last executing test programs: 2m38.390187374s ago: executing program 2 (id=2802): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x7, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000180)={0x3, &(0x7f0000000280)=[{0x1ff, 0x84, 0x0, 0x8}, {0x1, 0x6, 0x1, 0x7}, {0xa, 0x1, 0x8, 0x7}]}) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x4000000000000, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x4001, 0x3, 0x230, 0x1d0, 0x0, 0x148, 0x0, 0x148, 0x1d0, 0x240, 0x240, 0x1d0, 0x240, 0x7fffffe, 0x0, {[{{@ip={@multicast2, @local, 0x0, 0x0, 'erspan0\x00', 'nr0\x00'}, 0x0, 0x94, 0xbc, 0x0, {}, [@inet=@rpfilter={{0x24}}]}, @common=@unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x5, 0x35, 0x1}}}, {{@ip={@local, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 'ip6gre0\x00', 'pim6reg\x00', {}, {0xff}, 0x11}, 0x0, 0xb8, 0xe0, 0x0, {}, [@inet=@rpfilter={{0x24}}, @inet=@rpfilter={{0x24}}]}, @common=@unspec=@NFQUEUE3={0x28}}], {{'\x00', 0x0, 0x70, 0x94}, {0x24, '\x00', 0x0, 0xfffffffb}}}}, 0x28c) pwritev2(0xffffffffffffffff, &(0x7f0000000240)=[{&(0x7f0000000000)='$', 0x3fec00}], 0x2, 0x1400, 0x0, 0x3) ioctl$VIDIOC_SUBDEV_S_CROP(0xffffffffffffffff, 0xc038563c, &(0x7f0000000140)={0x0, 0x0, {0xe, 0x1, 0x4, 0x1}}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x11) r4 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r5, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000000}, 0x0) ioctl$UI_SET_FFBIT(r4, 0x4004556b, 0x51) ioctl$UI_DEV_CREATE(r4, 0x5501) mlock2(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) socket$nl_route(0x10, 0x3, 0x0) r6 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000040)={'sit0\x00'}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000040), &(0x7f0000000080)=0xc) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000000140), &(0x7f0000000240)=0x4) setsockopt$inet_sctp6_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000010280)={0x0, 0x9, 0x0, 0x5}, 0x10) 2m35.189071456s ago: executing program 2 (id=2807): r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$SNDCTL_DSP_SETFMT(r0, 0xc0045005, &(0x7f0000000080)=0x40000) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000000)={0x6, 0x1, 0x1, 0x0, 0x3}) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(0xffffffffffffffff, 0x3ba0, 0x0) bind$can_j1939(0xffffffffffffffff, 0x0, 0x0) ioctl$vim2m_VIDIOC_STREAMOFF(0xffffffffffffffff, 0x40045612, &(0x7f0000000040)=0x1) ioctl$vim2m_VIDIOC_STREAMOFF(0xffffffffffffffff, 0x40045612, &(0x7f0000000080)=0x2) ioctl$vim2m_VIDIOC_QBUF(0xffffffffffffffff, 0xc058560f, 0x0) openat$audio1(0xffffffffffffff9c, &(0x7f0000000080), 0x282a2, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x68801, 0x124) ioctl$IOMMU_VFIO_IOAS$SET(r2, 0x3b88, &(0x7f00000004c0)={0xc}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) prlimit64(0x0, 0xb, 0x0, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4, 0x0, 0x0, 0x2) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) io_uring_enter(r2, 0x666a, 0x90d5, 0x0, &(0x7f0000000480)={[0x7, 0x80000000]}, 0x8) r3 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r3, 0xc1105518, &(0x7f0000000040)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x1, [0x5, 0xfffffffffffffffc, 0x0, 0x2, 0x8000000000000001, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x67, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000000, 0x9, 0x4, 0x8, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x3, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x4, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000, 0x0, 0x1c, 0x5, 0x3, 0x2, 0x2, 0x0, 0x2, 0x0, 0x0, 0x0, 0x400, 0x0, 0x1, 0x7ff, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x7fffffffffffffff, 0x80000, 0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x3, 0x8, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1, 0x200000000000000]}) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r3, 0xc2c45513, &(0x7f0000000180)={{0x7, 0x6, 0x9, 0x10000, 'syz1\x00', 0x7}, 0x0, [0x0, 0x1, 0x7fff, 0x60000000, 0x8, 0x81190c7, 0x6, 0x80000000, 0x5, 0x8, 0x5, 0x1000, 0x401, 0x3, 0x9, 0x3, 0x0, 0x4, 0xc, 0x4021, 0x1, 0x1e, 0xfc, 0xf, 0x8, 0x10001, 0x6, 0x1, 0x4, 0xc000, 0x1000000, 0x9, 0xe61a, 0x40, 0x0, 0x5, 0xbaaf, 0xfffff000, 0x3, 0xffff, 0x8bf6, 0x2, 0x5, 0x60000000, 0x40, 0x8, 0x6, 0xfffffffb, 0x7, 0x3, 0x2, 0x1, 0x7f, 0x40, 0x0, 0xffffffff, 0x7, 0x1, 0x3, 0x2, 0xc0000000, 0x5, 0x0, 0x5, 0xb25, 0x4, 0x381b, 0x0, 0xce, 0x7fffffff, 0x2, 0x5, 0x8, 0x9, 0x2, 0x1, 0xc06, 0x7, 0x1855, 0x0, 0x3ff, 0x6, 0x6, 0x1, 0x9, 0xa, 0x1, 0x9, 0x2, 0x0, 0x277, 0x1, 0x3b, 0x768, 0x6, 0x3, 0x5, 0x3, 0x7, 0x100, 0x100, 0x9, 0x3, 0x80, 0x4, 0x7fff, 0x7fffffff, 0x1, 0x9, 0x4, 0x80, 0x6c6, 0x8001, 0x0, 0x51b0, 0xfffffff7, 0x2, 0x2, 0xd34, 0x1, 0x2, 0x83, 0x9, 0x268, 0x1, 0x0, 0x1744, 0x4]}) 2m32.896035739s ago: executing program 2 (id=2816): socket$nl_route(0x10, 0x3, 0x0) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/wakeup_count', 0x101a02, 0x0) r1 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r4, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r5 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r5, 0x10e, 0x4, &(0x7f0000000140)=0x6, 0x4) setsockopt$sock_int(r5, 0x1, 0x8, &(0x7f0000000200), 0x4) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="980000000001010400000000000000000a0000003c0001802c00018014000300fe8000000000000000000000000000aa14000400ff0100000000000000000000000000010c00028005000100000000003c0002802c00018014000300fe8000000000000000000000000000aa14000400fe8800000000000000000000000000010c000280050001"], 0x98}}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000001c0)=ANY=[], 0x98}, 0x1, 0x0, 0x0, 0x20040800}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000008c0)={0x50, 0x0, 0x1, 0x3, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}]}, 0x50}}, 0x0) sendmmsg$alg(r1, &(0x7f0000001800)=[{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000100)="e92c3e5b5fea72d36d0f1ce0c1e16a89594759fe6816116aea0f6829fb0e01d753fdfda29b9fe80d5489652869b6b3eeef2e97fe4757", 0x36}, {&(0x7f0000000180)="aed9403172519ce89a419fce54b6039f63c98c", 0x13}, {&(0x7f00000002c0)="cad2985019f4e01a8f2249dfe45549d98fcd6a3a35f684075f51d7aaccbef8ac16ca395bf2bd16c28eb1461b3e1805515fb57ab53cd8474d379cd3449625c6a5e4e5ef158235d43abbaf354d3e9b6faa62ab7a4a4c06d2e27df772b9719fade7a0cc5e33b9144ee2200d99f4b9060c3d83ac8c0f924df255448d33cfd5e0514fbbea2e0f344bf523cc4ccec5f559768a98de1eef0af76e511ffc9b561f0a0fb1707a2e27f80201d011dd9d6532925b34", 0xb0}, {&(0x7f00000001c0)}, {&(0x7f00000007c0)="6a8262904c848c17c9a4e56f47186fafa59a67f43da0b494903acf72acd56d2253ceee243ade0c0d8ccb80ab242b4cb658af8818b1619a8207960781263eb7efe80e5ef34f96fd985e518b810f1bc9c4e452375a9eaafbd8e88a39372b87b4572ead2e5298794ef3f052bdfb0fb885230aeb07823b72ff44b58975721135c125caf35e7eeee1251390b326967180e1de65ed442a97ed2a513885e4a1c4414a4622bdd87f86900638ed5097a2b42855c3e80694bb8059dd8b1d0ae94f00447cc466410eeadd0a54569d7ec1d193e34beffa5a6a861b5600652a29c5b087fa1967e78c8b4a761303d33b75f2367ac19762631a877f5cfa9cca341d5577b6290de322620f5a5a676638c97b7c6d0b10dcb9209edf15273d150ec6e89814c218997dbcb687d06027cdf3eff025414619e5890215b059ae9425660bf4e291160e3ab4df54bd89ef055f9724a335ef8f7ac81c1751c412e23ec59596a6a800450f20429e8f604f0568b6b4700b799ada6aa0e6963f2ec3b18f42a58c1dd432e6323ce66f95c4f334d7c0c12e74bfe86b4025faecf6070d572f1297652d9bc1d7114e3695698ca7f324e3bd0202577cf2dd362b60b2df225e6ae54f127c1e02ddea1fd9ca48586b654c17d63833d523abf3029386f5f254061c235aa7fc333b87cfbc923c32f73dcbb27bc70a0f0eb5c60a2feea1a33bc198b5ae727e9d216c81c6c76a44e111fa38ce9a49b2d5eab4aa703e5bc5436fa94e146d72754d27097d9d5ecf0e652b12e5fc1d675e81d3c724f7638fa1880255955681437d88cf4431511154da22124bafce9e35187c6f10b90e113c85f1325bef2197baccc66a35251b92329f79e211966e568f397c16f018b5bfc5dc05849ef0bafc47ef3f7d266f478df3b5856369a1be9cce710dc9f85d32e89595f7ad7654ce59c75735f6e52722300e084ae956a354c771e8f0aeabdca1d63289ccc42b52effdcc483b3a8303a63465d88f04789cad5ed5a2cf782eba630d29c5d2ca93de6491cd60ada6e7596c18cc86e573e1352b2fb40dcd92a5bc69ad2280815c8e2bf503b44defb0d2f6105051", 0x300}, {0x0}, {&(0x7f0000000480)="83d763683f984bc11e2488e619ecec7e77667e5032d2412f70cb9cba1a19cf906fed30192629187789f9e15ffd100c9f93e01f614ce40f365be740e3b999a3a6f3db24561582956cc55786315d9a34678472eda3433780f09d8257e2b6c8c8eee3a9", 0x62}], 0x7, &(0x7f0000000500)=[@op={0x10, 0x117, 0x3, 0x1}, @iv={0x110, 0x117, 0x2, 0xff, "d17613b8dc104c2144f2fafb4716f50e3f025a4072d891a4fe04e11884ecb59a160bdd3b3efa9705bec9c72e699ee3fca4dedacd549999e9fa3e829913a00f8a588613c04f8b9352b4e2e773a36f710a6534904571307246e4c5c28913b50d0a6eb1076f615962ef451d9cbce39c6716cfa3e6dd15ea3b2fc51ca378879d924d096783778d467a6943ac870de085b0a16d31d3a1783c61624129ae7d804f60e0d9b24713a9c9927bbd48ec726731d9936c800cf7d88596653d26d6f81031cbd5dfe3f7b2ba1d5501769232f2f97a06f26e423c1ae347bf076a1bb01128092fcf855e2144ae9e9c59656ef68ec60dc51679ab01a6e68f7430a3562514a4b1d1"}], 0x120, 0x4000}, {0x0, 0x0, &(0x7f00000017c0)=[{&(0x7f0000000640)="e5e7b8211e99c98bab5661", 0xb}, {&(0x7f0000000680)="6d0b929817424057ba781098154ccd800898cbf8ea61117d38013ca51b15fcbfb29a234f399facf4041b2f0ff97e5f4c3c9f2def360dd953300ed7a20f6d233710475f5065baffa54256744798c32e95fc5f00cc9d6b053b80d8a9068d70eaf187264bbdb36e518926c81817b1cc9c453c", 0x71}], 0x2, 0x0, 0x0, 0x80}], 0x2, 0x4000) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newqdisc={0x60, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r8, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0xea, 0x2, 0x0, 0x0, 0x9, 0x5}, {0x12, 0x2, 0x0, 0x401, 0x8001, 0x1400}, 0xa5, 0x5, 0x10000000}}, @TCA_TBF_BURST={0x8, 0x6, 0x8057}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x40000}, 0x44080) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000440)=@newqdisc={0x40, 0x24, 0xd0f, 0x70bd29, 0x0, {0x60, 0x0, 0x0, r8, {0x0, 0x6}, {0xffe0, 0xa}, {0x1, 0x10}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x14, 0x2, [@TCA_FQ_TIMER_SLACK={0x8, 0xd, 