown main item tag 0x0 [ 1927.348680][T15958] validate_nla: 33 callbacks suppressed [ 1927.348694][T15958] netlink: 'syz-executor.3': attribute type 14 has an invalid length. [ 1927.361124][T22685] hid-generic 0000:0000:0000.0287: unknown main item tag 0x0 17:43:31 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x21) [ 1927.365827][T15956] netlink: 'syz-executor.0': attribute type 16 has an invalid length. [ 1927.401214][T22685] hid-generic 0000:0000:0000.0287: unknown main item tag 0x0 [ 1927.402639][T15959] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'. [ 1927.410262][T22685] hid-generic 0000:0000:0000.0287: unknown main item tag 0x0 [ 1927.431691][T22685] hid-generic 0000:0000:0000.0287: unknown main item tag 0x0 [ 1927.442685][T22685] hid-generic 0000:0000:0000.0287: unknown main item tag 0x0 [ 1927.462807][T22685] hid-generic 0000:0000:0000.0287: unknown main item tag 0x0 [ 1927.477148][T15947] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 1927.483498][T22685] hid-generic 0000:0000:0000.0287: unknown main item tag 0x0 [ 1927.495993][T15958] netlink: 'syz-executor.3': attribute type 14 has an invalid length. [ 1927.505514][T22685] hid-generic 0000:0000:0000.0287: unknown main item tag 0x0 [ 1927.517897][T15946] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1927.522791][T22685] hid-generic 0000:0000:0000.0287: unknown main item tag 0x0 [ 1927.538875][T15956] netlink: 'syz-executor.0': attribute type 16 has an invalid length. 17:43:31 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x900000000000000}, 0x0) 17:43:31 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x7400, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) [ 1927.564685][T22685] hid-generic 0000:0000:0000.0287: unknown main item tag 0x0 17:43:31 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x4, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) [ 1927.596804][T22685] hid-generic 0000:0000:0000.0287: unknown main item tag 0x0 [ 1927.604973][T22685] hid-generic 0000:0000:0000.0287: unknown main item tag 0x0 [ 1927.658874][T22685] hid-generic 0000:0000:0000.0287: hidraw0: HID v0.00 Device [syz1] on %z5 [ 1927.683294][T15979] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 17:43:32 executing program 4: r0 = syz_io_uring_setup(0x82, 0x0, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xfffffffffffffeb8, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1927.782766][T15991] netlink: 'syz-executor.3': attribute type 14 has an invalid length. [ 1927.799866][T15997] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'. [ 1927.877130][T15999] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1927.913193][T15979] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 1927.926037][T15991] netlink: 'syz-executor.3': attribute type 14 has an invalid length. [ 1927.945684][T16001] netlink: 'syz-executor.0': attribute type 16 has an invalid length. [ 1927.983912][T16001] netlink: 'syz-executor.0': attribute type 16 has an invalid length. [ 1928.220176][T22685] hid-generic 0000:0000:0000.0288: unknown main item tag 0x0 [ 1928.240340][T22685] hid-generic 0000:0000:0000.0288: unknown main item tag 0x0 [ 1928.263925][T22685] hid-generic 0000:0000:0000.0288: unknown main item tag 0x0 [ 1928.271360][T22685] hid-generic 0000:0000:0000.0288: unknown main item tag 0x0 [ 1928.279633][T22685] hid-generic 0000:0000:0000.0288: unknown main item tag 0x0 [ 1928.287645][T22685] hid-generic 0000:0000:0000.0288: unknown main item tag 0x0 [ 1928.296985][T22685] hid-generic 0000:0000:0000.0288: unknown main item tag 0x0 [ 1928.304970][T22685] hid-generic 0000:0000:0000.0288: unknown main item tag 0x0 [ 1928.312409][T22685] hid-generic 0000:0000:0000.0288: unknown main item tag 0x0 [ 1928.320491][T22685] hid-generic 0000:0000:0000.0288: unknown main item tag 0x0 [ 1928.328576][T22685] hid-generic 0000:0000:0000.0288: unknown main item tag 0x0 [ 1928.336786][T22685] hid-generic 0000:0000:0000.0288: unknown main item tag 0x0 [ 1928.344650][T22685] hid-generic 0000:0000:0000.0288: unknown main item tag 0x0 [ 1928.352070][T22685] hid-generic 0000:0000:0000.0288: unknown main item tag 0x0 [ 1928.375507][T22685] hid-generic 0000:0000:0000.0288: hidraw0: HID v0.00 Device [syz1] on %z5 17:43:32 executing program 5: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x900, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:32 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x300) 17:43:32 executing program 4: r0 = syz_io_uring_setup(0x82, 0x0, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xfffffffffffffeb8, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:32 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0xa00000000000000}, 0x0) 17:43:32 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x7a00, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:32 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x5, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:32 executing program 4: r0 = syz_io_uring_setup(0x82, 0x0, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xfffffffffffffeb8, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1928.578618][T16040] netlink: 'syz-executor.0': attribute type 16 has an invalid length. 17:43:32 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0xb00000000000000}, 0x0) 17:43:32 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x500) [ 1928.652871][T16028] netlink: 'syz-executor.3': attribute type 14 has an invalid length. 17:43:33 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x6, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:33 executing program 5: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x65580000}, 0x0) 17:43:33 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x8100, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:33 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0xfffffffd}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xfffffffffffffeb8, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:33 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0xfffffffd}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xfffffffffffffeb8, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:33 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x600) 17:43:33 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0xc00000000000000}, 0x0) 17:43:33 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0xfffffffd}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xfffffffffffffeb8, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:33 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x7, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:33 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_inet_SIOCRTMSG(r0, 0x890d, &(0x7f0000000040)={0x0, {0x2, 0x4e21, @empty}, {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x15}}, {0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x8, 0x0, 0x0, 0x0, 0x7fff, &(0x7f0000000000)='bond_slave_1\x00', 0x8, 0xfff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3e40efdbeeee7c1cac233917b00bca5cbc2bf49"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) fcntl$setlease(r0, 0x400, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) 17:43:33 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0xf000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:33 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x700) 17:43:33 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x4}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xfffffffffffffeb8, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:33 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0xe00000000000000}, 0x0) [ 1929.282231][T32372] hid-generic 0000:0000:0000.0289: item fetching failed at offset 19/22 [ 1929.323400][T32372] hid-generic: probe of 0000:0000:0000.0289 failed with error -22 17:43:33 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x900) 17:43:33 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x8, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:33 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0xf582, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:33 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x4}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0, &(0x7f0000000000)) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xfffffffffffffeb8, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:33 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0xf00000000000000}, 0x0) 17:43:33 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0xa00) 17:43:33 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x4}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0, &(0x7f0000000000)) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xfffffffffffffeb8, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:34 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_inet_SIOCRTMSG(r0, 0x890d, &(0x7f0000000040)={0x0, {0x2, 0x4e21, @empty}, {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x15}}, {0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x8, 0x0, 0x0, 0x0, 0x7fff, &(0x7f0000000000)='bond_slave_1\x00', 0x8, 0xfff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3e40efdbeeee7c1cac233917b00bca5cbc2bf49"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) fcntl$setlease(r0, 0x400, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) 17:43:34 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x9, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:34 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x34000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:34 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x4}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0, &(0x7f0000000000)) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xfffffffffffffeb8, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:34 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x1000000000000000}, 0x0) 17:43:34 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0xb00) 17:43:34 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x4}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), 0x0) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xfffffffffffffeb8, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:34 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x1100000000000000}, 0x0) [ 1930.038481][T32372] hid-generic 0000:0000:0000.028A: item fetching failed at offset 19/22 [ 1930.076969][T32372] hid-generic: probe of 0000:0000:0000.028A failed with error -22 17:43:34 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0xa, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:34 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0xc00) 17:43:34 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x400300, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:34 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x4}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), 0x0) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xfffffffffffffeb8, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:34 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_inet_SIOCRTMSG(r0, 0x890d, &(0x7f0000000040)={0x0, {0x2, 0x4e21, @empty}, {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x15}}, {0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x8, 0x0, 0x0, 0x0, 0x7fff, &(0x7f0000000000)='bond_slave_1\x00', 0x8, 0xfff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3e40efdbeeee7c1cac233917b00bca5cbc2bf49"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) fcntl$setlease(r0, 0x400, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) 17:43:34 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0xd00) 17:43:34 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x4}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), 0x0) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xfffffffffffffeb8, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:34 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x6000000000000000}, 0x0) 17:43:34 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0xb, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:34 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0xf0ffff, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:35 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x4}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xfffffffffffffeb8, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:35 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0xe00) [ 1930.814666][ T7] hid-generic 0000:0000:0000.028B: item fetching failed at offset 19/22 [ 1930.824463][ T7] hid-generic: probe of 0000:0000:0000.028B failed with error -22 17:43:35 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x6558000000000000}, 0x0) 17:43:35 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x1000000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:35 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0xc, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:35 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x4}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xfffffffffffffeb8, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:35 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_inet_SIOCRTMSG(r0, 0x890d, &(0x7f0000000040)={0x0, {0x2, 0x4e21, @empty}, {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x15}}, {0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x8, 0x0, 0x0, 0x0, 0x7fff, &(0x7f0000000000)='bond_slave_1\x00', 0x8, 0xfff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3e40efdbeeee7c1cac233917b00bca5cbc2bf49"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) fcntl$setlease(r0, 0x400, 0x0) 17:43:35 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x8100000000000000}, 0x0) 17:43:35 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0xf00) 17:43:35 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0xe, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:35 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x4}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xfffffffffffffeb8, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:35 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x2000000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:35 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0xf, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:35 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x3000000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:35 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x1100) [ 1931.566672][T32372] hid-generic 0000:0000:0000.028C: item fetching failed at offset 19/22 17:43:35 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x4}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xfffffffffffffeb8, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1931.611332][T32372] hid-generic: probe of 0000:0000:0000.028C failed with error -22 17:43:35 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x88a8ffff00000000}, 0x0) 17:43:36 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_inet_SIOCRTMSG(r0, 0x890d, &(0x7f0000000040)={0x0, {0x2, 0x4e21, @empty}, {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x15}}, {0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x8, 0x0, 0x0, 0x0, 0x7fff, &(0x7f0000000000)='bond_slave_1\x00', 0x8, 0xfff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3e40efdbeeee7c1cac233917b00bca5cbc2bf49"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) 17:43:36 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x4}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xfffffffffffffeb8, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:36 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x1200) 17:43:36 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x4000000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:36 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x10, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) [ 1931.889328][T32372] hid-generic 0000:0000:0000.028D: item fetching failed at offset 19/22 [ 1931.914565][T32372] hid-generic: probe of 0000:0000:0000.028D failed with error -22 17:43:36 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x9effffff00000000}, 0x0) 17:43:36 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_inet_SIOCRTMSG(r0, 0x890d, &(0x7f0000000040)={0x0, {0x2, 0x4e21, @empty}, {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x15}}, {0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x8, 0x0, 0x0, 0x0, 0x7fff, &(0x7f0000000000)='bond_slave_1\x00', 0x8, 0xfff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3e40efdbeeee7c1cac233917b00bca5cbc2bf49"], 0x12e) dup2(0xffffffffffffffff, r2) 17:43:36 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x4}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xfffffffffffffeb8, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:36 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x1300) [ 1932.148540][T22685] hid-generic 0000:0000:0000.028E: item fetching failed at offset 19/22 [ 1932.196438][T22685] hid-generic: probe of 0000:0000:0000.028E failed with error -22 17:43:36 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x11, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:36 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0xbe5a010001000000}, 0x0) 17:43:36 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x5000000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:36 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_inet_SIOCRTMSG(r0, 0x890d, &(0x7f0000000040)={0x0, {0x2, 0x4e21, @empty}, {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x15}}, {0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x8, 0x0, 0x0, 0x0, 0x7fff, &(0x7f0000000000)='bond_slave_1\x00', 0x8, 0xfff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3e40efdbeeee7c1cac233917b00bca5cbc2bf49"], 0x12e) dup2(0xffffffffffffffff, r2) 17:43:36 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x1400) 17:43:36 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x4}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, 0x0, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1932.369573][T32372] hid-generic 0000:0000:0000.028F: item fetching failed at offset 19/22 [ 1932.375530][T16456] __nla_validate_parse: 69 callbacks suppressed [ 1932.375543][T16456] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 1932.400631][T32372] hid-generic: probe of 0000:0000:0000.028F failed with error -22 17:43:36 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_inet_SIOCRTMSG(r0, 0x890d, &(0x7f0000000040)={0x0, {0x2, 0x4e21, @empty}, {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x15}}, {0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x8, 0x0, 0x0, 0x0, 0x7fff, &(0x7f0000000000)='bond_slave_1\x00', 0x8, 0xfff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3e40efdbeeee7c1cac233917b00bca5cbc2bf49"], 0x12e) dup2(0xffffffffffffffff, r2) 17:43:36 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x4}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, 0x0, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:36 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x1500) [ 1932.520833][T16460] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1932.568261][T16462] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'. 17:43:36 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x4}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, 0x0, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1932.612411][T16466] validate_nla: 40 callbacks suppressed [ 1932.612426][T16466] netlink: 'syz-executor.3': attribute type 14 has an invalid length. [ 1932.662643][T10759] hid-generic 0000:0000:0000.0290: item fetching failed at offset 19/22 [ 1932.681294][T16474] netlink: 'syz-executor.0': attribute type 16 has an invalid length. [ 1932.685316][T10759] hid-generic: probe of 0000:0000:0000.0290 failed with error -22 [ 1932.709222][T16473] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'. [ 1932.731143][T16456] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 17:43:37 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x1600) [ 1932.755231][T16466] netlink: 'syz-executor.3': attribute type 14 has an invalid length. [ 1932.768843][T16460] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1932.792962][T16474] netlink: 'syz-executor.0': attribute type 16 has an invalid length. 17:43:37 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x6000000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:37 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x48, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:37 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x4}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xfffffffffffffeb8, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:37 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0xc4eddeb900000000}, 0x0) 17:43:37 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_inet_SIOCRTMSG(r0, 0x890d, &(0x7f0000000040)={0x0, {0x2, 0x4e21, @empty}, {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x15}}, {0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x8, 0x0, 0x0, 0x0, 0x7fff, &(0x7f0000000000)='bond_slave_1\x00', 0x8, 0xfff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) [ 1932.951786][T16515] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 17:43:37 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x1700) 17:43:37 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x4}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000240)=@tipc=@id, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1933.038361][T16519] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'. 17:43:37 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_inet_SIOCRTMSG(r0, 0x890d, &(0x7f0000000040)={0x0, {0x2, 0x4e21, @empty}, {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x15}}, {0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x8, 0x0, 0x0, 0x0, 0x7fff, &(0x7f0000000000)='bond_slave_1\x00', 0x8, 0xfff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) [ 1933.086416][T16523] netlink: 'syz-executor.3': attribute type 14 has an invalid length. [ 1933.109866][T16529] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1933.180919][T16533] netlink: 'syz-executor.0': attribute type 16 has an invalid length. [ 1933.200801][T16519] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'. 17:43:37 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x4}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80000, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:37 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x1800) [ 1933.226608][T16523] netlink: 'syz-executor.3': attribute type 14 has an invalid length. [ 1933.248053][T16533] netlink: 'syz-executor.0': attribute type 16 has an invalid length. 17:43:37 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x4c, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:37 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0xf0ffffff00000000}, 0x0) 17:43:37 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x7000000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:37 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_inet_SIOCRTMSG(r0, 0x890d, &(0x7f0000000040)={0x0, {0x2, 0x4e21, @empty}, {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x15}}, {0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x8, 0x0, 0x0, 0x0, 0x7fff, &(0x7f0000000000)='bond_slave_1\x00', 0x8, 0xfff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) 17:43:37 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x4}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:37 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x1900) [ 1933.499240][T16562] netlink: 'syz-executor.3': attribute type 14 has an invalid length. [ 1933.517578][T16579] netlink: 'syz-executor.0': attribute type 16 has an invalid length. 17:43:37 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_inet_SIOCRTMSG(r0, 0x890d, &(0x7f0000000040)={0x0, {0x2, 0x4e21, @empty}, {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x15}}, {0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x8, 0x0, 0x0, 0x0, 0x7fff, &(0x7f0000000000)='bond_slave_1\x00', 0x8, 0xfff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3e40efdbeeee7c1cac233917b00bca5cbc2bf49"], 0x12e) r2 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r2, 0xffffffffffffffff) 17:43:37 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x60, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:37 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x4}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, 0xffffffffffffffff, 0x0}, 0x10000) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:37 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0xf1ffffff00000000}, 0x0) 17:43:37 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x8000000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:38 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x1a00) 17:43:38 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x4}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, 0xffffffffffffffff, 0x0}, 0x0) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:38 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_inet_SIOCRTMSG(r0, 0x890d, &(0x7f0000000040)={0x0, {0x2, 0x4e21, @empty}, {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x15}}, {0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x8, 0x0, 0x0, 0x0, 0x7fff, &(0x7f0000000000)='bond_slave_1\x00', 0x8, 0xfff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3e40efdbeeee7c1cac233917b00bca5cbc2bf49"], 0x12e) r2 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r2, 0xffffffffffffffff) 17:43:38 executing program 4: syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x4}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) r0 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, 0xffffffffffffffff, 0x0}, 0x0) io_uring_enter(0xffffffffffffffff, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:38 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x68, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:38 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x9000000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:38 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0xfcffffff00000000}, 0x0) 17:43:38 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_inet_SIOCRTMSG(r0, 0x890d, &(0x7f0000000040)={0x0, {0x2, 0x4e21, @empty}, {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x15}}, {0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x8, 0x0, 0x0, 0x0, 0x7fff, &(0x7f0000000000)='bond_slave_1\x00', 0x8, 0xfff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3e40efdbeeee7c1cac233917b00bca5cbc2bf49"], 0x12e) r2 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r2, 0xffffffffffffffff) 17:43:38 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x1b00) 17:43:38 executing program 4: syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x4}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) r0 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, 0xffffffffffffffff, 0x0}, 0x0) io_uring_enter(0xffffffffffffffff, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:38 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0xffffff7f00000000}, 0x0) 17:43:38 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0xa000000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:38 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x6c, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:38 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_inet_SIOCRTMSG(r0, 0x890d, &(0x7f0000000040)={0x0, {0x2, 0x4e21, @empty}, {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x15}}, {0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x8, 0x0, 0x0, 0x0, 0x7fff, &(0x7f0000000000)='bond_slave_1\x00', 0x8, 0xfff}) dup(r0) r1 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3e40efdbeeee7c1cac233917b00bca5cbc2bf49"], 0x12e) r2 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r2, r1) 17:43:38 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x1c00) 17:43:38 executing program 4: syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x4}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) r0 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, 0xffffffffffffffff, 0x0}, 0x0) io_uring_enter(0xffffffffffffffff, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:38 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0xffffffff00000000}, 0x0) [ 1934.383001][T22685] hid-generic 0000:0000:0000.0291: item fetching failed at offset 19/22 17:43:38 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0xc000000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) [ 1934.434602][T22685] hid-generic: probe of 0000:0000:0000.0291 failed with error -22 17:43:38 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_inet_SIOCRTMSG(r0, 0x890d, &(0x7f0000000040)={0x0, {0x2, 0x4e21, @empty}, {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x15}}, {0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x8, 0x0, 0x0, 0x0, 0x7fff, &(0x7f0000000000)='bond_slave_1\x00', 0x8, 0xfff}) dup(r0) r1 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3e40efdbeeee7c1cac233917b00bca5cbc2bf49"], 0x12e) r2 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r2, r1) 17:43:38 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x1d00) 17:43:38 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x74, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:38 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x4}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, 0xffffffffffffffff, 0x0}, 0x0) io_uring_enter(r0, 0x0, 0x0, 0x0, 0x0, 0x0) 17:43:38 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0xfffffffffffff000}, 0x0) 17:43:39 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0xe000000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:39 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x4}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, 0xffffffffffffffff, 0x0}, 0x0) io_uring_enter(r0, 0x0, 0x0, 0x0, 0x0, 0x0) [ 1934.742006][T22685] hid-generic 0000:0000:0000.0292: item fetching failed at offset 19/22 [ 1934.785348][T22685] hid-generic: probe of 0000:0000:0000.0292 failed with error -22 17:43:39 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x1e00) 17:43:39 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_inet_SIOCRTMSG(r0, 0x890d, &(0x7f0000000040)={0x0, {0x2, 0x4e21, @empty}, {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x15}}, {0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x8, 0x0, 0x0, 0x0, 0x7fff, &(0x7f0000000000)='bond_slave_1\x00', 0x8, 0xfff}) dup(r0) r1 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3e40efdbeeee7c1cac233917b00bca5cbc2bf49"], 0x12e) r2 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r2, r1) 17:43:39 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x7a, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:39 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:39 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x4}, &(0x7f0000000000/0x11000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000000)) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, 0xffffffffffffffff, 0x0}, 0x0) io_uring_enter(r0, 0x0, 0x0, 0x0, 0x0, 0x0) 17:43:39 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0xf000000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:39 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0xf0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) [ 1935.044996][ T6101] hid-generic 0000:0000:0000.0293: item fetching failed at offset 19/22 [ 1935.071821][ T6101] hid-generic: probe of 0000:0000:0000.0293 failed with error -22 17:43:39 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x1f00) 17:43:39 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_inet_SIOCRTMSG(r0, 0x890d, &(0x7f0000000040)={0x0, {0x2, 0x4e21, @empty}, {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x15}}, {0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x8, 0x0, 0x0, 0x0, 0x7fff, &(0x7f0000000000)='bond_slave_1\x00', 0x8, 0xfff}) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r1 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3e40efdbeeee7c1cac233917b00bca5cbc2bf49"], 0x12e) r2 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r2, r1) 17:43:39 executing program 4: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_inet_SIOCRTMSG(r0, 0x890d, &(0x7f0000000040)={0x0, {0x2, 0x4e21, @empty}, {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x15}}, {0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x8, 0x0, 0x0, 0x0, 0x7fff, &(0x7f0000000000)='bond_slave_1\x00', 0x8, 0xfff}) dup(r0) r1 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3e40efdbeeee7c1cac233917b00bca5cbc2bf49"], 0x12e) r2 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r2, r1) 17:43:39 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x2000) 17:43:39 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x2}, 0x0) 17:43:39 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x300, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:39 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x10000000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) [ 1935.345327][ T6101] hid-generic 0000:0000:0000.0294: item fetching failed at offset 19/22 [ 1935.378840][ T6101] hid-generic: probe of 0000:0000:0000.0294 failed with error -22 17:43:39 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_inet_SIOCRTMSG(r0, 0x890d, &(0x7f0000000040)={0x0, {0x2, 0x4e21, @empty}, {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x15}}, {0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x8, 0x0, 0x0, 0x0, 0x7fff, &(0x7f0000000000)='bond_slave_1\x00', 0x8, 0xfff}) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r1 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3e40efdbeeee7c1cac233917b00bca5cbc2bf49"], 0x12e) r2 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r2, r1) [ 1935.458161][ T6101] hid-generic 0000:0000:0000.0295: item fetching failed at offset 19/22 [ 1935.481825][ T6101] hid-generic: probe of 0000:0000:0000.0295 failed with error -22 17:43:39 executing program 4: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0xd00) 17:43:39 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x2100) [ 1935.637178][ T7] hid-generic 0000:0000:0000.0296: item fetching failed at offset 19/22 [ 1935.667794][ T7] hid-generic: probe of 0000:0000:0000.0296 failed with error -22 17:43:40 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_inet_SIOCRTMSG(r0, 0x890d, &(0x7f0000000040)={0x0, {0x2, 0x4e21, @empty}, {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x15}}, {0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x8, 0x0, 0x0, 0x0, 0x7fff, &(0x7f0000000000)='bond_slave_1\x00', 0x8, 0xfff}) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r1 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3e40efdbeeee7c1cac233917b00bca5cbc2bf49"], 0x12e) r2 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r2, r1) 17:43:40 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x500, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:40 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x20000) 17:43:40 executing program 4: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0xf582, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:40 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x20000000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:40 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x3}, 0x0) [ 1935.960773][T22685] hid-generic 0000:0000:0000.0297: item fetching failed at offset 19/22 [ 1935.995765][T22685] hid-generic: probe of 0000:0000:0000.0297 failed with error -22 17:43:40 