0x3ff}, @TCA_FQ_RATE_ENABLE={0x8}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x55}, 0x4000) timer_delete(0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) sendfile(r0, r0, 0x0, 0x101) 2m29.810939218s ago: executing program 2 (id=2821): bind$alg(0xffffffffffffffff, &(0x7f00000003c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) r0 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x80000) syz_genetlink_get_family_id$fou(&(0x7f0000000040), r0) sendmsg$TIPC_NL_KEY_SET(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000540)={0x14, 0x0, 0x22, 0x70bd25, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x20000011}, 0x4) r1 = syz_genetlink_get_family_id$devlink(&(0x7f00000000c0), r0) sendmsg$DEVLINK_CMD_PORT_UNSPLIT(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000280)={0xb4, r1, 0x200, 0x70bd28, 0x25dfdbfd, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}}]}, 0xb4}, 0x1, 0x0, 0x0, 0x20000804}, 0xc040) 2m29.496907s ago: executing program 2 (id=2823): fsopen(&(0x7f0000000280)='cifs\x00', 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$IPSET_CMD_GET_BYNAME(0xffffffffffffffff, 0x0, 0xc004004) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x0, 0x1, 0x401, 0x0, 0x92, 0x55, 0x8, 0x7, 0x8}, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000280), 0x0) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b3", 0x40}], 0x1}], 0x1, 0x40800) r4 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_SET_PIT(r5, 0x8048ae66, &(0x7f0000000340)={[{0x122e, 0x3, 0x0, 0x0, 0x0, 0x4, 0xb3, 0x0, 0x5, 0xff, 0x1f}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x4}, {0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0xfd}]}) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000400)={0x10004, 0x0, 0x0, 0x1000, &(0x7f0000ffc000/0x1000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) r7 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$UI_SET_LEDBIT(r7, 0x40045569, 0x7) ioctl$UI_SET_EVBIT(r7, 0x40045564, 0x11) ioctl$UI_DEV_SETUP(r7, 0x405c5503, &(0x7f0000000100)={{0x100}, 'syz1\x00'}) ioctl$UI_DEV_CREATE(r7, 0x5501) ioctl$UI_DEV_DESTROY(r7, 0x5502) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000000)=[@textreal={0x8, &(0x7f0000000200)="baf80c66b8b470d18e66efbafc0c66b87b15000066ef6b6402000fc7a8846c66b9b00b00000f32670f22930ffe36ab1eba410066b80018000066efb800008ed00f01cff30f09", 0x46}], 0x1, 0x1, 0x0, 0x0) ioctl$TUNSETOFFLOAD(0xffffffffffffffff, 0x400454d0, 0x2) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0) openat$sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/mm/ksm/run\x00', 0x1, 0x0) 2m29.442020555s ago: executing program 0 (id=2824): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x59032, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0xaf01, 0x0) r1 = eventfd(0x4) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f0000000080)={0x1, 0x7f}) ioctl$VHOST_SET_LOG_FD(0xffffffffffffffff, 0x4004af07, &(0x7f0000000240)=r1) ioctl$VHOST_SET_VRING_KICK(0xffffffffffffffff, 0x4008af20, &(0x7f0000000040)={0x1, r1}) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000380)={0xaa, 0x564}) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000180)=""/53, 0x0}) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/236, 0x0, &(0x7f0000000480)=""/71}) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0xfffffeac, &(0x7f00000001c0)=""/115}]}) ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, &(0x7f0000000000)=0x1) r2 = dup(r0) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) socket(0xb, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) socket(0x3, 0x3, 0x0) r4 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000022546940fa0ae803d0990102030109023600010000000009047500038cbb2a0009050a001000010000090588"], 0x0) syz_usb_control_io$uac1(r4, 0x0, &(0x7f00000004c0)={0x24, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) migrate_pages(0x0, 0x9, &(0x7f0000000040)=0x9, &(0x7f0000000380)=0x102) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) munlockall() madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) socket$unix(0x1, 0x5, 0x0) 2m27.393546554s ago: executing program 2 (id=2830): openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000300), 0x25c182, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x4e21, @multicast2}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_open_dev$vcsn(0x0, 0x2040, 0x7c1501) fsetxattr$security_capability(r0, &(0x7f0000000280), &(0x7f0000000380)=@v2={0x2000000, [{0x8001, 0x10}, {0xffffff89, 0x100004}]}, 0x14, 0x3) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, 0x0) arch_prctl$ARCH_SHSTK_ENABLE(0x5001, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r0, &(0x7f0000000000), 0x0, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r3, 0x84, 0x72, &(0x7f0000000180)={0x0, 0xfffff789, 0x10}, &(0x7f00000001c0)=0xc) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = syz_open_dev$usbfs(&(0x7f0000000080), 0x70, 0x101301) ioctl$USBDEVFS_IOCTL(r4, 0xc0105512, &(0x7f0000000780)=@usbdevfs_connect={0x7}) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r5, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) getsockopt$inet6_tcp_buf(r0, 0x6, 0x1a, 0x0, &(0x7f0000000740)) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYRES8=r5, @ANYBLOB="03000000abbe16fefad790ee0309000090"], 0x50) ioctl$USBDEVFS_IOCTL(r4, 0xc0105512, &(0x7f0000000040)=@usbdevfs_connect) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f00000003c0)=@raw={'raw\x00', 0x9, 0x3, 0x314, 0xf8, 0xffffffff, 0xffffffff, 0xf8, 0xffffffff, 0x24c, 0xffffffff, 0xffffffff, 0x24c, 0xffffffff, 0x3, &(0x7f0000000100), {[{{@uncond, 0x0, 0xd4, 0xf8, 0x0, {}, [@common=@ah={{0x30}, {[0x4d5, 0x4d6], 0x1, 0xe, 0x2}}]}, @common=@inet=@TCPMSS={0x24, 'TCPMSS\x00', 0x0, {0x2}}}, {{@uncond, 0x0, 0xec, 0x154, 0x0, {}, [@inet=@rpfilter={{0x24}, {0x4}}, @inet=@rpfilter={{0x24}, {0x6}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x15, 0xfffe, 0x5, 0x7, '\x00', 'syz1\x00', {0x4}}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x370) 2m26.375578795s ago: executing program 0 (id=2832): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x400, 0x0, 0x32}, 0x9c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0x0, 0x0, @empty}}, 0x0, 0x0, 0x0, 0x0, 0x8a}, 0x9c) bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f0000000000)=0xdc30, 0x4) r1 = syz_open_dev$loop(&(0x7f0000000100), 0xf01c, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.stat\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000180)={'#! ', './file1/../file0', [{0x20, '\x00\x85\x95\xf1#R7\x9f~\xfe\x91\x8d\xc9>\x8a\'\xb6\xc8\xe5\xa8\x00\xeeU\xa4\xf4'}, {0x20, '@\x1d$.%{'}, {}], 0xa, "0000783348b29e910024000029f50a8993360100000000000000137228b60a0fd94415ad24ed37066498a2e1fed31075654e1b44cec7543fb562146903f434b5d6957398b43841d87d000e28863c057abb20db364524f96af9fabc4777fc7aeb7cb194e16c00007ff4d8c1549b48eb44ad378a000000000000"}, 0xaf) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000400)={'geneve1\x00'}) write$UHID_INPUT(r2, &(0x7f00000007c0)={0x8, {"dc5d3b0169633d3eba3eabbc09167be55101d4af4b22a373236464d2dbfaa84399b77bd438a54364a7ebc5bdaab4f9decb7c044318cd59a0af8279bcab35dd7daf7a0ceb381df2c32eff45b13e2c8f40e1895355bf6f165200cb1ca41a155730ee2e9f83183f9fafe029d0401b0770618254a8b2dc87b630072b1e2de160d1afed51b74c14b71ec1b226a324482d14ad586b1a4ce80e458fe45244c01eddeddf3564af838d6d5324f8a77023d6eb7aa14397a0e1413ea1c3dfdf063a35b709e627f36fe403ee3117365be5017682f53595f28543062c740a94a794312f5cebc315044b8ea000a5d0f27812ab0ce149d11e6f6f7620c5f3e250bf67d13a1ca39dbb7b8b5a31e3d7ba7ebe5849a7a09b61fc9f2cfc54b89e9cd0105bca49483ce55e0187ce2ad692a18219d881057c838587b915337169ee054655f26a04df913a658fccbf4def6aad750ca4796b74d322c67e9d4ee6a530a22dcc35db850b424d6ec9f62495b9f9fd2b000feadd57d26dbd505798c208d91eb0aab0fd97537631b8bf81ce0e2241c4272be4ff69b390e4485d574146b76d1fdbf7fc5334906805534cdae1e47240af7761a18fc8bd0a694be47529da98bc0f98eb7db3fc4a74cbb6e486f4de90fbf2452e72c2e1dca44543ad9ad094b8bc861eef1e814662d0b350339e3a510d459c6f83aabd5fd3dcb38224056d761e7df9b482b9905f1e2135c1929be328ecdb69c007a3efd548502c83106f6df1ab1178fac499eda92ad4373155227ec2df150c919d322ecb3ea37e659285f18a3e2f79b59900ca438df3a1381380a12d3ad7678e0a8d3bdfb40651389b4ac8c66138d442d70eafdc2df8b080028006b124e4ebe0d9883ef100f1934e42794146382c1d628fd2ebe5859b6c243824903d056d800975675bb1913142adbc039a9c68c2f146a0e8903447313f5e5549905f397a9b1f21a93b80c4d04a8ea7a29a50fbc5407a9305bba420edf898ea678d6879489c39692c99bb6dacf61f5f97637b94c1031d635b5423b38b9196fafaaf87b2796eadc21466af5a10281e6a808748969d29efb444c99a4cb2111732a792dbca4376a125a68f7cdac065cc6173dc21caafba48c742d9a7df2f771ff2f5725b22c247d4e0c6106f9f5f6929b69929ab37e9a9b326ce618bb702b883b12026f1300f21f2c7440cac8c5f1210a78aa067211d2827f5dcc7578252c2ccc3f67bab9d1bb6939b21b550788ef550acfed4bf50c0b4fb3ca4d2872ee64f95d611a317d9daaf373a10d868680b2226396c95fa2b0ab4d6fce06c3b42cb97d17a7b5089061537fdeb1a53040869f7befca330358fdba86754fc2e46c2113e1484cb37534af8f0408a7ee313778dab49f08229964298f847ea66c4ec319f64b6a12da585bc59e82e0263c507b397d3efee3b4066f4d25566aa1549f6185f6375f84b65fa8945148b90430c86a5b6fdf58d5c812b98d9dc621fd9a3d9f1a577495356516d1cbcf5e8bb8923b54b247225b9c3892b18a9e137f3620c734052af9dc8f1ea36f0d4592d5ee32e35676a84dc891f97456f2ac3a4ab58a42bcdc221a4ac8bb28d428add2fcbe5b110a8afd5d23b31e827bd16167b2d88cae024afc04a722ac0b4d45c52512e6b6f102aac4be21bc89ce246539048370553665b0a4336a6db99d0d19399be6437bf21419304331b4342b2c1db580f0c9bf681fdb8e9fa3e025454197bbc82ef93ee2f385660818ec5127080675a8013766469afe3b1e36e81bf2f04c3a26eaf4517551e734d21ba3bc90e48aea0891792970c39f3f528397e9b7ae190f1760fe5960dc763ee0a17939c60bfcac0a8914be82c749e4fe85d1ac5fa733413468fb8941085e8c4d6e0b6d1e62e20da58440facd640ddbb6c1f694b3ca48757a34c5a11668368711a1d4f3a81d31ac30d71277d7ae77882b6841cfa6289e6cce84a3ad57eeb328f831888ac7d3cfcd3a472a48d903f20cec8c8ae8d0bea04ebf7413ef7693f8ed876e49bd5f89d7e1078208ff62712e330fc0341b9ccf26845578d44b1e0c66d1bebc14742baedfabb8e9