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x600, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:40 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x1000000) 17:43:40 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3e40efdbeeee7c1cac233917b00bca5cbc2bf49"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) 17:43:40 executing program 4: eventfd(0x0) r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) r3 = eventfd(0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$CHAR_RAW_FLSBUF(0xffffffffffffffff, 0x1261, &(0x7f0000000000)=0x10001) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r7, 0xae60) r8 = eventfd(0x0) r9 = dup3(r7, r5, 0x0) ioctl$KVM_IRQFD(r9, 0x4020ae76, &(0x7f0000000100)={r3, 0x0, 0x0, r8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) ioctl$KVM_IRQFD(r9, 0x4020ae76, &(0x7f0000000100)={r3, 0x0, 0x2, r3, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffe000/0x2000)=nil, 0x2000, 0xd}, 0x0) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:40 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x48000000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:40 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4}, 0x0) [ 1936.298438][ T5] hid-generic 0000:0000:0000.0298: item fetching failed at offset 19/22 [ 1936.322183][ T5] hid-generic: probe of 0000:0000:0000.0298 failed with error -22 17:43:40 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x700, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:40 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x2000000) 17:43:40 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x4c000000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:40 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x5}, 0x0) 17:43:40 executing program 5: r0 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3e40efdbeeee7c1cac233917b00bca5cbc2bf49"], 0x12e) r2 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r2, r1) 17:43:40 executing program 4: eventfd(0x0) r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) r3 = eventfd(0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$CHAR_RAW_FLSBUF(0xffffffffffffffff, 0x1261, &(0x7f0000000000)=0x10001) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r7, 0xae60) r8 = eventfd(0x0) r9 = dup3(r7, r5, 0x0) ioctl$KVM_IRQFD(r9, 0x4020ae76, &(0x7f0000000100)={r3, 0x0, 0x0, r8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) ioctl$KVM_IRQFD(r9, 0x4020ae76, &(0x7f0000000100)={r3, 0x0, 0x2, r3, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffe000/0x2000)=nil, 0x2000, 0xd}, 0x0) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1936.672157][ T5] hid-generic 0000:0000:0000.0299: item fetching failed at offset 19/22 17:43:41 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x3000000) [ 1936.713514][ T5] hid-generic: probe of 0000:0000:0000.0299 failed with error -22 17:43:41 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x900, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:41 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x60000000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:41 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x6}, 0x0) 17:43:41 executing program 5: r0 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3e40efdbeeee7c1cac233917b00bca5cbc2bf49"], 0x12e) r2 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r2, r1) 17:43:41 executing program 4: eventfd(0x0) r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) r3 = eventfd(0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$CHAR_RAW_FLSBUF(0xffffffffffffffff, 0x1261, &(0x7f0000000000)=0x10001) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r7, 0xae60) r8 = eventfd(0x0) r9 = dup3(r7, r5, 0x0) ioctl$KVM_IRQFD(r9, 0x4020ae76, &(0x7f0000000100)={r3, 0x0, 0x0, r8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) ioctl$KVM_IRQFD(r9, 0x4020ae76, &(0x7f0000000100)={r3, 0x0, 0x2, r3, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffe000/0x2000)=nil, 0x2000, 0xd}, 0x0) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1936.974553][T22685] hid-generic 0000:0000:0000.029A: item fetching failed at offset 19/22 [ 1937.009491][T22685] hid-generic: probe of 0000:0000:0000.029A failed with error -22 17:43:41 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x4000000) 17:43:41 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x65580000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:41 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0xa00, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:41 executing program 5: r0 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3e40efdbeeee7c1cac233917b00bca5cbc2bf49"], 0x12e) r2 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r2, r1) 17:43:41 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x7}, 0x0) [ 1937.305103][T22685] hid-generic 0000:0000:0000.029B: item fetching failed at offset 19/22 [ 1937.337730][T22685] hid-generic: probe of 0000:0000:0000.029B failed with error -22 17:43:41 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x5000000) 17:43:41 executing program 4: eventfd(0x0) r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000040)) r1 = eventfd(0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$CHAR_RAW_FLSBUF(0xffffffffffffffff, 0x1261, &(0x7f0000000000)=0x10001) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) r6 = eventfd(0x0) r7 = dup3(r5, r3, 0x0) ioctl$KVM_IRQFD(r7, 0x4020ae76, &(0x7f0000000100)={r1, 0x0, 0x0, r6, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) ioctl$KVM_IRQFD(r7, 0x4020ae76, &(0x7f0000000100)={r1, 0x0, 0x2, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1937.392300][T17025] __nla_validate_parse: 74 callbacks suppressed [ 1937.392314][T17025] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 17:43:41 executing program 5: socket$inet_icmp_raw(0x2, 0x3, 0x1) r0 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3e40efdbeeee7c1cac233917b00bca5cbc2bf49"], 0x12e) r2 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r2, r1) [ 1937.485467][T17037] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'. 17:43:41 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x68000000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) [ 1937.604089][T17030] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'. 17:43:41 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x6000000) [ 1937.644636][T17037] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'. [ 1937.701922][ T5] hid-generic 0000:0000:0000.029C: item fetching failed at offset 19/22 [ 1937.734097][T17068] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 1937.737753][ T5] hid-generic: probe of 0000:0000:0000.029C failed with error -22 17:43:42 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0xb00, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:42 executing program 4: eventfd(0x0) r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000040)) r1 = eventfd(0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$CHAR_RAW_FLSBUF(0xffffffffffffffff, 0x1261, &(0x7f0000000000)=0x10001) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) r6 = eventfd(0x0) r7 = dup3(r5, r3, 0x0) ioctl$KVM_IRQFD(r7, 0x4020ae76, &(0x7f0000000100)={r1, 0x0, 0x0, r6, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) ioctl$KVM_IRQFD(r7, 0x4020ae76, &(0x7f0000000100)={r1, 0x0, 0x2, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1937.812256][T17070] validate_nla: 50 callbacks suppressed [ 1937.812271][T17070] netlink: 'syz-executor.3': attribute type 14 has an invalid length. 17:43:42 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8}, 0x0) [ 1937.859899][T17068] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 1937.877396][T17070] netlink: 'syz-executor.3': attribute type 14 has an invalid length. 17:43:42 executing program 5: socket$inet_icmp_raw(0x2, 0x3, 0x1) r0 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3e40efdbeeee7c1cac233917b00bca5cbc2bf49"], 0x12e) r2 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r2, r1) 17:43:42 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x7000000) 17:43:42 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x6c000000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) [ 1937.977709][T17086] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'. 17:43:42 executing program 4: eventfd(0x0) r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000040)) r1 = eventfd(0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$CHAR_RAW_FLSBUF(0xffffffffffffffff, 0x1261, &(0x7f0000000000)=0x10001) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) r6 = eventfd(0x0) r7 = dup3(r5, r3, 0x0) ioctl$KVM_IRQFD(r7, 0x4020ae76, &(0x7f0000000100)={r1, 0x0, 0x0, r6, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) ioctl$KVM_IRQFD(r7, 0x4020ae76, &(0x7f0000000100)={r1, 0x0, 0x2, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1938.102565][ T7] hid-generic 0000:0000:0000.029D: item fetching failed at offset 19/22 [ 1938.130572][T17098] netlink: 'syz-executor.0': attribute type 16 has an invalid length. [ 1938.155071][ T7] hid-generic: probe of 0000:0000:0000.029D failed with error -22 [ 1938.164719][T17097] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'. 17:43:42 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x8000000) 17:43:42 executing program 5: socket$inet_icmp_raw(0x2, 0x3, 0x1) r0 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3e40efdbeeee7c1cac233917b00bca5cbc2bf49"], 0x12e) r2 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r2, r1) [ 1938.287178][T17107] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 1938.396173][T17116] netlink: 'syz-executor.3': attribute type 14 has an invalid length. [ 1938.410789][T17086] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'. 17:43:42 executing program 4: eventfd(0x0) r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) r3 = eventfd(0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$CHAR_RAW_FLSBUF(0xffffffffffffffff, 0x1261, &(0x7f0000000000)=0x10001) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r7, 0xae60) r8 = eventfd(0x0) r9 = dup3(r7, r5, 0x0) ioctl$KVM_IRQFD(r9, 0x4020ae76, &(0x7f0000000100)={r3, 0x0, 0x0, r8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffe000/0x2000)=nil, 0x2000, 0xd}, 0x0) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1938.449433][T17098] netlink: 'syz-executor.0': attribute type 16 has an invalid length. [ 1938.457724][ T9806] hid-generic 0000:0000:0000.029E: item fetching failed at offset 19/22 [ 1938.457999][ T9806] hid-generic: probe of 0000:0000:0000.029E failed with error -22 17:43:42 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r1 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3e40efdbeeee7c1cac233917b00bca5cbc2bf49"], 0x12e) r2 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r2, r1) 17:43:42 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x9000000) [ 1938.615374][T17116] netlink: 'syz-executor.3': attribute type 14 has an invalid length. 17:43:42 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0xc00, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) [ 1938.697893][ T9806] hid-generic 0000:0000:0000.029F: item fetching failed at offset 19/22 17:43:43 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x9}, 0x0) 17:43:43 executing program 4: eventfd(0x0) r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) eventfd(0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$CHAR_RAW_FLSBUF(0xffffffffffffffff, 0x1261, &(0x7f0000000000)=0x10001) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) eventfd(0x0) dup3(r6, r4, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffe000/0x2000)=nil, 0x2000, 0xd}, 0x0) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:43 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x74000000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) [ 1938.736683][ T9806] hid-generic: probe of 0000:0000:0000.029F failed with error -22 17:43:43 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r1 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3e40efdbeeee7c1cac233917b00bca5cbc2bf49"], 0x12e) r2 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r2, r1) 17:43:43 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0xa000000) [ 1938.992692][ T7] hid-generic 0000:0000:0000.02A0: item fetching failed at offset 19/22 [ 1939.031395][ T7] hid-generic: probe of 0000:0000:0000.02A0 failed with error -22 17:43:43 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0xb000000) [ 1939.113385][T17200] netlink: 'syz-executor.3': attribute type 14 has an invalid length. 17:43:43 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r1 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3e40efdbeeee7c1cac233917b00bca5cbc2bf49"], 0x12e) r2 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r2, r1) [ 1939.156291][T17204] netlink: 'syz-executor.0': attribute type 16 has an invalid length. [ 1939.200101][T17200] netlink: 'syz-executor.3': attribute type 14 has an invalid length. [ 1939.226455][T17204] netlink: 'syz-executor.0': attribute type 16 has an invalid length. 17:43:43 executing program 4: eventfd(0x0) r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) eventfd(0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$CHAR_RAW_FLSBUF(0xffffffffffffffff, 0x1261, &(0x7f0000000000)=0x10001) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) eventfd(0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffe000/0x2000)=nil, 0x2000, 0xd}, 0x0) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:43 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0xa}, 0x0) [ 1939.255736][ T5] hid-generic 0000:0000:0000.02A1: item fetching failed at offset 19/22 17:43:43 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x7a000000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:43 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0xe00, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) [ 1939.315787][ T5] hid-generic: probe of 0000:0000:0000.02A1 failed with error -22 17:43:43 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0xc000000) 17:43:43 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3e40efdbeeee7c1cac233917b00bca5cbc2bf49"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) [ 1939.561501][ T9806] hid-generic 0000:0000:0000.02A2: item fetching failed at offset 19/22 [ 1939.589175][ T9806] hid-generic: probe of 0000:0000:0000.02A2 failed with error -22 17:43:43 executing program 4: eventfd(0x0) r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) eventfd(0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$CHAR_RAW_FLSBUF(0xffffffffffffffff, 0x1261, &(0x7f0000000000)=0x10001) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffe000/0x2000)=nil, 0x2000, 0xd}, 0x0) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:43 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0xd000000) 17:43:44 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3e40efdbeeee7c1cac233917b00bca5cbc2bf49"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) 17:43:44 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x81000000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:44 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0xf00, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:44 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0xb}, 0x0) [ 1939.851397][ T9806] hid-generic 0000:0000:0000.02A3: item fetching failed at offset 19/22 [ 1939.884108][ T9806] hid-generic: probe of 0000:0000:0000.02A3 failed with error -22 17:43:44 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0xe000000) 17:43:44 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3e40efdbeeee7c1cac233917b00bca5cbc2bf49"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) 17:43:44 executing program 4: eventfd(0x0) r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) eventfd(0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$CHAR_RAW_FLSBUF(0xffffffffffffffff, 0x1261, &(0x7f0000000000)=0x10001) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffe000/0x2000)=nil, 0x2000, 0xd}, 0x0) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:44 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x1100, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:44 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0xc}, 0x0) [ 1940.122654][ T9806] hid-generic 0000:0000:0000.02A4: item fetching failed at offset 19/22 [ 1940.155816][ T9806] hid-generic: probe of 0000:0000:0000.02A4 failed with error -22 17:43:44 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x82f50000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:44 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0xf000000) 17:43:44 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, 0x0, 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3e40efdbeeee7c1cac233917b00bca5cbc2bf49"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) 17:43:44 executing program 4: eventfd(0x0) r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) eventfd(0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$CHAR_RAW_FLSBUF(0xffffffffffffffff, 0x1261, &(0x7f0000000000)=0x10001) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffe000/0x2000)=nil, 0x2000, 0xd}, 0x0) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:44 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x10000000) 17:43:44 executing program 4: eventfd(0x0) r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) eventfd(0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$CHAR_RAW_FLSBUF(0xffffffffffffffff, 0x1261, &(0x7f0000000000)=0x10001) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffe000/0x2000)=nil, 0x2000, 0xd}, 0x0) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:44 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, 0x0, 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3e40efdbeeee7c1cac233917b00bca5cbc2bf49"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) 17:43:44 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x2000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:44 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x88a8ffff, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:44 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0xe}, 0x0) 17:43:45 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, 0x0, 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3e40efdbeeee7c1cac233917b00bca5cbc2bf49"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) 17:43:45 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x11000000) 17:43:45 executing program 4: eventfd(0x0) r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) eventfd(0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$CHAR_RAW_FLSBUF(0xffffffffffffffff, 0x1261, &(0x7f0000000000)=0x10001) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffe000/0x2000)=nil, 0x2000, 0xd}, 0x0) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:45 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x0, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3e40efdbeeee7c1cac233917b00bca5cbc2bf49"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) 17:43:45 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x8bd53e93, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:45 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x4800, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:45 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0xf}, 0x0) 17:43:45 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x0, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3e40efdbeeee7c1cac233917b00bca5cbc2bf49"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) 17:43:45 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x12000000) 17:43:45 executing program 4: eventfd(0x0) r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) eventfd(0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$CHAR_RAW_FLSBUF(0xffffffffffffffff, 0x1261, &(0x7f0000000000)=0x10001) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffe000/0x2000)=nil, 0x2000, 0xd}, 0x0) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:45 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x933ed58b, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:45 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x0, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3e40efdbeeee7c1cac233917b00bca5cbc2bf49"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) 17:43:45 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x4c00, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:45 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x13000000) 17:43:45 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x10}, 0x0) 17:43:45 executing program 4: eventfd(0x0) r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) eventfd(0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffe000/0x2000)=nil, 0x2000, 0xd}, 0x0) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:45 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3e40efdbeeee7c1cac233917b00bca5cbc2bf49"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) 17:43:45 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x9effffff, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:45 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x5865, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:45 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x14000000) 17:43:45 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x11}, 0x0) 17:43:46 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3e40efdbeeee7c1cac233917b00bca5cbc2bf49"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) 17:43:46 executing program 4: eventfd(0x0) r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) eventfd(0x0) openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffe000/0x2000)=nil, 0x2000, 0xd}, 0x0) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:46 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0xf0ffffff, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:46 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x5882, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:46 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x15000000) 17:43:46 executing program 4: eventfd(0x0) r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) eventfd(0x0) openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffe000/0x2000)=nil, 0x2000, 0xd}, 0x0) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:46 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3e40efdbeeee7c1cac233917b00bca5cbc2bf49"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) 17:43:46 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x60}, 0x0) 17:43:46 executing program 4: eventfd(0x0) r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) eventfd(0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffe000/0x2000)=nil, 0x2000, 0xd}, 0x0) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:46 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x6000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:46 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x16000000) 17:43:46 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, 0x0, 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) 17:43:46 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0xf1ffffff, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:46 executing program 4: eventfd(0x0) r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffe000/0x2000)=nil, 0x2000, 0xd}, 0x0) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:46 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, 0x0, 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) 17:43:46 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0xf0}, 0x0) 17:43:46 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x6558, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:46 executing program 4: eventfd(0x0) r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffe000/0x2000)=nil, 0x2000, 0xd}, 0x0) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:46 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0xffffa888, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:46 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x17000000) 17:43:46 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, 0x0, 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) 17:43:46 executing program 4: eventfd(0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffe000/0x2000)=nil, 0x2000, 0xd}, 0x0) io_uring_enter(0xffffffffffffffff, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1942.510414][T17588] __nla_validate_parse: 56 callbacks suppressed [ 1942.510428][T17588] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'. [ 1942.559009][T17589] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 1942.586863][T17586] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'. 17:43:46 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x18000000) [ 1942.636566][T17589] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 17:43:47 executing program 4: eventfd(0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffe000/0x2000)=nil, 0x2000, 0xd}, 0x0) io_uring_enter(0xffffffffffffffff, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:47 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) 17:43:47 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0xfffff000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) [ 1942.715170][T17588] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'. [ 1942.752387][T17586] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'. 17:43:47 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x300}, 0x0) 17:43:47 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x6800, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) [ 1942.830023][T17623] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 17:43:47 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) 17:43:47 executing program 4: eventfd(0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffe000/0x2000)=nil, 0x2000, 0xd}, 0x0) io_uring_enter(0xffffffffffffffff, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:47 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x19000000) [ 1942.938454][T17628] validate_nla: 40 callbacks suppressed [ 1942.938467][T17628] netlink: 'syz-executor.3': attribute type 14 has an invalid length. [ 1942.962709][T17623] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 1942.978528][T17628] netlink: 'syz-executor.3': attribute type 14 has an invalid length. 17:43:47 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffe000/0x2000)=nil, 0x2000, 0xd}, 0x0) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1943.030993][T17640] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1943.066719][T17636] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'. 17:43:47 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffe000/0x2000)=nil, 0x2000, 0xd}, 0x0) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:47 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0xffffff7f, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:47 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x1a000000) [ 1943.164769][T17643] netlink: 'syz-executor.0': attribute type 16 has an invalid length. 17:43:47 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) 17:43:47 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x500}, 0x0) 17:43:47 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x6c00, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:47 executing program 4: r0 = syz_io_uring_setup(0x0, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffe000/0x2000)=nil, 0x2000, 0xd}, 0x0) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1943.298679][T17670] netlink: 'syz-executor.3': attribute type 14 has an invalid length. 17:43:47 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0xffffff9e, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) [ 1943.342522][T17681] netlink: 'syz-executor.3': attribute type 14 has an invalid length. 17:43:47 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x1b000000) 17:43:47 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) 17:43:47 executing program 4: r0 = syz_io_uring_setup(0x0, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffe000/0x2000)=nil, 0x2000, 0xd}, 0x0) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1943.492736][T17697] netlink: 'syz-executor.0': attribute type 16 has an invalid length. 17:43:47 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x600}, 0x0) 17:43:47 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x1c000000) 17:43:47 executing program 4: r0 = syz_io_uring_setup(0x0, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffe000/0x2000)=nil, 0x2000, 0xd}, 0x0) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1943.611183][T17697] netlink: 'syz-executor.0': attribute type 16 has an invalid length. [ 1943.636744][T17713] netlink: 'syz-executor.3': attribute type 14 has an invalid length. 17:43:48 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) 17:43:48 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x7400, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) [ 1943.683829][T17713] netlink: 'syz-executor.3': attribute type 14 has an invalid length. 17:43:48 executing program 4: r0 = syz_io_uring_setup(0x82, 0x0, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffe000/0x2000)=nil, 0x2000, 0xd}, 0x0) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:48 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0xfffffff0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:48 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x700}, 0x0) 17:43:48 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) 17:43:48 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x1d000000) [ 1943.952259][T17743] netlink: 'syz-executor.0': attribute type 16 has an invalid length. 17:43:48 executing program 4: r0 = syz_io_uring_setup(0x82, 0x0, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffe000/0x2000)=nil, 0x2000, 0xd}, 0x0) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:48 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x7a00, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:48 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feff"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) 17:43:48 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0xfffffff1, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:48 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x1e000000) 17:43:48 executing program 4: r0 = syz_io_uring_setup(0x82, 0x0, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffe000/0x2000)=nil, 0x2000, 0xd}, 0x0) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:48 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x900}, 0x0) 17:43:48 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x8100, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:48 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x1f000000) 17:43:48 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feff"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) 17:43:48 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0xffffffff, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:48 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffe000/0x2000)=nil, 0x2000, 0xd}, 0x0) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:48 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0xa00}, 0x0) 17:43:48 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffe000/0x2000)=nil, 0x2000, 0xd}, 0x0) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:48 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feff"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) 17:43:48 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x20000000) 17:43:48 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0xf000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:48 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:49 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffe000/0x2000)=nil, 0x2000, 0xd}, 0x0) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:49 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) 17:43:49 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0xb00}, 0x0) 17:43:49 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x34000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:49 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x21000000) 17:43:49 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000200)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffe000/0x2000)=nil, 0x2000, 0xd}, 0x0) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:49 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x2, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:49 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) 17:43:49 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0xc00}, 0x0) 17:43:49 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000200)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffe000/0x2000)=nil, 0x2000, 0xd}, 0x0) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:49 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0xf5ffffff) 17:43:49 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) 17:43:49 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x3, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:49 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x400300, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:49 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000200)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffe000/0x2000)=nil, 0x2000, 0xd}, 0x0) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:49 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff0000"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) 17:43:49 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0xfffffff5) 17:43:49 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0xe00}, 0x0) 17:43:49 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0xf0ffff, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:49 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x4, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) [ 1945.469312][T32372] hid-generic 0000:0000:0000.02A5: unknown main item tag 0x0 [ 1945.491763][T32372] hid-generic 0000:0000:0000.02A5: unknown main item tag 0x0 17:43:49 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000200)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffe000/0x2000)=nil, 0x2000, 0xd}, 0x0) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:49 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x1000000000000) [ 1945.537942][T32372] hid-generic 0000:0000:0000.02A5: unknown main item tag 0x0 [ 1945.572981][T32372] hid-generic 0000:0000:0000.02A5: unknown main item tag 0x0 [ 1945.609025][T32372] hid-generic 0000:0000:0000.02A5: unknown main item tag 0x0 [ 1945.631952][T32372] hid-generic 0000:0000:0000.02A5: unknown main item tag 0x0 [ 1945.654055][T32372] hid-generic 0000:0000:0000.02A5: unknown main item tag 0x0 [ 1945.661517][T32372] hid-generic 0000:0000:0000.02A5: unknown main item tag 0x0 [ 1945.670897][T32372] hid-generic 0000:0000:0000.02A5: unknown main item tag 0x0 [ 1945.680455][T32372] hid-generic 0000:0000:0000.02A5: unknown main item tag 0x0 [ 1945.688215][T32372] hid-generic 0000:0000:0000.02A5: unknown main item tag 0x0 [ 1945.695771][T32372] hid-generic 0000:0000:0000.02A5: unknown main item tag 0x0 [ 1945.703228][T32372] hid-generic 0000:0000:0000.02A5: unknown main item tag 0x0 [ 1945.711459][T32372] hid-generic 0000:0000:0000.02A5: unknown main item tag 0x0 [ 1945.719040][T32372] hid-generic 0000:0000:0000.02A5: unknown main item tag 0x0 [ 1945.728761][T32372] hid-generic 0000:0000:0000.02A5: unknown main item tag 0x0 [ 1945.743370][T32372] hid-generic 0000:0000:0000.02A5: unknown main