a2c8f42730360c72997efe0ce786ff330c2eb6e0ff20896f813c2a515ce76f826c11a1c1588eb369231ddeb4a2f9f9591ecdecc74d20aeb50047beb3ab89a9e4e1b805a20b645c79d0bc5d0247fab8ba46a97a07630b1f1cb69b42b568af746733d2c581f057873d64fe6e659b00b4a26745f5fba1fe7406a86b007936c7cfdac53a4c5b0ea9f6604863c8e3f174eddbb09175f6e13cda9a860cf400ef9ed02b895502ac6e6de6a658249c3c6e8a653517eae2231e56e0f120547923c6549ebc1ed14c623637ce3d96af5c93a32e58e2d9659d8b5b145888b52d9a5b5cb3cdf594eb137bcef2ba068cfd2c6ccf7ab6e5b4ec55e9197bfb91c9b8729f7b50cf0b0326f7ea3e712c77674d48545ca2a86744c3c38f149d69cf811beacf7e5f49c7bfba20f1dcf3d7bc0b9c796016820a46495d244c9606a06fe2e14233eda78d69ae4523ad7b708b0c7ead44d7fd376fed60e3cc2ee25e9600adfbe87ac7c8fb8269aec9459602af0f420becda6120ce7d9626c65ae7f860639e8bf664eb4301ec18add0e436c0356c12ab6b4ca35da2b43c4a8c239fd0b59a2ce94843cdfa1667053165053633b062844dbb0d00070fde74fa3178eb5f1f5fd02e2088d8690379f39ab22c080cdcb29d700bac74fabd8a356fe99afe83a5d99aa5024e9158a299eda6c99b6701e64f1d68e7e2c0c6e88396bb535a02d0948f0a250a6e090041c96d9c9acd6134d44d516fd1010c39e572b86b05bb1326a2a4f23f11181186f9c2a01dc7b58c0129f4b851ca9b1e3dc35db7364e29ef646211796b1651511e041345abce427fa5d6e48b8fb078c8432061a4cc518a8f2a2caf709a5c1473a62112a6650afc64eec12f8f9c08cff1b6fbf7a1209fc8661f62303b7c5d49c1d0b32a9f37e81ed9ab6193816d40995ed49c10b9f5752e04d57535a3d16f06c65d32846c31ec9787ec4a965679eb804e86b45d007f38d8104550770dc6f313bc846e43a14a8c21d0628c744e3e83cb998d1b7acfe996541a8c03852dadf9326444c582b481cae844e4f3fe3d638903b38f24633b63adbad841ac6c4c1169d781a0e271e8a967b1c7e986fcb3a66168e86e3559a44fcfa92452260491da9397659af60453f4cd4be2d15439445ec2b4366a79d3283da912d9d499df1242bd174edc235848caa21d2c997aff0e95c7e5cc0803c90fab84e7be7b37909d0e2f3bc9974e3388acb6800baba183ecc8eea8c71c0d65d669e41f99ceae523b7a6b772f3b8ebba1d2127ccc3ddb7ddcb4ec73cbdc26fc87c3848e258a0b5484d3a13e40ec4e4a65dd92f09e9fe1e3e2f8b96c4e363aa3683860dee62dfcf8823ee4a3593a092e0bd9c4cedacf44a272faa164447b01f46a7795642a40c61b0034a37f0e9b792428a0ddcd144fe8263088eaac8016f8f1cd30b55ac90a8f10d785b7570dd9e639a4a068d3fe98a420b9f72e79de817f676c2a224300d749571ad43f49d1fbe838f4566bc7b5f104c384ad87189213152b644d9fcbdf98bafeee569d640ce9045779f1d90024c023a7480a358dee276fba139c14b4fdb12885240903d0e61dc161659a68f62c92b899007e0f2b65bf0a069e9e57c9b6ae50a3b30dd1003fb0eead73ae2f6010b3b356b4060579a4f29935e1f00c01d12e5f44e8e3163d81dfef7ca8560604240c7e96e4454c6971614df306c768121abb3f628e3f1d2d026f58d1087334c5bdb74d7c949b0ee66a4531ba4e9b922aee3d0f802ed034734507a5913c52966f1f8bd4577840de0253aabc23299dced2a299859c07af9fb0f9c29b6533b9d84d471390d59ab315f5ddb226f6b8dd7889295f0fb1f7bd1adafe4cc520a1e84bf2a59d5b9795aeafc8d6fd66a8228aba8653b98622617ddfeb5d6795c9bd2f35d4a0c386e862675a50e3314c3fbb17aca151c13c7fc8b1d1b72ed0a958537b5ddc9e74bddc2b9571ec3f2b7775b125338d4852a75a63941564c65bb36dfb6bea4aab1ae7a4f285c2177aa98406eb2cc10934aa92d5a9612d4455c84ad200841d289b5c2d5deab0d8e2459598ef183d3dc47f6bad0b9513710600cfa4d69fcd5763cdcc4f2c2b7cd7d4491fd52f4aec82ce846c0988f6f0123e21e900d39c61085e68c9badc350b44004f6c042d64b0d0cbf91ad0592b198f1eeea1e52200bc8e6d62848d6884b10bdde72466039da488be6b340c23148f666f2fe6e032c07dac43586df182aca9116f4600313fa8375c76337ba86bdc391dae6450218f58f047ced64befc6bb5c2a60024669630a6279fedf2fe45e7e19ce582ad96ae0d023eb9b39f5f1e666e73bb038ae38157275be5eb3e7cbc8b05adf53e817646bdc2cfce98e5d162bf7faaca787db8717ab8b27b9e35609c5fb9fe9def07f010df8b43cf5c96851eadfdeff0b7bc5826e7e15490ae9c3d14166ee81bef007070e7981235a673804ad89943ee6b51ac63364f7870e121e6ff23a0c7d179527cd58dd7a4ca37247c2bd9efc79b720bb1ee2d39862e98cb81e93cf5b48d5d02ee8ac737ab504c867a1c49e678300803c94fbe978dea918a1e71b9791ee1e4d30056e86c26a4675a8b090be2365c0b451a13ece52a89a7057fe2052e11c6666eb916d823ea66bf217c320acba3b714910734b2d27c2fa586bd7f7664b0d1422adabad2ce2afc10270057f11940fac1a51d023ce48bd04ea39b7f99381b239fd0ddeea0dce7863ec1f8f61775013b6414ecf86e686a340a3148f87a9d7d60a1f2da53436d16fc88d6a4e7c3d55e0dd004cbecc15a5558eb705d82aacb1862ddc251dd5d9cbf1d78f97900ce6e8dab0ea678cb823bd1e7bbd1e927841af08f5427878c19f4f322228f9b36287fc13e7c1293ea875ae73815e052d6c2ebc40df8f7b9d1f76e0b10e35aa160944983d8e6b790df0d9b13f3460657336d81f7d83c0350324b930ec9c7557ce12887f76372e126f504b0980fea27f31a780c05187b9b5353dafc6b101543b24332b96e15bc26b19062e52fa9f86d260ee3a3bc92a133e328407bb85357ee5c45cb87228f44888b14941b5911b050e9319fe88033f830a8490917a9c0572ebbc5492b4e1083a2e3d77215a34abef947b5b9a950e780662de18873e55899c92db3ad3d437e8407890afa6b0c04ef861b8bc85fbbe1bb67b3d9ef001409f84b8ec4f01d861cecc143a805b981ab5cf5b605057b63cb2c84ec358e510a69cd8c33a8a62fe4680d0c980145cc709157832bfaef261cb0466c237376ca2944ce9affffd4b1dc7cc9511da0b34bffb9ac216fb8cf7c6572d95627787720d1ba67c6512fcdb16f6329e9668681c404efebad559f81f05971b5efb6b4cca97ad0346753cc0a40a877242d8a808c602b03dc962cee38e646cb18abb079c70d357c30738a70f55cd3c5956a83a1bfcd6649dd765f16bfe968066345df7380bbc0c16b3b5af513d6458c791343952f33a051c5d711c1f35af1b47f3db9bbfb5c7c636b3a2b52805d606479879be0b404a28ade5649a3185e0f85a85fc15cd824671c2befdd0da509597c87d869f0bd7ad163ad93ca28fc0c4025eccaafe385ec3fc06c54ebcd7b07b6c7e0197c5b9ef886159a1585ae45248f865be760db6f5bc8f868fc6aefd04e34ecb51159e4cdcc2214b42b1ca9caec13ba3e1b2e7a3c736977b226213d265c2873195122a9b448088c8b50edd549be41c38ab176807b75e7267f86e4", 0x1000}}, 0x1006) ioctl$LOOP_CONFIGURE(r1, 0x4c0a, &(0x7f00000002c0)={r2, 0x0, {0x2a00, 0x80010000, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x1c, "fee8a2ab78fc5e3ed1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "9001001c551265406c7f306003d8a0f4bd0000000300"}}) r3 = request_key(&(0x7f0000000040)='blacklist\x00', &(0x7f0000000080)={'syz', 0x3}, &(0x7f00000000c0)='\x00', 0xffffffffffffffff) r4 = add_key$fscrypt_v1(&(0x7f0000000100), &(0x7f0000000140)={'fscrypt:', @desc1}, &(0x7f0000000180)={0x0, "e6ed124b98f53eb10367b2cb60dbb6fe1a31faa32357c34ba7f8b9b523cfda4fca60c3560eb019ba027e9856be1bb63f6debee5253d37ab4111b3610d8b6dac4", 0x38}, 0x48, 0xfffffffffffffffd) keyctl$unlink(0x9, r3, r4) shutdown(r0, 0x2) socket$inet6_sctp(0xa, 0x1, 0x84) (async) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x400, 0x0, 0x32}, 0x9c) (async) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0x0, 0x0, @empty}}, 0x0, 0x0, 0x0, 0x0, 0x8a}, 0x9c) (async) bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) (async) sendto$inet6(r0, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) (async) setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f0000000000)=0xdc30, 0x4) (async) syz_open_dev$loop(&(0x7f0000000100), 0xf01c, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.stat\x00', 0x275a, 0x0) (async) write$binfmt_script(r2, &(0x7f0000000180)={'#! ', './file1/../file0', [{0x20, '\x00\x85\x95\xf1#R7\x9f~\xfe\x91\x8d\xc9>\x8a\'\xb6\xc8\xe5\xa8\x00\xeeU\xa4\xf4'}, {0x20, '@\x1d$.%{'}, {}], 0xa, "0000783348b29e910024000029f50a8993360100000000000000137228b60a0fd94415ad24ed37066498a2e1fed31075654e1b44cec7543fb562146903f434b5d6957398b43841d87d000e28863c057abb20db364524f96af9fabc4777fc7aeb7cb194e16c00007ff4d8c1549b48eb44ad378a000000000000"}, 0xaf) (async) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000400)={'geneve1\x00'}) (async) write$UHID_INPUT(r2, &(0x7f00000007c0)={0x8, {"dc5d3b0169633d3eba3eabbc09167be55101d4af4b22a373236464d2dbfaa84399b77bd438a54364a7ebc5bdaab4f9decb7c044318cd59a0af8279bcab35dd7daf7a0ceb381df2c32eff45b13e2c8f40e1895355bf6f165200cb1ca41a155730ee2e9f83183f9fafe029d0401b0770618254a8b2dc87b630072b1e2de160d1afed51b74c14b71ec1b226a324482d14ad586b1a4ce80e458fe45244c01eddeddf3564af838d6d5324f8a77023d6eb7aa14397a0e1413ea1c3dfdf063a35b709e627f36fe403ee3117365be5017682f53595f28543062c740a94a794312f5cebc315044b8ea000a5d0f27812ab0ce149d11e6f6f7620c5f3e250bf67d13a1ca39dbb7b8b5a31e3d7ba7ebe5849a7a09b61fc9f2cfc54b89e9cd0105bca49483ce55e0187ce2ad692a18219d881057c838587b915337169ee054655f26a04df913a658fccbf4def6aad750ca4796b74d322c67e9d4ee6a530a22dcc35db850b424d6ec9f62495b9f9fd2b000feadd57d26dbd505798c208d91eb0aab0fd97537631b8bf81ce0e2241c4272be4ff69b390e4485d574146b76d1fdbf7fc5334906805534cdae1e47240af7761a18fc8bd0a694be47529da98bc0f98eb7db3fc4a74cbb6e486f4de90fbf2452e72c2e1dca44543ad9ad094b8bc861eef1e814662d0b350339e3a510d459c6f83aabd5fd3dcb38224056d761e7df9b482b9905f1e2135c1929be328ecdb69c007a3efd548502c83106f6df1ab1178fac499eda92ad4373155227ec2df150c919d322ecb3ea37e659285f18a3e2f79b59900ca438df3a1381380a12d3ad7678e0a8d3bdfb40651389b4ac8c66138d442d70eafdc2df8b080028006b124e4ebe0d9883ef100f1934e42794146382c1d628fd2ebe5859b6c243824903d056d800975675bb1913142adbc039a9c68c2f146a0e8903447313f5e5549905f397a9b1f21a93b80c4d04a8ea7a29a50fbc5407a9305bba420edf898ea678d6879489c39692c99bb6dacf61f5f97637b94c1031d635b5423b38b9196fafaaf87b2796eadc21466af5a10281e6a808748969d29efb444c99a4cb2111732a792dbca4376a125a68f7cdac065cc6173dc21caafba48c742d9a7df2f771ff2f5725b22c247d4e0c6106f9f5f6929b69929ab37e9a9b326ce618bb702b883b12026f1300f21f2c7440cac8c5f1210a78aa067211d2827f5dcc7578252c2ccc3f67bab9d1bb6939b21b550788ef550acfed4bf50c0b4fb3ca4d2872ee64f95d611a317d9daaf373a10d868680b2226396c95fa2b0ab4d6fce06c3b42cb97d17a7b5089061537fdeb1a53040869f7befca330358fdba86754fc2e46c2113e1484cb37534af8f0408a7ee313778dab49f08229964298f847ea66c4ec319f64b6a12da585bc59e82e0263c507b397d3efee3b4066f4d25566aa1549f6185f6375f84b65fa8945148b90430c86a5b6fdf58d5c812b98d9dc621fd9a3d9f1a577495356516d1cbcf5e8bb8923b54b247225b9c3892b18a9e137f3620c734052af9dc8f1ea36f0d4592d5ee32e35676a84dc891f97456f2ac3a4ab58a42bcdc221a4ac8bb28d428add2fcbe5b110a8afd5d23b31e827bd16167b2d88cae024afc04a722ac0b4d45c52512e6b6f102aac4be21bc89ce246539048370553665b0a4336a6db99d0d19399be6437bf21419304331b4342b2c1db580f0c9bf681fdb8e9fa3e025454197bbc82ef93ee2f385660818ec5127080675a8013766469afe3b1e36e81bf2f04c3a26eaf4517551e734d21ba3bc90e48aea0891792970c39f3f528397e9b7ae190f1760fe5960dc763ee0a17939c60bfcac0a8914be82c749e4fe85d1ac5fa733413468fb8941085e8c4d6e0b6d1e62e20da58440facd640ddbb6c1f694b3ca48757a34c5a11668368711a1d4f3a81d31ac30d71277d7ae77882b6841cfa6289e6