item tag 0x0 [ 1945.756115][T32372] hid-generic 0000:0000:0000.02A5: unknown main item tag 0x0 [ 1945.774066][T32372] hid-generic 0000:0000:0000.02A5: unknown main item tag 0x0 [ 1945.787770][T32372] hid-generic 0000:0000:0000.02A5: unknown main item tag 0x0 [ 1945.800509][T32372] hid-generic 0000:0000:0000.02A5: unknown main item tag 0x0 [ 1945.813049][T32372] hid-generic 0000:0000:0000.02A5: unknown main item tag 0x0 [ 1945.826945][T32372] hid-generic 0000:0000:0000.02A5: hidraw0: HID v0.00 Device [syz1] on %z5 17:43:50 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff0000"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) 17:43:50 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0xf00}, 0x0) 17:43:50 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x1000000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:50 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x2000000000000) 17:43:50 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000200)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffe000/0x2000)=nil, 0x2000, 0xd}, 0x0) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:50 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x5, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) [ 1946.092583][ T6101] hid-generic 0000:0000:0000.02A6: unknown main item tag 0x0 [ 1946.126988][ T6101] hid-generic 0000:0000:0000.02A6: unknown main item tag 0x0 [ 1946.161266][ T6101] hid-generic 0000:0000:0000.02A6: unknown main item tag 0x0 [ 1946.178926][ T6101] hid-generic 0000:0000:0000.02A6: unknown main item tag 0x0 [ 1946.200461][ T6101] hid-generic 0000:0000:0000.02A6: unknown main item tag 0x0 [ 1946.215310][ T6101] hid-generic 0000:0000:0000.02A6: unknown main item tag 0x0 [ 1946.230823][ T6101] hid-generic 0000:0000:0000.02A6: unknown main item tag 0x0 [ 1946.239879][ T6101] hid-generic 0000:0000:0000.02A6: unknown main item tag 0x0 [ 1946.247777][ T6101] hid-generic 0000:0000:0000.02A6: unknown main item tag 0x0 [ 1946.256555][ T6101] hid-generic 0000:0000:0000.02A6: unknown main item tag 0x0 17:43:50 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x100000000000000) [ 1946.264256][ T6101] hid-generic 0000:0000:0000.02A6: unknown main item tag 0x0 [ 1946.271835][ T6101] hid-generic 0000:0000:0000.02A6: unknown main item tag 0x0 [ 1946.279863][ T6101] hid-generic 0000:0000:0000.02A6: unknown main item tag 0x0 [ 1946.288208][ T6101] hid-generic 0000:0000:0000.02A6: unknown main item tag 0x0 [ 1946.296212][ T6101] hid-generic 0000:0000:0000.02A6: unknown main item tag 0x0 [ 1946.304401][ T6101] hid-generic 0000:0000:0000.02A6: unknown main item tag 0x0 [ 1946.312072][ T6101] hid-generic 0000:0000:0000.02A6: unknown main item tag 0x0 [ 1946.321068][ T6101] hid-generic 0000:0000:0000.02A6: unknown main item tag 0x0 [ 1946.329066][ T6101] hid-generic 0000:0000:0000.02A6: unknown main item tag 0x0 [ 1946.338325][ T6101] hid-generic 0000:0000:0000.02A6: unknown main item tag 0x0 [ 1946.346632][ T6101] hid-generic 0000:0000:0000.02A6: unknown main item tag 0x0 [ 1946.356730][ T6101] hid-generic 0000:0000:0000.02A6: unknown main item tag 0x0 [ 1946.368643][ T6101] hid-generic 0000:0000:0000.02A6: hidraw0: HID v0.00 Device [syz1] on %z5 17:43:50 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff0000"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) 17:43:50 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x1100}, 0x0) 17:43:50 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x2000000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:50 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000200)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffe000/0x2000)=nil, 0x2000, 0xd}, 0x0) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:50 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x200000000000000) [ 1946.630065][ T6101] hid-generic 0000:0000:0000.02A7: unknown main item tag 0x0 [ 1946.647449][ T6101] hid-generic 0000:0000:0000.02A7: unknown main item tag 0x0 17:43:50 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x6, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) [ 1946.692016][ T6101] hid-generic 0000:0000:0000.02A7: unknown main item tag 0x0 [ 1946.730918][ T6101] hid-generic 0000:0000:0000.02A7: unknown main item tag 0x0 17:43:51 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000040)=0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000200)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffe000/0x2000)=nil, 0x2000, 0xd}, 0x0) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1946.768074][ T6101] hid-generic 0000:0000:0000.02A7: unknown main item tag 0x0 [ 1946.788171][ T6101] hid-generic 0000:0000:0000.02A7: unknown main item tag 0x0 [ 1946.808384][ T6101] hid-generic 0000:0000:0000.02A7: unknown main item tag 0x0 17:43:51 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x300000000000000) [ 1946.834880][ T6101] hid-generic 0000:0000:0000.02A7: unknown main item tag 0x0 [ 1946.854751][ T6101] hid-generic 0000:0000:0000.02A7: unknown main item tag 0x0 [ 1946.865478][ T6101] hid-generic 0000:0000:0000.02A7: unknown main item tag 0x0 [ 1946.882261][ T6101] hid-generic 0000:0000:0000.02A7: unknown main item tag 0x0 [ 1946.890566][ T6101] hid-generic 0000:0000:0000.02A7: unknown main item tag 0x0 [ 1946.899252][ T6101] hid-generic 0000:0000:0000.02A7: unknown main item tag 0x0 [ 1946.907712][ T6101] hid-generic 0000:0000:0000.02A7: unknown main item tag 0x0 [ 1946.915862][ T6101] hid-generic 0000:0000:0000.02A7: unknown main item tag 0x0 [ 1946.924779][ T6101] hid-generic 0000:0000:0000.02A7: unknown main item tag 0x0 [ 1946.932474][ T6101] hid-generic 0000:0000:0000.02A7: unknown main item tag 0x0 [ 1946.940871][ T6101] hid-generic 0000:0000:0000.02A7: unknown main item tag 0x0 [ 1946.949094][ T6101] hid-generic 0000:0000:0000.02A7: unknown main item tag 0x0 [ 1946.958540][ T6101] hid-generic 0000:0000:0000.02A7: unknown main item tag 0x0 [ 1946.967540][ T6101] hid-generic 0000:0000:0000.02A7: unknown main item tag 0x0 [ 1946.975633][ T6101] hid-generic 0000:0000:0000.02A7: unknown main item tag 0x0 [ 1946.985162][ T6101] hid-generic 0000:0000:0000.02A7: hidraw0: HID v0.00 Device [syz1] on %z5 17:43:51 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x1780}, 0x0) 17:43:51 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x3000000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:51 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) 17:43:51 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000040)=0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000200)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffe000/0x2000)=nil, 0x2000, 0xd}, 0x0) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:51 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x400000000000000) [ 1947.225877][ T7] hid-generic 0000:0000:0000.02A8: item fetching failed at offset 19/22 [ 1947.264535][ T7] hid-generic: probe of 0000:0000:0000.02A8 failed with error -22 17:43:51 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x7, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:51 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) 17:43:51 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x4000000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:51 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x5865}, 0x0) 17:43:51 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000040)=0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000200)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffe000/0x2000)=nil, 0x2000, 0xd}, 0x0) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1947.489169][ T6101] hid-generic 0000:0000:0000.02A9: unknown main item tag 0x0 [ 1947.505175][ T6101] hid-generic 0000:0000:0000.02A9: unknown main item tag 0x0 [ 1947.530401][ T6101] hid-generic 0000:0000:0000.02A9: unknown main item tag 0x0 [ 1947.536702][T18104] __nla_validate_parse: 68 callbacks suppressed [ 1947.536715][T18104] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 1947.551492][ T6101] hid-generic 0000:0000:0000.02A9: unknown main item tag 0x0 17:43:51 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x500000000000000) [ 1947.577755][ T6101] hid-generic 0000:0000:0000.02A9: unknown main item tag 0x0 17:43:51 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)) syz_io_uring_submit(r1, 0x0, &(0x7f0000000200)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffe000/0x2000)=nil, 0x2000, 0xd}, 0x0) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:51 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x8, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) [ 1947.606927][ T6101] hid-generic 0000:0000:0000.02A9: unknown main item tag 0x0 [ 1947.633234][ T6101] hid-generic 0000:0000:0000.02A9: unknown main item tag 0x0 [ 1947.658804][ T6101] hid-generic 0000:0000:0000.02A9: unknown main item tag 0x0 [ 1947.674592][ T6101] hid-generic 0000:0000:0000.02A9: unknown main item tag 0x0 [ 1947.687522][ T6101] hid-generic 0000:0000:0000.02A9: unknown main item tag 0x0 [ 1947.695567][ T6101] hid-generic 0000:0000:0000.02A9: unknown main item tag 0x0 [ 1947.703178][ T6101] hid-generic 0000:0000:0000.02A9: unknown main item tag 0x0 [ 1947.711235][ T6101] hid-generic 0000:0000:0000.02A9: unknown main item tag 0x0 [ 1947.719215][ T6101] hid-generic 0000:0000:0000.02A9: unknown main item tag 0x0 [ 1947.727184][ T6101] hid-generic 0000:0000:0000.02A9: unknown main item tag 0x0 [ 1947.735302][ T6101] hid-generic 0000:0000:0000.02A9: unknown main item tag 0x0 [ 1947.742895][ T6101] hid-generic 0000:0000:0000.02A9: unknown main item tag 0x0 [ 1947.753026][ T6101] hid-generic 0000:0000:0000.02A9: hidraw0: HID v0.00 Device [syz1] on %z5 17:43:52 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) [ 1947.845337][T18137] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 1947.892252][T18133] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'. 17:43:52 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x600000000000000) [ 1947.934266][T32372] hid-generic 0000:0000:0000.02AA: unknown main item tag 0x0 [ 1947.943810][T32372] hid-generic 0000:0000:0000.02AA: unknown main item tag 0x0 [ 1947.966889][T18135] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'. 17:43:52 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)) syz_io_uring_submit(r1, 0x0, &(0x7f0000000200)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffe000/0x2000)=nil, 0x2000, 0xd}, 0x0) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1947.981428][T32372] hid-generic 0000:0000:0000.02AA: unknown main item tag 0x0 [ 1948.007298][T32372] hid-generic 0000:0000:0000.02AA: unknown main item tag 0x0 [ 1948.047422][T32372] hid-generic 0000:0000:0000.02AA: unknown main item tag 0x0 [ 1948.067863][T32372] hid-generic 0000:0000:0000.02AA: unknown main item tag 0x0 [ 1948.077100][T32372] hid-generic 0000:0000:0000.02AA: unknown main item tag 0x0 [ 1948.086917][T32372] hid-generic 0000:0000:0000.02AA: unknown main item tag 0x0 [ 1948.096903][T32372] hid-generic 0000:0000:0000.02AA: unknown main item tag 0x0 [ 1948.107007][T32372] hid-generic 0000:0000:0000.02AA: unknown main item tag 0x0 17:43:52 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)) syz_io_uring_submit(r1, 0x0, &(0x7f0000000200)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffe000/0x2000)=nil, 0x2000, 0xd}, 0x0) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1948.126391][T32372] hid-generic 0000:0000:0000.02AA: unknown main item tag 0x0 [ 1948.135067][T32372] hid-generic 0000:0000:0000.02AA: unknown main item tag 0x0 [ 1948.142873][T32372] hid-generic 0000:0000:0000.02AA: unknown main item tag 0x0 [ 1948.151207][T32372] hid-generic 0000:0000:0000.02AA: unknown main item tag 0x0 [ 1948.167149][T32372] hid-generic 0000:0000:0000.02AA: unknown main item tag 0x0 17:43:52 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x700000000000000) [ 1948.181388][T32372] hid-generic 0000:0000:0000.02AA: unknown main item tag 0x0 [ 1948.219543][T32372] hid-generic 0000:0000:0000.02AA: unknown main item tag 0x0 [ 1948.241048][T32372] hid-generic 0000:0000:0000.02AA: hidraw0: HID v0.00 Device [syz1] on %z5 17:43:52 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, 0x0, 0x0) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1948.315303][T18148] validate_nla: 38 callbacks suppressed [ 1948.315327][T18148] netlink: 'syz-executor.3': attribute type 14 has an invalid length. [ 1948.356845][T18149] netlink: 'syz-executor.0': attribute type 16 has an invalid length. [ 1948.379113][T18135] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'. [ 1948.413014][T18137] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 1948.436712][T18148] netlink: 'syz-executor.3': attribute type 14 has an invalid length. [ 1948.460216][T18133] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1948.482440][T18149] netlink: 'syz-executor.0': attribute type 16 has an invalid length. 17:43:52 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x5000000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:52 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) 17:43:52 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x800000000000000) 17:43:52 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x6000}, 0x0) 17:43:52 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x9, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:52 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, 0x0, 0x0) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1948.635440][T18200] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'. [ 1948.672618][T18205] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 1948.677040][ T17] hid-generic 0000:0000:0000.02AB: unknown main item tag 0x0 17:43:53 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, 0x0, 0x0) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1948.726703][ T17] hid-generic 0000:0000:0000.02AB: unknown main item tag 0x0 [ 1948.735257][ T17] hid-generic 0000:0000:0000.02AB: unknown main item tag 0x0 [ 1948.742913][ T17] hid-generic 0000:0000:0000.02AB: unknown main item tag 0x0 [ 1948.751629][ T17] hid-generic 0000:0000:0000.02AB: unknown main item tag 0x0 [ 1948.761887][ T17] hid-generic 0000:0000:0000.02AB: unknown main item tag 0x0 [ 1948.771329][ T17] hid-generic 0000:0000:0000.02AB: unknown main item tag 0x0 [ 1948.780006][ T17] hid-generic 0000:0000:0000.02AB: unknown main item tag 0x0 [ 1948.789450][T18214] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1948.802324][ T17] hid-generic 0000:0000:0000.02AB: unknown main item tag 0x0 [ 1948.819348][ T17] hid-generic 0000:0000:0000.02AB: unknown main item tag 0x0 [ 1948.828990][ T17] hid-generic 0000:0000:0000.02AB: unknown main item tag 0x0 [ 1948.838281][ T17] hid-generic 0000:0000:0000.02AB: unknown main item tag 0x0 [ 1948.849369][ T17] hid-generic 0000:0000:0000.02AB: unknown main item tag 0x0 [ 1948.858093][ T17] hid-generic 0000:0000:0000.02AB: unknown main item tag 0x0 [ 1948.869642][ T17] hid-generic 0000:0000:0000.02AB: unknown main item tag 0x0 17:43:53 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x900000000000000) [ 1948.885537][T18215] netlink: 'syz-executor.3': attribute type 14 has an invalid length. [ 1948.906501][T18219] netlink: 'syz-executor.0': attribute type 16 has an invalid length. [ 1948.926567][ T17] hid-generic 0000:0000:0000.02AB: unknown main item tag 0x0 17:43:53 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_MADVISE={0x19, 0x0, 0x0, 0x0, 0x0, &(0x7f0000ffe000/0x2000)=nil, 0x2000, 0xd}, 0x0) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1948.940622][T18219] netlink: 'syz-executor.0': attribute type 16 has an invalid length. [ 1948.967869][ T17] hid-generic 0000:0000:0000.02AB: unknown main item tag 0x0 [ 1948.976510][T18215] netlink: 'syz-executor.3': attribute type 14 has an invalid length. 17:43:53 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x6558}, 0x0) 17:43:53 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x6000000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) [ 1949.030779][ T17] hid-generic 0000:0000:0000.02AB: hidraw0: HID v0.00 Device [syz1] on %z5 17:43:53 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0xa, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:53 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0xa00000000000000) 17:43:53 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766a"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) 17:43:53 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_MADVISE={0x19, 0x0, 0x0, 0x0, 0x0, &(0x7f0000ffe000/0x2000)=nil, 0x2000}, 0x0) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:53 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0xb00000000000000) [ 1949.342649][ T5] hid-generic 0000:0000:0000.02AC: unknown main item tag 0x0 [ 1949.368164][ T5] hid-generic 0000:0000:0000.02AC: unknown main item tag 0x0 [ 1949.398127][ T5] hid-generic 0000:0000:0000.02AC: unknown main item tag 0x0 [ 1949.436535][ T5] hid-generic 0000:0000:0000.02AC: unknown main item tag 0x0 17:43:53 executing program 4: syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r0, r1, &(0x7f0000000200)=@IORING_OP_MADVISE={0x19, 0x0, 0x0, 0x0, 0x0, &(0x7f0000ffe000/0x2000)=nil, 0x2000}, 0x0) io_uring_enter(0xffffffffffffffff, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1949.468774][ T5] hid-generic 0000:0000:0000.02AC: unknown main item tag 0x0 [ 1949.512811][ T5] hid-generic 0000:0000:0000.02AC: unknown main item tag 0x0 [ 1949.552994][ T5] hid-generic 0000:0000:0000.02AC: unknown main item tag 0x0 17:43:53 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0xc00000000000000) [ 1949.575750][ T5] hid-generic 0000:0000:0000.02AC: unknown main item tag 0x0 [ 1949.585957][ T5] hid-generic 0000:0000:0000.02AC: unknown main item tag 0x0 [ 1949.598456][T18270] netlink: 'syz-executor.0': attribute type 16 has an invalid length. [ 1949.611649][ T5] hid-generic 0000:0000:0000.02AC: hidraw0: HID v0.00 Device [syz1] on %z5 [ 1949.614121][T18276] netlink: 'syz-executor.3': attribute type 14 has an invalid length. 17:43:54 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766a"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) 17:43:54 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x7000000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:54 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8100}, 0x0) 17:43:54 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0xc, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:54 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0xd00000000000000) 17:43:54 executing program 4: syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r0, r1, &(0x7f0000000200)=@IORING_OP_MADVISE={0x19, 0x0, 0x0, 0x0, 0x0, &(0x7f0000ffe000/0x2000)=nil, 0x2000}, 0x0) io_uring_enter(0xffffffffffffffff, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1949.845422][ T17] hid-generic 0000:0000:0000.02AD: unknown main item tag 0x0 [ 1949.857033][ T17] hid-generic 0000:0000:0000.02AD: unknown main item tag 0x0 [ 1949.895617][ T17] hid-generic 0000:0000:0000.02AD: unknown main item tag 0x0 [ 1949.942536][ T17] hid-generic 0000:0000:0000.02AD: unknown main item tag 0x0 17:43:54 executing program 4: syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r0, r1, &(0x7f0000000200)=@IORING_OP_MADVISE={0x19, 0x0, 0x0, 0x0, 0x0, &(0x7f0000ffe000/0x2000)=nil, 0x2000}, 0x0) io_uring_enter(0xffffffffffffffff, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1949.990282][ T17] hid-generic 0000:0000:0000.02AD: unknown main item tag 0x0 [ 1950.025715][ T17] hid-generic 0000:0000:0000.02AD: unknown main item tag 0x0 17:43:54 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0xe00000000000000) [ 1950.050151][ T17] hid-generic 0000:0000:0000.02AD: unknown main item tag 0x0 17:43:54 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0xf000}, 0x0) [ 1950.099395][ T17] hid-generic 0000:0000:0000.02AD: unknown main item tag 0x0 17:43:54 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x8000000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:54 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0xe, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) [ 1950.143935][ T17] hid-generic 0000:0000:0000.02AD: unknown main item tag 0x0 [ 1950.189306][ T17] hid-generic 0000:0000:0000.02AD: hidraw0: HID v0.00 Device [syz1] on %z5 17:43:54 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_MADVISE={0x19, 0x0, 0x0, 0x0, 0x0, &(0x7f0000ffe000/0x2000)=nil, 0x2000}, 0x0) io_uring_enter(r0, 0x0, 0x0, 0x0, 0x0, 0x0) 17:43:54 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766a"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) 17:43:54 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0xf00000000000000) [ 1950.411978][ T5] hid-generic 0000:0000:0000.02AE: unknown main item tag 0x0 [ 1950.427474][ T5] hid-generic 0000:0000:0000.02AE: unknown main item tag 0x0 17:43:54 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_MADVISE={0x19, 0x0, 0x0, 0x0, 0x0, &(0x7f0000ffe000/0x2000)=nil, 0x2000}, 0x0) io_uring_enter(r0, 0x0, 0x0, 0x0, 0x0, 0x0) 17:43:54 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x9000000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) [ 1950.463384][ T5] hid-generic 0000:0000:0000.02AE: unknown main item tag 0x0 [ 1950.492111][ T5] hid-generic 0000:0000:0000.02AE: unknown main item tag 0x0 17:43:54 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x34000}, 0x0) 17:43:54 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0xf, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:54 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x1000000000000000) [ 1950.526653][ T5] hid-generic 0000:0000:0000.02AE: unknown main item tag 0x0 [ 1950.564797][ T5] hid-generic 0000:0000:0000.02AE: unknown main item tag 0x0 17:43:54 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_MADVISE={0x19, 0x0, 0x0, 0x0, 0x0, &(0x7f0000ffe000/0x2000)=nil, 0x2000}, 0x0) io_uring_enter(r0, 0x0, 0x0, 0x0, 0x0, 0x0) [ 1950.592335][ T5] hid-generic 0000:0000:0000.02AE: unknown main item tag 0x0 [ 1950.601065][ T5] hid-generic 0000:0000:0000.02AE: unknown main item tag 0x0 [ 1950.623042][ T5] hid-generic 0000:0000:0000.02AE: unknown main item tag 0x0 [ 1950.644299][ T5] hid-generic 0000:0000:0000.02AE: hidraw0: HID v0.00 Device [syz1] on %z5 17:43:54 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) 17:43:55 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x1100000000000000) 17:43:55 executing program 4: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x3000000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) [ 1950.875197][ T7] hid-generic 0000:0000:0000.02AF: unknown main item tag 0x0 [ 1950.894234][ T7] hid-generic 0000:0000:0000.02AF: unknown main item tag 0x0 17:43:55 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x400300}, 0x0) [ 1950.941626][ T7] hid-generic 0000:0000:0000.02AF: unknown main item tag 0x0 17:43:55 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0xa000000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:55 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x10, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) [ 1951.005600][ T7] hid-generic 0000:0000:0000.02AF: unknown main item tag 0x0 17:43:55 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x1200000000000000) 17:43:55 executing program 4: eventfd(0x0) r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) r3 = creat(&(0x7f0000000280)='./file0\x00', 0xd931d3864d39dcd7) write$binfmt_script(r3, &(0x7f0000000340)=ANY=[@ANYBLOB="2321202e2f66696c653020806f06000000459f000072dc000092290a7e4555a763c15ccda085e2da58f729fa6680d7b0ec89b551c676ed3ae7a290ab0e74467713d41832ee9f99ba46c604a8bf8893cc7149595314f0771b65d33e129933dd93f99f00cd6b3e5903fcddb592a67f706e000000000000005256fd6e9af099cc6f684b27ab024e44795f09407b9caff26de096f5131fd16e191a9d85a914031b0caf7392fde9073fd902ff944b7dd129dc18a2dd00005d9467590271d8ed07d8e363bdd3fde4fef23005d54194d33c9cf0f1579f5fe90c8f78ad0fb55b80c7bc5b04ada2d1f3c69de1c8f8"], 0x80) syz_io_uring_setup(0x6c0f, &(0x7f0000000040)={0x0, 0xc2d1, 0x1, 0x1, 0x34}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000000c0), &(0x7f0000000100)=0x0) r5 = io_uring_register$IORING_REGISTER_PERSONALITY(r3, 0x9, 0x0, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f0000000140)=@IORING_OP_FALLOCATE={0x11, 0x0, 0x0, @fd_index=0x8, 0xfffffffffffff8d8, 0x0, 0xffff1c17, 0x0, 0x1, {0x0, r5}}, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x5, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000000)='./file0\x00', 0x54bb9bd88f3ccfcf, 0x0, 0x12345, {0x0, r5}}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1951.073743][ T7] hid-generic 0000:0000:0000.02AF: hidraw0: HID v0.00 Device [syz1] on %z5 17:43:55 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) 17:43:55 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x1300000000000000) 17:43:55 executing program 4: eventfd(0x0) r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) r3 = creat(&(0x7f0000000280)='./file0\x00', 0xd931d3864d39dcd7) write$binfmt_script(r3, &(0x7f0000000340)=ANY=[@ANYBLOB="2321202e2f66696c653020806f06000000459f000072dc000092290a7e4555a763c15ccda085e2da58f729fa6680d7b0ec89b551c676ed3ae7a290ab0e74467713d41832ee9f99ba46c604a8bf8893cc7149595314f0771b65d33e129933dd93f99f00cd6b3e5903fcddb592a67f706e000000000000005256fd6e9af099cc6f684b27ab024e44795f09407b9caff26de096f5131fd16e191a9d85a914031b0caf7392fde9073fd902ff944b7dd129dc18a2dd00005d9467590271d8ed07d8e363bdd3fde4fef23005d54194d33c9cf0f1579f5fe90c8f78ad0fb55b80c7bc5b04ada2d1f3c69de1c8f8"], 0x80) syz_io_uring_setup(0x6c0f, &(0x7f0000000040)={0x0, 0xc2d1, 0x1, 0x1, 0x34}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000000c0), &(0x7f0000000100)=0x0) r5 = io_uring_register$IORING_REGISTER_PERSONALITY(r3, 0x9, 0x0, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f0000000140)=@IORING_OP_FALLOCATE={0x11, 0x0, 0x0, @fd_index=0x8, 0xfffffffffffff8d8, 0x0, 0xffff1c17, 0x0, 0x1, {0x0, r5}}, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x5, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000000)='./file0\x00', 0x54bb9bd88f3ccfcf, 0x0, 0x12345, {0x0, r5}}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1951.329119][ T7] hid-generic 0000:0000:0000.02B0: unknown main item tag 0x0 [ 1951.350269][ T7] hid-generic 0000:0000:0000.02B0: unknown main item tag 0x0 17:43:55 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0xf0ffff}, 0x0) 17:43:55 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x48, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:55 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0xb000000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) [ 1951.398041][ T7] hid-generic 0000:0000:0000.02B0: unknown main item tag 0x0 17:43:55 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x1400000000000000) [ 1951.453783][ T7] hid-generic 0000:0000:0000.02B0: unknown main item tag 0x0 [ 1951.510490][ T7] hid-generic 0000:0000:0000.02B0: hidraw0: HID v0.00 Device [syz1] on %z5 17:43:55 executing program 4: eventfd(0x0) r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) r3 = creat(&(0x7f0000000280)='./file0\x00', 0xd931d3864d39dcd7) write$binfmt_script(r3, &(0x7f0000000340)=ANY=[@ANYBLOB="2321202e2f66696c653020806f06000000459f000072dc000092290a7e4555a763c15ccda085e2da58f729fa6680d7b0ec89b551c676ed3ae7a290ab0e74467713d41832ee9f99ba46c604a8bf8893cc7149595314f0771b65d33e129933dd93f99f00cd6b3e5903fcddb592a67f706e000000000000005256fd6e9af099cc6f684b27ab024e44795f09407b9caff26de096f5131fd16e191a9d85a914031b0caf7392fde9073fd902ff944b7dd129dc18a2dd00005d9467590271d8ed07d8e363bdd3fde4fef23005d54194d33c9cf0f1579f5fe90c8f78ad0fb55b80c7bc5b04ada2d1f3c69de1c8f8"], 0x80) syz_io_uring_setup(0x6c0f, &(0x7f0000000040)={0x0, 0xc2d1, 0x1, 0x1, 0x34}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000000c0), &(0x7f0000000100)=0x0) r5 = io_uring_register$IORING_REGISTER_PERSONALITY(r3, 0x9, 0x0, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f0000000140)=@IORING_OP_FALLOCATE={0x11, 0x0, 0x0, @fd_index=0x8, 0xfffffffffffff8d8, 0x0, 0xffff1c17, 0x0, 0x1, {0x0, r5}}, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x5, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000000)='./file0\x00', 0x54bb9bd88f3ccfcf, 0x0, 0x12345, {0x0, r5}}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:55 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) 17:43:56 executing program 4: eventfd(0x0) r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000040)) r1 = creat(&(0x7f0000000280)='./file0\x00', 0xd931d3864d39dcd7) write$binfmt_script(r1, &(0x7f0000000340)=ANY=[@ANYBLOB="2321202e2f66696c653020806f06000000459f000072dc000092290a7e4555a763c15ccda085e2da58f729fa6680d7b0ec89b551c676ed3ae7a290ab0e74467713d41832ee9f99ba46c604a8bf8893cc7149595314f0771b65d33e129933dd93f99f00cd6b3e5903fcddb592a67f706e000000000000005256fd6e9af099cc6f684b27ab024e44795f09407b9caff26de096f5131fd16e191a9d85a914031b0caf7392fde9073fd902ff944b7dd129dc18a2dd00005d9467590271d8ed07d8e363bdd3fde4fef23005d54194d33c9cf0f1579f5fe90c8f78ad0fb55b80c7bc5b04ada2d1f3c69de1c8f8"], 0x80) syz_io_uring_setup(0x6c0f, &(0x7f0000000040)={0x0, 0xc2d1, 0x1, 0x1, 0x34}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000000c0), &(0x7f0000000100)=0x0) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000140)=@IORING_OP_FALLOCATE={0x11, 0x0, 0x0, @fd_index=0x8, 0xfffffffffffff8d8, 0x0, 0xffff1c17, 0x0, 0x1, {0x0, r3}}, 0x4) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:56 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0xc000000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:56 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x4c, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:56 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x1000000}, 0x0) [ 1951.762432][ T7] hid-generic 0000:0000:0000.02B1: unknown main item tag 0x0 [ 1951.791778][ T7] hid-generic 0000:0000:0000.02B1: unknown main item tag 0x0 17:43:56 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x1500000000000000) [ 1951.838383][ T7] hid-generic 0000:0000:0000.02B1: unknown main item tag 0x0 [ 1951.856469][ T7] hid-generic 0000:0000:0000.02B1: unknown main item tag 0x0 [ 1951.868656][ T7] hid-generic 0000:0000:0000.02B1: hidraw0: HID v0.00 Device [syz1] on %z5 17:43:56 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) [ 1952.084626][ T17] hid-generic 0000:0000:0000.02B2: unknown main item tag 0x0 17:43:56 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x1600000000000000) 17:43:56 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x60, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) [ 1952.123512][ T17] hid-generic 0000:0000:0000.02B2: unknown main item tag 0x0 [ 1952.135062][ T17] hid-generic 0000:0000:0000.02B2: unknown main item tag 0x0 17:43:56 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) 17:43:56 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x2000000}, 0x0) 17:43:56 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0xe000000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) [ 1952.135084][ T17] hid-generic 0000:0000:0000.02B2: unknown main item tag 0x0 [ 1952.140269][ T17] hid-generic 0000:0000:0000.02B2: hidraw0: HID v0.00 Device [syz1] on %z5 [ 1952.325978][ T17] hid-generic 0000:0000:0000.02B3: unknown main item tag 0x0 [ 1952.333449][ T17] hid-generic 0000:0000:0000.02B3: unknown main item tag 0x0 17:43:56 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x1700000000000000) [ 1952.403198][ T17] hid-generic 0000:0000:0000.02B3: unknown main item tag 0x0 17:43:56 executing program 4: eventfd(0x0) r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000040)) r1 = creat(&(0x7f0000000280)='./file0\x00', 0xd931d3864d39dcd7) write$binfmt_script(r1, &(0x7f0000000340)=ANY=[@ANYBLOB="2321202e2f66696c653020806f06000000459f000072dc000092290a7e4555a763c15ccda085e2da58f729fa6680d7b0ec89b551c676ed3ae7a290ab0e74467713d41832ee9f99ba46c604a8bf8893cc7149595314f0771b65d33e129933dd93f99f00cd6b3e5903fcddb592a67f706e000000000000005256fd6e9af099cc6f684b27ab024e44795f09407b9caff26de096f5131fd16e191a9d85a914031b0caf7392fde9073fd902ff944b7dd129dc18a2dd00005d9467590271d8ed07d8e363bdd3fde4fef23005d54194d33c9cf0f1579f5fe90c8f78ad0fb55b80c7bc5b04ada2d1f3c69de1c8f8"], 0x80) syz_io_uring_setup(0x6c0f, &(0x7f0000000040)={0x0, 0xc2d1, 0x1, 0x1, 0x34}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000000c0), &(0x7f0000000100)=0x0) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000140)=@IORING_OP_FALLOCATE={0x11, 0x0, 0x0, @fd_index=0x8, 0xfffffffffffff8d8, 0x0, 0xffff1c17, 0x0, 0x1, {0x0, r3}}, 0x4) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1952.449416][ T17] hid-generic 0000:0000:0000.02B3: unknown main item tag 0x0 [ 1952.550240][ T17] hid-generic 0000:0000:0000.02B3: hidraw0: HID v0.00 Device [syz1] on %z5 17:43:56 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x68, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:56 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0xf000000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:56 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x3000000}, 0x0) 17:43:56 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) 17:43:56 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x1800000000000000) [ 1952.719351][T18637] __nla_validate_parse: 51 callbacks suppressed [ 1952.719365][T18637] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'. 17:43:57 executing program 4: eventfd(0x0) r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000040)) r1 = creat(&(0x7f0000000280)='./file0\x00', 0xd931d3864d39dcd7) write$binfmt_script(r1, &(0x7f0000000340)=ANY=[@ANYBLOB="2321202e2f66696c653020806f06000000459f000072dc000092290a7e4555a763c15ccda085e2da58f729fa6680d7b0ec89b551c676ed3ae7a290ab0e74467713d41832ee9f99ba46c604a8bf8893cc7149595314f0771b65d33e129933dd93f99f00cd6b3e5903fcddb592a67f706e000000000000005256fd6e9af099cc6f684b27ab024e44795f09407b9caff26de096f5131fd16e191a9d85a914031b0caf7392fde9073fd902ff944b7dd129dc18a2dd00005d9467590271d8ed07d8e363bdd3fde4fef23005d54194d33c9cf0f1579f5fe90c8f78ad0fb55b80c7bc5b04ada2d1f3c69de1c8f8"], 0x80) syz_io_uring_setup(0x6c0f, &(0x7f0000000040)={0x0, 0xc2d1, 0x1, 0x1, 0x34}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000000c0), &(0x7f0000000100)=0x0) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000140)=@IORING_OP_FALLOCATE={0x11, 0x0, 0x0, @fd_index=0x8, 0xfffffffffffff8d8, 0x0, 0xffff1c17, 0x0, 0x1, {0x0, r3}}, 0x4) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1952.768655][T18638] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 1952.811110][T18637] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1952.831873][T18638] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 17:43:57 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x10000000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) [ 1952.901625][ T17] hid-generic 0000:0000:0000.02B4: unknown main item tag 0x0 [ 1952.915902][T18650] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'. [ 1952.918534][ T17] hid-generic 0000:0000:0000.02B4: unknown main item tag 0x0 17:43:57 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x1900000000000000) [ 1952.967756][ T17] hid-generic 0000:0000:0000.02B4: unknown main item tag 0x0 17:43:57 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x6c, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) [ 1953.015978][T18664] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'. [ 1953.044395][ T17] hid-generic 0000:0000:0000.02B4: unknown main item tag 0x0 [ 1953.052091][T18673] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'. 