cce84a3ad57eeb328f831888ac7d3cfcd3a472a48d903f20cec8c8ae8d0bea04ebf7413ef7693f8ed876e49bd5f89d7e1078208ff62712e330fc0341b9ccf26845578d44b1e0c66d1bebc14742baedfabb8e9a2c8f42730360c72997efe0ce786ff330c2eb6e0ff20896f813c2a515ce76f826c11a1c1588eb369231ddeb4a2f9f9591ecdecc74d20aeb50047beb3ab89a9e4e1b805a20b645c79d0bc5d0247fab8ba46a97a07630b1f1cb69b42b568af746733d2c581f057873d64fe6e659b00b4a26745f5fba1fe7406a86b007936c7cfdac53a4c5b0ea9f6604863c8e3f174eddbb09175f6e13cda9a860cf400ef9ed02b895502ac6e6de6a658249c3c6e8a653517eae2231e56e0f120547923c6549ebc1ed14c623637ce3d96af5c93a32e58e2d9659d8b5b145888b52d9a5b5cb3cdf594eb137bcef2ba068cfd2c6ccf7ab6e5b4ec55e9197bfb91c9b8729f7b50cf0b0326f7ea3e712c77674d48545ca2a86744c3c38f149d69cf811beacf7e5f49c7bfba20f1dcf3d7bc0b9c796016820a46495d244c9606a06fe2e14233eda78d69ae4523ad7b708b0c7ead44d7fd376fed60e3cc2ee25e9600adfbe87ac7c8fb8269aec9459602af0f420becda6120ce7d9626c65ae7f860639e8bf664eb4301ec18add0e436c0356c12ab6b4ca35da2b43c4a8c239fd0b59a2ce94843cdfa1667053165053633b062844dbb0d00070fde74fa3178eb5f1f5fd02e2088d8690379f39ab22c080cdcb29d700bac74fabd8a356fe99afe83a5d99aa5024e9158a299eda6c99b6701e64f1d68e7e2c0c6e88396bb535a02d0948f0a250a6e090041c96d9c9acd6134d44d516fd1010c39e572b86b05bb1326a2a4f23f11181186f9c2a01dc7b58c0129f4b851ca9b1e3dc35db7364e29ef646211796b1651511e041345abce427fa5d6e48b8fb078c8432061a4cc518a8f2a2caf709a5c1473a62112a6650afc64eec12f8f9c08cff1b6fbf7a1209fc8661f62303b7c5d49c1d0b32a9f37e81ed9ab6193816d40995ed49c10b9f5752e04d57535a3d16f06c65d32846c31ec9787ec4a965679eb804e86b45d007f38d8104550770dc6f313bc846e43a14a8c21d0628c744e3e83cb998d1b7acfe996541a8c03852dadf9326444c582b481cae844e4f3fe3d638903b38f24633b63adbad841ac6c4c1169d781a0e271e8a967b1c7e986fcb3a66168e86e3559a44fcfa92452260491da9397659af60453f4cd4be2d15439445ec2b4366a79d3283da912d9d499df1242bd174edc235848caa21d2c997aff0e95c7e5cc0803c90fab84e7be7b37909d0e2f3bc9974e3388acb6800baba183ecc8eea8c71c0d65d669e41f99ceae523b7a6b772f3b8ebba1d2127ccc3ddb7ddcb4ec73cbdc26fc87c3848e258a0b5484d3a13e40ec4e4a65dd92f09e9fe1e3e2f8b96c4e363aa3683860dee62dfcf8823ee4a3593a092e0bd9c4cedacf44a272faa164447b01f46a7795642a40c61b0034a37f0e9b792428a0ddcd144fe8263088eaac8016f8f1cd30b55ac90a8f10d785b7570dd9e639a4a068d3fe98a420b9f72e79de817f676c2a224300d749571ad43f49d1fbe838f4566bc7b5f104c384ad87189213152b644d9fcbdf98bafeee569d640ce9045779f1d90024c023a7480a358dee276fba139c14b4fdb12885240903d0e61dc161659a68f62c92b899007e0f2b65bf0a069e9e57c9b6ae50a3b30dd1003fb0eead73ae2f6010b3b356b4060579a4f29935e1f00c01d12e5f44e8e3163d81dfef7ca8560604240c7e96e4454c6971614df306c768121abb3f628e3f1d2d026f58d1087334c5bdb74d7c949b0ee66a4531ba4e9b922aee3d0f802ed034734507a5913c52966f1f8bd4577840de0253aabc23299dced2a299859c07af9fb0f9c29b6533b9d84d471390d59ab315f5ddb226f6b8dd7889295f0fb1f7bd1adafe4cc520a1e84bf2a59d5b9795aeafc8d6fd66a8228aba8653b98622617ddfeb5d6795c9bd2f35d4a0c386e862675a50e3314c3fbb17aca151c13c7fc8b1d1b72ed0a958537b5ddc9e74bddc2b9571ec3f2b7775b125338d4852a75a63941564c65bb36dfb6bea4aab1ae7a4f285c2177aa98406eb2cc10934aa92d5a9612d4455c84ad200841d289b5c2d5deab0d8e2459598ef183d3dc47f6bad0b9513710600cfa4d69fcd5763cdcc4f2c2b7cd7d4491fd52f4aec82ce846c0988f6f0123e21e900d39c61085e68c9badc350b44004f6c042d64b0d0cbf91ad0592b198f1eeea1e52200bc8e6d62848d6884b10bdde72466039da488be6b340c23148f666f2fe6e032c07dac43586df182aca9116f4600313fa8375c76337ba86bdc391dae6450218f58f047ced64befc6bb5c2a60024669630a6279fedf2fe45e7e19ce582ad96ae0d023eb9b39f5f1e666e73bb038ae38157275be5eb3e7cbc8b05adf53e817646bdc2cfce98e5d162bf7faaca787db8717ab8b27b9e35609c5fb9fe9def07f010df8b43cf5c96851eadfdeff0b7bc5826e7e15490ae9c3d14166ee81bef007070e7981235a673804ad89943ee6b51ac63364f7870e121e6ff23a0c7d179527cd58dd7a4ca37247c2bd9efc79b720bb1ee2d39862e98cb81e93cf5b48d5d02ee8ac737ab504c867a1c49e678300803c94fbe978dea918a1e71b9791ee1e4d30056e86c26a4675a8b090be2365c0b451a13ece52a89a7057fe2052e11c6666eb916d823ea66bf217c320acba3b714910734b2d27c2fa586bd7f7664b0d1422adabad2ce2afc10270057f11940fac1a51d023ce48bd04ea39b7f99381b239fd0ddeea0dce7863ec1f8f61775013b6414ecf86e686a340a3148f87a9d7d60a1f2da53436d16fc88d6a4e7c3d55e0dd004cbecc15a5558eb705d82aacb1862ddc251dd5d9cbf1d78f97900ce6e8dab0ea678cb823bd1e7bbd1e927841af08f5427878c19f4f322228f9b36287fc13e7c1293ea875ae73815e052d6c2ebc40df8f7b9d1f76e0b10e35aa160944983d8e6b790df0d9b13f3460657336d81f7d83c0350324b930ec9c7557ce12887f76372e126f504b0980fea27f31a780c05187b9b5353dafc6b101543b24332b96e15bc26b19062e52fa9f86d260ee3a3bc92a133e328407bb85357ee5c45cb87228f44888b14941b5911b050e9319fe88033f830a8490917a9c0572ebbc5492b4e1083a2e3d77215a34abef947b5b9a950e780662de18873e55899c92db3ad3d437e8407890afa6b0c04ef861b8bc85fbbe1bb67b3d9ef001409f84b8ec4f01d861cecc143a805b981ab5cf5b605057b63cb2c84ec358e510a69cd8c33a8a62fe4680d0c980145cc709157832bfaef261cb0466c237376ca2944ce9affffd4b1dc7cc9511da0b34bffb9ac216fb8cf7c6572d95627787720d1ba67c6512fcdb16f6329e9668681c404efebad559f81f05971b5efb6b4cca97ad0346753cc0a40a877242d8a808c602b03dc962cee38e646cb18abb079c70d357c30738a70f55cd3c5956a83a1bfcd6649dd765f16bfe968066345df7380bbc0c16b3b5af513d6458c791343952f33a051c5d711c1f35af1b47f3db9bbfb5c7c636b3a2b52805d606479879be0b404a28ade5649a3185e0f85a85fc15cd824671c2befdd0da509597c87d869f0bd7ad163ad93ca28fc0c4025eccaafe385ec3fc06c54ebcd7b07b6c7e0197c5b9ef886159a1585ae45248f865be760db6f5bc8f868fc6aefd04e34ecb51159e4cdcc2214b42b1ca9caec13ba3e1b2e7a3c736977b226213d265c2873195122a9b448088c8b50edd549be41c38ab176807b75e7267f86e4", 0x1000}}, 0x1006) (async) ioctl$LOOP_CONFIGURE(r1, 0x4c0a, &(0x7f00000002c0)={r2, 0x0, {0x2a00, 0x80010000, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x1c, "fee8a2ab78fc5e3ed1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "9001001c551265406c7f306003d8a0f4bd0000000300"}}) (async) request_key(&(0x7f0000000040)='blacklist\x00', &(0x7f0000000080)={'syz', 0x3}, &(0x7f00000000c0)='\x00', 0xffffffffffffffff) (async) add_key$fscrypt_v1(&(0x7f0000000100), &(0x7f0000000140)={'fscrypt:', @desc1}, &(0x7f0000000180)={0x0, "e6ed124b98f53eb10367b2cb60dbb6fe1a31faa32357c34ba7f8b9b523cfda4fca60c3560eb019ba027e9856be1bb63f6debee5253d37ab4111b3610d8b6dac4", 0x38}, 0x48, 0xfffffffffffffffd) (async) keyctl$unlink(0x9, r3, r4) (async) shutdown(r0, 0x2) (async) 2m26.006058941s ago: executing program 0 (id=2833): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x7, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000180)={0x3, &(0x7f0000000280)=[{0x1ff, 0x84, 0x0, 0x8}, {0x1, 0x6, 0x1, 0x7}, {0xa, 0x1, 0x8, 0x7}]}) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x4000000000000, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x4001, 0x3, 0x230, 0x1d0, 0x0, 0x148, 0x0, 0x148, 0x1d0, 0x240, 0x240, 0x1d0, 0x240, 0x7fffffe, 0x0, {[{{@ip={@multicast2, @local, 0x0, 0x0, 'erspan0\x00', 'nr0\x00'}, 0x0, 0x94, 0xbc, 0x0, {}, [@inet=@rpfilter={{0x24}}]}, @common=@unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x5, 0x35, 0x1}}}, {{@ip={@local, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 'ip6gre0\x00', 'pim6reg\x00', {}, {0xff}, 0x11}, 0x0, 0xb8, 0xe0, 0x0, {}, [@inet=@rpfilter={{0x24}}, @inet=@rpfilter={{0x24}}]}, @common=@unspec=@NFQUEUE3={0x28}}], {{'\x00', 0x0, 0x70, 0x94}, {0x24, '\x00', 0x0, 0xfffffffb}}}}, 0x28c) pwritev2(0xffffffffffffffff, &(0x7f0000000240)=[{&(0x7f0000000000)='$', 0x3fec00}], 0x2, 0x1400, 0x0, 0x3) ioctl$VIDIOC_SUBDEV_S_CROP(0xffffffffffffffff, 0xc038563c, &(0x7f0000000140)={0x0, 0x0, {0xe, 0x1, 0x4, 0x1}}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x11) r4 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r5, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000000}, 0x0) ioctl$UI_SET_FFBIT(r4, 0x4004556b, 0x51) ioctl$UI_DEV_CREATE(r4, 0x5501) mlock2(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) socket$nl_route(0x10, 0x3, 0x0) r6 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000040)={'sit0\x00'}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x0, @private=0xa010101}]}, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000000140), &(0x7f0000000240)=0x4) setsockopt$inet_sctp6_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000010280)={0x0, 0x9, 0x0, 0x5}, 0x10) 2m25.552093982s ago: executing program 3 (id=2835): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0xcccc0000, 0x1000, &(0x7f0000f15000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0xfb7f, 0x0, 0x0, 0x1000, &(0x7f0000fff000/0x1000)=nil}) 2m24.254245763s ago: executing program 3 (id=2837): socket$nl_route(0x10, 0x3, 0x0) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/wakeup_count', 0x101a02, 0x0) r1 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r4, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r5 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r5, 0x10e, 0x4, &(0x7f0000000140)=0x6, 0x4) setsockopt$sock_int(r5, 0x1, 0x8, &(0x7f0000000200), 0x4) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="980000000001010400000000000000000a0000003c0001802c00018014000300fe8000000000000000000000000000aa14000400ff0100000000000000000000000000010c00028005000100000000003c0002802c00018014000300fe8000000000000000000000000000aa14000400fe8800000000000000000000000000010c00028005000100000000"], 0x98}}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000001c0)=ANY=[], 0x98}, 0x1, 0x0, 0x0, 0x20040800}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000008c0)={0x50, 0x0, 0x1, 0x3, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}]}, 0x50}}, 0x0) sendmmsg$alg(r1, &(0x7f0000001800)=[{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000100)="e92c3e5b5fea72d36d0f1ce0c1e16a89594759fe6816116aea0f6829fb0e01d753fdfda29b9fe80d5489652869b6b3eeef2e97fe4757", 0x36}, {&(0x7f0000000180)="aed9403172519ce89a419fce54b6039f63c98c", 0x13}, {&(0x7f00000002c0)="cad2985019f4e01a8f2249dfe45549d98fcd6a3a35f684075f51d7aaccbef8ac16ca395bf2bd16c28eb1461b3e1805515fb57ab53cd8474d379cd3449625c6a5e4e5ef158235d43abbaf354d3e9b6faa62ab7a4a4c06d2e27df772b9719fade7a0cc5e33b9144ee2200d99f4b9060c3d83ac8c0f924df255448d33cfd5e0514fbbea2e0f344bf523cc4ccec5f559768a98de1eef0af76e511ffc9b561f0a0fb1707a2e27f80201d011dd9d6532925b34", 