17:43:57 executing program 4: eventfd(0x0) r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) r3 = creat(&(0x7f0000000280)='./file0\x00', 0xd931d3864d39dcd7) write$binfmt_script(r3, &(0x7f0000000340)=ANY=[@ANYBLOB="2321202e2f66696c653020806f06000000459f000072dc000092290a7e4555a763c15ccda085e2da58f729fa6680d7b0ec89b551c676ed3ae7a290ab0e74467713d41832ee9f99ba46c604a8bf8893cc7149595314f0771b65d33e129933dd93f99f00cd6b3e5903fcddb592a67f706e000000000000005256fd6e9af099cc6f684b27ab024e44795f09407b9caff26de096f5131fd16e191a9d85a914031b0caf7392fde9073fd902ff944b7dd129dc18a2dd00005d9467590271d8ed07d8e363bdd3fde4fef23005d54194d33c9cf0f1579f5fe90c8f78ad0fb55b80c7bc5b04ada2d1f3c69de1c8f8"], 0x80) syz_io_uring_setup(0x6c0f, &(0x7f0000000040)={0x0, 0xc2d1, 0x1, 0x1, 0x34}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000000c0), &(0x7f0000000100)) r4 = io_uring_register$IORING_REGISTER_PERSONALITY(r3, 0x9, 0x0, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x5, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000000)='./file0\x00', 0x54bb9bd88f3ccfcf, 0x0, 0x12345, {0x0, r4}}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:57 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) [ 1953.084663][ T17] hid-generic 0000:0000:0000.02B4: hidraw0: HID v0.00 Device [syz1] on %z5 [ 1953.157796][T18678] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'. 17:43:57 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) 17:43:57 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x1a00000000000000) [ 1953.278501][T18700] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 17:43:57 executing program 4: eventfd(0x0) r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) r3 = creat(&(0x7f0000000280)='./file0\x00', 0xd931d3864d39dcd7) write$binfmt_script(r3, &(0x7f0000000340)=ANY=[@ANYBLOB="2321202e2f66696c653020806f06000000459f000072dc000092290a7e4555a763c15ccda085e2da58f729fa6680d7b0ec89b551c676ed3ae7a290ab0e74467713d41832ee9f99ba46c604a8bf8893cc7149595314f0771b65d33e129933dd93f99f00cd6b3e5903fcddb592a67f706e000000000000005256fd6e9af099cc6f684b27ab024e44795f09407b9caff26de096f5131fd16e191a9d85a914031b0caf7392fde9073fd902ff944b7dd129dc18a2dd00005d9467590271d8ed07d8e363bdd3fde4fef23005d54194d33c9cf0f1579f5fe90c8f78ad0fb55b80c7bc5b04ada2d1f3c69de1c8f8"], 0x80) syz_io_uring_setup(0x6c0f, &(0x7f0000000040)={0x0, 0xc2d1, 0x1, 0x1, 0x34}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000000c0), &(0x7f0000000100)) r4 = io_uring_register$IORING_REGISTER_PERSONALITY(r3, 0x9, 0x0, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x5, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000000)='./file0\x00', 0x54bb9bd88f3ccfcf, 0x0, 0x12345, {0x0, r4}}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:57 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x11000000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) [ 1953.376202][ T17] hid-generic 0000:0000:0000.02B5: unknown main item tag 0x0 [ 1953.401456][ T17] hid-generic 0000:0000:0000.02B5: unknown main item tag 0x0 [ 1953.402550][T18701] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'. [ 1953.432693][ T17] hid-generic 0000:0000:0000.02B5: unknown main item tag 0x0 [ 1953.442248][ T17] hid-generic 0000:0000:0000.02B5: hidraw0: HID v0.00 Device [syz1] on %z5 17:43:57 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x1b00000000000000) [ 1953.503350][T18705] validate_nla: 33 callbacks suppressed [ 1953.503364][T18705] netlink: 'syz-executor.3': attribute type 14 has an invalid length. 17:43:57 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) [ 1953.557337][T18705] netlink: 'syz-executor.3': attribute type 14 has an invalid length. 17:43:57 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x74, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:57 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x5000000}, 0x0) 17:43:57 executing program 4: eventfd(0x0) r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) r3 = creat(&(0x7f0000000280)='./file0\x00', 0xd931d3864d39dcd7) write$binfmt_script(r3, &(0x7f0000000340)=ANY=[@ANYBLOB="2321202e2f66696c653020806f06000000459f000072dc000092290a7e4555a763c15ccda085e2da58f729fa6680d7b0ec89b551c676ed3ae7a290ab0e74467713d41832ee9f99ba46c604a8bf8893cc7149595314f0771b65d33e129933dd93f99f00cd6b3e5903fcddb592a67f706e000000000000005256fd6e9af099cc6f684b27ab024e44795f09407b9caff26de096f5131fd16e191a9d85a914031b0caf7392fde9073fd902ff944b7dd129dc18a2dd00005d9467590271d8ed07d8e363bdd3fde4fef23005d54194d33c9cf0f1579f5fe90c8f78ad0fb55b80c7bc5b04ada2d1f3c69de1c8f8"], 0x80) syz_io_uring_setup(0x6c0f, &(0x7f0000000040)={0x0, 0xc2d1, 0x1, 0x1, 0x34}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000000c0), &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x5, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000000)='./file0\x00', 0x54bb9bd88f3ccfcf, 0x0, 0x12345}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1953.661457][T18738] netlink: 'syz-executor.0': attribute type 16 has an invalid length. [ 1953.701122][T18738] netlink: 'syz-executor.0': attribute type 16 has an invalid length. 17:43:58 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x1c00000000000000) 17:43:58 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) 17:43:58 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x20000000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) [ 1953.870938][T18749] netlink: 'syz-executor.3': attribute type 14 has an invalid length. [ 1953.901178][ T7] hid-generic 0000:0000:0000.02B6: unknown main item tag 0x0 17:43:58 executing program 4: eventfd(0x0) r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) r3 = creat(&(0x7f0000000280)='./file0\x00', 0xd931d3864d39dcd7) write$binfmt_script(r3, &(0x7f0000000340)=ANY=[@ANYBLOB="2321202e2f66696c653020806f06000000459f000072dc000092290a7e4555a763c15ccda085e2da58f729fa6680d7b0ec89b551c676ed3ae7a290ab0e74467713d41832ee9f99ba46c604a8bf8893cc7149595314f0771b65d33e129933dd93f99f00cd6b3e5903fcddb592a67f706e000000000000005256fd6e9af099cc6f684b27ab024e44795f09407b9caff26de096f5131fd16e191a9d85a914031b0caf7392fde9073fd902ff944b7dd129dc18a2dd00005d9467590271d8ed07d8e363bdd3fde4fef23005d54194d33c9cf0f1579f5fe90c8f78ad0fb55b80c7bc5b04ada2d1f3c69de1c8f8"], 0x80) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x5, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000000)='./file0\x00', 0x54bb9bd88f3ccfcf, 0x0, 0x12345}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:58 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x1d00000000000000) [ 1953.926630][ T7] hid-generic 0000:0000:0000.02B6: unknown main item tag 0x0 [ 1953.957065][ T7] hid-generic 0000:0000:0000.02B6: unknown main item tag 0x0 [ 1954.008458][ T7] hid-generic 0000:0000:0000.02B6: hidraw0: HID v0.00 Device [syz1] on %z5 [ 1954.050604][T18774] netlink: 'syz-executor.3': attribute type 14 has an invalid length. [ 1954.077739][T18775] netlink: 'syz-executor.0': attribute type 16 has an invalid length. [ 1954.109732][T18775] netlink: 'syz-executor.0': attribute type 16 has an invalid length. 17:43:58 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x1e00000000000000) 17:43:58 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x6000000}, 0x0) 17:43:58 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3"], 0x12e) r3 = creat(0x0, 0x0) dup2(r3, r2) 17:43:58 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x7a, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:58 executing program 4: eventfd(0x0) r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) creat(&(0x7f0000000280)='./file0\x00', 0xd931d3864d39dcd7) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x5, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000000)='./file0\x00', 0x54bb9bd88f3ccfcf, 0x0, 0x12345}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:58 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x471903be, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) [ 1954.272131][T22685] hid-generic 0000:0000:0000.02B7: item fetching failed at offset 19/22 [ 1954.299819][T22685] hid-generic: probe of 0000:0000:0000.02B7 failed with error -22 17:43:58 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3"], 0x12e) r3 = creat(0x0, 0x0) dup2(r3, r2) 17:43:58 executing program 4: eventfd(0x0) r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x5, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000000)='./file0\x00', 0x54bb9bd88f3ccfcf, 0x0, 0x12345}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:58 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x1f00000000000000) [ 1954.437351][T18826] netlink: 'syz-executor.3': attribute type 14 has an invalid length. [ 1954.477438][T18830] netlink: 'syz-executor.0': attribute type 16 has an invalid length. [ 1954.502958][ T9806] hid-generic 0000:0000:0000.02B8: item fetching failed at offset 19/22 [ 1954.525201][ T9806] hid-generic: probe of 0000:0000:0000.02B8 failed with error -22 17:43:58 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0xf0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:58 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x7000000}, 0x0) 17:43:58 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3"], 0x12e) r3 = creat(0x0, 0x0) dup2(r3, r2) 17:43:58 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x48000000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:58 executing program 4: eventfd(0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x5, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000000)='./file0\x00', 0x54bb9bd88f3ccfcf, 0x0, 0x12345}, 0x8) io_uring_enter(0xffffffffffffffff, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:58 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x2000000000000000) 17:43:59 executing program 4: eventfd(0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x5, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000000)='./file0\x00', 0x54bb9bd88f3ccfcf, 0x0, 0x12345}, 0x8) io_uring_enter(0xffffffffffffffff, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1954.778902][ T9806] hid-generic 0000:0000:0000.02B9: item fetching failed at offset 19/22 [ 1954.797431][ T9806] hid-generic: probe of 0000:0000:0000.02B9 failed with error -22 17:43:59 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3"], 0x12e) creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(0xffffffffffffffff, r2) 17:43:59 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x2100000000000000) 17:43:59 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x4c000000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:59 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x300, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:59 executing program 4: eventfd(0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x5, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000000)='./file0\x00', 0x54bb9bd88f3ccfcf, 0x0, 0x12345}, 0x8) io_uring_enter(0xffffffffffffffff, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:59 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8000000}, 0x0) [ 1955.023389][ T9806] hid-generic 0000:0000:0000.02BA: item fetching failed at offset 19/22 [ 1955.060599][ T9806] hid-generic: probe of 0000:0000:0000.02BA failed with error -22 17:43:59 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0xf5ffffff00000000) 17:43:59 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3"], 0x12e) creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(0xffffffffffffffff, r2) 17:43:59 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x5, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000000)='./file0\x00', 0x54bb9bd88f3ccfcf, 0x0, 0x12345}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:59 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x500, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:59 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x9000000}, 0x0) [ 1955.244020][ T9806] hid-generic 0000:0000:0000.02BB: item fetching failed at offset 19/22 [ 1955.266832][ T9806] hid-generic: probe of 0000:0000:0000.02BB failed with error -22 17:43:59 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x60000000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:43:59 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3"], 0x12e) creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(0xffffffffffffffff, r2) 17:43:59 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x5, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000000)='./file0\x00', 0x54bb9bd88f3ccfcf, 0x0, 0x12345}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:59 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0xffffffff00000000) [ 1955.502925][ T7] hid-generic 0000:0000:0000.02BC: item fetching failed at offset 19/22 [ 1955.525603][ T7] hid-generic: probe of 0000:0000:0000.02BC failed with error -22 17:43:59 executing program 4: r0 = syz_io_uring_setup(0x0, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x5, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000000)='./file0\x00', 0x54bb9bd88f3ccfcf, 0x0, 0x12345}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:43:59 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, 0xffffffffffffffff) 17:43:59 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x600, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:43:59 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0xa000000}, 0x0) 17:43:59 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x65580000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:44:00 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x4, 0xc101) ioctl$HIDIOCINITREPORT(r0, 0x4805, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r1, &(0x7f0000000240)={0x10000003}) r2 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r2, 0x2039, 0x0, 0x0, 0x0, 0x0) signalfd4(r2, &(0x7f0000000100)={[0x101]}, 0x8, 0x180000) 17:44:00 executing program 4: r0 = syz_io_uring_setup(0x0, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x5, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000000)='./file0\x00', 0x54bb9bd88f3ccfcf, 0x0, 0x12345}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1955.811372][T32372] hid-generic 0000:0000:0000.02BD: item fetching failed at offset 19/22 [ 1955.838022][T32372] hid-generic: probe of 0000:0000:0000.02BD failed with error -22 17:44:00 executing program 4: r0 = syz_io_uring_setup(0x0, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x5, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000000)='./file0\x00', 0x54bb9bd88f3ccfcf, 0x0, 0x12345}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:44:00 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, 0xffffffffffffffff) 17:44:00 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x700, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:44:00 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0xb000000}, 0x0) 17:44:00 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x68000000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) [ 1956.126401][T32372] hid-generic 0000:0000:0000.02BE: item fetching failed at offset 19/22 [ 1956.146991][T32372] hid-generic: probe of 0000:0000:0000.02BE failed with error -22 17:44:00 executing program 4: r0 = syz_io_uring_setup(0x82, 0x0, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x5, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000000)='./file0\x00', 0x54bb9bd88f3ccfcf, 0x0, 0x12345}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:44:00 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, 0xffffffffffffffff) 17:44:00 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x6c000000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:44:00 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0xc000000}, 0x0) 17:44:00 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x900, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:44:00 executing program 4: r0 = syz_io_uring_setup(0x82, 0x0, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x5, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000000)='./file0\x00', 0x54bb9bd88f3ccfcf, 0x0, 0x12345}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1956.388597][ T17] hid-generic 0000:0000:0000.02BF: item fetching failed at offset 19/22 [ 1956.423983][ T17] hid-generic: probe of 0000:0000:0000.02BF failed with error -22 17:44:00 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = open_tree(0xffffffffffffffff, 0x0, 0x0) r1 = syz_io_uring_setup(0x83, &(0x7f0000000080)={0x0, 0x0, 0x20}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0xc0, &(0x7f0000000140)=0xfffff934, 0x0, 0x4) r4 = creat(&(0x7f0000000280)='./file0\x00', 0xd931d3864d39dcd7) write$binfmt_script(r4, &(0x7f0000000340)=ANY=[@ANYBLOB="2321202e2f66696c653020806f06000000459f000072dc000092290a7e4555a763c15ccda085e2da58f729fa6680d7b0ec89b551c676ed3ae7a290ab0e74467713d41832ee9f99ba46c604a8bf8893cc7149595314f0771b65d33e129933dd93f99f00cd6b3e5903fcddb592a67f706e000000000000005256fd6e9af099cc6f684b27ab024e44795f09407b9caff26de096f5131fd16e191a9d85a914031b0caf7392fde964ac40ce92beba56d129dc18a2dd00005d9467590271d8ed07d8e363bdd3fde4fef23005d54194d33c9cf0f1579f5fe90c8f78ad0fb55b80c7bc5b04ada2d1f3c69de1c8f8"], 0x80) syz_io_uring_setup(0x6c0f, &(0x7f0000000040)={0x0, 0xc2d1, 0x1, 0x1, 0x34}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000000c0), &(0x7f0000000100)=0x0) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(r4, 0x9, 0x0, 0x0) syz_io_uring_submit(0x0, r5, &(0x7f0000000140)=@IORING_OP_FALLOCATE={0x11, 0x0, 0x0, @fd_index=0x8, 0xfffffffffffff8d8, 0x0, 0xffff1c17, 0x0, 0x1, {0x0, r6}}, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_STATX={0x15, 0x3, 0x0, r0, &(0x7f0000000440), &(0x7f0000000000)='./file0\x00', 0x10, 0x1000}, 0x20) io_uring_enter(r1, 0x83e, 0x0, 0x2, 0x0, 0x0) 17:44:00 executing program 5: eventfd(0x0) r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000040)) r1 = creat(&(0x7f0000000280)='./file0\x00', 0xd931d3864d39dcd7) write$binfmt_script(r1, &(0x7f0000000340)=ANY=[@ANYBLOB="2321202e2f66696c653020806f06000000459f000072dc000092290a7e4555a763c15ccda085e2da58f729fa6680d7b0ec89b551c676ed3ae7a290ab0e74467713d41832ee9f99ba46c604a8bf8893cc7149595314f0771b65d33e129933dd93f99f00cd6b3e5903fcddb592a67f706e000000000000005256fd6e9af099cc6f684b27ab024e44795f09407b9caff26de096f5131fd16e191a9d85a914031b0caf7392fde9073fd902ff944b7dd129dc18a2dd00005d9467590271d8ed07d8e363bdd3fde4fef23005d54194d33c9cf0f1579f5fe90c8f78ad0fb55b80c7bc5b04ada2d1f3c69de1c8f8"], 0x80) syz_io_uring_setup(0x6c0f, &(0x7f0000000040)={0x0, 0xc2d1, 0x1, 0x1, 0x34}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000000c0), &(0x7f0000000100)=0x0) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000140)=@IORING_OP_FALLOCATE={0x11, 0x0, 0x0, @fd_index=0x8, 0xfffffffffffff8d8, 0x0, 0xffff1c17, 0x0, 0x1, {0x0, r3}}, 0x4) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:44:00 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = open_tree(0xffffffffffffffff, 0x0, 0x0) r2 = eventfd(0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f0000000080)={0x0, @empty, 0x4e22, 0x1, 'nq\x00', 0x29, 0x5, 0x22}, 0x2c) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) r7 = eventfd(0x0) r8 = dup3(r6, r4, 0x0) ioctl$KVM_IRQFD(r8, 0x4020ae76, &(0x7f0000000100)={r2, 0x0, 0x0, r7, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) ioctl$KVM_IRQFD(r8, 0x4020ae76, &(0x7f0000000100)={r2, 0x0, 0x2, r2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) r9 = syz_io_uring_setup(0x83, &(0x7f0000000300)={0x0, 0x0, 0x4, 0x40000, 0x0, 0x0, r8}, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) fgetxattr(r0, &(0x7f0000000100)=@random={'trusted.', '\x00'}, &(0x7f0000000240)=""/89, 0x59) syz_memcpy_off$IO_URING_METADATA_GENERIC(r10, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) syz_io_uring_submit(r10, r11, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r9, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:44:00 executing program 4: r0 = syz_io_uring_setup(0x82, 0x0, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x5, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000000)='./file0\x00', 0x54bb9bd88f3ccfcf, 0x0, 0x12345}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:44:00 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0xe000000}, 0x0) 17:44:01 executing program 5: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0xb000000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:44:01 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x74000000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:44:01 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0xa00, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:44:01 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x5, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000000)='./file0\x00', 0x54bb9bd88f3ccfcf, 0x0, 0x12345}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:44:01 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x5, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000000)='./file0\x00', 0x54bb9bd88f3ccfcf, 0x0, 0x12345}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:44:01 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:44:01 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0xf000000}, 0x0) 17:44:01 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0xc00, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:44:01 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x7a000000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:44:01 executing program 5: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x10, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:44:01 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x5, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000000)='./file0\x00', 0x54bb9bd88f3ccfcf, 0x0, 0x12345}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:44:01 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x10000000}, 0x0) 17:44:01 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x5, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000000)='./file0\x00', 0x54bb9bd88f3ccfcf, 0x0, 0x12345}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:44:01 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x81000000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:44:01 executing program 5 (fault-call:6 fault-nth:0): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) 17:44:01 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0xe00, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:44:01 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x5, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000000)='./file0\x00', 0x54bb9bd88f3ccfcf, 0x0, 0x12345}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1957.612829][T28129] hid-generic 0000:0000:0000.02C0: item fetching failed at offset 19/22 [ 1957.662343][T28129] hid-generic: probe of 0000:0000:0000.02C0 failed with error -22 17:44:02 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x11000000}, 0x0) [ 1957.713351][T19155] FAULT_INJECTION: forcing a failure. [ 1957.713351][T19155] name failslab, interval 1, probability 0, space 0, times 0 [ 1957.759776][T19155] CPU: 1 PID: 19155 Comm: syz-executor.5 Not tainted 5.10.0-rc7-syzkaller #0 [ 1957.768580][T19155] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1957.778655][T19155] Call Trace: [ 1957.782413][T19155] dump_stack+0x107/0x163 [ 1957.786773][T19155] should_fail.cold+0x5/0xa [ 1957.791623][T19155] ? kobject_uevent_env+0x240/0x1680 [ 1957.796937][T19155] ? kobject_uevent_env+0x240/0x1680 [ 1957.802242][T19155] ? dev_uevent_filter+0xd0/0xd0 [ 1957.807200][T19155] should_failslab+0x5/0x10 [ 1957.811723][T19155] kmem_cache_alloc_trace+0x55/0x360 [ 1957.817037][T19155] ? dev_uevent_filter+0xd0/0xd0 [ 1957.822002][T19155] kobject_uevent_env+0x240/0x1680 [ 1957.827141][T19155] ? software_node_notify+0xf8/0x2e0 [ 1957.832457][T19155] device_del+0x91f/0xec0 [ 1957.836872][T19155] ? device_link_add_missing_supplier_links+0x370/0x370 [ 1957.843838][T19155] hid_destroy_device+0xe1/0x150 [ 1957.848797][T19155] uhid_char_release+0xd5/0x1b0 [ 1957.853683][T19155] __fput+0x285/0x920 17:44:02 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = open_tree(0xffffffffffffffff, 0x0, 0x0) r1 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = openat$cgroup_type(r0, &(0x7f0000000000)='cgroup.type\x00', 0x2, 0x0) r5 = socket$kcm(0xa, 0x3, 0x3a) sendmsg$kcm(r5, &(0x7f0000000180)={&(0x7f00000001c0)=@nl=@unspec, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000240)="82c2178d", 0xfc9e}], 0x1}, 0x0) r6 = syz_open_dev$swradio(&(0x7f0000000140)='/dev/swradio#\x00', 0x1, 0x2) ioctl$BTRFS_IOC_START_SYNC(r6, 0x80089418, &(0x7f0000000180)=0x0) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r6, 0xc0c89425, &(0x7f0000000540)={"fc3611617453ae7abe0852d7d0f64693", r7, r7, {0x830, 0x1}, {0x49, 0xfe66}, 0x5, [0x40000000000, 0x800, 0x2, 0x7, 0x1000, 0x4, 0x400, 0x0, 0x49034d9c, 0x7, 0x1, 0x25, 0x1, 0x1, 0x10001, 0x9]}) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r5, 0xc0c89425, &(0x7f0000000480)={"34a56ed2024cbd098ffae055a20f01ed", r7, 0x0, {0xffff, 0x8}, {0x8, 0xd1}, 0x2, [0x40, 0x7fff, 0x9, 0x2, 0x13dbd63b, 0x5, 0x0, 0x486, 0x6, 0x4, 0xfff, 0xffe0000000000000, 0x100000001, 0x68, 0x2, 0x8000]}) ioctl$BTRFS_IOC_DEV_REPLACE(r1, 0xca289435, &(0x7f0000000300)={0x2, 0x3f, @start={0x0, 0x0, "f7f05293647a934ca649f153b37aeccb403c8a682fa32a770d79de08ac07ec8a584fdd54a5584e444dd11eec9c978f1f8f119ba3476b754413d70968085c82766d2b1e759697b3563490c928edece6d20aef8e32ae2c03fb8ec113353f867d8d6a029570f28771f2857ca58f6389f6271cddb2066f4511bcf5fee1ad4e796aada0cf80e35f7ff19f48e81dbb348248ebcfb4691a6c6d406325c74738982eb944e1640ff38bdac98b40f02a47b197e354906feab560fb73ecd48a1ca4e97c80ad1000994bf4025bec34ea9418a6a068d8cbe5ba8a10245f98776b9688bc7b28d5c1f43dd5d2e315d588f01cd88fc5cfe50950dc9d169cc5901af29606a669ad2be4885a35d93997e18449e800ff9825a2c21ff840d666eb6a059abb3a63c631e8c9c27fefda617298c8ea1927523e43107587bdd947d88eb2ec7f70e6f646fa68cf05229eb2db2e22c9425cf03db6c29e624bd7214a9bcd69969fcc93bc2231b39e0176f156601a1d48ee5f9c1c02d4b1e95950224fa8130a638e3d80d8b0e1a1525b1cb16cbb263ebeae113c2af31fbffea0c3fe38ffa2120b3a13d8eb6e2a28848654173a03239d362f3068d892687c20b35ef56c2536cf63a6b41a50114ef3736657966c2136eb862bbb4e20dc65f1271fde1502980b40f0d39040f95920641e3966845c890d284e50f10e5c090617cebe0742a54e69f35089e2b7448d73839a874cfbfa34aa5c77418a2183d9ddae76b3e2de3ba1c78e03a19105a4ee49d7a1bd5f42562894bc52054dd52f3d85f10e8b8aaa1b8d3b22f64e8209097fa4d43b46c535e6197fb6df56e3247615065d8fcaa6ca7d2e54c211ac7ce09f5b83b98eb4df3b9bdde874b387f3800da8ee72ef2869a69581d8289727f60ba3098d2c01c7aef57a9dec61dc817bd91867cf71b3eefe641de2ff3916c8171998ad6a8dea1c155995eb55d6a3d46200c5d140351712b802433dffb15f4a6570ee5620d27fb524517cdd18bb4c093517a446396bd1266dc7db7dde2bea68d80ac88a8905c1a7023e95f43853290d8ec5c34145f0188854d2f19dec32f09689893d164ee87bdeb2921d6edaaae37bd0934f28e204f2843dadf66e217ee693e6749e0386edae10fed7e0978dfb7898b937a60dc714bd5b486f66b6c00c28e88d0a51581347e64b615c8d3062c413132711cfd865ad2517e4dcd1acaa9aa9755d898e2341eae6eaff7f031510d90cfaac7c79c5fe45d887f5b5a28747ed0f6ec156463e91b7346f1744070719a012b04e494ae61903b3bea0f5ce0950d9e04d67712012d09e76d58cb1404c05c97c72b954d05a4bccd8c13e60f46355ec766f681f23f785df368e040e635e5a48a0bee68173c307092ccfd774f98fe87b4a8a8a0ec786e88bc6edd8da8202bc9ddafba403fde84a88a584a63b3e3706448d3ce67a33ed6aca76", "d6153a226120fe611ca6926e9cdad31eb8533d3e50979621a49e1b566a4a1ba9cf2c5aa8aaa1e2065003f4ae0d8d26016fecd77ece09d8b391c772e64e23dfa5f973df0f5c19f7ea14576fe205ed8e06abf624b34df5ca6b9e425cff357112df117c0821dc3497e0636cd2b89dc8c83a21caa3147a9eff516bc39d9f0338c94cde36439af25c44f194cc309f43bf1932d2432910ef95ba58c9efbb554979f4870f4ec02f2fc472de8726705f681ca00ae0940f1675f95359b05414d981b8fdd93edcd8087369f076c711697408a034998f3b86f17097ca8a8a00f009d0dac45212e5f1c5fcc563a27596f79b7ac452f5bd813cd265f1153cb0687534a5bbde3c27940ea918f03dab4b742282dd2e70e4cbd6c6996dc791ecb73c791123c02b4ffbd10f8a4786af3b67dd09ec7cd811f727ad58441083abaa91da09b5550fcbbbf6a83f008b5cce9cf5d7b78b6ea2f6d142e5a5cfa5e6a33400623febc0b780ab7485a1082e1e881a9380474e84731f094d32fbeeb4c2a835e3ea5980c99c9fa8d2aec51cac34d5a65f33d85afb4ca830029f436b838066954aa71416eba41ba66334073d2316a689302e9de16c2e56c533b9e869a48d4d0001c9115649689ca41ff06e1c102275cd1eaf9aed61776d9f6085c9e77735c037b559c99ee320e53ca0a9dc99a2bfe01470a404a4c771d0925c62bed112643784b445356e7106769242c24ab8451e46e697fc354ef6e31bd2a07c808419810f60a3d0545910e13dd342261e6757534804b0bf45a5e0fb3524dfe34c5914d19476c15069cfda54b393f9e44a3340b486a992db63ae3afb4b09f3fceccd3d72d702895fa12ef80f30cde67c0807f0a347bfda92d0dbc693d639feb2c3f29fc5402db8afd6b299a01cee36a7dba59096c8f938d898670eef9e0f95a92c942584e8676dd119267edbf1a1a3e1ae9f857a6a7bedba8919047aabc69d87e75532ee8145cc8c2ed3537e0d67423bdac49d3b6db16dd381af1f12a3bd6fc204e9ba1073e191bc4f9e252ac34cd6a420bc43bb275403e6f90d5efd53b77fcabacb2f5c17a9042cfa4d1dbcf8dfe11c91ee958542bfab25a59e8b1110562751d9c0b19878f73babd6b706f3bc59af7885f3ed09f8d7720d455cfa447acd0fc9188ffe21ddd305a0c81680a54d470ad0a8491f78730a0cb9ebe3942c4a701535b6b02456f137120810086a1838729d02a605be7a1e2277ace27e5d68f3fca3ad1675cf8190fffb53a3f39cf1e2d10a0e3c0b784e00a80ac19c538aaa97449b8eeceb283c415ad4418eee76d9ab94b7d4aab8f1f420dd3f255c88c975ac348649b1548528af6add2ca549d185251f4c3e8f1674ba0815c613dbb34672885a9a3d2a8f864671519cc7544b4cbebb756c34dfb01e90b6d21469174aeacd5ac6eb190fa33caa5171fc17fde4b279a3b6eb"}, [0x0, 0xdb81, 0x1, 0x9, 0x101, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xe94d, 0x2000000000000000, 0x3, 0x10001, 0x2b27, 0x3, 0xcd, 0x725, 0x8, 0x0, 0x100000001, 0xc8, 0x3, 0x10000, 0x100000001, 0x5, 0x5e46, 0x7, 0x8001, 0xfffffffffffffff9, 0x80000000, 0x8000000000000, 0x7fff, 0xffffffffffffffc8, 0x0, 0x5, 0x10000, 0x7, 0x153d, 0x66, 0x2f, 0x7f, 0x9, 0x5, 0x4, 0x2, 0x4, 0x1ff, 0x1da, 0x7fffffff, 0x0, 0x9, 0x1, 0x4, 0x6, 0x3, 0x2, 0x10000, 0xb5, 0x8, 0xffffffff, 0xfffffffffffffffd, 0x0, 0x81, 0x100]}) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r1, 0x50009417, &(0x7f0000000d40)={{r4}, r7, 0x30, @unused=[0x40, 0x1d, 0x3, 0xffffffff], @devid=r8}) socket$unix(0x1, 0x0, 0x0) syz_io_uring_setup(0x87, &(0x7f0000000180), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r9, 0x40, 0x0, 0x0, 0x4) r11 = socket$rds(0x15, 0x5, 0x0) syz_io_uring_submit(r9, r10, &(0x7f0000000200)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r11}, 0x0) syz_io_uring_submit(r9, r3, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x3, 0x0, 0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x4b}, &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r1, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1957.858023][T19155] ? uhid_dev_create2+0x7c0/0x7c0 [ 1957.864212][T19155] task_work_run+0xdd/0x190 [ 1957.868969][T19155] exit_to_user_mode_prepare+0x17e/0x1a0 [ 1957.875730][T19155] syscall_exit_to_user_mode+0x38/0x260 [ 1957.882409][T19155] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 1957.888330][T19155] RIP: 0033:0x45e159 [ 1957.892709][T19155] Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1957.912342][T19155] RSP: 002b:00007f1e3e27ac68 EFLAGS: 00000246 ORIG_RAX: 0000000000000021 [ 1957.921345][T19155] RAX: 0000000000000005 RBX: 0000000000000007 RCX: 000000000045e159 [ 1957.929341][T19155] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000006 [ 1957.938339][T19155] RBP: 00007f1e3e27aca0 R08: 0000000000000000 R09: 0000000000000000 [ 1957.946339][T19155] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 17:44:02 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0xf00, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) [ 1957.955462][T19155] R13: 00000000016afb7f R14: 00007f1e3e27b9c0 R15: 000000000119bf8c 17:44:02 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x82580000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:44:02 executing program 5 (fault-call:6 fault-nth:1): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) 17:44:02 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x5, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000000)='./file0\x00', 0x54bb9bd88f3ccfcf, 0x0, 0x12345}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1958.066552][T19190] __nla_validate_parse: 71 callbacks suppressed [ 1958.066567][T19190] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'. 17:44:02 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/key-users\x00', 0x0, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x106}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r1, &(0x7f00000000c0)={0x14, 0x88, 0xfa00, {r2, 0x30, 0x0, @ib={0x1b, 0x0, 0x0, {}, 0x0, 0xffffffffffffffff}}}, 0x90) write$RDMA_USER_CM_CMD_LISTEN(r0, &(0x7f0000000100)={0x7, 0x8, 0xfa00, {r2, 0x2}}, 0x10) open_tree(0xffffffffffffffff, 0x0, 0x0) r3 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r3, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1958.162953][T19198] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1958.212513][T19194] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 1958.229354][ T7] hid-generic 0000:0000:0000.02C1: item fetching failed at offset 19/22 17:44:02 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x5, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000000)='./file0\x00', 0x54bb9bd88f3ccfcf, 0x0, 0x12345}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1958.268894][T19192] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'. [ 1958.280783][ T7] hid-generic: probe of 0000:0000:0000.02C1 failed with error -22 [ 1958.292560][T19198] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'. 17:44:02 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x60000000}, 0x0) [ 1958.350401][T19199] FAULT_INJECTION: forcing a failure. [ 1958.350401][T19199] name failslab, interval 1, probability 0, space 0, times 0 [ 1958.373163][T19194] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 17:44:02 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x88a8ffff, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) [ 1958.404189][T19199] CPU: 1 PID: 19199 Comm: syz-executor.5 Not tainted 5.10.0-rc7-syzkaller #0 [ 1958.413006][T19199] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1958.423075][T19199] Call Trace: [ 1958.426396][T19199] dump_stack+0x107/0x163 [ 1958.430776][T19199] should_fail.cold+0x5/0xa [ 1958.435330][T19199] ? kobject_get_path+0xbe/0x230 [ 1958.440312][T19199] ? kobject_get_path+0xbe/0x230 [ 1958.445275][T19199] should_failslab+0x5/0x10 [ 1958.450626][T19199] __kmalloc+0x72/0x3e0 [ 1958.455314][T19199] kobject_get_path+0xbe/0x230 [ 1958.460108][T19199] kobject_uevent_env+0x265/0x1680 [ 1958.465247][T19199] ? software_node_notify+0xf8/0x2e0 [ 1958.470561][T19199] device_del+0x91f/0xec0 [ 1958.474924][T19199] ? device_link_add_missing_supplier_links+0x370/0x370 [ 1958.481897][T19199] hid_destroy_device+0xe1/0x150 [ 1958.486857][T19199] uhid_char_release+0xd5/0x1b0 [ 1958.492151][T19199] __fput+0x285/0x920 [ 1958.496169][T19199] ? uhid_dev_create2+0x7c0/0x7c0 [ 1958.501288][T19199] task_work_run+0xdd/0x190 [ 1958.505836][T19199] exit_to_user_mode_prepare+0x17e/0x1a0 [ 1958.512686][T19199] syscall_exit_to_user_mode+0x38/0x260 [ 1958.518299][T19199] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 1958.524205][T19199] RIP: 0033:0x45e159 [ 1958.528122][T19199] Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 17:44:02 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x2000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:44:02 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = open_tree(0xffffffffffffffff, 0x0, 0x0) r1 = syz_io_uring_setup(0x86, &(0x7f0000000080)={0x0, 0x1391, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ee4000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000000)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r1, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1958.547751][T19199] RSP: 002b:00007f1e3e27ac68 EFLAGS: 00000246 ORIG_RAX: 0000000000000021 [ 1958.556189][T19199] RAX: 0000000000000005 RBX: 0000000000000007 RCX: 000000000045e159 [ 1958.564172][T19199] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000006 [ 1958.572988][T19199] RBP: 00007f1e3e27aca0 R08: 0000000000000000 R09: 0000000000000000 [ 1958.581073][T19199] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1958.589065][T19199] R13: 00000000016afb7f R14: 00007f1e3e27b9c0 R15: 000000000119bf8c 17:44:02 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x5, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000000)='./file0\x00', 0x54bb9bd88f3ccfcf, 0x0, 0x12345}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:44:03 executing program 5 (fault-call:6 fault-nth:2): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) [ 1958.702171][T19238] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 17:44:03 executing program 1: ioctl$VIDIOC_TRY_FMT(0xffffffffffffffff, 0xc0d05640, &(0x7f0000000300)={0x7, @vbi={0x7f, 0x100, 0x6, 0x34343459, [0x7, 0x2], [0x40, 0x7ff], 0x1}}) openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1958.789792][T19235] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'. 17:44:03 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x5, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000000)='./file0\x00', 0x54bb9bd88f3ccfcf, 0x0, 0x12345}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1958.900333][T19245] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1958.941074][T32372] hid-generic 0000:0000:0000.02C2: item fetching failed at offset 19/22 [ 1958.954187][T19248] validate_nla: 41 callbacks suppressed [ 1958.954201][T19248] netlink: 'syz-executor.3': attribute type 14 has an invalid length. [ 1958.973766][T32372] hid-generic: probe of 0000:0000:0000.02C2 failed with error -22 [ 1958.999639][T19266] FAULT_INJECTION: forcing a failure. [ 1958.999639][T19266] name failslab, interval 1, probability 0, space 0, times 0 [ 1959.037583][T19258] netlink: 'syz-executor.0': attribute type 16 has an invalid length. [ 1959.064083][T19238] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 1959.069042][T19266] CPU: 0 PID: 19266 Comm: syz-executor.5 Not tainted 5.10.0-rc7-syzkaller #0 [ 1959.082351][T19266] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1959.092467][T19266] Call Trace: [ 1959.095775][T19266] dump_stack+0x107/0x163 [ 1959.100500][T19266] should_fail.cold+0x5/0xa [ 1959.105377][T19266] ? __alloc_skb+0x71/0x550 [ 1959.110280][T19266] should_failslab+0x5/0x10 [ 1959.115148][T19266] kmem_cache_alloc_node+0x55/0x470 [ 1959.121593][T19266] __alloc_skb+0x71/0x550 [ 1959.126794][T19266] alloc_uevent_skb+0x7b/0x210 [ 1959.128629][T19279] netlink: 'syz-executor.0': attribute type 16 has an invalid length. [ 1959.131576][T19266] kobject_uevent_env+0xb0f/0x1680 [ 1959.131604][T19266] ? software_node_notify+0xf8/0x2e0 [ 1959.131630][T19266] device_del+0x91f/0xec0 [ 1959.131656][T19266] ? device_link_add_missing_supplier_links+0x370/0x370 [ 1959.131685][T19266] hid_destroy_device+0xe1/0x150 [ 1959.168254][T19266] uhid_char_release+0xd5/0x1b0 [ 1959.173123][T19266] __fput+0x285/0x920 [ 1959.177746][T19266] ? uhid_dev_create2+0x7c0/0x7c0 [ 1959.182798][T19266] task_work_run+0xdd/0x190 [ 1959.187554][T19266] exit_to_user_mode_prepare+0x17e/0x1a0 [ 1959.194152][T19266] syscall_exit_to_user_mode+0x38/0x260 [ 1959.200944][T19266] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 1959.207679][T19266] RIP: 0033:0x45e159 [ 1959.212271][T19266] Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1959.231961][T19266] RSP: 002b:00007f1e3e259c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000021 [ 1959.241335][T19266] RAX: 0000000000000005 RBX: 0000000000000007 RCX: 000000000045e159 [ 1959.250526][T19266] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000006 17:44:03 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = open_tree(0xffffffffffffffff, 0x0, 0x0) r1 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet_dccp(0x2, 0x6, 0x0) ioctl$sock_SIOCDELDLCI(r4, 0x8981, &(0x7f0000000700)={'vlan0\x00', 0x5}) ioctl$NBD_SET_FLAGS(r0, 0xab0a, 0x400) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r1, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:44:03 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000040)=0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x5, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000000)='./file0\x00', 0x54bb9bd88f3ccfcf, 0x0, 0x12345}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1959.258658][T19266] RBP: 00007f1e3e259ca0 R08: 0000000000000000 R09: 0000000000000000 [ 1959.266667][T19266] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1959.274658][T19266] R13: 00000000016afb7f R14: 00007f1e3e25a9c0 R15: 000000000119c034 17:44:03 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x9effffff, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) [ 1959.307809][T19248] netlink: 'syz-executor.3': attribute type 14 has an invalid length. 17:44:03 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x65580000}, 0x0) 17:44:03 executing program 5 (fault-call:6 fault-nth:3): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) 17:44:03 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x4800, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) [ 1959.429181][T19289] netlink: 'syz-executor.0': attribute type 16 has an invalid length. [ 1959.480774][T19301] netlink: 'syz-executor.0': attribute type 16 has an invalid length. [ 1959.513473][T32372] hid-generic 0000:0000:0000.02C3: item fetching failed at offset 19/22 17:44:03 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x7f, &(0x7f0000000240)={0x0, 0xfffffffe}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:44:03 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0xbe031947, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:44:03 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000040)=0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x5, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000000)='./file0\x00', 0x54bb9bd88f3ccfcf, 0x0, 0x12345}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1959.537843][T32372] hid-generic: probe of 0000:0000:0000.02C3 failed with error -22 [ 1959.558732][T19305] FAULT_INJECTION: forcing a failure. [ 1959.558732][T19305] name failslab, interval 1, probability 0, space 0, times 0 [ 1959.621333][T19305] CPU: 0 PID: 19305 Comm: syz-executor.5 Not tainted 5.10.0-rc7-syzkaller #0 [ 1959.630721][T19305] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1959.641537][T19305] Call Trace: [ 1959.645977][T19305] dump_stack+0x107/0x163 [ 1959.651114][T19305] should_fail.cold+0x5/0xa [ 1959.656857][T19305] should_failslab+0x5/0x10 [ 1959.661927][T19305] __kmalloc_node_track_caller+0x72/0x3e0 [ 1959.667686][T19305] ? alloc_uevent_skb+0x7b/0x210 [ 1959.673849][T19305] __alloc_skb+0xae/0x550 [ 1959.678627][T19305] alloc_uevent_skb+0x7b/0x210 [ 1959.683451][T19305] kobject_uevent_env+0xb0f/0x1680 [ 1959.688593][T19305] ? software_node_notify+0xf8/0x2e0 [ 1959.693905][T19305] device_del+0x91f/0xec0 [ 1959.699477][T19305] ? device_link_add_missing_supplier_links+0x370/0x370 [ 1959.706444][T19305] hid_destroy_device+0xe1/0x150 [ 1959.711397][T19305] uhid_char_release+0xd5/0x1b0 [ 1959.716265][T19305] __fput+0x285/0x920 17:44:04 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = open_tree(0xffffffffffffffff, 0x0, 0x0) ioctl$IMCTRLREQ(r0, 0x80044945, &(0x7f0000000000)={0x180, 0x9, 0x4, 0xfffffc01}) r1 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r1, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1959.720298][T19305] ? uhid_dev_create2+0x7c0/0x7c0 [ 1959.725459][T19305] task_work_run+0xdd/0x190 [ 1959.730002][T19305] exit_to_user_mode_prepare+0x17e/0x1a0 [ 1959.735668][T19305] syscall_exit_to_user_mode+0x38/0x260 [ 1959.741231][T19305] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 1959.747129][T19305] RIP: 0033:0x45e159 [ 1959.751040][T19305] Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1959.770652][T19305] RSP: 002b:00007f1e3e27ac68 EFLAGS: 00000246 ORIG_RAX: 0000000000000021 [ 1959.779070][T19305] RAX: 0000000000000005 RBX: 0000000000000007 RCX: 000000000045e159 [ 1959.787029][T19305] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000006 [ 1959.795006][T19305] RBP: 00007f1e3e27aca0 R08: 0000000000000000 R09: 0000000000000000 [ 1959.802973][T19305] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 [ 1959.810935][T19305] R13: 00000000016afb7f R14: 00007f1e3e27b9c0 R15: 000000000119bf8c [ 1959.848578][T19310] netlink: 'syz-executor.3': attribute type 14 has an invalid length. 17:44:04 executing program 5 (fault-call:6 fault-nth:4): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) [ 1959.916829][T19310] netlink: 'syz-executor.3': attribute type 14 has an invalid length. 17:44:04 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x80170000}, 0x0) [ 1959.992316][T19329] netlink: 'syz-executor.0': attribute type 16 has an invalid length. 17:44:04 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x4c00, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:44:04 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000040)=0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x5, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000000)='./file0\x00', 0x54bb9bd88f3ccfcf, 0x0, 0x12345}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1960.037479][T32372] hid-generic 0000:0000:0000.02C4: item fetching failed at offset 19/22 [ 1960.086261][T32372] hid-generic: probe of 0000:0000:0000.02C4 failed with error -22 17:44:04 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0xf0ffffff, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) [ 1960.130925][T19342] FAULT_INJECTION: forcing a failure. [ 1960.130925][T19342] name failslab, interval 1, probability 0, space 0, times 0 [ 1960.172195][T19342] CPU: 1 PID: 19342 Comm: syz-executor.5 Not tainted 5.10.0-rc7-syzkaller #0 [ 1960.181932][T19342] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1960.192713][T19342] Call Trace: [ 1960.196038][T19342] dump_stack+0x107/0x163 [ 1960.200394][T19342] should_fail.cold+0x5/0xa [ 1960.205315][T19342] ? skb_clone+0x14f/0x3c0 [ 1960.210212][T19342] should_failslab+0x5/0x10 [ 1960.215158][T19342] kmem_cache_alloc+0x5b/0x440 [ 1960.219956][T19342] skb_clone+0x14f/0x3c0 [ 1960.224503][T19342] netlink_broadcast_filtered+0xa04/0xdc0 [ 1960.230271][T19342] netlink_broadcast+0x35/0x40 [ 1960.235068][T19342] kobject_uevent_env+0xad6/0x1680 [ 1960.240215][T19342] ? software_node_notify+0xf8/0x2e0 [ 1960.245543][T19342] device_del+0x91f/0xec0 [ 1960.249960][T19342] ? device_link_add_missing_supplier_links+0x370/0x370 [ 1960.256961][T19342] hid_destroy_device+0xe1/0x150 [ 1960.263082][T19342] uhid_char_release+0xd5/0x1b0 [ 1960.267969][T19342] __fput+0x285/0x920 17:44:04 executing program 1: sendmsg$TIPC_NL_BEARER_ADD(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000480)={&(0x7f0000000500)=ANY=[@ANYBLOB="6be86a210a3735494d2ba3622c9057d8d4ab440e84b591bd59deb4a26ad144c9b365f7f3a5f09343d61dab372b4c1edebd19ec77be168e68058d43ecdcaf0fdfbf492e5041952a811305477b70e769b604bd9b0b5abebff9419de97dcdf29534f4af423cbbd2c9a73e675554ac85efd9b659bd319ee6d3308a953611ee4b1b073466c77ab1113e57a9ddb3a705eb132c5aa52b95459fd4290e82778aaa60d0fdbf4e3e8069704edc2e9d7f5c894b8c2e1ed5f45ddeba1b", @ANYRESHEX=0x0, @ANYBLOB="010028bd7000ffdbdf2515000000480002800400040008000100040000000400040008000200008000002400038008000100030000000800020020000000080001b282007f00000008000200ff03000008000100ff0000005a7e3c7010aee23ef1a05875fa41d5eb97a09df95db1fd9b6e6306a7f5a31e041291350c50483bacbfce5c388ba8bb15d928408405e51e72e9d8b8ba31a70f1cb22deb3acd0abdfeb69caf71ffc58c6175e299f3fe4f4e9e815ef79002620200a49197576ed6356ec8f4ab788ff04940c7d620e19dfe4c3f16bde0750b9474ea291bb3cffedffce657eb84a01c93834816b14b5ef9d7b6d90783ea4e9cb4d4625241d7ad43794f497256887a5a4ed92061f916a53c5fd54abdb37ad4a9def8e7ad3f7fb22add69e9fa038ac7e971434842c37615963c76"], 0x5c}, 0x1, 0x0, 0x0, 0x41}, 0x1) openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = open_tree(0xffffffffffffffff, 0x0, 0x0) r1 = syz_io_uring_setup(0x60f, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffff9c, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0xffff) r4 = eventfd(0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r8, 0xae60) r9 = eventfd(0x0) r10 = dup3(r8, r6, 0x0) ioctl$KVM_IRQFD(r10, 0x4020ae76, &(0x7f0000000100)={r4, 0x0, 0x0, r9, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) ioctl$KVM_IRQFD(r10, 0x4020ae76, &(0x7f0000000100)={r4, 0x0, 0x2, r4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) getsockopt$inet6_IPV6_XFRM_POLICY(r10, 0x29, 0x23, &(0x7f0000000700)={{{@in6=@private2, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in6=@initdev}}, &(0x7f0000000300)=0xe8) lchown(&(0x7f0000000000)='./file0\x00', r11, 0xee00) io_uring_enter(r1, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1960.272597][T19342] ? uhid_dev_create2+0x7c0/0x7c0 [ 1960.277657][T19342] task_work_run+0xdd/0x190 [ 1960.282557][T19342] exit_to_user_mode_prepare+0x17e/0x1a0 [ 1960.288226][T19342] syscall_exit_to_user_mode+0x38/0x260 [ 1960.294223][T19342] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 1960.300730][T19342] RIP: 0033:0x45e159 [ 1960.305163][T19342] Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1960.324794][T19342] RSP: 002b:00007f1e3e27ac68 EFLAGS: 00000246 ORIG_RAX: 0000000000000021 [ 1960.333233][T19342] RAX: 0000000000000005 RBX: 0000000000000007 RCX: 000000000045e159 [ 1960.341832][T19342] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000006 [ 1960.349863][T19342] RBP: 00007f1e3e27aca0 R08: 0000000000000000 R09: 0000000000000000 [ 1960.357850][T19342] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 1960.365839][T19342] R13: 00000000016afb7f R14: 00007f1e3e27b9c0 R15: 000000000119bf8c 17:44:04 executing program 5 (fault-call:6 fault-nth:5): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) 17:44:04 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x81000000}, 0x0) 17:44:04 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)) syz_io_uring_submit(r1, 0x0, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x5, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000000)='./file0\x00', 0x54bb9bd88f3ccfcf, 0x0, 0x12345}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1960.585968][T19363] netlink: 'syz-executor.3': attribute type 14 has an invalid length. [ 1960.667967][ T7] hid-generic 0000:0000:0000.02C5: item fetching failed at offset 19/22 [ 1960.701667][ T7] hid-generic: probe of 0000:0000:0000.02C5 failed with error -22 17:44:05 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0xf1ffffff, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:44:05 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x40000, 0x40}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x521600, 0x0) ioctl$SNDCTL_TMR_METRONOME(r3, 0x40045407) 17:44:05 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x5865, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) [ 1960.738222][T19388] FAULT_INJECTION: forcing a failure. [ 1960.738222][T19388] name failslab, interval 1, probability 0, space 0, times 0 17:44:05 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x88a8ffff}, 0x0) [ 1960.821381][T19388] CPU: 1 PID: 19388 Comm: syz-executor.5 Not tainted 5.10.0-rc7-syzkaller #0 [ 1960.830186][T19388] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1960.840268][T19388] Call Trace: [ 1960.843627][T19388] dump_stack+0x107/0x163 [ 1960.847991][T19388] should_fail.cold+0x5/0xa [ 1960.852522][T19388] ? call_usermodehelper_setup+0x94/0x2f0 [ 1960.858742][T19388] ? call_usermodehelper_setup+0x94/0x2f0 [ 1960.864498][T19388] should_failslab+0x5/0x10 [ 1960.869203][T19388] kmem_cache_alloc_trace+0x55/0x360 [ 1960.874526][T19388] call_usermodehelper_setup+0x94/0x2f0 [ 1960.880224][T19388] ? kobj_ns_initial+0x90/0x90 [ 1960.885655][T19388] kobject_uevent_env+0xf83/0x1680 [ 1960.890815][T19388] ? software_node_notify+0xf8/0x2e0 [ 1960.896138][T19388] device_del+0x91f/0xec0 [ 1960.900507][T19388] ? device_link_add_missing_supplier_links+0x370/0x370 [ 1960.907508][T19388] hid_destroy_device+0xe1/0x150 [ 1960.912466][T19388] uhid_char_release+0xd5/0x1b0 [ 1960.918356][T19388] __fput+0x285/0x920 [ 1960.922984][T19388] ? uhid_dev_create2+0x7c0/0x7c0 [ 1960.928044][T19388] task_work_run+0xdd/0x190 [ 1960.932576][T19388] exit_to_user_mode_prepare+0x17e/0x1a0 [ 1960.938243][T19388] syscall_exit_to_user_mode+0x38/0x260 [ 1960.944318][T19388] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 1960.951242][T19388] RIP: 0033:0x45e159 [ 1960.955169][T19388] Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1960.974791][T19388] RSP: 002b:00007f1e3e27ac68 EFLAGS: 00000246 ORIG_RAX: 0000000000000021 [ 1960.983228][T19388] RAX: 0000000000000005 RBX: 0000000000000007 RCX: 000000000045e159 [ 1960.991215][T19388] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000006 [ 1960.999205][T19388] RBP: 00007f1e3e27aca0 R08: 0000000000000000 R09: 0000000000000000 [ 1961.007284][T19388] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 1961.015283][T19388] R13: 00000000016afb7f R14: 00007f1e3e27b9c0 R15: 000000000119bf8c 17:44:05 executing program 5 (fault-call:6 fault-nth:6): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) 17:44:05 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)) syz_io_uring_submit(r1, 0x0, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x5, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000000)='./file0\x00', 0x54bb9bd88f3ccfcf, 0x0, 0x12345}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:44:05 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = open_tree(0xffffffffffffffff, 0x0, 0x0) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000100)={r0}, 0x8) r2 = syz_io_uring_setup(0x83, &(0x7f0000000080)={0x0, 0x0, 0x10, 0x0, 0x0, 0x0, r1}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r2, 0x2039, 0x0, 0x0, 0x0, 0x0) r5 = eventfd(0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r9, 0xae60) r10 = eventfd(0x0) r11 = dup3(r9, r7, 0x0) ioctl$KVM_IRQFD(r11, 0x4020ae76, &(0x7f0000000100)={r5, 0x0, 0x0, r10, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) ioctl$KVM_IRQFD(r11, 0x4020ae76, &(0x7f0000000100)={r5, 0x0, 0x2, r5, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) ioctl$VT_ACTIVATE(r11, 0x5606, 0xc000000000000) 17:44:05 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)) syz_io_uring_submit(r1, 0x0, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x5, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000000)='./file0\x00', 0x54bb9bd88f3ccfcf, 0x0, 0x12345}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1961.286820][ T9806] hid-generic 0000:0000:0000.02C6: item fetching failed at offset 19/22 [ 1961.324001][ T9806] hid-generic: probe of 0000:0000:0000.02C6 failed with error -22 17:44:05 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x9effffff}, 0x0) 17:44:05 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0xffffa888, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) [ 1961.372426][T19430] FAULT_INJECTION: forcing a failure. [ 1961.372426][T19430] name fail_usercopy, interval 1, probability 0, space 0, times 0 17:44:05 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x6000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) [ 1961.445858][T19430] CPU: 0 PID: 19430 Comm: syz-executor.5 Not tainted 5.10.0-rc7-syzkaller #0 [ 1961.455147][T19430] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1961.465223][T19430] Call Trace: [ 1961.468539][T19430] dump_stack+0x107/0x163 [ 1961.472911][T19430] should_fail.cold+0x5/0xa [ 1961.478156][T19430] _copy_to_user+0x2c/0x150 [ 1961.482688][T19430] simple_read_from_buffer+0xcc/0x160 [ 1961.488416][T19430] proc_fail_nth_read+0x187/0x220 [ 1961.494629][T19430] ? proc_exe_link+0x1d0/0x1d0 [ 1961.500509][T19430] ? security_file_permission+0x248/0x560 [ 1961.507031][T19430] ? proc_exe_link+0x1d0/0x1d0 [ 1961.512545][T19430] vfs_read+0x1b5/0x570 [ 1961.517256][T19430] ksys_read+0x12d/0x250 [ 1961.521723][T19430] ? vfs_write+0xa30/0xa30 [ 1961.526544][T19430] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1961.532949][T19430] do_syscall_64+0x2d/0x70 [ 1961.537460][T19430] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 1961.544185][T19430] RIP: 0033:0x417a51 [ 1961.548571][T19430] Code: 75 14 b8 00 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 04 1b 00 00 c3 48 83 ec 08 e8 6a fc ff ff 48 89 04 24 b8 00 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 b3 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01 [ 1961.568614][T19430] RSP: 002b:00007f1e3e27ac70 EFLAGS: 00000293 ORIG_RAX: 0000000000000000 [ 1961.577539][T19430] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000417a51 [ 1961.586215][T19430] RDX: 000000000000000f RSI: 00007f1e3e27acb0 RDI: 0000000000000007 [ 1961.594907][T19430] RBP: 00007f1e3e27aca0 R08: 0000000000000000 R09: 0000000000000000 [ 1961.603636][T19430] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000006 [ 1961.611635][T19430] R13: 00000000016afb7f R14: 00007f1e3e27b9c0 R15: 000000000119bf8c 17:44:05 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) 17:44:06 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, 0x0, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:44:06 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = open_tree(0xffffffffffffffff, 0x0, 0x0) r1 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@initdev={0xfe, 0x88, [], 0x1, 0x0}}, 0x14) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_setup(0x6cea, &(0x7f0000000240)={0x0, 0x91f3, 0x10, 0x2, 0x2f9, 0x0, r1}, &(0x7f0000ee8000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000100), &(0x7f0000000300)) syz_io_uring_setup(0x57c6, &(0x7f0000000340)={0x0, 0xb0d1, 0x10, 0x1, 0xdf, 0x0, r0}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ee7000/0x1000)=nil, &(0x7f00000003c0)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0xd}, &(0x7f00000001c0)='./file0\x00', 0x18}, 0x6) io_uring_enter(r1, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:44:06 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0xb9deedc4}, 0x0) 17:44:06 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0xfffff000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) [ 1961.898730][T32372] hid-generic 0000:0000:0000.02C7: item fetching failed at offset 19/22 [ 1961.948538][T32372] hid-generic: probe of 0000:0000:0000.02C7 failed with error -22 17:44:06 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x6558, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:44:06 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, 0x0, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:44:06 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r4 = dup2(r3, r2) r5 = eventfd(0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r9, 0xae60) r10 = eventfd(0x0) r11 = dup3(r9, r7, 0x0) ioctl$KVM_IRQFD(r11, 0x4020ae76, &(0x7f0000000100)={r5, 0x0, 0x0, r10, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) ioctl$VHOST_SET_VRING_ERR(r4, 0x4008af22, &(0x7f0000000000)={0x3, r10}) 17:44:06 executing program 1: r0 = socket$packet(0x11, 0x2, 0x300) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'bond0\x00', 0x0}) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000300)={'batadv0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@newlink={0x44, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc, 0x1, 'macvlan\x00'}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r2}, @IFLA_MASTER={0x8, 0xa, r4}]}, 0x44}}, 0x0) openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r5 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r6, r7, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r5, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1962.187215][ T7] hid-generic 0000:0000:0000.02C8: item fetching failed at offset 19/22 17:44:06 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, 0x0, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:44:06 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0xc4eddeb9}, 0x0) 17:44:06 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0xffffff7f, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) [ 1962.229556][ T7] hid-generic: probe of 0000:0000:0000.02C8 failed with error -22 [ 1962.300806][T19526] batman_adv: batadv0: Adding interface: macvlan2 17:44:06 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x6800, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) [ 1962.337048][T19526] batman_adv: batadv0: The MTU of interface macvlan2 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1962.401401][T19526] batman_adv: batadv0: Not using interface macvlan2 (retrying later): interface not active [ 1962.515239][T19531] batman_adv: batadv0: Adding interface: macvlan3 17:44:06 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000000)='./file0\x00', 0x54bb9bd88f3ccfcf, 0x0, 0x12345}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:44:06 executing program 5: r0 = eventfd(0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r5 = eventfd(0x0) r6 = dup3(r4, r2, 0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000040)={r0, 0x1, 0xffffffff, r5, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) ioctl$KVM_IRQFD(r6, 0x4020ae76, &(0x7f0000000100)={r0, 0x0, 0x2, r0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) ioctl$SNDCTL_SEQ_SYNC(r6, 0x5101) read(r2, &(0x7f0000000280)=""/74, 0x4a) r7 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r8 = dup(r7) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) r9 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r9, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3"], 0x12e) r10 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r10, r9) [ 1962.540396][T19531] batman_adv: batadv0: The MTU of interface macvlan3 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1962.610443][T19531] batman_adv: batadv0: Not using interface macvlan3 (retrying later): interface not active 17:44:07 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = open_tree(0xffffffffffffffff, 0x0, 0x0) r1 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x400c6615, &(0x7f0000000280)={0x0, @aes128, 0x0, @desc4}) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r1, 0x2039, 0x0, 0x0, 0x0, 0x0) sendmsg$IPCTNL_MSG_CT_DELETE(r0, &(0x7f0000000240)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x1f4, 0x2, 0x1, 0x101, 0x0, 0x0, {0x1}, [@CTA_MARK={0x8}, @CTA_SYNPROXY={0xc, 0x18, 0x0, 0x1, [@CTA_SYNPROXY_ISN={0x8, 0x1, 0x1, 0x0, 0x6}]}, @CTA_NAT_DST={0x20, 0xd, 0x0, 0x1, [@CTA_NAT_V4_MINIP={0x8, 0x1, @multicast1}, @CTA_NAT_V6_MAXIP={0x14, 0x5, @private0}]}, @CTA_LABELS_MASK={0x28, 0x17, [0x81, 0x7, 0xfffffffa, 0x2f7, 0x4, 0x9cca, 0x5, 0x40, 0xcc62]}, @CTA_MARK_MASK={0x8}, @CTA_NAT_DST={0x20, 0xd, 0x0, 0x1, [@CTA_NAT_V6_MAXIP={0x14, 0x5, @initdev={0xfe, 0x88, [], 0x0, 0x0}}, @CTA_NAT_V4_MINIP={0x8, 0x1, @multicast2}]}, @CTA_TUPLE_ORIG={0x30, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast2}, {0x8, 0x2, @remote}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6, 0x12, 0x1, 0x0, 0x3}, @CTA_NAT_DST={0xb4, 0xd, 0x0, 0x1, [@CTA_NAT_PROTO={0x4}, @CTA_NAT_V6_MINIP={0x14, 0x4, @initdev={0xfe, 0x88, [], 0x0, 0x0}}, @CTA_NAT_PROTO={0x24, 0x3, 0x0, 0x1, [@CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e22}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e23}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e23}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e23}]}, @CTA_NAT_V6_MINIP={0x14, 0x4, @local}, @CTA_NAT_V6_MAXIP={0x14, 0x5, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @CTA_NAT_V6_MAXIP={0x14, 0x5, @rand_addr=' \x01\x00'}, @CTA_NAT_V4_MINIP={0x8, 0x1, @local}, @CTA_NAT_V6_MINIP={0x14, 0x4, @mcast2}, @CTA_NAT_V6_MINIP={0x14, 0x4, @private0}, @CTA_NAT_V4_MINIP={0x8, 0x1, @local}]}, @CTA_TUPLE_MASTER={0x70, 0xe, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x84}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x84}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x21}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}]}]}, 0x1f4}, 0x1, 0x0, 0x0, 0x801}, 0x30000004) 17:44:07 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0xf0ffffff}, 0x0) 17:44:07 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x6c00, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:44:07 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0xffffff9e, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:44:07 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000000)='./file0\x00', 0x54bb9bd88f3ccfcf, 0x0, 0x12345}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1962.843967][T22685] hid-generic 0000:0000:0000.02C9: item fetching failed at offset 19/22 [ 1962.866255][T22685] hid-generic: probe of 0000:0000:0000.02C9 failed with error -22 17:44:07 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000000)='./file0\x00', 0x54bb9bd88f3ccfcf, 0x0, 0x12345}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:44:07 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = eventfd(0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r5 = eventfd(0x0) r6 = dup3(r4, r2, 0x0) ioctl$KVM_IRQFD(r6, 0x4020ae76, &(0x7f0000000100)={r0, 0x0, 0x0, r5, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) ioctl$KVM_IRQFD(r6, 0x4020ae76, &(0x7f0000000100)={r0, 0x0, 0x2, r0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) ioctl$USBDEVFS_CONNECTINFO(r6, 0x40085511, &(0x7f0000000100)) r7 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r8, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r8, r9, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) ioctl$sock_inet6_SIOCDELRT(r10, 0x890c, &(0x7f0000000240)={@empty, @rand_addr=' \x01\x00', @remote, 0x0, 0x6e96, 0xfff7, 0x100, 0x400, 0x4000000}) io_uring_enter(r7, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1963.029264][T22685] hid-generic 0000:0000:0000.02CA: item fetching failed at offset 19/22 [ 1963.072821][T22685] hid-generic: probe of 0000:0000:0000.02CA failed with error -22 [ 1963.087430][T19619] __nla_validate_parse: 46 callbacks suppressed [ 1963.087443][T19619] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'. 17:44:07 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3000000000000000000"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) 17:44:07 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0xf1ffffff}, 0x0) 17:44:07 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x54bb9bd88f3ccfcf, 0x0, 0x12345}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1963.262190][T19614] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 17:44:07 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0xfffffff0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) [ 1963.343063][T19666] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'. 17:44:07 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x7400, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:44:07 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_setup(0x87, &(0x7f0000000180), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, 0x0, 0x0, 0x4) r4 = socket$rds(0x15, 0x5, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r4}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_FALLOCATE={0x11, 0x4, 0x0, @fd_index=0x7, 0x162d, 0x0, 0x1, 0x0, 0x1}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:44:07 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x54bb9bd88f3ccfcf, 0x0, 0x12345}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:44:07 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) r3 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x80000, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) r7 = eventfd(0x0) r8 = dup3(r6, r5, 0x0) ioctl$KVM_IRQFD(r8, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r7, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) ioctl$KVM_IRQFD(r8, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x2, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) ioctl$UFFDIO_REGISTER(r8, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffa000/0x3000)=nil, 0x3000}, 0x1}) ioctl$SNDCTL_SEQ_RESET(r3, 0x5100) write$UHID_CREATE2(r2, &(0x7f00000002c0)=ANY=[@ANYRES64=r1], 0x12e) r9 = creat(&(0x7f0000000100)='./bus\x00', 0x0) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) dup2(r9, r2) [ 1963.514563][T19682] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 17:44:07 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0xfcffffff}, 0x0) [ 1963.609932][T19681] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'. 17:44:07 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x54bb9bd88f3ccfcf, 0x0, 0x12345}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1963.719805][T19682] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 17:44:08 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=@newqdisc={0x148, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_red={{0x8, 0x1, 'red\x00'}, {0x11c, 0x2, [@TCA_RED_STAB={0x104, 0x2, "5fcea2720370debdcd7796d58f06204365cf0a7f6ec14f5e0f9985c451186950aacedbcbe8f6a3261d7e7e850aae5683e9a7045dea2dbc096e6c1bdd9536d8acf4c29b1458627f0b19c8869aad0e53d580eb8cea889860430f40d1c3e29166a8bb2709638caf0ab36da7f2f7b05221eebd323c73f2be7b30bd689717a3c6b23984f0cd4bcc67e34f576f4ea3d016abcd4819b7ed59fdb44820cb7b1fe6630ab67c2a1df18846d4892f10220761ee1647601f89474bdf251e5f982d49afe9b2aeeb930836775e51f0c131bfdc98fb918b1bd627a0b3f781794eab45b26913592c85e470b8345cefd3530bac20a9634f7ce8e9599c3d59e69afaffee9b6e03aeaf"}, @TCA_RED_PARMS={0x14}]}}]}, 0x148}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="24180000002a00390d00"/21, @ANYRES32=r3, @ANYBLOB='\x00'/12], 0x24}, 0xe}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=@newqdisc={0x148, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_red={{0x8, 0x1, 'red\x00'}, {0x11c, 0x2, [@TCA_RED_STAB={0x104, 0x2, "5fcea2720370debdcd7796d58f06204365cf0a7f6ec14f5e0f9985c451186950aacedbcbe8f6a3261d7e7e850aae5683e9a7045dea2dbc096e6c1bdd9536d8acf4c29b1458627f0b19c8869aad0e53d580eb8cea889860430f40d1c3e29166a8bb2709638caf0ab36da7f2f7b05221eebd323c73f2be7b30bd689717a3c6b23984f0cd4bcc67e34f576f4ea3d016abcd4819b7ed59fdb44820cb7b1fe6630ab67c2a1df18846d4892f10220761ee1647601f89474bdf251e5f982d49afe9b2aeeb930836775e51f0c131bfdc98fb918b1bd627a0b3f781794eab45b26913592c85e470b8345cefd3530bac20a9634f7ce8e9599c3d59e69afaffee9b6e03aeaf"}, @TCA_RED_PARMS={0x14}]}}]}, 0x148}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000540)=ANY=[@ANYBLOB="240000002aff390d0000000000000000000000005ee96cb9a186da348b7ebccb26489bc0446173996418f7fc4e15dad85bc9a08adf782e5ede0b68d475b59a716b3a28a5c6d36e12caf2600bd6251765eb23f52e9890848e0c04ba78482024b801cbbb9211f48b202adb55deb41cf27ef3e2fdf8c16b3559d7116bed017ccb43f5236cc59e8eab5fa3ce51c47d15", @ANYRES32=r8, @ANYBLOB='\x00'/12], 0x24}, 0xe}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000000e00)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000dc0)={&(0x7f00000012c0)={0x884, 0x0, 0x200, 0x70bd2a, 0x25dfdbfe, {}, [{{0x8}, {0x134, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x5}, {0x8, 0x4, 0x7}}, {0x8}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x5}, {0x4}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x5}, {0x8, 0x4, 0x80000000}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x5}, {0x8, 0x4, 0x8001}}, {0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0x258, 0x2, 0x0, 0x1, [{0x5c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x5}, {0x2c, 0x4, [{0x5, 0x7f, 0x8, 0xa38}, {0x0, 0x55, 0xa8, 0x3}, {0x40, 0x7f, 0x3f, 0xfff}, {0x8, 0x1f, 0x7, 0x8}, {0x6, 0x0, 0xd0, 0x6}]}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x5}, {0x8, 0x4, 0x100}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x5}, {0x8}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x5}, {0x4}}, {0x8}}}, {0x5c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x5}, {0x2c, 0x4, [{0x2, 0x1f, 0x8, 0x1}, {0x4, 0x80, 0x2, 0x2a4e}, {0x8000, 0x5, 0x4, 0x800}, {0x6, 0x3f, 0x4, 0x2}, {0x2, 0x9, 0x0, 0x7ff}]}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x5}, {0x8, 0x4, 0x5}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x5}, {0x10, 0x4, 'loadbalance\x00'}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x5}, {0x8, 0x4, 0xffff}}, {0x8}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x5}, {0x8, 0x4, 0xc5}}}]}}, {{0x8}, {0x7c, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x5}, {0x8, 0x4, 0x200}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x5}, {0x8}}}]}}, {{0x8}, {0x50, 0x2, 0x0, 0x1, [{0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}]}}, {{0x8}, {0x168, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x5}, {0x8, 0x4, 0x80}}, {0x8}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x5}, {0x8, 0x4, 0x6}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x5}, {0x8}}, {0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x5}, {0x4}}, {0x8}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x5}, {0x8, 0x4, 0x7f}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x5}, {0x8, 0x4, 0x8}}}]}}, {{0x8, 0x1, r3}, {0xf4, 0x2, 0x0, 0x1, [{0x6c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x5}, {0x3c, 0x4, [{0xfff, 0x2, 0x2, 0x81}, {0x2, 0x7, 0x1, 0x1}, {0x1, 0xfd, 0x8, 0x2}, {0x7, 0x9, 0x8, 0x131}, {0x4, 0x1f, 0x3, 0x4}, {0x2, 0x20, 0x9, 0x100}, {0xfff8, 0x3f, 0x5, 0x10000}]}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x5}, {0x10, 0x4, 'loadbalance\x00'}}}, {0x44, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x5}, {0x11, 0x4, 'activebackup\x00'}}}]}}, {{0x8}, {0x184, 0x2, 0x0, 0x1, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x5}, {0x4}}, {0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x5}, {0x4}}, {0x8, 0x6, r8}}}, {0x4c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x5}, {0x1c, 0x4, [{0x800, 0x4, 0xea, 0x1}, {0x3, 0xf7, 0x80, 0x80000000}, {0xfffc, 0x1, 0x5b, 0x3ff}]}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x5}, {0x8, 0x4, 0x3}}, {0x8}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x5}, {0xf, 0x4, 'roundrobin\x00'}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x5}, {0x4}}, {0x8}}}]}}]}, 0x884}, 0x1, 0x0, 0x0, 0x80}, 0xc1) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1963.797231][T19703] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'. 