0xb0}, {&(0x7f00000001c0)}, {&(0x7f00000007c0)="6a8262904c848c17c9a4e56f47186fafa59a67f43da0b494903acf72acd56d2253ceee243ade0c0d8ccb80ab242b4cb658af8818b1619a8207960781263eb7efe80e5ef34f96fd985e518b810f1bc9c4e452375a9eaafbd8e88a39372b87b4572ead2e5298794ef3f052bdfb0fb885230aeb07823b72ff44b58975721135c125caf35e7eeee1251390b326967180e1de65ed442a97ed2a513885e4a1c4414a4622bdd87f86900638ed5097a2b42855c3e80694bb8059dd8b1d0ae94f00447cc466410eeadd0a54569d7ec1d193e34beffa5a6a861b5600652a29c5b087fa1967e78c8b4a761303d33b75f2367ac19762631a877f5cfa9cca341d5577b6290de322620f5a5a676638c97b7c6d0b10dcb9209edf15273d150ec6e89814c218997dbcb687d06027cdf3eff025414619e5890215b059ae9425660bf4e291160e3ab4df54bd89ef055f9724a335ef8f7ac81c1751c412e23ec59596a6a800450f20429e8f604f0568b6b4700b799ada6aa0e6963f2ec3b18f42a58c1dd432e6323ce66f95c4f334d7c0c12e74bfe86b4025faecf6070d572f1297652d9bc1d7114e3695698ca7f324e3bd0202577cf2dd362b60b2df225e6ae54f127c1e02ddea1fd9ca48586b654c17d63833d523abf3029386f5f254061c235aa7fc333b87cfbc923c32f73dcbb27bc70a0f0eb5c60a2feea1a33bc198b5ae727e9d216c81c6c76a44e111fa38ce9a49b2d5eab4aa703e5bc5436fa94e146d72754d27097d9d5ecf0e652b12e5fc1d675e81d3c724f7638fa1880255955681437d88cf4431511154da22124bafce9e35187c6f10b90e113c85f1325bef2197baccc66a35251b92329f79e211966e568f397c16f018b5bfc5dc05849ef0bafc47ef3f7d266f478df3b5856369a1be9cce710dc9f85d32e89595f7ad7654ce59c75735f6e52722300e084ae956a354c771e8f0aeabdca1d63289ccc42b52effdcc483b3a8303a63465d88f04789cad5ed5a2cf782eba630d29c5d2ca93de6491cd60ada6e7596c18cc86e573e1352b2fb40dcd92a5bc69ad2280815c8e2bf503b44defb0d2f6105051", 0x300}, {0x0}, {&(0x7f0000000480)="83d763683f984bc11e2488e619ecec7e77667e5032d2412f70cb9cba1a19cf906fed30192629187789f9e15ffd100c9f93e01f614ce40f365be740e3b999a3a6f3db24561582956cc55786315d9a34678472eda3433780f09d8257e2b6c8c8eee3a9", 0x62}], 0x7, &(0x7f0000000500)=[@op={0x10, 0x117, 0x3, 0x1}, @iv={0x110, 0x117, 0x2, 0xff, "d17613b8dc104c2144f2fafb4716f50e3f025a4072d891a4fe04e11884ecb59a160bdd3b3efa9705bec9c72e699ee3fca4dedacd549999e9fa3e829913a00f8a588613c04f8b9352b4e2e773a36f710a6534904571307246e4c5c28913b50d0a6eb1076f615962ef451d9cbce39c6716cfa3e6dd15ea3b2fc51ca378879d924d096783778d467a6943ac870de085b0a16d31d3a1783c61624129ae7d804f60e0d9b24713a9c9927bbd48ec726731d9936c800cf7d88596653d26d6f81031cbd5dfe3f7b2ba1d5501769232f2f97a06f26e423c1ae347bf076a1bb01128092fcf855e2144ae9e9c59656ef68ec60dc51679ab01a6e68f7430a3562514a4b1d1"}], 0x120, 0x4000}, {0x0, 0x0, &(0x7f00000017c0)=[{&(0x7f0000000640)="e5e7b8211e99c98bab5661", 0xb}, {&(0x7f0000000680)="6d0b929817424057ba781098154ccd800898cbf8ea61117d38013ca51b15fcbfb29a234f399facf4041b2f0ff97e5f4c3c9f2def360dd953300ed7a20f6d233710475f5065baffa54256744798c32e95fc5f00cc9d6b053b80d8a9068d70eaf187264bbdb36e518926c81817b1cc9c453c", 0x71}], 0x2, 0x0, 0x0, 0x80}], 0x2, 0x4000) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newqdisc={0x60, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r8, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0xea, 0x2, 0x0, 0x0, 0x9, 0x5}, {0x12, 0x2, 0x0, 0x401, 0x8001, 0x1400}, 0xa5, 0x5, 0x10000000}}, @TCA_TBF_BURST={0x8, 0x6, 0x8057}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x40000}, 0x44080) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000440)=@newqdisc={0x40, 0x24, 0xd0f, 0x70bd29, 0x0, {0x60, 0x0, 0x0, r8, {0x0, 0x6}, {0xffe0, 0xa}, {0x1, 0x10}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x14, 0x2, [@TCA_FQ_TIMER_SLACK={0x8, 0xd, 0x3ff}, @TCA_FQ_RATE_ENABLE={0x8}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x55}, 0x4000) timer_delete(0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) sendfile(r0, r0, 0x0, 0x101) 2m23.643437531s ago: executing program 0 (id=2840): fsopen(&(0x7f0000000280)='cifs\x00', 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$IPSET_CMD_GET_BYNAME(0xffffffffffffffff, 0x0, 0xc004004) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x0, 0x1, 0x401, 0x0, 0x92, 0x55, 0x8, 0x7, 0x8}, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000280), 0x0) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b3", 0x40}], 0x1}], 0x1, 0x40800) r4 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_SET_PIT(r5, 0x8048ae66, &(0x7f0000000340)={[{0x122e, 0x3, 0x0, 0x0, 0x0, 0x4, 0xb3, 0x0, 0x5, 0xff, 0x1f}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x4}, {0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0xfd}]}) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000400)={0x10004, 0x0, 0x0, 0x1000, &(0x7f0000ffc000/0x1000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) r7 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$UI_SET_LEDBIT(r7, 0x40045569, 0x7) ioctl$UI_SET_EVBIT(r7, 0x40045564, 0x11) ioctl$UI_DEV_SETUP(r7, 0x405c5503, &(0x7f0000000100)={{0x100}, 'syz1\x00'}) ioctl$UI_DEV_CREATE(r7, 0x5501) ioctl$UI_DEV_DESTROY(r7, 0x5502) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000000)=[@textreal={0x8, &(0x7f0000000200)="baf80c66b8b470d18e66efbafc0c66b87b15000066ef6b6402000fc7a8846c66b9b00b00000f32670f22930ffe36ab1eba410066b80018000066efb800008ed00f01cff30f09", 0x46}], 0x1, 0x1, 0x0, 0x0) ioctl$TUNSETOFFLOAD(0xffffffffffffffff, 0x400454d0, 0x2) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0) openat$sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/mm/ksm/run\x00', 0x1, 0x0) 2m21.766143267s ago: executing program 3 (id=2843): r0 = openat$ptp0(0xffffff9c, &(0x7f0000000000), 0x523483, 0x0) read$ptp(r0, &(0x7f0000000180)=""/114, 0x72) r1 = syz_open_dev$loop(&(0x7f0000000080), 0x47ffffb, 0x122c42) mmap(&(0x7f00003ba000/0x1000)=nil, 0x1000, 0x1000005, 0x13, r1, 0x8745b000) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/timer_list\x00', 0x0, 0x0) sendfile(r2, r3, 0x0, 0x20000023896) close(r2) r4 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc)=0x0) timer_settime(r5, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000002a82, 0x0) r6 = syz_io_uring_setup(0x231, &(0x7f0000000080)={0x0, 0x0, 0x10100}, &(0x7f0000000000)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r7, r8, &(0x7f00000009c0)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, 0x18}) io_uring_enter(r6, 0x7a98, 0x0, 0x0, 0x0, 0x0) r9 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x42000, 0x0) r10 = openat$userio(0xffffffffffffff9c, &(0x7f0000000000), 0x80200, 0x0) write$USERIO_CMD_SEND_INTERRUPT(r10, &(0x7f00000000c0)={0x2, 0xfa}, 0x2) r11 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000540), 0x42a00) connect(r3, &(0x7f0000000200)=@pppol2tp={0x18, 0x1, {0x0, r3, {0x2, 0x4e20, @remote}, 0x3, 0x0, 0x3, 0x4}}, 0x80) ioctl$SNDRV_TIMER_IOCTL_GSTATUS(r11, 0xc0505405, &(0x7f0000000580)={{0x1, 0x0, 0x1, 0x2}, 0x0, 0xc, 0x400001}) r12 = syz_open_dev$loop(&(0x7f0000000080), 0x45ffffa, 0x281) ioctl$vim2m_VIDIOC_QBUF(r3, 0xc04c560f, &(0x7f0000000280)=@fd={0x9, 0x3, 0x4, 0x6cd2b88b46d32719, 0x1, {0x0, 0x2710}, {0x7, 0x0, 0x4, 0xb, 0x8, 0x7, "db469239"}, 0x7, 0x4, {}, 0x7, 0x0, r3}) ioctl$LOOP_CONFIGURE(r12, 0x4c0a, &(0x7f0000001100)={r9, 0x0, {0x0, 0x0, 0x0, 0x1000000, 0x0, 0x0, 0x0, 0x0, 0x1c, "339f020bbe82b398000000000000000000000d0ec0c1b4e9b1c4369d03740250ceaac594b1b3d741dd17c1c50d38ef2a565ef1e83323691c58d66500", "a9103939c787a16c1ca43f80026d1a8554fe581b59ded130e04d528539f3d3289737f0374c72a964a02447a75df8a69ea917deb7ba193b3e7772fd29f35239d2", "244333791f045158d97405000000000000040000000100", [0xfffffffffeff7ffc]}}) ioctl$LOOP_SET_STATUS(r12, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x8011, 0x6, 0x9, 0x0, "ba90204c1f205b4bbb0676c0f24a856b29eda6d2be74dce1b9020f74795a23f4d891e22b115aaafecc084cca2f96b5c2321009dd75bf1ab80e665703bb668786", "41b66c54f348be2cc9b5f945716c9742ec4fc42cc4fd6b3498a90e1c63502b99", [0x511, 0x3ff]}) 2m21.641815238s ago: executing program 0 (id=2844): socket$nl_generic(0x10, 0x3, 0x10) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) ioctl$VIDIOC_S_INPUT(0xffffffffffffffff, 0xc0045627, &(0x7f00000000c0)=0x3) ioctl$MEDIA_IOC_REQUEST_ALLOC(0xffffffffffffffff, 0x80047c05, &(0x7f0000000940)) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) setregid(0xffffffffffffffff, 0x0) unshare(0x2a020400) r2 = openat(0xffffffffffffff9c, 0x0, 0xa000, 0x1da) r3 = socket$inet6(0xa, 0x4, 0x3) setsockopt$inet6_MCAST_MSFILTER(r3, 0x29, 0x30, 0x0, 0x310) r4 = syz_usb_connect(0x0, 0x36, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0x2, 0xff, 0x71, 0x20, 0x9c4, 0x11, 0xb01c, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x4, 0x10, 0x0, [{{0x9, 0x4, 0x7e, 0x10, 0x2, 0x26, 0xd5, 0x18, 0x8, [], [{{0x9, 0x5, 0x6, 0x2, 0x3ff}}, {{0x9, 0x5, 0x82, 0x2, 0x8}}]}}]}}]}}, 0x0) syz_usb_control_io(r4, &(0x7f0000000880)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$cdc_ecm(r4, &(0x7f00000004c0)={0xc, 0x0, &(0x7f0000000e00)={0x0, 0x3, 0x74, {0x1a}}}, 0x0) syz_usb_control_io$printer(r4, &(0x7f00000000c0)={0x14, &(0x7f0000000180)={0x0, 0xf, 0xc, {0xc, 0xb, "04f3da68074119011e06"}}, 0x0}, 0x0) setsockopt$inet6_group_source_req(r3, 0x29, 0x2b, &(0x7f00000005c0)={0x0, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x4e22, 0x0, @empty}}}, 0x108) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="600000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0106000000000000400012800e00010069703665727370616e0000002c00028014000500000000000000000000000000000000010400120005001600010000000800150019945c"], 0x60}, 0x1, 0x0, 0x0, 0xcbf2b2b85a7692bb}, 0x40) read$FUSE(r2, &(0x7f0000000040)={0x2020}, 0x2020) close(r2) r6 = syz_open_dev$dri(&(0x7f0000000180), 0x0, 0x0) fsopen(&(0x7f00000000c0)='hfs\x00', 0x1) close_range(r6, 0xffffffffffffffff, 0x0) 2m21.087392415s ago: executing program 3 (id=2846): sendmmsg(0xffffffffffffffff, &(0x7f0000005e00), 0x0, 0x48d4) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x4ee59ce4, 0xfffffffffffffffe, 0xfffffffc}, 0x0) r2 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r2, 0x1, 0x0) fchdir(r3) r4 = open(&(0x7f0000000040)='./file1\x00', 0x80242, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r5, 0x29, 0x33, &(0x7f0000000000)=0x7, 0x4) setsockopt$inet6_int(r5, 0x29, 0x31, &(0x7f0000000240)=0xf2b, 0x4) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r7 = socket(0x400000000010, 0x3, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r9, {0x0, 0x7}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) r10 = mmap$IORING_OFF_CQ_RING(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x3000006, 0x10, r3, 0x8000000) r11 = mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1000000, 0x10, r4, 0x10000000) syz_io_uring_submit(r10, r11, &(0x7f0000000140)=@IORING_OP_TIMEOUT_REMOVE={0xc, 0x0, 0x0, 0x0, 0x0, 0x23456, 0x0, 0x0, 0x1}) sendmsg$nl_route_sched(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=@newtfilter={0x88, 0x2c, 0xd27, 0x70bd25, 0x2, {0x0, 0x0, 0x0, r9, {0x0, 0x1}, {}, {0x8, 0x6}}, [@filter_kind_options=@f_flow={{0x9}, {0x58, 0x2, [@TCA_FLOW_ACT={0x54, 0x9, 0x0, 0x1, [@m_mirred={0x50, 0x1, 0x0, 0x0, {{0xb}, {0x80, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x3ff, 0xe, 0x5, 0x5, 0x3}, 0x1}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x1}}}}]}]}}]}, 0x88}}, 0x0) getsockopt$inet6_buf(r5, 0x29, 0x6, &(0x7f0000000280)=""/10, &(0x7f0000000080)=0xfffffffffffffedc) write$FUSE_CREATE_OPEN(r4, &(0x7f0000000180)={0xa0, 0xfffffffffffffff5, 0x0, {{0x4, 0x1, 0x5, 0x200000000006, 0x3, 0xa2, {0x3, 0x180, 0xff, 0x5, 0x100, 0x7cf4, 0x9, 0x7ffffffd, 0xfffffffe, 0x8000, 0x0, 0xee00, 0x0, 0x3ff, 0x1}}, {0x0, 0x11}}}, 0xa0) sendfile(r4, r4, &(0x7f0000000080)=0x2, 0xa71) 2m18.885044742s ago: executing program 3 (id=2849): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x47) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000080)}, {&(0x7f0000000380)="3bc4ede1f4db035ddf201a6b72a3d9ba18ebd838217a8dac25348455376da78b53c5cbeb1057a757de34d2ba16fc68c4f088ed3af5955abfd2d94490d74ed506f1501df9f1ab6f0b36751df7357fdb5186aead31d2dc17c2582e4f0a339bc346deacbb5422c48c71e875b955e10eb16a52432d048f6a692d047c535f8ef072ef8cd795c8fa594249d3e8a5b33cf9587381cd", 0x92}, {&(0x7f0000000500)="7061d930f5f82dea12c98d37f2a6d3541b60c33264dd2b11068de4eedbb17a12d733f55208f8d35cee90f8d5192a1c4bf3b290b82227e6c376dd1d97dde811c0cf167691fe7f4881aedbd46477bf36cf7c79671c", 0x54}], 0x3) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000340)=[@timestamp, @window={0x3, 0x6, 0x7}, @mss={0x2, 0x7}, @window={0x3, 0x0, 0x4}, @window={0x3, 0x8, 0x6}, @timestamp, @window={0x3, 0xfffe}, @sack_perm], 0x2000000000000061) sendto$inet(r0, &(0x7f0000000200)="c342263b84e2a5742cc3a1a33316fab23ecf279b1c706990b5a6e15ebbed1252c005f46bc0b1cc1f1d8a9b20b27655157326e5a2553c8e17ae7c", 0x3a, 0x6000c000, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r0, &(0x7f00000004c0)='<', 0x381, 0x805, 0x0, 0x0) 2m18.754209791s ago: executing program 3 (id=2850): openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x80082, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x4e21, @multicast2}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_open_dev$vcsn(0x0, 0x0, 0x26642) fsetxattr$security_capability(r0, &(0x7f0000000280), &(0x7f0000000380)=@v2={0x2000000, [{0x6, 0x10}, {0xffffff89, 0x100004}]}, 0x14, 0x3) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, 0x0) arch_prctl$ARCH_SHSTK_ENABLE(0x5001, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r4, 0x84, 0x72, &(0x7f0000000180)={0x0, 0xfffff789, 0x10}, &(0x7f00000001c0)=0xc) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = syz_open_dev$usbfs(&(0x7f0000000080), 0x70, 0x101301) ioctl$USBDEVFS_IOCTL(r5, 0xc0105512, &(0x7f0000000200)) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r6, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) getsockopt$inet6_tcp_buf(r6, 0x6, 0x1a, 0x0, &(0x7f00000001c0)=0xd) bpf$MAP_CREATE(0x0, &(0x7f0000000880)=ANY=[], 0x50) ioctl$USBDEVFS_IOCTL(r5, 0xc0105512, &(0x7f0000000040)=@usbdevfs_connect) socketpair$unix(0x1, 0x3, 0x4000, &(0x7f0000000080)) 2m18.181946273s ago: executing program 0 (id=2852): openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x80082, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x4e21, @multicast2}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_open_dev$vcsn(0x0, 0x0, 0x26642) fsetxattr$security_capability(r0, &(0x7f0000000280), &(0x7f0000000380)=@v2={0x2000000, [{0x6, 0x10}, {0xffffff89, 0x100004}]}, 0x14, 0x3) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, 0x0) arch_prctl$ARCH_SHSTK_ENABLE(0x5001, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x4, 0x0, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r4, 0x84, 0x72, &(0x7f0000000180)={0x0, 0xfffff789, 0x10}, &(0x7f00000001c0)=0xc) syz_open_procfs(r1, &(0x7f0000000300)='net/ip6_tables_names\x00') recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = syz_open_dev$usbfs(&(0x7f0000000080), 0x70, 0x101301) ioctl$USBDEVFS_IOCTL(r6, 0xc0105512, &(0x7f0000000200)) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r7, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) getsockopt$inet6_tcp_buf(r7, 0x6, 0x1a, 0x0, &(0x7f00000001c0)=0xd) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYRES32=r1, @ANYRESDEC=r5, @ANYRES64], 0x50) ioctl$USBDEVFS_IOCTL(r6, 0xc0105512, &(0x7f0000000040)=@usbdevfs_connect) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) 2m11.481414156s ago: executing program 32 (id=2830): openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000300), 0x25c182, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x4e21, @multicast2}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_open_dev$vcsn(0x0, 0x2040, 0x7c1501) fsetxattr$security_capability(r0, &(0x7f0000000280), &(0x7f0000000380)=@v2={0x2000000, [{0x8001, 0x10}, {0xffffff89, 0x100004}]}, 0x14, 0x3) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, 0x0) arch_prctl$ARCH_SHSTK_ENABLE(0x5001, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r0, &(0x7f0000000000), 0x0, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r3, 0x84, 0x72, &(0x7f0000000180)={0x0, 0xfffff789, 0x10}, &(0x7f00000001c0)=0xc) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = syz_open_dev$usbfs(&(0x7f0000000080), 0x70, 0x101301) ioctl$USBDEVFS_IOCTL(r4, 0xc0105512, &(0x7f0000000780)=@usbdevfs_connect={0x7}) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r5, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) getsockopt$inet6_tcp_buf(r0, 0x6, 0x1a, 0x0, &(0x7f0000000740)) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYRES8=r5, @ANYBLOB="03000000abbe16fefad790ee0309000090"], 0x50) ioctl$USBDEVFS_IOCTL(r4, 0xc0105512, &(0x7f0000000040)=@usbdevfs_connect) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f00000003c0)=@raw={'raw\x00', 0x9, 0x3, 0x314, 0xf8, 0xffffffff, 0xffffffff, 0xf8, 0xffffffff, 0x24c, 0xffffffff, 0xffffffff, 0x24c, 0xffffffff, 0x3, &(0x7f0000000100), {[{{@uncond, 0x0, 0xd4, 0xf8, 0x0, {}, [@common=@ah={{0x30}, {[0x4d5, 0x4d6], 0x1, 0xe, 0x2}}]}, @common=@inet=@TCPMSS={0x24, 'TCPMSS\x00', 0x0, {0x2}}}, {{@uncond, 0x0, 0xec, 0x154, 0x0, {}, [@inet=@rpfilter={{0x24}, {0x4}}, @inet=@rpfilter={{0x24}, {0x6}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x15, 0xfffe, 0x5, 0x7, '\x00', 'syz1\x00', {0x4}}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x370) 2m3.604073364s ago: executing program 33 (id=2850): openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x80082, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x4e21, @multicast2}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_open_dev$vcsn(0x0, 0x0, 0x26642) fsetxattr$security_capability(r0, &(0x7f0000000280), &(0x7f0000000380)=@v2={0x2000000, [{0x6, 0x10}, {0xffffff89, 0x100004}]}, 0x14, 0x3) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, 0x0) arch_prctl$ARCH_SHSTK_ENABLE(0x5001, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r4, 0x84, 0x72, &(0x7f0000000180)={0x0, 0xfffff789, 0x10}, &(0x7f00000001c0)=0xc) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = syz_open_dev$usbfs(&(0x7f0000000080), 0x70, 0x101301) ioctl$USBDEVFS_IOCTL(r5, 0xc0105512, &(0x7f0000000200)) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r6, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) getsockopt$inet6_tcp_buf(r6, 0x6, 0x1a, 0x0, &(0x7f00000001c0)=0xd) bpf$MAP_CREATE(0x0, &(0x7f0000000880)=ANY=[], 0x50) ioctl$USBDEVFS_IOCTL(r5, 0xc0105512, &(0x7f0000000040)=@usbdevfs_connect) socketpair$unix(0x1, 0x3, 0x4000, &(0x7f0000000080)) 2m3.126711598s ago: executing program 34 (id=2852): openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x80082, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x4e21, @multicast2}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_open_dev$vcsn(0x0, 0x0, 0x26642) fsetxattr$security_capability(r0, &(0x7f0000000280), &(0x7f0000000380)=@v2={0x2000000, [{0x6, 0x10}, {0xffffff89, 0x100004}]}, 0x14, 0x3) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, 0x0) arch_prctl$ARCH_SHSTK_ENABLE(0x5001, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x4, 0x0, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r4, 0x84, 0x72, &(0x7f0000000180)={0x0, 0xfffff789, 0x10}, &(0x7f00000001c0)=0xc) syz_open_procfs(r1, &(0x7f0000000300)='net/ip6_tables_names\x00') recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = syz_open_dev$usbfs(&(0x7f0000000080), 0x70, 0x101301) ioctl$USBDEVFS_IOCTL(r6, 0xc0105512, &(0x7f0000000200)) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r7, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) getsockopt$inet6_tcp_buf(r7, 0x6, 0x1a, 0x0, &(0x7f00000001c0)=0xd) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYRES32=r1, @ANYRESDEC=r5, @ANYRES64], 0x50) ioctl$USBDEVFS_IOCTL(r6, 0xc0105512, &(0x7f0000000040)=@usbdevfs_connect) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) 1m57.947525779s ago: executing program 1 (id=2897): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000003c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept4(r0, 0x0, 