17:44:08 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x12345}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:44:08 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x7a00, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) [ 1963.980182][T19694] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1963.998385][T19706] validate_nla: 24 callbacks suppressed [ 1963.998400][T19706] netlink: 'syz-executor.0': attribute type 16 has an invalid length. 17:44:08 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1964.027091][T19720] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'. 17:44:08 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) dup(r0) creat(&(0x7f0000000000)='./bus\x00', 0x3a) openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0x20000, 0x0) r1 = eventfd(0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) r6 = eventfd(0x0) r7 = dup3(r5, r3, 0x0) ioctl$KVM_IRQFD(r7, 0x4020ae76, &(0x7f0000000100)={r1, 0x0, 0x0, r6, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) ioctl$KVM_IRQFD(r7, 0x4020ae76, &(0x7f0000000100)={r1, 0x0, 0x2, r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) eventfd(0x2b7) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x80000000000085) r8 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r8, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3"], 0x12e) r9 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r9, r8) 17:44:08 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0xfffffff1, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) [ 1964.108808][T19703] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'. [ 1964.170865][T19744] netlink: 'syz-executor.3': attribute type 14 has an invalid length. [ 1964.196072][T19744] netlink: 'syz-executor.3': attribute type 14 has an invalid length. 17:44:08 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0xffffa888}, 0x0) 17:44:08 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:44:08 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) eventfd2(0x9, 0x80000) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:44:08 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x8100, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) [ 1964.350467][T19758] netlink: 'syz-executor.0': attribute type 16 has an invalid length. [ 1964.414860][T19775] netlink: 'syz-executor.0': attribute type 16 has an invalid length. 17:44:08 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:44:08 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = open_tree(0xffffffffffffffff, 0x0, 0x0) r1 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) fsetxattr$trusted_overlay_opaque(r4, &(0x7f0000000100)='trusted.overlay.opaque\x00', &(0x7f0000000240)='y\x00', 0x2, 0x1) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) ioctl$SNDRV_CTL_IOCTL_HWDEP_NEXT_DEVICE(r0, 0xc0045520, &(0x7f0000000000)=0x9) io_uring_enter(r1, 0x2039, 0x0, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ee6000/0x3000)=nil, 0x3000, 0x2000000, 0x810, r1, 0x10000000) 17:44:08 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3"], 0x12e) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x40, 0x0) ioctl$SOUND_PCM_READ_RATE(r3, 0x80045002, &(0x7f0000000040)) r4 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r4, r2) 17:44:08 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0xffffffff, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) [ 1964.585598][T19786] netlink: 'syz-executor.3': attribute type 14 has an invalid length. [ 1964.611246][T19786] netlink: 'syz-executor.3': attribute type 14 has an invalid length. 17:44:08 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0xfffff000}, 0x0) 17:44:09 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:44:09 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0xf000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) [ 1964.732288][ T6101] hid-generic 0000:0000:0000.02CB: item fetching failed at offset 19/22 [ 1964.753120][T19805] netlink: 'syz-executor.0': attribute type 16 has an invalid length. [ 1964.762567][ T6101] hid-generic: probe of 0000:0000:0000.02CB failed with error -22 [ 1964.796240][T19810] netlink: 'syz-executor.0': attribute type 16 has an invalid length. [ 1964.858103][ T17] hid-generic 0000:0000:0000.02CC: item fetching failed at offset 19/22 [ 1964.885336][ T17] hid-generic: probe of 0000:0000:0000.02CC failed with error -22 17:44:09 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) ptrace$peekuser(0x3, 0xffffffffffffffff, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = eventfd(0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r5 = eventfd(0x0) r6 = dup3(r4, r2, 0x0) ioctl$KVM_IRQFD(r6, 0x4020ae76, &(0x7f0000000100)={r0, 0x0, 0x0, r5, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) ioctl$KVM_IRQFD(r6, 0x4020ae76, &(0x7f0000000100)={r0, 0x0, 0x2, r0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) ioctl$RTC_EPOCH_READ(r6, 0x8008700d, &(0x7f0000000080)) r7 = syz_io_uring_setup(0x1efa, &(0x7f0000000240)={0x0, 0x1, 0x20, 0x1, 0x368, 0x0, r6}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r8, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r8, r9, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r7, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:44:09 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:44:09 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:44:09 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3"], 0x12e) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x204000, 0x0) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) [ 1965.016697][T19831] netlink: 'syz-executor.3': attribute type 14 has an invalid length. [ 1965.129245][T22685] hid-generic 0000:0000:0000.02CD: item fetching failed at offset 19/22 17:44:09 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0xffffff7f}, 0x0) [ 1965.169901][T22685] hid-generic: probe of 0000:0000:0000.02CD failed with error -22 17:44:09 executing program 4: syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r0, r1, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x8) io_uring_enter(0xffffffffffffffff, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1965.251816][T22685] hid-generic 0000:0000:0000.02CE: item fetching failed at offset 19/22 17:44:09 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0xf582, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) [ 1965.293968][T22685] hid-generic: probe of 0000:0000:0000.02CE failed with error -22 17:44:09 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x2, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:44:09 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) r3 = eventfd(0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r7, 0xae60) r8 = eventfd(0x0) ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) r9 = dup3(r7, r5, 0x0) ioctl$KVM_IRQFD(r9, 0x4020ae76, &(0x7f0000000100)={r3, 0x0, 0x0, r8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) r10 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/nat_icmp_send\x00', 0x2, 0x0) ioctl$TUNSETIFF(r10, 0x400454ca, &(0x7f0000000040)={'gretap0\x00'}) ioctl$KVM_IRQFD(r9, 0x4020ae76, &(0x7f0000000100)={r3, 0xc1a, 0x4, r3, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) write$UHID_CREATE2(r2, &(0x7f0000000080)=ANY=[], 0x12e) r11 = creat(&(0x7f0000000100)='./bus\x00', 0x21) dup2(r11, r2) 17:44:09 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080)={0x0, 0x56cc}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:44:09 executing program 4: syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r0, r1, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x8) io_uring_enter(0xffffffffffffffff, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:44:09 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0xffffff9e}, 0x0) 17:44:09 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x3, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:44:09 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x34000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:44:10 executing program 4: syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r0, r1, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x8) io_uring_enter(0xffffffffffffffff, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:44:10 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a35000000000c0000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) 17:44:10 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = open_tree(0xffffffffffffffff, 0x0, 0x0) r1 = syz_io_uring_setup(0x733, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x4}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_setup(0x736a, &(0x7f0000000240)={0x0, 0x8, 0x0, 0x3, 0xa5, 0x0, r0}, &(0x7f0000ee8000/0x2000)=nil, &(0x7f0000ee9000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000100)=0x0) syz_io_uring_setup(0x87, &(0x7f0000000180), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0) seccomp$SECCOMP_SET_MODE_FILTER(0x1, 0x2, &(0x7f0000000380)={0x6, &(0x7f00000003c0)=[{0x1db, 0x2, 0x8, 0xff}, {0xfff8, 0x6, 0x8, 0x3b5}, {0x9, 0x9b, 0xe1, 0x8}, {0x7, 0x3, 0x1, 0x6}, {0x8, 0x7f, 0x40, 0xffffffff}, {0x401, 0x7, 0x1, 0x3}]}) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x40, 0x0, 0x0, 0x4) r6 = socket$rds(0x15, 0x5, 0x0) syz_io_uring_submit(r4, r5, &(0x7f0000000200)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r6}, 0x0) syz_io_uring_submit(r4, r3, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x4, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f0000000300)='./file0\x00', 0x18}, 0x1d) io_uring_enter(r1, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:44:10 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x4, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:44:10 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x8) io_uring_enter(r0, 0x0, 0x0, 0x0, 0x0, 0x0) 17:44:10 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0xfffffff0}, 0x0) [ 1965.905308][T28129] hid-generic 0000:0000:0000.02CF: item fetching failed at offset 19/22 [ 1965.942273][T28129] hid-generic: probe of 0000:0000:0000.02CF failed with error -22 17:44:10 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x400300, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) [ 1966.020288][ T17] hid-generic 0000:0000:0000.02D0: item fetching failed at offset 19/22 [ 1966.048241][ T17] hid-generic: probe of 0000:0000:0000.02D0 failed with error -22 17:44:10 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x802, 0x0) r0 = open_tree(0xffffffffffffffff, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r0, 0xc05c5340, &(0x7f0000000240)={0x1, 0x4, 0x1ff, {0x8, 0x1}, 0x5d, 0xf7}) r1 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r3 = eventfd(0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r7, 0xae60) r8 = eventfd(0x2) r9 = dup3(r7, r5, 0x0) ioctl$KVM_IRQFD(r9, 0x4020ae76, &(0x7f0000000100)={r3, 0x0, 0x0, r8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) ioctl$KVM_IRQFD(r9, 0x4020ae76, &(0x7f0000000100)={r3, 0x0, 0x2, r3, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) accept$inet(r9, &(0x7f0000000100)={0x2, 0x0, @multicast2}, &(0x7f0000000180)=0x10) ioctl$BLKRRPART(r0, 0x125f, 0x0) io_uring_enter(r1, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:44:10 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x8) io_uring_enter(r0, 0x0, 0x0, 0x0, 0x0, 0x0) 17:44:10 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) r4 = eventfd(0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r8, 0xae60) r9 = eventfd(0x0) r10 = dup3(r8, r6, 0x0) ioctl$KVM_IRQFD(r10, 0x4020ae76, &(0x7f0000000100)={r4, 0x0, 0x0, r9, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) ioctl$KVM_IRQFD(r10, 0x4020ae76, &(0x7f0000000100)={r4, 0x0, 0x2, r4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) open_by_handle_at(r10, &(0x7f0000000000)={0x92, 0x9, "104e3ff5aaf1b0d8ee0536d5f5f39d0cf97ab738e929c225b2ff7e9bd9f0664c953e57a76fa0ddf6ec8d8cc5991eb2b07089d522e2aa214006ce58c264117f998141ea4ddf725af8e43e57d36fa20d3a4daaecb047dc42c2aa2c534423209838d31268f2491b3c0f66f1628b5dc80ada82ef0853ac3cb8fe2462e979297ff9e075dc691e9fe1d3326ddc"}, 0x20000) 17:44:10 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x8) io_uring_enter(r0, 0x0, 0x0, 0x0, 0x0, 0x0) [ 1966.300926][T22685] hid-generic 0000:0000:0000.02D1: item fetching failed at offset 19/22 17:44:10 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0xfffffff1}, 0x0) 17:44:10 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x5, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:44:10 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0xf0ffff, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) [ 1966.367555][T22685] hid-generic: probe of 0000:0000:0000.02D1 failed with error -22 17:44:10 executing program 4 (fault-call:2 fault-nth:0): r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:44:10 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r0, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r1 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) r4 = eventfd(0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r8, 0xae60) r9 = eventfd(0x0) r10 = dup3(r8, r6, 0x0) ioctl$KVM_IRQFD(r10, 0x4020ae76, &(0x7f0000000100)={r4, 0x0, 0x0, r9, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) ioctl$KVM_IRQFD(r10, 0x4020ae76, &(0x7f0000000100)={r4, 0x0, 0x2, r4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) getsockopt$IPT_SO_GET_REVISION_MATCH(r10, 0x0, 0x42, &(0x7f0000000100)={'ah\x00'}, &(0x7f0000000240)=0x1e) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) setrlimit(0xe, &(0x7f0000000000)={0x1, 0x1}) io_uring_enter(r1, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:44:10 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./bus\x00', 0x400, 0x9) ioctl$F2FS_IOC_WRITE_CHECKPOINT(r4, 0xf507, 0x0) write$P9_RREADLINK(r3, &(0x7f0000000080)={0xe, 0x17, 0x1, {0x5, './bus'}}, 0xe) setsockopt$RXRPC_MIN_SECURITY_LEVEL(r3, 0x110, 0x4, &(0x7f0000000000), 0x4) [ 1966.749636][T20036] FAULT_INJECTION: forcing a failure. [ 1966.749636][T20036] name failslab, interval 1, probability 0, space 0, times 0 [ 1966.778864][T20036] CPU: 1 PID: 20036 Comm: syz-executor.4 Not tainted 5.10.0-rc7-syzkaller #0 [ 1966.787702][T20036] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1966.797792][T20036] Call Trace: [ 1966.801138][T20036] dump_stack+0x107/0x163 [ 1966.802637][ T5] hid-generic 0000:0000:0000.02D2: item fetching failed at offset 19/22 [ 1966.805482][T20036] should_fail.cold+0x5/0xa [ 1966.805513][T20036] should_failslab+0x5/0x10 [ 1966.805532][T20036] kmem_cache_alloc_bulk+0x4b/0x450 [ 1966.805565][T20036] ? percpu_counter_add_batch+0xbd/0x180 [ 1966.833703][T20036] io_submit_sqes+0x146d/0x28a0 [ 1966.838593][T20036] ? io_queue_sqe+0x11f0/0x11f0 [ 1966.843454][T20036] ? __do_sys_io_uring_enter+0xc84/0x1ab0 [ 1966.846774][ T5] hid-generic: probe of 0000:0000:0000.02D2 failed with error -22 [ 1966.849215][T20036] ? mutex_lock_io_nested+0xf60/0xf60 [ 1966.849246][T20036] ? __fget_files+0x294/0x400 [ 1966.849279][T20036] __do_sys_io_uring_enter+0xc90/0x1ab0 [ 1966.849306][T20036] ? __mutex_unlock_slowpath+0xe2/0x610 [ 1966.849329][T20036] ? io_submit_sqes+0x28a0/0x28a0 [ 1966.883256][T20036] ? wait_for_completion+0x260/0x260 [ 1966.888568][T20036] ? vfs_write+0x18e/0xa30 [ 1966.892998][T20036] ? fput_many+0x2f/0x1a0 [ 1966.897478][T20036] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1966.903413][T20036] do_syscall_64+0x2d/0x70 [ 1966.907852][T20036] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 1966.913754][T20036] RIP: 0033:0x45e159 [ 1966.917664][T20036] Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1966.937288][T20036] RSP: 002b:00007f451bbc5c68 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa 17:44:11 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0xfffffffc}, 0x0) [ 1966.946529][T20036] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 000000000045e159 [ 1966.955043][T20036] RDX: 0000000000000000 RSI: 0000000000002039 RDI: 0000000000000003 [ 1966.963033][T20036] RBP: 00007f451bbc5ca0 R08: 0000000000000000 R09: 0000000000000000 [ 1966.971105][T20036] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1966.979114][T20036] R13: 00000000016afb7f R14: 00007f451bbc69c0 R15: 000000000119bf8c 17:44:11 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) read$snddsp(0xffffffffffffffff, &(0x7f0000000000)=""/170, 0xaa) 17:44:11 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x1000000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:44:11 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x6, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:44:11 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = open_tree(0xffffffffffffffff, 0x0, 0x0) r1 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = eventfd(0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r8, 0xae60) r9 = eventfd(0x0) r10 = dup3(r8, r6, 0x0) ioctl$KVM_IRQFD(r10, 0x4020ae76, &(0x7f0000000100)={r4, 0x0, 0x0, r9, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) ioctl$KVM_IRQFD(r10, 0x4020ae76, &(0x7f0000000100)={r4, 0x0, 0x2, r4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_TDLS_MGMT(r10, &(0x7f0000000300)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="020025bd7000fbdbdf255200000008000300", @ANYRES32=r11, @ANYBLOB="0c009900040000044a0000000800cb0008000000"], 0x30}, 0x1, 0x0, 0x0, 0x8010}, 0x404000c) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r1, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1967.189761][T32372] hid-generic 0000:0000:0000.02D3: item fetching failed at offset 19/22 [ 1967.215153][T32372] hid-generic: probe of 0000:0000:0000.02D3 failed with error -22 17:44:11 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0xffffffff}, 0x0) [ 1967.304829][T28129] hid-generic 0000:0000:0000.02D4: item fetching failed at offset 19/22 17:44:11 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x2000000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) [ 1967.360602][T28129] hid-generic: probe of 0000:0000:0000.02D4 failed with error -22 17:44:11 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x7, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:44:11 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x110) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r7, 0xae60) dup3(r7, r5, 0x0) ioctl$BTRFS_IOC_RM_DEV(r7, 0x5000940b, &(0x7f0000000680)={{r3}, "d9228c6f0b793802b6f936793b155214676ad9d8001a7e552c6e6de7563fbed6da4003844732416ee331b001bef9339e324a8ace6c6aa22cace7146a537a5fe23d418f9bf68d7ff37d7beeddd9efb9c7bb3ed3e6020cc121d3a88d4b49341f2f4122efeb9f2f9331554c207a43e8ab2a6ec8cc136af4b68250491d790dda1f57db46f37adcd8613679bd2a6f279d2d6e937408cd6bef84cd6757631d6519259727cb4bceb0492d0a059fe26af437d4bbe4ed4dc3fc33a241b713a4d70c0d922831c04cf6bf3eb958834febd337c99138eb8a7c9f9128cf56008cd80424d62304e62c2fcc12593e56853bea65d2bea2f0738f758aca8dadc49e3686d9f00e7968f4be4253b05caa9aabfa3bd6ca38b858c7e94e9747e8eae0d3b8c6d4dca4b35f49958ccd5e80b9a40fa18aae0954cca903e9bde7c07a8fa526ac3092023de14f4fba4b42672b6a0428bce0954a864f5b0db799f948f058eaf441849443bac4b45cb8118f3ab5cce49e48b77d22a109ac69de949f4a8aa66f2b780578b291e74113333505a77d071b399c2da74937ef5a3f912b7b2925399780777439c0b673ce2b6f24dac69106ab991125fcb2ef106ca4fcfa6675f6567783c1f994c7c8e7b6cbbcd9253331718275d09e5cf88e9412adb8f8c5ceb0a61e758df6e9f03cf06ba340875d14b2c4cc94049ad81f4a653e6f64ef0321cdda12946f640b067ef9b47d5b262d1d44ebc530c1734c26577f2ad2da91ee6c25f2e3ed5e51d68cf18497d271cce9d1b63a49b255d31facb65b78d30d0ed6892d6984bf6c5c1cf0c427d6b81b69906aa344093908f29f7cd0046eaff8c527a2ce1cb0bf3bd25141297f287e9927a47381f20fe42bbabfaa96ce2c1f359112aab90bf9530b2f0ebce178e3ed6c62dcd28cf98aa0dc79c472e52f198b9d01a27049a9b3034d078122a9192c9bce2c2108a918b6136f554d28797e2e0cfe5526e688b3da53275c6e30d21e518e94e79a950827abc3a33b3c7d73f2567f98d04419eab4c1cb924aab3618e66f58a033d59e30e71fdba0fc1e871eab83e0ac0df34c997f2b23f722fff245e18c09ba32a04c4ed8e0b177da5943da39dea2ca1f2361bf86a3d9d4997f5ab880b1eb1fd1512c267d7533d83189a01d296f214f105d12a00c3ad58b59f7f6cfba42a502da2130c783eec0a9d22fda93b59a662ea6331e1767e340bfe2e3aef538f92cf24c76834d68c7aafb129d8afa824612cc306e8d5d61c5c7aaff96645ef618c2ab02ef92645d1a9addba3963888a7ccdaa54235761312036d16f7c0153357fd3d6e069cddb4dd270e3e25108710526e434c8751261940df797039807ed2edae71e8e8fdcb26c51230ba47e103a7f8730233431253c785323c91ceece64b4058ab49e77c12006ed5ef93a93e225722501841b5dfad7c868974fd9bcd5faecd6f20586d4855344193c49f3d5ef02b186880420a896a2c55ba1ab0ba2222a90059a7bef5354d242fc737730920eeecb2d69e3e49f01d344f30329c222c69089cdb0a9ac2510d66ca03f6f6479425b0e2aa69406fbee0bd9185e25b4d8add44732f68c5bc37809dd98a4b30c093b2e200ad3bde0b99c76315525fcd19e8f0e9155b7dfb60124c7a7131b9acaab4dc0d7c926d0828b1cfbe91c87f7faaafe8a5f4298363bbfc79b6b6b292971eb4c06c1e47899fd8337e98b0c0e4335247b879a83c00bd93bf604707838b257ae2fd6194d1078303948e8acbf5d5319605f891e6cf4920006be1fc619309c8d8ed4fe7d40a38c560ec06ad4093b667a5c3dfc520ef42ea62406138edbd7ec9c01365328f9d5472c6d5c382e984198b824a80d54401b709fb6b1bd4e88fedde8881614810f9d6bbf093d09940d8ebd2367aaf45e23ce9db882d0e9f32094ff48494071136a7abe9cf8be90029098626f56be24e817e5d934534ac7eb8b90397ff7b3e6b3eafd16b0bc83ffacb66d3e3366c1bbdf0b29a40e0ddf19ec642e578571bcb87eb3a5c73dc8a230027c9f7592c07b08027ccc00f1b253a0eaa9c55926d53db325c5703e6a59d72f7eac2b0b0d1fe184ffedd6c51081d0a0b1350720e0bf1ffecdac4ff079679957ca38233849bc0c25eedbf91267c39da503479d178d7ce9e905eb1748b65768ef3ffceba0188fe1097e511783f523ea0e3d44ed1eb782cd42233643bca3b8859b218673db85a4ef642e101864d70820c98a51a3e517c85f2894846450a1c4f22a1172511bccb6edca1a0cc43ce2812944f7f206c951068d1d195fa7e9fab35a99528a6f6dbc1d442d48066f0092224c03a93eda8c375e5970aa701c0681cbf50f228d379bdba12244ec4d66ed69048fc5fb202e9ed041558de949ef0e4410e1240def8ef1794b0146862f5c51ed4d9f0fd142ec03eed41c8932a811d2fce0be2db948cf7932d4aa85e61b52cc01e363b4c7235f3714484e018fd3abb77eacf701f5d732d9bf6fceb153858c06f29e2f406be6d3ede4967ce4ee14ac7b9e84be86c28a3e97c18b06482b9d2252087df2d45a68265c8b6595a3eef6eb14062d0d751b4b882243330967c5e3411cf899bdf6135a38cb8ab47a08b23e88499e20f1cc89e7a5bc4676527d948917645760e3b944420fdea9a0b56b0bbe981a4ba3ebfe4d325881258e03df2c0e8d4e0e01c7e9742a760c6ff3716d261e4e9b6def5a7a9bebd792b0e06cadb0c6e0bbbc33894498216a1f24f1b6a35389b925f6a70e23d28add51057b35b3b0b7e6a89115fad444a1efd63bbabd15b000edf94aabdea1a06aa45c5aadf804a11782452546a7a9b949814e71e5bb5d6fe432028984e20f6b3461939ed6042e0db977b9c55ec6e466242eb74a7b284d64f84cc9ce95cf31bd0a5b65ae609e7f60bb159e2ef225a83087e4656dff3f2b0e9cdb8dabdfac71808574337b6ce99590c5bbfb96d7cdbeab236c68e26232d71415d4bb8492f1882e3792818897da69e4ab51f00c3cc6f41326fe32392f605769acd2cdbbbf4f22b62fe2286d8baa33bd22428d3d35b229433a501003f3d026156fca3106939ce86fe806fbb05e579f7d3f8325a48eb9e5cb3ed0ef5b100800321417827faf5d9ab7ea3c37d512bcd0b018c59ba620eb0515d9532e5892994f1258a1e15cebae4c5eb30facf37fe7061b20017f1b96ae88e07af6dbbbb41da375be1d03111b56ca36f0e55df09329a7abd5d19b071849dd3099d232d5f364ee77fdc7bccaa682d4d3f415a8034cc2af7cc14a3a166da4a173aa0e493acaead127718d117eec1fdff1ff01173a178426476068dc700f937494e0bd897bca6e79683c7c3aa88ed9c395ddfc2bd8b113855ca01bc659b3d25c6e01247718057bc97e9126f075cbc3887f52bec0bd40788cf58cfeda4bae94aa8bdc8b6d8d032e9829a83749ba4aabcd74cb5d93440c5b950a578cc3cbc38aaf43a8b490b02b6709de06882146955a42cd70fb1765ad8d9c8a49796ee26368a1dcc6c8e6d78b7dc88f4832113f921e39376e5a79bd5b71c55da0a7afe223d52377d4c07f9f64ec0d246abc6f6f76104a73b80ca7bb2762ce6a557ada379a60eeeba10f0a4ea6377d3064fbc743153b1c670dead8ae0aa614a55ea658d1c47ac675c3ca5062c06172af69ba95e5f40f440b180769f733cf8be8a9b7b3572695d828724e72fdf574f40a7a62f261521ffea9f6735b6080f87c32dff542986e723fe7c49547a601fe787ea96aea5c29e59067c967d3d7b784dc84932f55e29a73f31063b82bbffd6c8628d019aab9f8201430000f07da7798bf5de5a3cd20880956f0e0343ff676e370aade131055bc4cb9e7d52a3c278a954cb42ff7945d0c8a6e69cba23546c605f7495c17342e32851ed1beef367182be3aead1d57046f1bc6174887f5e6c8e81873528d1ad437e0c440b7dd071def7046a4ca78f61fd285bdc8843a768b7c32894e281d8fa89943417d828d8e51c0b77e795f600a2e82f1a51f5ba3c436a475ab86d474002447f11d97a856fbdcf49c77d93b1e9d62b947defbf02f4c21e14d7444a06adc8ceaef1ccc80ecf3e06279c20cadc15690aaa304f987c29484ec46e7079f99bc0e81a424633fc6d989368b07b39c9e3815800ca593a7613a29ec188ac4d11a5ae41017964f3117af2434323b4e791ad89b94c6db4f5ed898bd149f001fbda1f4b5cf94b9f34ed0c0cf109fc3f11c6a56cc42819baba0b4c4241a35313dedb206c5f209409c1278c6075bf52fa83473663e3c2dd11fb5c2c7c3aa01ae8e3211a90bbf1bf312dd21cc46bc7238bdfc2eb9c71ce2e4fecc00d809d4600e270d5c9d5f7586a284d845a0d154560b2de5bf0bb5df23611dea10eb0709ad3062fc8073f35066852bf5033fa9edc0db85914f6222619a288ad3a050e22bc57ebe74f20594c3cdef0a8cca9afe980e2429ac4e0e4622e9ddd6ed7181ee53da4cd84c5a3597f45c6975c8354d753f4d913cf1f526d8563e1b809fd4dcf59f5db60e5f35ec8766745d57141e00ad66d4d715605c5fdd4d7daa2d7428477e7b7382e2e4a830edcd84b16ab6848ea0bcac522e1f11cb8bace393263ca34b20eef827be97bb00195a9b8808322df24fac67fd7a60d300206d314a46c7a534b5ee1467acb9df2ef5b04d70d110b6307f4d35f78cd86ef3b18c448af126111123a4e38ce6af2d24158bd87152517fc350b3292b512676926e281c6d3f4f0baa1d31b3da90ef5901eede31107d0cdd880322ed4bed705384e31f168dddb3faea0881f6442e02ac23aa1325eae057eabe3052626a49377b01d81a81967334f3461731215c5c372bf69799746750546bc35295c253ac484688b889a96bc5299c6be1faead475b0f2297ec963c5b3e78bb1d1920726f11cfc98a5df35705d76504fe1fadb1977703cd93abc5a4a2b0a6818a9e84d8020a43b48db90c28e392d5b197af7a3a3f1c7db105d3fd156c2fd062c71bbf6bbb44ccfc08026002f3f797c47de58372cde94cbb7204803807b6e76c968e82952e0c7927ac3bc8b8ccfb9b973551e4d45b52edd24b3463637d9c1e6e031c378e49950f5f976972774121725a3ed85e45709132d4c947778a88fb80512f612516c1f1445874e1cbf40c63fd4a12204d16b7dff296f340f02295aff8031a68acab4304ccc63408cf824b6e13ff4829060997795c4da776ecd167ec8e5d4aa7d4c4f320b32e1c5cafa8241714f72dcffd625503ccc49e92f1ed560d8693649b2c66065c523148b18f1fea954387ddd9700c5abe322816c73be3ffd18115ee7f01ef4c5c58e830c248a3127ac9c466c843515cc8ae9d33d37fa38566e6ac058b888d095e6fea3668b4b51e697ca0bcbcf72051afa395726f48357435d7a19aea32f4c8d2ae499049de230f4a3a5f544ec7b0c4789088038587de64354485a2ff1607b54c6ea68d1a6e96c747d1d07cf29eb277c44511f54022f3fb64009654045736ec7ec135db9c5b1bf7024fccaf11a8a0e25ee434b478b8d80618c7053ee580c5e43ecf2daeb789a035f6c10a3d69a07a1635d70e1ff18fe5a7626b480a7bbcbc1cffe2822f293dbfc657a6303065e47ed3e9b1d21bff6db779f2f0952a5ba4bb3a5a3b1af590facec895bc261b84ff6e47301e8cd37b0f3d246841268d04ff159fd16f50a9bee1a3174f05e2890094c6b3be1bc161c709bea85937ffeec2ee7e16e1303a25cd6a3cf61e2ca5cbb439d0e9198006d6cda40ff3972599badd2f663220792df265c74d0dd939d6c0489cca6ccba042f456ed81d3b6cb"}) dup2(r3, r2) [ 1967.670451][ T5] hid-generic 0000:0000:0000.02D5: item fetching failed at offset 19/22 [ 1967.743387][ T5] hid-generic: probe of 0000:0000:0000.02D5 failed with error -22 17:44:12 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:44:12 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x2) 17:44:12 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x62803, 0x0) openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000240)='/proc/capi/capi20ncci\x00', 0x280, 0x0) ioctl$PPPIOCGNPMODE(r0, 0xc008744c, &(0x7f0000000100)={0xc025, 0x3}) open_tree(0xffffffffffffffff, 0x0, 0x0) r1 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r1, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:44:12 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x3000000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:44:12 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x8, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) [ 1967.864660][ T7] hid-generic 0000:0000:0000.02D6: item fetching failed at offset 19/22 [ 1967.906223][T20134] Unknown ioctl -1073187764 [ 1967.913477][ T7] hid-generic: probe of 0000:0000:0000.02D6 failed with error -22 17:44:12 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_CREATE(r1, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x20, r3, 0x100, 0x10001, 0x25dfdbfb, {}, [@L2TP_ATTR_COOKIE={0xc, 0xf, 0xa5a7}]}, 0x20}, 0x1, 0x0, 0x0, 0x44}, 0x8015) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3"], 0x12e) r4 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r4, r2) [ 1968.007440][T20134] Unknown ioctl -1073187764 17:44:12 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x3) 17:44:12 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000240)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_TOL(r3, &(0x7f0000000340)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x30, r4, 0x100, 0x70bd25, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x10001, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x44010}, 0x4840) 17:44:12 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:44:12 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x4000000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:44:12 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x9, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) [ 1968.211766][ T5] hid-generic 0000:0000:0000.02D7: item fetching failed at offset 19/22 [ 1968.244636][ T5] hid-generic: probe of 0000:0000:0000.02D7 failed with error -22 17:44:12 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)) [ 1968.415788][ T5] hid-generic 0000:0000:0000.02D8: item fetching failed at offset 19/22 [ 1968.421559][T20182] __nla_validate_parse: 53 callbacks suppressed [ 1968.421571][T20182] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'. [ 1968.460898][ T5] hid-generic: probe of 0000:0000:0000.02D8 failed with error -22 17:44:12 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x8) io_uring_enter(r0, 0x2039, 0x7, 0x0, 0x0, 0x0) 17:44:12 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = open_tree(0xffffffffffffffff, 0x0, 0x0) r1 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = eventfd(0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r7, 0xae60) r8 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={r4, 0x0, 0x0, r8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={r4, 0x0, 0x2, r4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) ioctl$vim2m_VIDIOC_ENUM_FRAMESIZES(r0, 0xc02c564a, &(0x7f0000000240)={0xfffffffd, 0x20493859, 0x0, @stepwise={0x8000, 0x8, 0x7fffffff, 0x9, 0x4, 0xad}}) io_uring_enter(r1, 0x2039, 0x0, 0x0, 0x0, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f00000002c0)=@security={'security\x00', 0xe, 0x4, 0x4c8, 0xffffffff, 0x0, 0xd8, 0xd8, 0xffffffff, 0xffffffff, 0x3f8, 0x3f8, 0x3f8, 0xffffffff, 0x4, &(0x7f0000000280), {[{{@ipv6={@private2={0xfc, 0x2, [], 0x1}, @empty, [0xffffff00, 0xffffffff, 0x0, 0xffffff00], [0xffffffff, 0xffffff00, 0xffffff00, 0xffffff00], 'veth1\x00', 'macvlan0\x00', {}, {}, 0x11, 0x0, 0x3}, 0x0, 0xa8, 0xd8}, @common=@inet=@SET2={0x30, 'SET\x00', 0x2, {{0x1, 0x0, 0x2}, {0x1, 0x2, 0x6}, 0x7, 0x4}}}, {{@uncond, 0x0, 0x228, 0x250, 0x0, {}, [@common=@hbh={{0x48, 'hbh\x00'}, {0x7, 0x2, 0x0, [0xf7b4, 0x20, 0x5, 0x3f, 0x7fff, 0x2, 0x0, 0x3, 0x3a, 0xf2, 0x1f, 0x3ff, 0x7, 0x3ff, 0x4, 0x4289], 0x6}}, @common=@rt={{0x138, 'rt\x00'}, {0x80, [0x101, 0x5], 0xffff, 0x1, 0x0, [@private1={0xfc, 0x1, [], 0x1}, @private1, @private2={0xfc, 0x2, [], 0x1}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @empty, @dev={0xfe, 0x80, [], 0xe}, @local, @private2={0xfc, 0x2, [], 0x1}, @private1, @private2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @mcast1, @mcast2, @loopback, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1a}}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'], 0xe}}]}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x29, 0x2, 0x1}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0xe, 0x3, 0x5}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x528) [ 1968.521588][T20185] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1968.558238][ T5] hid-generic 0000:0000:0000.02D9: item fetching failed at offset 19/22 [ 1968.601455][ T5] hid-generic: probe of 0000:0000:0000.02D9 failed with error -22 [ 1968.621552][T20183] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 1968.664559][T20190] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'. [ 1968.690002][T20185] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'. 17:44:13 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) sendmsg$IPCTNL_MSG_EXP_NEW(r1, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, 0x0, 0x2, 0x5, 0x0, 0x0, {0x1, 0x0, 0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x800}, 0x4048000) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r4 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ttyprintk\x00', 0x50000, 0x0) r5 = gettid() tkill(r5, 0x10) ioprio_get$pid(0x3, r5) dup2(r3, r4) [ 1968.753090][T20199] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 17:44:13 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x8) io_uring_enter(r0, 0x2039, 0x700, 0x0, 0x0, 0x0) 17:44:13 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x4) 17:44:13 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0xa, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:44:13 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x5000000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) [ 1968.950136][ T5] hid-generic 0000:0000:0000.02DA: item fetching failed at offset 19/22 [ 1968.978242][ T5] hid-generic: probe of 0000:0000:0000.02DA failed with error -22 17:44:13 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000280)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3bc19de7a"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) [ 1969.021697][T20248] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'. 17:44:13 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x8) io_uring_enter(r0, 0x2039, 0x2000, 0x0, 0x0, 0x0) 17:44:13 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000100)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_LIST(r4, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000500)=ANY=[@ANYBLOB="0600000074f7df04fc1af1d856544498b4b99e88d93327ad0449f18983c92d26210ed7d916d31de69a27e1df998df12a996829257d4137d0cf750ddf1fa6fea476b82879c6727e8ba99bd88c4668be83fa3dcab76fb10769829de8b4a2ae724f85fb1865c0471a9bfca0150618a6afd344381c1410c9a8aecfecc06a937a8042ab04ed668537aa326d8755b778d5c99af2b9470080d41b609039f1e199408085566936230fe059d123b518334403cd9a5881180704ecadb46353f23cd64ce7f9916a885fc228cc0e7b3c44174df2344b04be3f255cf87090b659fc4c73f6294b69a2d5b145b6712e0d6fc804701eedb4574d00"/255, @ANYRES16=r5, @ANYBLOB="00012bbd7000fcdbdf2502000000080005007f00000114000200fc010000000000000000000000000000140006006e6574706369300000000000000000000500010001000000050001000000000014000300fe8000000000000000000000000000bb2800070073797374656d5f753a6f626a6563745f723a73657472616e735f657865635f743a733000"], 0x90}, 0x1, 0x0, 0x0, 0xc010}, 0x40000) sched_getattr(0x0, &(0x7f0000000240)={0x38}, 0x38, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000340)=@assoc_value={0x0}, &(0x7f0000000280)=0x8) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount(0x0, &(0x7f000000aff8)='./file0\x00', &(0x7f0000000000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f00000003c0)='./file0\x00') symlink(&(0x7f0000000140)='..', &(0x7f00000000c0)='./file0\x00') umount2(&(0x7f0000000180)='../file0\x00', 0x2) mount(0x0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x1020, 0x0) ioctl$vim2m_VIDIOC_ENUM_FMT(r3, 0xc0405602, &(0x7f0000000380)={0x1d88, 0x1, 0x3, "661a6f82ad441521b4c9f8bdafcfa01fd273d76641893445340229deb0aeccfd", 0x12fa637c}) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f00000000c0)={r6, @in={{0x2, 0x0, @rand_addr=0x64010102}}, 0x0, 0x0, 0x0, 0x2, 0x326}, 0x9c) getsockopt$inet_sctp6_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, &(0x7f0000000180)={r6, 0x6, 0x6, 0x4, 0x1000, 0x2}, &(0x7f0000000980)=0x14) [ 1969.152791][T20249] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 1969.223303][T20255] validate_nla: 33 callbacks suppressed [ 1969.223318][T20255] netlink: 'syz-executor.3': attribute type 14 has an invalid length. [ 1969.262110][ T7] hid-generic 0000:0000:0000.02DB: item fetching failed at offset 19/22 17:44:13 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x8) io_uring_enter(r0, 0x2039, 0x2039, 0x0, 0x0, 0x0) [ 1969.298801][ T7] hid-generic: probe of 0000:0000:0000.02DB failed with error -22 [ 1969.309628][T20257] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'. 17:44:13 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) r3 = gettid() tkill(r3, 0x10) syz_open_procfs(r3, &(0x7f0000000080)='net/snmp6\x00') write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3"], 0x12e) r4 = syz_open_dev$vivid(&(0x7f0000000000)='/dev/video#\x00', 0x0, 0x2) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_INTERVAL(r4, 0xc040564b, &(0x7f0000000040)={0xc14e, 0x0, 0x201a, 0x0, 0x668, {0x0, 0x80}, 0x1}) r5 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r5, r2) 17:44:13 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_emit_ethernet(0xa8, &(0x7f0000000300)={@local, @remote, @val={@void, {0x8100, 0x7, 0x1}}, {@llc_tr={0x11, {@llc={0x0, 0x4e, "0ea7", "a118c02de546c0647087958eadd0f0321683658b4dbcb602ed3654f8a0ad2a1813142cf2229baf53d51f8ae2b70c1bba395bf827a28a6e60d2154a8a335376b3b18a6443154b8d214a4b20ef228f270cabf3172c8d2655124493ce241efaf4b7b6e62c517cb626bda945bd4d2fce7ae17d00028bdafdacd9b753b355c6b4d361445119a75240c02251f5405bc79d3367f819"}}}}}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) ioctl$BTRFS_IOC_START_SYNC(r0, 0x80089418, &(0x7f0000000000)) [ 1969.389234][T20265] netlink: 'syz-executor.0': attribute type 16 has an invalid length. [ 1969.418722][T20248] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'. 17:44:13 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x8) io_uring_enter(r0, 0x2039, 0x3920, 0x0, 0x0, 0x0) 17:44:13 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x5) 17:44:13 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x6000000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) [ 1969.537244][T20255] netlink: 'syz-executor.3': attribute type 14 has an invalid length. [ 1969.558797][T20265] netlink: 'syz-executor.0': attribute type 16 has an invalid length. 17:44:13 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0xb, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:44:13 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3"], 0x12e) r3 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080)='/dev/bsg\x00', 0x408400, 0x0) ioctl$TIOCNXCL(r3, 0x540d) creat(&(0x7f0000000100)='./bus\x00', 0x0) socket$nl_sock_diag(0x10, 0x3, 0x4) socket(0xb, 0x80000, 0x101) r4 = syz_open_dev$char_raw(&(0x7f0000000880)='/dev/raw/raw#\x00', 0x0, 0x2000) r5 = perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x80, 0x7, 0x3f, 0x81, 0x0, 0xfffffffffffffffe, 0x10009, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x8, 0x1, @perf_config_ext={0xa55, 0xfa9}, 0x10, 0x52d, 0x6, 0x7, 0xffffffffffffffc1, 0x100, 0x7}, 0x0, 0x6, r1, 0x6) dup2(r4, r5) 17:44:13 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) msync(&(0x7f0000ee8000/0x2000)=nil, 0x2000, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1969.698278][T20315] netlink: 'syz-executor.0': attribute type 16 has an invalid length. 17:44:14 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x8) io_uring_enter(r0, 0x2039, 0x7000000, 0x0, 0x0, 0x0) [ 1969.790532][T20332] netlink: 'syz-executor.0': attribute type 16 has an invalid length. [ 1969.800227][T25996] hid-generic 0000:0000:0000.02DC: item fetching failed at offset 19/22 [ 1969.814730][T25996] hid-generic: probe of 0000:0000:0000.02DC failed with error -22 [ 1969.834674][T20320] netlink: 'syz-executor.3': attribute type 14 has an invalid length. 17:44:14 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcsa\x00', 0x200000, 0x0) write$RDMA_USER_CM_CMD_LISTEN(r0, &(0x7f0000000100)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0x400}}, 0x10) r1 = open_tree(0xffffffffffffffff, 0x0, 0x0) r2 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) ioctl$FITHAW(r1, 0xc0045878) io_uring_enter(r2, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:44:14 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x6) [ 1969.871225][T20348] netlink: 'syz-executor.3': attribute type 14 has an invalid length. 17:44:14 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0xc, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:44:14 executing program 5: ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000340)={'syz_tun\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r6, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000900)=ANY=[@ANYBLOB="4801000024001d0f00"/20, @ANYRES32=r6, @ANYBLOB="00000000f1ffffff0000000008000100726564001c010200040102005fcea2720370debdcd7796d58f06204365cf0a7f6ec14f5e0f9985c451186950aacedbcbe8f6a371e5572eaac7976fb648be261d7e7e850aae5683e9a7045dea2dbc096e6c1bdd9536d8acf4c29b1458627f0b19c8869aad0e53d580eb8cea8898f1460624d1c3e29166a8bb2709638caf0ab36da7f2f7b05221eebd323c0800000000000000993d060ac54a0cf6e7fe4476c51ff79717a3c6b23984f0cd4b19a1e34f576f4ea3d016abcd4819b7ed59fdb44820cb7b1fe6630ab67c2a1dd18846d4892f10220761ee1647601f89474bdf251e5f982d49afe9b2aeeb930836775e51f0c131bfdc98fb918b1bd627a0b3f781794eab45b26913592c85e470b8345cefd3530bac20a9634f7ce8e9599c3d59e69afaffee9b6e03aeaf140001000000000000"], 0x148}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000a80)=@delchain={0x24, 0x2a, 0xd39, 0x0, 0x0, {0x0, 0x0, 0x0, r6}}, 0x24}, 0xe}, 0x0) ioctl$sock_ipv6_tunnel_SIOCADD6RD(0xffffffffffffffff, 0x89f9, &(0x7f0000000400)={'ip6tnl0\x00', &(0x7f0000000380)={'sit0\x00', 0x0, 0x2f, 0x80, 0x9, 0x8, 0x1a, @dev={0xfe, 0x80, [], 0x1e}, @mcast2, 0x7800, 0x20, 0x1, 0x2}}) sendmsg$ETHTOOL_MSG_EEE_GET(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000440)={0xe8, 0x0, 0x20, 0x70bd2a, 0x25dfdbfd, {}, [@HEADER={0x5c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_hsr\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r0}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wlan0\x00'}]}, @HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'xfrm0\x00'}]}, @HEADER={0x60, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_batadv\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netpci0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}]}]}, 0xe8}, 0x1, 0x0, 0x0, 0x40}, 0x40000) r8 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r9 = dup(r8) ioctl$PERF_EVENT_IOC_ENABLE(r9, 0x8912, 0x400200) r10 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uhid\x00', 0x802, 0x0) r11 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r11, r10) keyctl$get_keyring_id(0x0, 0x0, 0x4) 17:44:14 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x7000000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:44:14 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x8) io_uring_enter(r0, 0x2039, 0x20000000, 0x0, 0x0, 0x0) 17:44:14 executing program 1: ioctl$BTRFS_IOC_BALANCE_CTL(0xffffffffffffffff, 0x40049421, 0x3) openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080)={0x0, 0x0, 0x1, 0x0, 0x2fc}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) ioctl$BTRFS_IOC_SCRUB(r0, 0xc400941b, &(0x7f0000000300)={0x0, 0x6, 0x8000, 0x1}) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:44:14 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = open_tree(0xffffffffffffffff, 0x0, 0x0) r1 = openat2(r0, &(0x7f0000000100)='./file1\x00', &(0x7f0000000240)={0x10200, 0x14}, 0x18) ioctl$INCFS_IOC_READ_FILE_SIGNATURE(r0, 0x8010671f, &(0x7f0000000380)={&(0x7f00000002c0)=""/157, 0x9d}) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r5 = eventfd(0x0) r6 = dup3(r4, r2, 0x0) ioctl$KVM_IRQFD(r6, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r5, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) ioctl$FS_IOC_GETVERSION(r5, 0x80087601, &(0x7f0000000500)) r7 = syz_io_uring_setup(0x20081, &(0x7f0000000080)={0x0, 0x9259, 0x1, 0x0, 0x0, 0x0, r1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000280)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r8, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r8, r9, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r7, 0x2039, 0x0, 0x0, 0x0, 0x0) read$proc_mixer(r1, &(0x7f00000003c0)=""/152, 0x98) chdir(&(0x7f0000000000)='./file0\x00') ioctl$SNAPSHOT_ATOMIC_RESTORE(r0, 0x3304) ioctl$sock_bt_cmtp_CMTPGETCONNLIST(0xffffffffffffffff, 0x800443d2, &(0x7f0000000480)={0x0, &(0x7f0000000480)}) [ 1970.149702][T20380] netlink: 'syz-executor.3': attribute type 14 has an invalid length. [ 1970.173998][T20379] netlink: 'syz-executor.0': attribute type 16 has an invalid length. 17:44:14 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x8) io_uring_enter(r0, 0x2039, 0x39200000, 0x0, 0x0, 0x0) 17:44:14 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r4 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x4100, 0x0) ioctl$BTRFS_IOC_DEV_INFO(r4, 0xd000941e, &(0x7f0000000680)={0x0, "40996db1ac5adf41ea92087351134d98"}) dup2(r3, r2) r5 = eventfd(0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r9, 0xae60) r10 = eventfd(0x0) r11 = dup3(r9, r7, 0x0) ioctl$KVM_IRQFD(r11, 0x4020ae76, &(0x7f0000000100)={r5, 0x0, 0x0, r10, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) ioctl$KVM_IRQFD(r11, 0x4020ae76, &(0x7f0000000100)={r5, 0x0, 0x2, r5, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) ioctl$SNDRV_PCM_IOCTL_READI_FRAMES(r11, 0x80184151, &(0x7f0000000080)={0x0, &(0x7f0000000040)="be60dad54ebe3e95dae5029c82f762a219", 0x11}) 17:44:14 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0xe, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:44:14 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x7) 17:44:14 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x8000000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:44:14 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = open_tree(0xffffffffffffffff, 0x0, 0x0) r1 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000000)={@local, @private=0xa010100, 0x1, 0x6, [@initdev={0xac, 0x1e, 0x1, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, @rand_addr=0x64010102, @loopback, @initdev={0xac, 0x1e, 0x1, 0x0}, @rand_addr=0x64010101]}, 0x28) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r1, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1970.421986][ T7] hid-generic 0000:0000:0000.02DD: item fetching failed at offset 19/22 [ 1970.458534][ T7] hid-generic: probe of 0000:0000:0000.02DD failed with error -22 17:44:14 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x7, 0x0, 0x0) 17:44:15 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = eventfd(0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r5 = eventfd(0x0) r6 = dup3(r4, r2, 0x0) ioctl$KVM_IRQFD(r6, 0x4020ae76, &(0x7f0000000100)={r0, 0x0, 0x0, r5, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) ioctl$KVM_IRQFD(r6, 0x4020ae76, &(0x7f0000000100)={r0, 0x0, 0x2, r0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) ioctl$SNDCTL_TMR_METRONOME(r6, 0x40045407) r7 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r8, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r8, r9, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r7, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:44:15 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x9000000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:44:15 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0xf, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:44:15 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x8) 17:44:15 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="0b00000073797a3100000000000000000000000000477e39c425028f401e0000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073ee7a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac820000000000000001da14b7cb88e3b830978423fc7642ec52654d68f572499caa52b1bc0e297f5f7d81a1c0ba0ce9895614e40407c75cd196f12a189fcb77fc48c18b52657de7e87391151dd74b0e5e175a00e952f0f8e81a2eb677e4b124c9fbb9d527e529e79d000ed87555d05bfabdb68708b999c23b1a25501256bf2bad03a983dd37170bd1676116a336c4fd84048c803b7fa4217254b60052b40bec6392ea2b0e6284b283db501b5787707a647426876e445173b2042602ef7dfbbdadb6a8310a5049a7c0b62c875395db45c1c3d4ca64647c17000000d3ce3a2b33815e7a1a239710ad014cd596211c4a216f216805a97cee057b2b76902f638f4952667089559cf34d56474b8697cffb994c6744dd29299307cc26f0315a70e4388fdbd4af59"], 0x12e) r3 = creat(&(0x7f0000000000)='./bus\x00', 0xc4) dup2(r3, r2) 17:44:15 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x700, 0x0, 0x0) 17:44:15 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x2000, 0x0, 0x0) 17:44:15 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3"], 0x12e) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r1, 0xc0045516, &(0x7f0000000000)=0x4beebf63) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) 17:44:15 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0xa000000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:44:15 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x10, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:44:15 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x9) 17:44:15 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) setsockopt$bt_BT_DEFER_SETUP(0xffffffffffffffff, 0x112, 0x7, &(0x7f0000000000)=0x1, 0x4) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:44:15 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x2039, 0x0, 0x0) [ 1971.242273][ T5] hid-generic 0000:0000:0000.02DE: item fetching failed at offset 19/22 [ 1971.272520][ T5] hid-generic: probe of 0000:0000:0000.02DE failed with error -22 17:44:15 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = open_tree(0xffffffffffffffff, 0x0, 0x0) r1 = syz_io_uring_setup(0x83, &(0x7f0000000080)={0x0, 0x701a, 0x10, 0x0, 0x1, 0x0, r0}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ee8000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180)={0x202101, 0x0, 0xb}, &(0x7f00000001c0)='./file0\x00', 0x18}, 0x2) io_uring_enter(r1, 0x2039, 0x0, 0x0, 0x0, 0x0) r4 = eventfd(0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r8, 0xae60) r9 = eventfd(0x0) r10 = dup3(r8, r6, 0x0) ioctl$KVM_IRQFD(r10, 0x4020ae76, &(0x7f0000000100)={r4, 0x0, 0x0, r9, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) r11 = fsmount(r10, 0x1, 0x7) ioctl$KVM_IRQFD(r10, 0x4020ae76, &(0x7f0000000240)={r11, 0xfffffffd, 0x2, r4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) ioctl$sock_SIOCSIFVLAN_SET_VLAN_FLAG_CMD(r10, 0x8983, &(0x7f0000000000)={0x7, 'veth0_to_hsr\x00', {0xff}, 0x1}) [ 1971.402389][T28129] hid-generic 0000:0000:0000.02DF: item fetching failed at offset 19/22 17:44:15 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0xa) [ 1971.446966][T28129] hid-generic: probe of 0000:0000:0000.02DF failed with error -22 17:44:15 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x3920, 0x0, 0x0) 17:44:15 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) statx(r1, &(0x7f0000000000)='./bus\x00', 0x800, 0x1, &(0x7f0000000280)) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) 17:44:15 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0xc000000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:44:15 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x11, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) [ 1971.697337][T28129] hid-generic 0000:0000:0000.02E0: item fetching failed at offset 19/22 17:44:16 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x7000000, 0x0, 0x0) 17:44:16 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = eventfd(0x0) r3 = dup3(r1, 0xffffffffffffffff, 0x0) ioctl$KVM_IRQFD(r3, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) ioctl$KVM_IRQFD(r3, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x2, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) ioctl$sock_inet_SIOCGIFBRDADDR(r3, 0x8919, &(0x7f0000000480)={'veth0_to_batadv\x00'}) openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r4 = syz_open_dev$mouse(&(0x7f0000000280)='/dev/input/mouse#\x00', 0x6, 0x220000) setsockopt$inet6_mreq(r4, 0x29, 0x14, &(0x7f0000000300)={@rand_addr=' \x01\x00'}, 0x14) open_tree(0xffffffffffffffff, 0x0, 0x0) r5 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) r8 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0x92302, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r8, 0x89f5, &(0x7f0000000400)={'ip6_vti0\x00', &(0x7f0000000380)={'ip6_vti0\x00', 0x0, 0x4, 0xff, 0x80, 0x5, 0x18, @private1, @dev={0xfe, 0x80, [], 0x10}, 0x10, 0x1, 0x2, 0x40}}) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_open_dev$vcsa(&(0x7f0000000440)='/dev/vcsa#\x00', 0x1, 0x101240) setxattr$trusted_overlay_origin(&(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='trusted.overlay.origin\x00', &(0x7f0000000240)='y\x00', 0x2, 0x1) syz_io_uring_submit(r6, r7, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r5, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1971.739721][T28129] hid-generic: probe of 0000:0000:0000.02E0 failed with error -22 17:44:16 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0xb) 17:44:16 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) r2 = eventfd(0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) r7 = eventfd(0x0) r8 = dup3(r6, r4, 0x0) ioctl$KVM_IRQFD(r8, 0x4020ae76, &(0x7f0000000100)={r2, 0x0, 0x0, r7, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) ioctl$KVM_IRQFD(r8, 0x4020ae76, &(0x7f0000000100)={r2, 0x0, 0x2, r2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x2400, 0x4) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r9 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r9, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3"], 0x12e) r10 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r10, r9) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x28, 0x0, 0x1, 0x70bd25, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r11}, @val={0xc, 0x99, {0x1, 0x13}}}}, ["", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x20800}, 0x20000885) 17:44:16 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0xe000000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:44:16 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x48, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:44:16 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000240)={0x0, 0x0, 0x2, 0x1, 0x2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) r3 = openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x30801) ioctl$IMGETVERSION(r3, 0x80044942, &(0x7f0000000100)) 17:44:16 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x20000000, 0x0, 0x0) 17:44:16 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0xc) 17:44:16 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = open_tree(0xffffffffffffffff, 0x0, 0x0) r1 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r1) connect$rxrpc(r0, &(0x7f0000000000)=@in6={0x21, 0x9bbe, 0x2, 0x1c, {0xa, 0x4e20, 0x8001, @remote, 0x8}}, 0x24) io_uring_enter(r1, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1972.244435][T28129] hid-generic 0000:0000:0000.02E1: item fetching failed at offset 19/22 [ 1972.276784][T28129] hid-generic: probe of 0000:0000:0000.02E1 failed with error -22 17:44:16 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0xf000000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:44:16 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x4c, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:44:16 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x39200000, 0x0, 0x0) 17:44:16 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) r3 = eventfd(0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r7, 0xae60) openat$vimc2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video2\x00', 0x2, 0x0) r8 = eventfd(0x0) r9 = dup3(r7, r5, 0x0) ioctl$EVIOCGABS20(r9, 0x80184560, &(0x7f0000000680)=""/4096) recvmsg(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @remote}}}, 0x80, &(0x7f00000001c0)=[{&(0x7f0000000240)=""/168, 0xa8}, {&(0x7f0000000180)=""/21, 0x15}, {&(0x7f0000000300)=""/231, 0xe7}, {&(0x7f0000001680)=""/4096, 0x1000}], 0x4, &(0x7f0000002680)=""/4096, 0x1000}, 0x40002020) ioctl$KVM_IRQFD(r9, 0x4020ae76, &(0x7f0000000100)={r3, 0x0, 0x0, r8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) ioctl$KVM_IRQFD(r9, 0x4020ae76, &(0x7f0000000100)={r3, 0x0, 0x2, r3, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYRES16=0x0], 0x12e) r10 = creat(&(0x7f0000000100)='./bus\x00', 0x21) dup2(r10, r2) 17:44:16 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x700000000000000, 0x0, 0x0) 17:44:16 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcsu\x00', 0x440002, 0x0) r1 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000280)='/dev/nvme-fabrics\x00', 0x8980, 0x0) r2 = syz_open_dev$media(&(0x7f0000000300)='/dev/media#\x00', 0x400, 0x80000) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$FS_IOC_FSSETXATTR(r2, 0x401c5820, &(0x7f0000000340)={0x8, 0xffffffff, 0x8000, 0x6, 0x6}) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) dup3(r6, r4, 0x0) close_range(r6, r0, 0x0) getsockopt$inet_sctp6_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000100)=@assoc_value={0x0, 0xb274}, &(0x7f0000000240)=0x8) open_tree(0xffffffffffffffff, 0x0, 0x81101) r7 = syz_io_uring_setup(0x83, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r8, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r8, r9, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r7, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:44:17 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0xe) 17:44:17 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x60, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:44:17 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x10000000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:44:17 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = open_tree(0xffffffffffffffff, 0x0, 0x0) r1 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r1, 0x2039, 0x0, 0x0, 0x0, 0x0) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x0) 17:44:17 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x2000000000000000, 0x0, 0x0) 17:44:17 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) r3 = eventfd(0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r7, 0xae60) r8 = eventfd(0x0) r9 = dup3(r7, r5, 0x0) ioctl$KVM_IRQFD(r9, 0x4020ae76, &(0x7f0000000100)={r3, 0x0, 0x0, r8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) ioctl$KVM_IRQFD(r9, 0x4020ae76, &(0x7f0000000100)={r3, 0x0, 0x2, r3, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040)='nl80211\x00') sendmsg$NL80211_CMD_SET_PMK(r9, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x50, r10, 0x100, 0x70bd2d, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_PMK={0x14, 0xfe, "302397ef4dac62222ea8dd21f276269a"}, @NL80211_ATTR_PMK={0x14, 0xfe, "23e2e1d3abbc483fd14cf3b0186e5d57"}, @NL80211_ATTR_PMKR0_NAME={0x14, 0x102, "8c4bea51c3911e6d62815cf595b1c45c"}]}, 0x50}, 0x1, 0x0, 0x0, 0x4000005}, 0x40001) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3"], 0x12e) r11 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r11, r2) 17:44:17 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x3920000000000000, 0x0, 0x0) 17:44:17 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000240), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) ioctl$BTRFS_IOC_GET_FEATURES(r0, 0x80189439, &(0x7f0000000000)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:44:17 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x68, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) [ 1973.156307][T28129] hid-generic 0000:0000:0000.02E2: item fetching failed at offset 19/22 17:44:17 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x20000000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:44:17 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0xf) [ 1973.202446][T28129] hid-generic: probe of 0000:0000:0000.02E2 failed with error -22 [ 1973.292601][T28129] hid-generic 0000:0000:0000.02E3: item fetching failed at offset 19/22 17:44:17 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x7) 17:44:17 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18, 0x0, 0x0, {0x0, r3}}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1973.337759][T28129] hid-generic: probe of 0000:0000:0000.02E3 failed with error -22 [ 1973.450721][T20786] __nla_validate_parse: 55 callbacks suppressed [ 1973.450736][T20786] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 17:44:17 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) 17:44:17 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = open_tree(0xffffffffffffffff, 0x0, 0x0) r1 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) r4 = eventfd(0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r8, 0xae60) r9 = eventfd(0x0) r10 = dup3(r8, r6, 0x0) ioctl$KVM_IRQFD(r10, 0x4020ae76, &(0x7f0000000100)={r4, 0x0, 0x0, r9, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) ioctl$KVM_IRQFD(r10, 0x4020ae76, &(0x7f0000000100)={r4, 0x0, 0x2, r4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) setns(r10, 0x0) r11 = syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x3, 0x800) ioctl$BTRFS_IOC_DEFRAG_RANGE(r11, 0x40309410, &(0x7f0000000280)={0x0, 0x1, 0x0, 0x800, 0x3, [0x5, 0x1000, 0x400, 0x6]}) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) ioctl$USBDEVFS_DISCSIGNAL(r0, 0x8010550e, &(0x7f0000000100)={0xffffffff, &(0x7f0000000000)="aa30dfef3ab9fa7b4edf5352f7e9820e61fe2811ce601b23d5aea2e74c0cc13b4402063c56080ac959ba"}) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r1, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:44:17 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x700) [ 1973.518853][T20775] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1973.542581][T20792] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'. 17:44:17 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x6c, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) [ 1973.611725][T20786] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 17:44:17 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x10) 17:44:18 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x48000000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) [ 1973.750539][T20833] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'. 17:44:18 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x2000) 17:44:18 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = pidfd_getfd(r1, 0xffffffffffffffff, 0x0) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r2, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x60, r3, 0x800, 0x70bd26, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_SERVICE={0x1c, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x2c}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x1}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x4}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x24, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e21}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0xa}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'ovf\x00'}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x6}]}, @IPVS_CMD_ATTR_DAEMON={0x4}]}, 0x60}, 0x1, 0x0, 0x0, 0x40808}, 0x40890) r4 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r4, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3"], 0x12e) r5 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r5, r4) [ 1973.830911][T20844] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'. [ 1973.902171][T20842] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1973.933064][T20844] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'. 17:44:18 executing program 1: r0 = syz_io_uring_complete(0x0) ioctl$VT_RESIZEX(r0, 0x560a, &(0x7f0000000000)={0x1ff, 0x8, 0xffff, 0x7fff, 0x8cb, 0x8}) openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x8) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000280)={r1, 0xf, 0x0, 0x4, &(0x7f0000000240)=[0x0], 0x1}, 0x20) open_tree(0xffffffffffffffff, 0x0, 0x0) r2 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r2, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:44:18 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x74, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:44:18 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x11) [ 1974.009886][T20856] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 17:44:18 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x2039) [ 1974.071494][ T17] hid-generic 0000:0000:0000.02E4: item fetching failed at offset 19/22 [ 1974.129838][ T17] hid-generic: probe of 0000:0000:0000.02E4 failed with error -22 [ 1974.162016][T20873] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'. 17:44:18 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x4c000000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:44:18 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = open_tree(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000240), 0x2, 0xf}}, 0x20) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) ioctl$RNDCLEARPOOL(r0, 0x5206, &(0x7f0000000000)=0x1) io_uring_enter(0xffffffffffffffff, 0x2039, 0x0, 0x1, 0x0, 0x0) [ 1974.269414][T32372] hid-generic 0000:0000:0000.02E5: item fetching failed at offset 19/22 [ 1974.323494][T32372] hid-generic: probe of 0000:0000:0000.02E5 failed with error -22 [ 1974.362650][T20885] validate_nla: 37 callbacks suppressed [ 1974.362666][T20885] netlink: 'syz-executor.0': attribute type 16 has an invalid length. 17:44:18 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$BLKTRACESTART(0xffffffffffffffff, 0x1274, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:44:18 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x3920) 17:44:18 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r4 = eventfd(0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r8, 0xae60) r9 = eventfd(0x0) r10 = dup3(r8, r6, 0x0) ioctl$KVM_IRQFD(r10, 0x4020ae76, &(0x7f0000000100)={r4, 0x0, 0x0, r9, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) ioctl$KVM_IRQFD(r10, 0x4020ae76, &(0x7f0000000100)={r4, 0x0, 0x2, r4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r10, 0x40182103, &(0x7f0000000000)={0x0, 0x0, r1}) dup2(r3, r2) [ 1974.441063][T20885] netlink: 'syz-executor.0': attribute type 16 has an invalid length. [ 1974.475219][T20908] netlink: 'syz-executor.3': attribute type 14 has an invalid length. 17:44:18 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x60) [ 1974.496845][T20908] netlink: 'syz-executor.3': attribute type 14 has an invalid length. 17:44:18 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x7a, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:44:18 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x60000000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:44:18 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) r3 = openat$zero(0xffffffffffffff9c, &(0x7f00000016c0)='/dev/zero\x00', 0x1, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000002d80)={&(0x7f0000001700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000002d40)={&(0x7f0000002d00)=@newchain={0x3c, 0x64, 0x10, 0x70bd25, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x6, 0xd}, {0x8, 0xd}, {0xf, 0x9}}, [@TCA_RATE={0x6, 0x5, {0x9, 0x5}}, @TCA_RATE={0x6, 0x5, {0x0, 0x3}}, @TCA_RATE={0x6, 0x5, {0x0, 0x9}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20004080}, 0x4000) [ 1974.589983][T32372] hid-generic 0000:0000:0000.02E6: item fetching failed at offset 19/22 [ 1974.623204][T32372] hid-generic: probe of 0000:0000:0000.02E6 failed with error -22 [ 1974.780786][ T7] hid-generic 0000:0000:0000.02E7: item fetching failed at offset 19/22 [ 1974.798340][ T7] hid-generic: probe of 0000:0000:0000.02E7 failed with error -22 [ 1974.809306][T20956] netlink: 'syz-executor.0': attribute type 16 has an invalid length. 17:44:19 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x7000000) [ 1974.886008][T20952] netlink: 'syz-executor.3': attribute type 14 has an invalid length. [ 1974.911755][T20956] netlink: 'syz-executor.0': attribute type 16 has an invalid length. 17:44:19 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0xf0) 17:44:19 executing program 1: r0 = eventfd(0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r5 = eventfd(0x0) r6 = dup3(r4, r2, 0x0) ioctl$KVM_IRQFD(r6, 0x4020ae76, &(0x7f0000000100)={r0, 0x0, 0x0, r5, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) ioctl$KVM_IRQFD(r6, 0x4020ae76, &(0x7f0000000100)={r0, 0x0, 0x2, r0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) ioctl$sock_SIOCSIFVLAN_GET_VLAN_VID_CMD(r6, 0x8983, &(0x7f0000000000)) r7 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r8 = syz_io_uring_setup(0x83, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x4}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r9, 0x110, &(0x7f0000000240)=0x1, 0x0, 0x4) r11 = openat$autofs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/autofs\x00', 0x40, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(r7, 0xc4009420, &(0x7f0000001800)={0x10, 0x2, {0x3e4c, @struct={0x0, 0x9}, 0x0, 0xfe, 0x1000, 0x200, 0x8, 0x9, 0x400, @usage=0x2, 0x2, 0x1, [0x4, 0x2, 0x6, 0x9, 0x4824, 0x7]}, {0x7, @struct={0x3ff, 0x3}, 0x0, 0x4, 0x9, 0xa3e, 0x3, 0x1, 0x400, @struct={0x80000000, 0x4}, 0x200, 0x5, [0x0, 0x9, 0x4, 0x7, 0xfffffffffffffffe, 0x5]}, {0x0, @struct={0x1f, 0x7}, 0x0, 0x6, 0x6, 0xffffffff, 0x3, 0x0, 0x450, @usage=0xffffffff80000001, 0x1200, 0x8, [0x6, 0x3, 0x10001, 0x6, 0x8e9, 0x200]}, {0x5, 0x3, 0x8}}) getsockopt$inet_sctp_SCTP_HMAC_IDENT(r11, 0x84, 0x16, &(0x7f0000000140)=ANY=[@ANYBLOB="018e30cb0a0200000400"], &(0x7f0000000540)=0x6) syz_io_uring_submit(r9, r10, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r8, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1974.936169][T20969] netlink: 'syz-executor.3': attribute type 14 has an invalid length. 