0x0, 0x80000) syz_genetlink_get_family_id$fou(0x0, r1) sendmsg$TIPC_NL_KEY_SET(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000540)={0x14, 0x0, 0x22, 0x70bd25, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x20000011}, 0x4) r2 = syz_genetlink_get_family_id$devlink(&(0x7f00000000c0), r1) sendmsg$DEVLINK_CMD_PORT_UNSPLIT(r1, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000280)={0xb4, r2, 0x200, 0x70bd28, 0x25dfdbfd, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}}]}, 0xb4}, 0x1, 0x0, 0x0, 0x20000804}, 0xc040) 1m57.816168939s ago: executing program 1 (id=2898): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x1c, 0x10, 0x701, 0x0, 0x0, {0xa}, [@typed={0x6, 0x1, 0x0, 0x0, @str='\xca\x00'}]}, 0x1c}}, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="120100001d906e20501dc6609b620103000109021b0001000010000904f7000176246700090582020002"], 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) r2 = epoll_create1(0x0) r3 = fcntl$dupfd(r2, 0x2, 0xffffffffffffffff) bpf$BPF_PROG_ATTACH(0x9, &(0x7f0000000140)={@cgroup=r3, 0xffffffffffffffff, 0x11, 0x0, r3}, 0x11) bind$alg(0xffffffffffffffff, &(0x7f00000022c0)={0x26, 'hash\x00', 0x0, 0x0, 'cryptd(ghash-generic)\x00'}, 0x58) close(0x3) r4 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) ioctl$IOCTL_STOP_ACCEL_DEV(r4, 0x40096101, &(0x7f0000000880)={{}, 0xfe}) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000000080)={&(0x7f00000000c0)={0x2, 0x2, 0x0, 0x9, 0xa, 0x0, 0x1, 0x0, [@sadb_address={0x3, 0x6, 0x0, 0x0, 0xe, @in={0x2, 0x0, @multicast1=0xe0000009}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x8, 0x2}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @loopback}}]}, 0x50}}, 0x0) preadv(r1, &(0x7f0000000180)=[{0x0}], 0x1, 0x1ff, 0x8) 1m54.730077559s ago: executing program 1 (id=2903): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x47) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000080)}, {&(0x7f0000000380)="3bc4ede1f4db035ddf201a6b72a3d9ba18ebd838217a8dac25348455376da78b53c5cbeb1057a757de34d2ba16fc68c4f088ed3af5955abfd2d94490d74ed506f1501df9f1ab6f0b36751df7357fdb5186aead31d2dc17c2582e4f0a339bc346deacbb5422c48c71e875b955e10eb16a52432d048f6a692d047c535f8ef072ef8cd795c8fa594249d3e8a5b33cf9587381cdd208d5", 0x95}, {&(0x7f0000000500)="7061d930f5f82dea12c98d37f2a6d3541b60c33264dd2b11068de4eedbb17a12d733f55208f8d35cee90f8d5192a1c4bf3b290b82227e6c376dd1d97dde811c0cf167691fe7f4881aedbd46477bf36cf7c79671c", 0x54}], 0x3) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000340)=[@timestamp, @window={0x3, 0x6, 0x7}, @mss={0x2, 0x7}, @window={0x3, 0x0, 0x4}, @window={0x3, 0x8, 0x6}, @timestamp, @window={0x3, 0xfffe}, @sack_perm], 0x2000000000000061) sendto$inet(r0, &(0x7f0000000200)="c342263b84e2a5742cc3a1a33316fab23ecf279b1c706990b5a6e15ebbed1252c005f46bc0b1cc1f1d8a9b20b27655157326e5a2553c8e17ae7c", 0x3a, 0x6000c000, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r0, &(0x7f00000004c0)='<', 0x381, 0x805, 0x0, 0x0) 1m54.63653191s ago: executing program 1 (id=2904): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x7, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000180)={0x3, &(0x7f0000000280)=[{0x1ff, 0x84, 0x0, 0x8}, {0x1, 0x6, 0x1, 0x7}, {0xa, 0x1, 0x8, 0x7}]}) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x4000000000000, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x4001, 0x3, 0x230, 0x1d0, 0x0, 0x148, 0x0, 0x148, 0x1d0, 0x240, 0x240, 0x1d0, 0x240, 0x7fffffe, 0x0, {[{{@ip={@multicast2, @local, 0x0, 0x0, 'erspan0\x00', 'nr0\x00'}, 0x0, 0x94, 0xbc, 0x0, {}, [@inet=@rpfilter={{0x24}}]}, @common=@unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x5, 0x35, 0x1}}}, {{@ip={@local, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 'ip6gre0\x00', 'pim6reg\x00', {}, {0xff}, 0x11}, 0x0, 0xb8, 0xe0, 0x0, {}, [@inet=@rpfilter={{0x24}}, @inet=@rpfilter={{0x24}}]}, @common=@unspec=@NFQUEUE3={0x28}}], {{'\x00', 0x0, 0x70, 0x94}, {0x24, '\x00', 0x0, 0xfffffffb}}}}, 0x28c) pwritev2(0xffffffffffffffff, &(0x7f0000000240)=[{&(0x7f0000000000)='$', 0x3fec00}], 0x2, 0x1400, 0x0, 0x3) ioctl$VIDIOC_SUBDEV_S_CROP(0xffffffffffffffff, 0xc038563c, &(0x7f0000000140)={0x0, 0x0, {0xe, 0x1, 0x4, 0x1}}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x11) r4 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r5, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000000}, 0x0) ioctl$UI_SET_FFBIT(r4, 0x4004556b, 0x51) ioctl$UI_DEV_CREATE(r4, 0x5501) mlock2(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) socket$nl_route(0x10, 0x3, 0x0) r6 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000040)={'sit0\x00'}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x0, @private=0xa010101}]}, &(0x7f0000000080)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, 0x0, &(0x7f0000000240)) setsockopt$inet_sctp6_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000010280)={0x0, 0x9, 0x0, 0x5}, 0x10) 1m52.455425572s ago: executing program 1 (id=2906): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) name_to_handle_at(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB="14"], &(0x7f0000000180), 0x0) open_by_handle_at(0xffffffffffffff9c, &(0x7f00000000c0)=ANY=[], 0x599681) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="3c0000006800010000000000fbdbdf250200000000000000060007000b0000000c000880050004"], 0x3c}, 0x1, 0x0, 0x0, 0x4402}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x1c, 0x2, 0x3, 0x3, 0x0, 0x0, {}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1}}]}, 0x1c}, 0x1, 0x0, 0x0, 0x400c000}, 0x0) sendmsg$NFQNL_MSG_CONFIG(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x1c, 0x2, 0x3, 0x3, 0x0, 0x0, {0x0, 0x0, 0x10}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1}}]}, 0x1c}}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01030000000000000000010000000900010073797a310000000054000000030a01020000000000000000010000000900030073797a320000000028000480080002400000000008000140000000051400030076657468315f6d6163767461700000000900010073797a"], 0xe8}, 0x1, 0x0, 0x0, 0x40040000}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32=r1, @ANYBLOB="08000100", @ANYRES32=r5], 0x90}}, 0x0) r6 = syz_genetlink_get_family_id$tipc(&(0x7f0000000240), r0) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000280)={0x34, r6, 0x1, 0x70bd27, 0x25dfdbfe, {{}, {}, {0x18, 0x17, {0xf, 0x1, @l2={'eth', 0x3a, 'batadv0\x00'}}}}, ["", ""]}, 0x34}, 0x1, 0x0, 0x0, 0x80}, 0x0) 1m52.135234571s ago: executing program 1 (id=2907): openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x80082, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x4e21, @multicast2}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_open_dev$vcsn(0x0, 0x0, 0x26642) fsetxattr$security_capability(r0, &(0x7f0000000280), &(0x7f0000000380)=@v2={0x2000000, [{0x6, 0x10}, {0xffffff89, 0x100004}]}, 0x14, 0x3) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, 0x0) arch_prctl$ARCH_SHSTK_ENABLE(0x5001, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_opts(r1, 0x0, 0xd, &(0x7f00000005c0)=""/3, &(0x7f0000000600)=0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r5, 0x84, 0x72, &(0x7f0000000180)={0x0, 0xfffff789, 0x10}, &(0x7f00000001c0)=0xc) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = syz_open_dev$usbfs(&(0x7f0000000080), 0x70, 0x101301) ioctl$USBDEVFS_IOCTL(r6, 0xc0105512, &(0x7f0000000200)) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r7, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) getsockopt$inet6_tcp_buf(r7, 0x6, 0x1a, 0x0, &(0x7f00000001c0)=0xd) bpf$MAP_CREATE(0x0, &(0x7f0000000880)=ANY=[], 0x50) ioctl$USBDEVFS_IOCTL(r6, 0xc0105512, &(0x7f0000000040)=@usbdevfs_connect) 1m36.876906453s ago: executing program 35 (id=2907): openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x80082, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x4e21, @multicast2}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_open_dev$vcsn(0x0, 0x0, 0x26642) fsetxattr$security_capability(r0, &(0x7f0000000280), &(0x7f0000000380)=@v2={0x2000000, [{0x6, 0x10}, {0xffffff89, 0x100004}]}, 0x14, 0x3) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, 0x0) arch_prctl$ARCH_SHSTK_ENABLE(0x5001, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_opts(r1, 0x0, 0xd, &(0x7f00000005c0)=""/3, &(0x7f0000000600)=0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r5, 0x84, 0x72, &(0x7f0000000180)={0x0, 0xfffff789, 0x10}, &(0x7f00000001c0)=0xc) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = syz_open_dev$usbfs(&(0x7f0000000080), 0x70, 0x101301) ioctl$USBDEVFS_IOCTL(r6, 0xc0105512, &(0x7f0000000200)) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r7, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) getsockopt$inet6_tcp_buf(r7, 0x6, 0x1a, 0x0, &(0x7f00000001c0)=0xd) bpf$MAP_CREATE(0x0, &(0x7f0000000880)=ANY=[], 0x50) ioctl$USBDEVFS_IOCTL(r6, 0xc0105512, &(0x7f0000000040)=@usbdevfs_connect) 14.127322431s ago: executing program 7 (id=3097): socket$nl_generic(0x10, 0x3, 0x10) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) ioctl$VIDIOC_S_INPUT(0xffffffffffffffff, 0xc0045627, &(0x7f00000000c0)=0x3) ioctl$MEDIA_IOC_REQUEST_ALLOC(0xffffffffffffffff, 0x80047c05, &(0x7f0000000940)) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) setregid(0xffffffffffffffff, 0x0) unshare(0x2a020400) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/cgroup.procs\x00', 0xa000, 0x1da) r3 = socket$inet6(0xa, 0x4, 0x3) setsockopt$inet6_MCAST_MSFILTER(r3, 0x29, 0x30, 0x0, 0x310) r4 = syz_usb_connect(0x0, 0x36, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0x2, 0xff, 0x71, 0x20, 0x9c4, 0x11, 0xb01c, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x4, 0x10, 0x0, [{{0x9, 0x4, 0x7e, 0x10, 0x2, 0x26, 0xd5, 0x18, 0x8, [], [{{0x9, 0x5, 0x6, 0x2, 0x3ff}}, {{0x9, 0x5, 0x82, 0x2, 0x8}}]}}]}}]}}, 0x0) syz_usb_control_io(r4, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r4, &(0x7f00000004c0)={0xc, 0x0, &(0x7f0000000e00)={0x0, 0x3, 0x74, {0x1a}}}, 