17:44:19 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xe7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_SIZE(r3, 0x40087703, 0x2) mmap(&(0x7f0000701000/0x4000)=nil, 0x4000, 0x0, 0x11, r3, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d00000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff000002000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e300"], 0x12e) r4 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r4, r2) getsockopt$IP_SET_OP_GET_BYINDEX(r1, 0x1, 0x53, &(0x7f0000000000)={0x7, 0x7, 0x3}, &(0x7f0000000040)=0x28) r5 = syz_genetlink_get_family_id$smc(&(0x7f00000000c0)='SMC_PNETID\x00') r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000340)='/proc/bus/input/handlers\x00', 0x0, 0x0) connect$l2tp6(r6, &(0x7f0000000380)={0xa, 0x0, 0x5, @dev={0xfe, 0x80, [], 0x2c}, 0x7, 0x3}, 0x20) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f0000002300)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_DELETE(r7, &(0x7f0000002440)={&(0x7f0000000280), 0xc, &(0x7f0000002400)={&(0x7f0000002340)={0x14, r8, 0x1}, 0x14}}, 0x0) sendmsg$L2TP_CMD_NOOP(r6, &(0x7f00000004c0)={&(0x7f00000003c0), 0xc, &(0x7f0000000480)={&(0x7f0000000680)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="000829bd7000fddbdf250000000008001800ffffffff0500210001000000080009000400000005000d0000000000080009000300000008001700", @ANYRES32=r1, @ANYBLOB="032b316941c421caa49776f1c88b63b003d8d3b01ddd12143345c0d53b4d6d69b29f3dd60f4ff4da66ed8b033a81acf848edb762bd34e3098aee80232945f0b15183b2d2189075f62c0d053e55e14ef44819d3b3a343fd38e25f3dd34cc43fbc5afe5d3e8a560b830cb892ac76c0c5fb0b104cdd8346da146b7d7e17970bb0a751c92a99aae82d57f1db3c8e6e8aae408a67b3b3849bbdf37ddbba4d5dfb50b00fa8ba3304b98fc607678371680cf92008b9c15a0e4a03a10573643061b21227cf09f2e9513cd0"], 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0xc004) sendmsg$SMC_PNETID_DEL(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000500)={&(0x7f0000000280)={0x28, r5, 0x10, 0x70bd29, 0x25dfdbff, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x1}]}, 0x28}, 0x1, 0x0, 0x0, 0x8001}, 0x4000) 17:44:19 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x65580000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:44:19 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:44:19 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x20000000) 17:44:19 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x300) 17:44:19 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000380)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d9000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff000000000039d40000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffff7f00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cbb660d666f25d7fb4b8c786c01307f53c65e1b1e96ba3cf255b9e7855245f326c17c8550a75ba9f36024446312b3343e19293c470b49de98953396ba50ef6aab246f6cb37b476e69f73ec4e2593933f7749f77f2626b360339e698b446b7897a448301c91944592d6ed1f87b2fb02d0303ac80ef6db79dcf399d3d94a5af08a31ab1e6e4cddbc630b032db09235d576252c8ab3f6b12453370ac9f325576f0b8cc0dec2b2f543f4c89a162d123094555ab41a285bfc5ad6d8bcc955c614bdeb1826b796252dd7268cb94c77924166aaec43434fbb06f602cf440b92"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r2) [ 1975.288281][T21007] netlink: 'syz-executor.3': attribute type 14 has an invalid length. [ 1975.314995][T21008] netlink: 'syz-executor.0': attribute type 16 has an invalid length. 17:44:19 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x39200000) 17:44:19 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x68000000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:44:19 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x2, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:44:19 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = open_tree(0xffffffffffffffff, 0x0, 0x0) r1 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) r4 = open_tree(r0, &(0x7f0000000000)='./file0\x00', 0x80900) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r8, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=@newqdisc={0x148, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r9, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_red={{0x8, 0x1, 'red\x00'}, {0x11c, 0x2, [@TCA_RED_STAB={0x104, 0x2, "5fcea2720370debdcd7796d58f06204365cf0a7f6ec14f5e0f9985c451186950aacedbcbe8f6a3261d7e7e850aae5683e9a7045dea2dbc096e6c1bdd9536d8acf4c29b1458627f0b19c8869aad0e53d580eb8cea889860430f40d1c3e29166a8bb2709638caf0ab36da7f2f7b05221eebd323c73f2be7b30bd689717a3c6b23984f0cd4bcc67e34f576f4ea3d016abcd4819b7ed59fdb44820cb7b1fe6630ab67c2a1df18846d4892f10220761ee1647601f89474bdf251e5f982d49afe9b2aeeb930836775e51f0c131bfdc98fb918b1bd627a0b3f781794eab45b26913592c85e470b8345cefd3530bac20a9634f7ce8e9599c3d59e69afaffee9b6e03aeaf"}, @TCA_RED_PARMS={0x14}]}}]}, 0x148}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000a80)=@delchain={0x24, 0x2a, 0xd39, 0x0, 0x0, {0x0, 0x0, 0x0, r9}}, 0x24}, 0xe}, 0x0) sendmsg$BATADV_CMD_SET_MESH(r4, &(0x7f0000000300)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x34, 0x0, 0x20, 0x70bd26, 0x25dfdbfd, {}, [@BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x4}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x1}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r9}]}, 0x34}}, 0x40040) modify_ldt$write2(0x11, &(0x7f0000000340)={0xf2, 0x0, 0x4000, 0x1, 0x2, 0x1, 0x1, 0x0, 0x1, 0x1}, 0x10) io_uring_enter(r1, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:44:19 executing program 5: r0 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r1, &(0x7f00000002c0)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc7802200000000000000063c0000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3ee2582a34fb294fe4d00fbdf5113caea1c3ef5f792"], 0x12e) r2 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r2, r1) 17:44:19 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x700000000000000) [ 1975.625404][T22685] hid-generic 0000:0000:0000.02E8: item fetching failed at offset 19/22 [ 1975.660343][T22685] hid-generic: probe of 0000:0000:0000.02E8 failed with error -22 [ 1975.752112][T22685] hid-generic 0000:0000:0000.02E9: item fetching failed at offset 19/22 [ 1975.787332][T22685] hid-generic: probe of 0000:0000:0000.02E9 failed with error -22 17:44:20 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x500) 17:44:20 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x3, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:44:20 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x6c000000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:44:20 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$capi20_data(r1, &(0x7f0000000000)=ANY=[@ANYBLOB="1000030041820180720c000000000000e600614aa0e4515409400af69409768c3b678a08c34d0a65525098973bab84298762998778ebfd1e54bf468b928a25a96f2cb1442b660800e1e48fec7bbfed34d4b23ddac69129746c9c73da1850f0f4bf249bd4d13f00bf67dd8cf771a68a6837029e64f0de43872a2900bda26b86a285c9508b1a1612539e2c9fab9193f5b63033d04c7ff78155e38b531517af5ee5db3b33a6ff1cc8ff2ac00a4b87c12066b1dda8cb21d69d086957bb23fb86f56a71f117e2e7bfaab61c98712ef9fcd6fc32c6bcfdda54586fe78a8937b6aca706bd8e53f7035d29e6aae40da905a626abad80a5d289077425"], 0xf8) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000100f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r4 = socket$inet(0x2, 0x2, 0x7f) getsockopt$inet_dccp_buf(r4, 0x21, 0xf, &(0x7f0000000340)=""/124, &(0x7f00000003c0)=0x7c) dup2(r3, r2) 17:44:20 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x56f, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) r3 = eventfd(0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r7, 0xae60) r8 = eventfd(0x0) r9 = dup3(r7, r5, 0x0) ioctl$KVM_IRQFD(r9, 0x4020ae76, &(0x7f0000000100)={r3, 0x0, 0x0, r8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) io_uring_register$IORING_REGISTER_FILES(r9, 0x2, &(0x7f0000000000), 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:44:20 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x2000000000000000) [ 1976.062172][T32372] hid-generic 0000:0000:0000.02EA: item fetching failed at offset 19/22 17:44:20 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x74000000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) [ 1976.119380][T32372] hid-generic: probe of 0000:0000:0000.02EA failed with error -22 17:44:20 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x600) 17:44:20 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x4, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:44:20 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r0, r1, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) readlink(&(0x7f0000000100)='./file0\x00', &(0x7f0000000240)=""/98, 0x62) 17:44:20 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x3920000000000000) [ 1976.246017][T22685] hid-generic 0000:0000:0000.02EB: item fetching failed at offset 19/22 [ 1976.263378][T22685] hid-generic: probe of 0000:0000:0000.02EB failed with error -22 17:44:20 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r3, r3) 17:44:20 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x8) r3 = fcntl$dupfd(r0, 0x0, r0) ioctl$SNDRV_PCM_IOCTL_REWIND(r3, 0x40084146, &(0x7f0000000000)=0x7f) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:44:20 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) r3 = openat$cgroup_ro(r0, &(0x7f0000000000)='freezer.state\x00', 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140)='devlink\x00') sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r4, &(0x7f0000001300)={0x0, 0x9effffff, &(0x7f0000000180)={&(0x7f0000000640)={0x14, r5, 0x0, 0x0, 0x0, {0x3d}}, 0x14}}, 0x0) sendmsg$DEVLINK_CMD_PORT_SPLIT(r3, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000240)={&(0x7f0000000300)={0x9c, r5, 0x100, 0x70bd2c, 0x25dfdbfe, {}, [{{@pci={{0x8, 0x1, 'pci\x00'}, {0x11, 0x2, '0000:00:10.0\x00'}}, {0x8, 0x3, 0x3}}, {0x8, 0x9, 0x8}}, {{@nsim={{0xe, 0x1, 'netdevsim\x00'}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}, {0x8, 0x9, 0x1}}, {{@pci={{0x8, 0x1, 'pci\x00'}, {0x11, 0x2, '0000:00:10.0\x00'}}, {0x8, 0x3, 0x1}}, {0x8, 0x9, 0x7}}]}, 0x9c}, 0x1, 0x0, 0x0, 0x40005}, 0x200040a4) [ 1976.513364][T28129] hid-generic 0000:0000:0000.02EC: item fetching failed at offset 19/22 17:44:20 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x7a000000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) [ 1976.554910][T28129] hid-generic: probe of 0000:0000:0000.02EC failed with error -22 17:44:20 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x700) 17:44:20 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x5, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:44:20 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_pts(r1, 0x8000) ioctl$VT_GETSTATE(r2, 0x5603, &(0x7f0000000000)={0x1ff, 0x76d, 0x5}) r3 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) ioctl$VIDIOC_ENUM_FRAMESIZES(r4, 0xc02c564a, &(0x7f0000000080)={0x400, 0x3147504d, 0x1, @stepwise={0x7fff, 0x8, 0x8000, 0x506600, 0x3, 0x9}}) newfstatat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x100) getgroups(0x2, &(0x7f0000000300)=[0x0, 0xffffffffffffffff]) setgroups(0x7, &(0x7f0000000340)=[r5, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, r6]) write$UHID_CREATE2(r3, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000007ebc144200000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cffcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e300000000"], 0x12e) r7 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r7, r3) 17:44:20 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r0, r1, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) 17:44:21 executing program 4: syz_io_uring_setup(0x5df2, &(0x7f0000000080)={0x0, 0x0, 0x4, 0x0, 0x4000000}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r0, r1, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x8) socket$inet_dccp(0x2, 0x6, 0x0) 17:44:21 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x81000000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:44:21 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) r3 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x842, 0x0) sendmsg$AUDIT_DEL_RULE(r3, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000240)={&(0x7f0000000740)=ANY=[@ANYBLOB="24040000f4032e9f26bd7800ffdbdf2503000000020000001a00000006000000000000800100010008000000f7ffffff00000000010100002304000001000100977d00000900000005000000ff7f0000030000000900000062ffffff6b0000004890ffff040000006531064f3f9a0e7e0100000007000000860000000000000004000000ffffffff05000000c9080000080000000010000007000000070000000900000001000000e7ffffff0100000004000000010000000500000008000000ffffffff040000000800000001000000890600000800000002000000080000000600000081000000060000007300000007000000000000100004000049050000810000000100000002000000054900005190000007000000ff0300000100000006000000020000000100010003000000fcffffff05000000b90000000200000005000000219c0000000000001f0000000700000008000000018000007f0000009d8f4f164015f41b82940008000008000000ff0000000600000005000000020000008100000006000000070000000900000060bb0000ff0f000000000080ff07000000100000ff0100008000000079ed000016e8064c020484000002000000ff030000f8ffffff060000000000000000001000000000000040000001000000ffff000005000000df00000002000000f50000000000400006000000030000000000000005000000050000000100000085db00001700000009000000040000008ea20000f7ffffff07000000030000000200000006000000030000000100000001000000090000003f00000000000000f8ffffff0300000001040000040000000400000001800000ff0f0000040000000100008000000000f8ffffff00010000040000000000010000020000ff7f0000010c0000800000000010000006000000ff01000004000000010000000600000003000000010000006e00000000000000ca00000000000000040000008100000006000000080000001f000000a50b0000ff01000007000000010000000000000000800000050000000080010004000000000000000700000009000000030000000000000004000000070000000600000003000000ff0000000000000099d400003535000004000000010000000400000006000000e4000000040000000700000004000000090000000100000001000000fcffffffff0000004000000001010000060000008e830000ac000000000000800500000006000000060000000700000057850000000800001f000000e6000000200000000180000006000000050000000600000008000000ffff000083000000080000000800000002000000d00400001f0000000100000005000000ff000000010000800002000000080000feffffff07000000ce00000007000000feffffff0200000000800000050000000600000008000000ff030000010400000200000081000000000200000400000021232d2ab78ec260c48d508c3e4ad1070949"], 0x424}, 0x1, 0x0, 0x0, 0x20000011}, 0x24040040) read$FUSE(r3, &(0x7f0000000b80)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) r5 = eventfd(0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r9, 0xae60) r10 = eventfd(0x0) r11 = dup3(r9, r7, 0x0) ioctl$KVM_IRQFD(r11, 0x4020ae76, &(0x7f0000000100)={r5, 0x0, 0x0, r10, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) ioctl$KVM_IRQFD(r11, 0x4020ae76, &(0x7f0000000100)={r5, 0x0, 0x2, r5, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) clone3(&(0x7f0000000500)={0x220000800, &(0x7f0000000300), &(0x7f0000000340), &(0x7f0000000380), {0x38}, &(0x7f00000003c0)=""/72, 0x48, &(0x7f0000000440)=""/69, &(0x7f00000004c0)=[0x0, 0x0, r4], 0x3, {r11}}, 0x58) 17:44:21 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x900) 17:44:21 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:44:21 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x6, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:44:21 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x82f50000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:44:21 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3"], 0x12e) r3 = eventfd(0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r7, 0xae60) r8 = eventfd(0x0) r9 = dup3(r7, r5, 0x0) ioctl$KVM_IRQFD(r9, 0x4020ae76, &(0x7f0000000100)={r3, 0x0, 0x0, r8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) ioctl$KVM_IRQFD(r9, 0x4020ae76, &(0x7f0000000100)={r3, 0x0, 0x2, r3, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) setsockopt$SO_TIMESTAMP(r9, 0x1, 0x23, &(0x7f0000000000)=0x6, 0x4) r10 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r10, r2) 17:44:21 executing program 4: r0 = syz_io_uring_setup(0x5095, &(0x7f0000000080)={0x0, 0x0, 0x1, 0x0, 0xfffffffc}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x1, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x4) ioctl$DRM_IOCTL_AGP_RELEASE(0xffffffffffffffff, 0x6431) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) r3 = fsmount(0xffffffffffffffff, 0x0, 0x9) ioctl$BLKDISCARD(r3, 0x1277, &(0x7f0000000100)=0x100) r4 = eventfd(0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r8, 0xae60) r9 = eventfd(0x0) r10 = dup3(r8, r6, 0x0) ioctl$KVM_IRQFD(r10, 0x4020ae76, &(0x7f0000000100)={r4, 0x0, 0x0, r9, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) ioctl$KVM_IRQFD(r10, 0x4020ae76, &(0x7f0000000100)={r4, 0x0, 0x2, r4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) ioctl$TIOCSBRK(r10, 0x5427) 17:44:21 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcsa\x00', 0x200800, 0x0) write$P9_RMKDIR(r0, &(0x7f0000000100)={0x14, 0x49, 0x2, {0x1, 0x0, 0x2}}, 0x14) open_tree(0xffffffffffffffff, 0x0, 0x0) r1 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r1, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1977.208240][ T17] hid-generic 0000:0000:0000.02ED: item fetching failed at offset 19/22 17:44:21 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x7, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) [ 1977.284870][ T17] hid-generic: probe of 0000:0000:0000.02ED failed with error -22 17:44:21 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0xa00) 17:44:21 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x88a8ffff, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) [ 1977.455104][T28129] hid-generic 0000:0000:0000.02EE: item fetching failed at offset 19/22 [ 1977.506583][T28129] hid-generic: probe of 0000:0000:0000.02EE failed with error -22 17:44:21 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = open_tree(0xffffffffffffffff, 0x0, 0x0) r1 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee8000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) recvfrom$packet(r0, &(0x7f0000000480)=""/229, 0xe5, 0x40, 0x0, 0x0) io_uring_enter(r1, 0x2039, 0x0, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000000)={0x3, 0x5, 0x4, 0x3, 0x8001, 0x1, 0x6, 0x20000000, 0x0}, &(0x7f0000000100)=0x20) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r1, 0x84, 0x1b, &(0x7f0000000300)={0x0, 0x79, "0cfff5d9226542ba285d5c656c2ade85b1eb44dd99732271bd89920b1fe4d30ff30a5a59bbbc14743bfebc845f4380cc8f6255c108622eac2efce1f7c8fc8fc327f001a2662832a5eb1ae0a5ee1bf37ab976dc97d7ec7cd5b431e0d03d08381e5813b11dcc0a22aa0e710e766679d166c8aafd674ceac383eb"}, &(0x7f0000000240)=0x81) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r9, 0xae60) r10 = eventfd(0x0) r11 = dup3(r9, r7, 0x0) ioctl$KVM_IRQFD(r11, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r10, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) ioctl$KVM_IRQFD(r11, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x2, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) ioctl$NS_GET_PARENT(r11, 0xb702, 0x0) getsockopt$inet_sctp_SCTP_STATUS(r0, 0x84, 0xe, &(0x7f00000003c0)={r4, 0x9, 0x316d, 0x1000, 0x100, 0x9, 0xe6, 0x8, {r5, @in={{0x2, 0x6, @private=0xa010100}}, 0x7fff, 0x6, 0x4, 0x1ff, 0x1}}, &(0x7f0000000280)=0xb0) 17:44:21 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x8, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:44:21 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = eventfd(0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) r6 = eventfd(0x0) r7 = dup3(r5, r3, 0x0) ioctl$KVM_IRQFD(r7, 0x4020ae76, &(0x7f0000000100)={r1, 0x0, 0x0, r6, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) ioctl$F2FS_IOC_RELEASE_COMPRESS_BLOCKS(r6, 0x8008f512, &(0x7f0000000000)) r8 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) r9 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r9, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000000073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e3"], 0x12e) r10 = creat(&(0x7f0000000100)='./bus\x00', 0x0) dup2(r10, r9) 17:44:22 executing program 4: r0 = eventfd(0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000580)='/dev/kvm\x00', 0x28280, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r5 = eventfd(0x0) r6 = dup3(r4, r2, 0x0) ioctl$KVM_IRQFD(r6, 0x4020ae76, &(0x7f0000000100)={r0, 0x0, 0x0, r5, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) ioctl$KVM_IRQFD(r6, 0x4020ae76, &(0x7f0000000100)={r0, 0x0, 0x2, r0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) r7 = syz_io_uring_setup(0x152d, &(0x7f0000000080)={0x0, 0xad49, 0x8, 0x3}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000440)=0x0) syz_io_uring_submit(r8, r9, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x8) io_uring_enter(r7, 0x2039, 0x0, 0x0, 0x0, 0x0) prctl$PR_SET_TIMERSLACK(0x1d, 0x800) fsetxattr$security_evm(0xffffffffffffffff, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000480)=@v1={0x2, "a34cf0"}, 0x4, 0x3) r10 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000040)=0x80, 0x80800) r12 = syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0)='IPVS\x00') setsockopt$packet_add_memb(r11, 0x107, 0x1, &(0x7f00000003c0)={0x0, 0x1, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x10) sendmsg$IPVS_CMD_SET_DEST(r10, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000240)={&(0x7f0000000300)={0x84, r12, 0x341, 0x70bd28, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x9}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x6}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x80000001}, @IPVS_CMD_ATTR_SERVICE={0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7}, @IPVS_CMD_ATTR_DAEMON={0x44, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'virt_wifi0\x00'}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast2}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @local}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8}]}, 0x84}, 0x1, 0x0, 0x0, 0x4000000}, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_GET(r11, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="10000000091420002bbd70df25000000"], 0x10}, 0x1, 0x0, 0x0, 0x20000085}, 0x6000c00) 17:44:22 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0xb00) 17:44:22 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x8bd53e93, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) [ 1977.905135][T25996] hid-generic 0000:0000:0000.02EF: item fetching failed at offset 19/22 [ 1977.924935][T25996] hid-generic: probe of 0000:0000:0000.02EF failed with error -22 17:44:22 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x933ed58b, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:44:22 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0xc00) 17:44:22 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x9, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:44:22 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) 17:44:22 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) lsetxattr$security_evm(&(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='security.evm\x00', &(0x7f0000000240)=ANY=[], 0x6, 0x1) 17:44:22 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000300)=ANY=[@ANYBLOB="0b000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000100000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200000000000000000000000000000000001000000000000000000004000000000000100258d7a3500000000000000000000000000000200000000000000feffffff00000000000000f2ffffffffffffff74b6628ddfb1cc186d630000a432bd0c47ffffff00000200000000010000000000030000cf0a000000fcffffff00000009000053f437efb9f56dfb5ca7810000000000000073cf000000000000000000000000ffff00003b38e967ac82d8627f766ad49083da14b7cb88e30000000000000000000154b2c4943c8ec8ad6b4f5aefa95d6d1f17dd70796acd3e2ff5665de2ac1bca76f55d8ca3d5b9716c0f5244cd0433452b10d998ae04e6242f7b61dca8cd9394b93ff40036f741551cbf533ec85f7841d6566f56b8fd690bb6f32934299b043cdc01a005fadb42739278abfd39e2e30712d83bc6e35c5773485c26ba040df00891b23e89ae671189d9f49d403da7c7ab7ce736fba7eb547e8c1387d90fe15e8cca00bc8f"], 0x12e) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r4 = eventfd(0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r8, 0xae60) r9 = eventfd(0x0) r10 = dup3(r8, r6, 0x0) ioctl$KVM_IRQFD(r10, 0x4020ae76, &(0x7f0000000100)={r4, 0x0, 0x0, r9, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) ioctl$KVM_IRQFD(r10, 0x4020ae76, &(0x7f0000000100)={r4, 0x0, 0x2, r4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_usbip_server_init(0x4) eventfd(0x0) openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) dup2(r6, r3) 17:44:22 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x83, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000000240)={0x8000, 0x8, 0x800c, 0x7, 0x84, 0x1000, 0x5, 0x1}, &(0x7f0000000280)=0x20) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) openat$vsock(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vsock\x00', 0x127000, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) r3 = eventfd(0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r7, 0xae60) r8 = eventfd(0x0) r9 = dup3(r7, r5, 0x0) ioctl$KVM_IRQFD(r9, 0x4020ae76, &(0x7f0000000100)={r3, 0x0, 0x0, r8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) ioctl$KVM_IRQFD(r9, 0x4020ae76, &(0x7f0000000100)={r3, 0x0, 0x2, r3, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) getsockopt$inet_pktinfo(r9, 0x0, 0x8, &(0x7f0000000300)={0x0, @broadcast, @broadcast}, &(0x7f0000000340)=0xc) 17:44:22 executing program 4: ioctl$sock_SIOCSIFVLAN_GET_VLAN_EGRESS_PRIORITY_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000000)) r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ff4000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1978.422752][T21423] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(13) [ 1978.429394][T21423] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) 17:44:22 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0xa, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:44:22 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x9effffff, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:44:22 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0xe00) [ 1978.560904][T21426] vhci_hcd: connection closed [ 1978.561064][ T132] vhci_hcd: stop threads [ 1978.575413][ T132] vhci_hcd: release socket [ 1978.593979][ T132] vhci_hcd: disconnect device 17:44:22 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x17c5, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x8) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1978.622656][T21442] __nla_validate_parse: 66 callbacks suppressed [ 1978.622669][T21442] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1978.739539][T21443] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 1978.786260][T21444] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'. 17:44:23 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = open_tree(0xffffffffffffffff, 0x0, 0x0) r1 = syz_io_uring_setup(0x4083, &(0x7f0000000080)={0x0, 0x0, 0x1, 0x0, 0x0, 0x0, r0}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r1, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1978.879025][T21442] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1978.906584][T21443] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 1978.947919][T21444] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'. 17:44:23 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0xb, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x7}]}}]}, 0x3c}}, 0x0) 17:44:23 executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0xf0ffffff, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0xc00e, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0x0) 17:44:23 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x3c}}, 0xf00) [ 1979.094890][T21423] vhci_hcd vhci_hcd.0: pdev(5) rhport(1) sockfd(11) [ 1979.101549][T21423] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 1979.146181][T21481] vhci_hcd: connection closed [ 1979.146592][T27906] ================================================================== [ 1979.159665][T27906] BUG: KASAN: null-ptr-deref in kthread_stop+0x90/0x720 [ 1979.166634][T27906] Write of size 4 at addr 000000000000001c by task kworker/u4:0/27906 [ 1979.174785][T27906] [ 1979.177134][T27906] CPU: 1 PID: 27906 Comm: kworker/u4:0 Not tainted 5.10.0-rc7-syzkaller #0 [ 1979.185729][T27906] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 17:44:23 executing program 1: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = open_tree(0xffffffffffffffff, 0x0, 0x0) bind$rxrpc(r0, &(0x7f0000000240)=@in6={0x21, 0x1, 0x2, 0x1c, {0xa, 0x4e20, 0x5, @ipv4={[], [], @broadcast}, 0x1}}, 0x24) r1 = syz_io_uring_setup(0x83, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1c4}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x18}, 0x20) io_uring_enter(r1, 0x2039, 0x0, 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f0000000300)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INTERRUPT(r0, &(0x7f0000000000)={0x10, 0xfffffffffffffff5, r4}, 0x10) [ 1979.187851][T21486] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1979.195810][T27906] Workqueue: usbip_event event_handler [ 1979.195858][T27906] Call Trace: [ 1979.195884][T27906] dump_stack+0x107/0x163 [ 1979.195904][T27906] ? kthread_stop+0x90/0x720 [ 1979.195918][T27906] ? kthread_stop+0x90/0x720 [ 1979.195932][T27906] kasan_report.cold+0x5/0x37 [ 1979.195952][T27906] ? kthread_stop+0x90/0x720 [ 1979.195972][T27906] check_memory_region+0x13d/0x180 [ 1979.195990][T27906] kthread_stop+0x90/0x720 17:44:23 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) r2 = socket$nl_audit(0x10, 0x3, 0x9) accept4(r2, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80, 0x800) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r3 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r3, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00060000000000000000000000000000000000000000009d0000000000fd00000000ecdf40e65cc780220000000000000000000000000000000300100000000000000000000004000f00000000000000000000000000000000000000000000200101000000000000000000000000000001000000000000000000000000000007000100258d7a350000000000000000000000000011000000feffffff00000000000000f2ffffffffffffff74fdffffffb1cc186d6300000000000000000073797a10fbffffff00000200000000010000000000030000cf0a000000fcffffff0000000900000000000fbc7f5c7e5ca7810000000000040073cf000000000016000000000000000000000000000000ffff00003b38e967ac82d8627f886ad49083da14b7cb88e30000000000"], 0x12e) r4 = creat(&(0x7f0000000100)='./bus\x00', 0x0) prctl$PR_GET_NO_NEW_PRIVS(0x27) dup2(r4, r3) [ 1979.196010][T27906] vhci_shutdown_connection+0x17f/0x340 [ 1979.196024][T27906] ? event_handler+0x14c/0x4f0 [ 1979.196039][T27906] ? kfree+0xdb/0x360 [ 1979.196067][T27906] event_handler+0x1f0/0x4f0 [ 1979.196088][T27906] process_one_work+0x933/0x15a0 [ 1979.196111][T27906] ? lock_release+0x710/0x710 [ 1979.196125][T27906] ? pwq_dec_nr_in_flight+0x320/0x320 [ 1979.196146][T27906] ? rwlock_bug.part.0+0x90/0x90 [ 1979.196161][T27906] ? _raw_spin_lock_irq+0x41/0x50 [ 1979.196186][T27906] worker_thread+0x64c/0x1120 [ 1979.196216][T27906] ? __kthread_parkme+0x13f/0x1e0 [ 1979.196231][T27906] ? process_one_work+0x15a0/0x15a0 [ 1979.196249][T27906] kthread+0x3b1/0x4a0 [ 1979.196266][T27906] ? kthread_create_worker_on_cpu+0xf0/0xf0 [ 1979.196284][T27906] ret_from_fork+0x1f/0x30 [ 1979.196310][T27906] ================================================================== [ 1979.196317][T27906] Disabling lock debugging due to kernel taint [ 1979.353934][T25996] vhci_hcd: vhci_device speed not set 17:44:23 executing program 4: r0 = syz_io_uring_setup(0x82, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000040)=0x0) io_uring_enter(r0, 0x22f0, 0x8d5f, 0x3, &(0x7f0000000000)={[0xcb6d]}, 0x8) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = syz_io_uring_complete(r1) r6 = creat(&(0x7f0000000280)='./file0\x00', 0xd931d3864d39dcd7) write$binfmt_script(r6, &(0x7f0000000340)=ANY=[@ANYBLOB="2321202e2f66696c653020806f06000000459f000072dc000092290a7e4555a763c15ccda085e2da58f729fa6680d7b0ec89b551c676ed3ae7a290ab0e74467713d41832ee9f99ba46c604a8bf8893cc7149595314f0771b65d33e129933dd93f99f00cd6b3e5903fcddb592a67f7062000000000000005256fd6e9af099cc6f684b27ab024e44795f09407b9caff26de096f5131fd16e191a9d85a914031b0caf7392fde9073fd902ff00005d9467590271d8ed07d8e363bdd3fde4fef23005d54194d33c9cf0f1579f5fe90c8f78ad0fb55b80c7bc5b04ada2d1f3c69de1c8f8"], 0x80) syz_io_uring_setup(0x6c0f, &(0x7f0000000040)={0x0, 0xc2d1, 0x1, 0x1, 0x34}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000000c0), &(0x7f0000000100)=0x0) r8 = io_uring_register$IORING_REGISTER_PERSONALITY(r6, 0x9, 0x0, 0x0) syz_io_uring_submit(0x0, r7, &(0x7f0000000140)=@IORING_OP_FALLOCATE={0x11, 0x0, 0x0, @fd_index=0x8, 0xfffffffffffff8d8, 0x0, 0xffff1c17, 0x0, 0x1, {0x0, r8}}, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_EPOLL_CTL=@mod={0x1d, 0x5, 0x0, r5, &(0x7f0000000100)={0x10}, r4, 0x3, 0x0, 0x1, {0x0, r8}}, 0xa) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r10, 0xae60) r11 = eventfd(0x0) r12 = dup3(r10, 0xffffffffffffffff, 0x0) ioctl$KVM_IRQFD(r12, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, r11, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) ioctl$KVM_IRQFD(r12, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x2, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) ioctl$KVM_X86_SET_MCE(r12, 0x4040ae9e, &(0x7f0000000180)={0xb000000000000000, 0x2000, 0x8000, 0xd, 0x7}) io_uring_enter(r0, 0x2039, 0x0, 0x0, 0x0, 0x0) [ 1979.404845][T27906] Kernel panic - not syncing: panic_on_warn set ... [ 1979.411476][T27906] CPU: 0 PID: 27906 Comm: kworker/u4:0 Tainted: G B 5.10.0-rc7-syzkaller #0 [ 1979.421472][T27906] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1979.431575][T27906] Workqueue: usbip_event event_handler [ 1979.437050][T27906] Call Trace: [ 1979.440355][T27906] dump_stack+0x107/0x163 [ 1979.444693][T27906] ? kthread_associate_blkcg+0x6e0/0x700 [ 1979.450330][T27906] panic+0x306/0x73d [ 1979.454228][T27906] ? __warn_printk+0xf3/0xf3 [ 1979.458822][T27906] ? preempt_schedule_common+0x59/0xc0 [ 1979.464288][T27906] ? kthread_stop+0x90/0x720 [ 1979.468908][T27906] ? preempt_schedule_thunk+0x16/0x18 [ 1979.474283][T27906] ? trace_hardirqs_on+0x51/0x1c0 [ 1979.479312][T27906] ? kthread_stop+0x90/0x720 [ 1979.483931][T27906] ? kthread_stop+0x90/0x720 [ 1979.488532][T27906] end_report+0x58/0x5e [ 1979.492691][T27906] kasan_report.cold+0xd/0x37 [ 1979.497375][T27906] ? kthread_stop+0x90/0x720 [ 1979.501977][T27906] check_memory_region+0x13d/0x180 [ 1979.507098][T27906] kthread_stop+0x90/0x720 [ 1979.511521][T27906] vhci_shutdown_connection+0x17f/0x340 [ 1979.517070][T27906] ? event_handler+0x14c/0x4f0 [ 1979.521840][T27906] ? kfree+0xdb/0x360 [ 1979.525833][T27906] event_handler+0x1f0/0x4f0 [ 1979.530431][T27906] process_one_work+0x933/0x15a0 [ 1979.535376][T27906] ? lock_release+0x710/0x710 [ 1979.540058][T27906] ? pwq_dec_nr_in_flight+0x320/0x320 [ 1979.545443][T27906] ? rwlock_bug.part.0+0x90/0x90 [ 1979.550393][T27906] ? _raw_spin_lock_irq+0x41/0x50 [ 1979.555431][T27906] worker_thread+0x64c/0x1120 [ 1979.560155][T27906] ? __kthread_parkme+0x13f/0x1e0 [ 1979.565186][T27906] ? process_one_work+0x15a0/0x15a0 [ 1979.570389][T27906] kthread+0x3b1/0x4a0 [ 1979.574468][T27906] ? kthread_create_worker_on_cpu+0xf0/0xf0 [ 1979.580365][T27906] ret_from_fork+0x1f/0x30 [ 1979.585206][T27906] Kernel Offset: disabled [ 1979.589635][T27906] Rebooting in 86400 seconds..