0x0) syz_usb_control_io$printer(r4, &(0x7f00000000c0)={0x14, &(0x7f0000000180)={0x0, 0xf, 0xc, {0xc, 0xb, "04f3da68074119011e06"}}, 0x0}, 0x0) setsockopt$inet6_group_source_req(r3, 0x29, 0x2b, &(0x7f00000005c0)={0x0, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x4e22, 0x0, @empty}}}, 0x108) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="600000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0106000000000000400012800e00010069703665727370616e0000002c00028014000500000000000000000000000000000000010400120005001600010000000800150019945c"], 0x60}, 0x1, 0x0, 0x0, 0xcbf2b2b85a7692bb}, 0x40) read$FUSE(r2, &(0x7f0000000040)={0x2020}, 0x2020) close(r2) r6 = syz_open_dev$dri(&(0x7f0000000180), 0x0, 0x0) fsopen(&(0x7f00000000c0)='hfs\x00', 0x1) close_range(r6, 0xffffffffffffffff, 0x0) 13.586141023s ago: executing program 4 (id=3098): socket$nl_route(0x10, 0x3, 0x0) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/wakeup_count', 0x101a02, 0x0) r1 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r4, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r5 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r5, 0x10e, 0x4, &(0x7f0000000140)=0x6, 0x4) setsockopt$sock_int(r5, 0x1, 0x8, &(0x7f0000000200), 0x4) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="980000000001010400000000000000000a0000003c0001802c00018014000300fe8000000000000000000000000000aa14000400ff0100000000000000000000000000010c00028005000100000000003c0002802c00018014000300fe8000000000000000000000000000aa14000400fe8800000000000000000000000000010c0002800500010000000000080007"], 0x98}}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000340)={0x0, 0x98}, 0x1, 0x0, 0x0, 0x20040800}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000008c0)={0x50, 0x0, 0x1, 0x3, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}]}, 0x50}}, 0x0) sendmmsg$alg(r1, &(0x7f0000001800)=[{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000100)="e92c3e5b5fea72d36d0f1ce0c1e16a89594759fe6816116aea0f6829fb0e01d753fdfda29b9fe80d5489652869b6b3eeef2e97fe4757", 0x36}, {&(0x7f0000000180)="aed9403172519ce89a419fce54b6039f63c98c", 0x13}, {&(0x7f00000002c0)="cad2985019f4e01a8f2249dfe45549d98fcd6a3a35f684075f51d7aaccbef8ac16ca395bf2bd16c28eb1461b3e1805515fb57ab53cd8474d379cd3449625c6a5e4e5ef158235d43abbaf354d3e9b6faa62ab7a4a4c06d2e27df772b9719fade7a0cc5e33b9144ee2200d99f4b9060c3d83ac8c0f924df255448d33cfd5e0514fbbea2e0f344bf523cc4ccec5f559768a98de1eef0af76e511ffc9b561f0a0fb1707a2e27f80201d011dd9d6532925b34", 0xb0}, {&(0x7f00000001c0)}, {&(0x7f00000007c0)="6a8262904c848c17c9a4e56f47186fafa59a67f43da0b494903acf72acd56d2253ceee243ade0c0d8ccb80ab242b4cb658af8818b1619a8207960781263eb7efe80e5ef34f96fd985e518b810f1bc9c4e452375a9eaafbd8e88a39372b87b4572ead2e5298794ef3f052bdfb0fb885230aeb07823b72ff44b58975721135c125caf35e7eeee1251390b326967180e1de65ed442a97ed2a513885e4a1c4414a4622bdd87f86900638ed5097a2b42855c3e80694bb8059dd8b1d0ae94f00447cc466410eeadd0a54569d7ec1d193e34beffa5a6a861b5600652a29c5b087fa1967e78c8b4a761303d33b75f2367ac19762631a877f5cfa9cca341d5577b6290de322620f5a5a676638c97b7c6d0b10dcb9209edf15273d150ec6e89814c218997dbcb687d06027cdf3eff025414619e5890215b059ae9425660bf4e291160e3ab4df54bd89ef055f9724a335ef8f7ac81c1751c412e23ec59596a6a800450f20429e8f604f0568b6b4700b799ada6aa0e6963f2ec3b18f42a58c1dd432e6323ce66f95c4f334d7c0c12e74bfe86b4025faecf6070d572f1297652d9bc1d7114e3695698ca7f324e3bd0202577cf2dd362b60b2df225e6ae54f127c1e02ddea1fd9ca48586b654c17d63833d523abf3029386f5f254061c235aa7fc333b87cfbc923c32f73dcbb27bc70a0f0eb5c60a2feea1a33bc198b5ae727e9d216c81c6c76a44e111fa38ce9a49b2d5eab4aa703e5bc5436fa94e146d72754d27097d9d5ecf0e652b12e5fc1d675e81d3c724f7638fa1880255955681437d88cf4431511154da22124bafce9e35187c6f10b90e113c85f1325bef2197baccc66a35251b92329f79e211966e568f397c16f018b5bfc5dc05849ef0bafc47ef3f7d266f478df3b5856369a1be9cce710dc9f85d32e89595f7ad7654ce59c75735f6e52722300e084ae956a354c771e8f0aeabdca1d63289ccc42b52effdcc483b3a8303a63465d88f04789cad5ed5a2cf782eba630d29c5d2ca93de6491cd60ada6e7596c18cc86e573e1352b2fb40dcd92a5bc69ad2280815c8e2bf503b44defb0d2f6105051", 0x300}, {0x0}, {&(0x7f0000000480)="83d763683f984bc11e2488e619ecec7e77667e5032d2412f70cb9cba1a19cf906fed30192629187789f9e15ffd100c9f93e01f614ce40f365be740e3b999a3a6f3db24561582956cc55786315d9a34678472eda3433780f09d8257e2b6c8c8eee3a9", 0x62}], 0x7, &(0x7f0000000500)=[@op={0x10, 0x117, 0x3, 0x1}, @iv={0x110, 0x117, 0x2, 0xff, "d17613b8dc104c2144f2fafb4716f50e3f025a4072d891a4fe04e11884ecb59a160bdd3b3efa9705bec9c72e699ee3fca4dedacd549999e9fa3e829913a00f8a588613c04f8b9352b4e2e773a36f710a6534904571307246e4c5c28913b50d0a6eb1076f615962ef451d9cbce39c6716cfa3e6dd15ea3b2fc51ca378879d924d096783778d467a6943ac870de085b0a16d31d3a1783c61624129ae7d804f60e0d9b24713a9c9927bbd48ec726731d9936c800cf7d88596653d26d6f81031cbd5dfe3f7b2ba1d5501769232f2f97a06f26e423c1ae347bf076a1bb01128092fcf855e2144ae9e9c59656ef68ec60dc51679ab01a6e68f7430a3562514a4b1d1"}], 0x120, 0x4000}, {0x0, 0x0, &(0x7f00000017c0)=[{&(0x7f0000000640)="e5e7b8211e99c98bab5661", 0xb}, {&(0x7f0000000680)="6d0b929817424057ba781098154ccd800898cbf8ea61117d38013ca51b15fcbfb29a234f399facf4041b2f0ff97e5f4c3c9f2def360dd953300ed7a20f6d233710475f5065baffa54256744798c32e95fc5f00cc9d6b053b80d8a9068d70eaf187264bbdb36e518926c81817b1cc9c453c", 0x71}], 0x2, 0x0, 0x0, 0x80}], 0x2, 0x4000) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newqdisc={0x60, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r8, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0xea, 0x2, 0x0, 0x0, 0x9, 0x5}, {0x12, 0x2, 0x0, 0x401, 0x8001, 0x1400}, 0xa5, 0x5, 0x10000000}}, @TCA_TBF_BURST={0x8, 0x6, 0x8057}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x40000}, 0x44080) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000440)=@newqdisc={0x40, 0x24, 0xd0f, 0x70bd29, 0x0, {0x60, 0x0, 0x0, r8, {0x0, 0x6}, {0xffe0, 0xa}, {0x1, 0x10}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x14, 0x2, [@TCA_FQ_TIMER_SLACK={0x8, 0xd, 0x3ff}, @TCA_FQ_RATE_ENABLE={0x8}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x55}, 0x4000) timer_delete(0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) sendfile(r0, r0, 0x0, 0x101) 10.219773107s ago: executing program 7 (id=3105): fsopen(&(0x7f0000000280)='cifs\x00', 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$IPSET_CMD_GET_BYNAME(0xffffffffffffffff, 0x0, 0xc004004) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x0, 0x1, 0x401, 0x0, 0x92, 0x55, 0x8, 0x7, 0x8}, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000280), 0x0) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b3", 0x40}], 0x1}], 0x1, 0x40800) r4 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_SET_PIT(r5, 0x8048ae66, &(0x7f0000000340)={[{0x122e, 0x3, 0x0, 0x0, 0x0, 0x4, 0xb3, 0x0, 0x5, 0xff, 0x1f}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x4}, {0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0xfd}]}) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000400)={0x10004, 0x0, 0x0, 0x1000, &(0x7f0000ffc000/0x1000)=nil}) ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) r6 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$UI_SET_LEDBIT(r6, 0x40045569, 0x7) ioctl$UI_DEV_SETUP(r6, 0x405c5503, &(0x7f0000000100)={{0x100}, 'syz1\x00'}) ioctl$UI_DEV_CREATE(r6, 0x5501) ioctl$TUNSETOFFLOAD(0xffffffffffffffff, 0x400454d0, 0x2) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0) prctl$PR_SET_IO_FLUSHER(0x43, 0x1) openat$sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/mm/ksm/run\x00', 0x1, 0x0) 10.105924215s ago: executing program 6 (id=3106): socketpair$unix(0x1, 0x3, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x48241, 0x141) pwrite64(r0, 0x0, 0x0, 0x8001000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x2}}, 0x2}, 0x1c) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0x106}, 0x1c) r2 = fcntl$dupfd(r1, 0x0, r1) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=@newlink={0x3c, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10681, 0x20000}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_IGMP_VERSION={0x5, 0x2b, 0x3}]}}}]}, 0x3c}}, 0x44006) sendmsg$NFULNL_MSG_CONFIG(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[], 0x1c}, 0x1, 0x0, 0x0, 0x2d707a214e80164e}, 0x805) sendmmsg$inet6(r2, &(0x7f0000000ec0)=[{{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000003c0)="8d", 0x1}], 0x1}}], 0x1, 0x40081) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r2, 0x6, 0x23, &(0x7f0000000040)={&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, &(0x7f00000001c0)=""/171, 0xab, 0x0, 0x0}, &(0x7f0000000280)=0x40) 9.716963079s ago: executing program 4 (id=3107): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(0xffffffffffffffff, 0x80047c05, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='cgroup\x00') preadv(r2, &(0x7f00000000c0)=[{&(0x7f0000000480)=""/128, 0x80}], 0x1, 0x12e, 0x4000) 8.894298266s ago: executing program 6 (id=3109): timer_create(0x3, 0x0, &(0x7f0000000300)=0x0) timer_create(0xfffffffd, 0x0, &(0x7f0000000040)=0x0) timer_settime(r1, 0x0, &(0x7f0000000080)={{}, {0x77359400}}, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000480), 0x77, 0x141341) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, 0x0, &(0x7f0000000040)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$USBDEVFS_CONTROL(r2, 0xc0185500, &(0x7f00000000c0)={0x80, 0x6, 0x2fe, 0xe5, 0xe0, 0xfe, 0x0}) unshare(0x40000000) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r3) ptrace$setsig(0x4203, r3, 0x0, &(0x7f00000003c0)={0x8, 0xaf1, 0x9}) prctl$PR_SCHED_CORE(0x3e, 0x2, r3, 0x1, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r4) unshare(0x10040a80) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000003c0)={'wlan0\x00'}) sendmsg$NL80211_CMD_NEW_STATION(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001040)={&(0x7f00000000c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="cf04000000000000fcff1200000008000300", @ANYBLOB="0400130006001200000000000600b500850100000a000600080211000001000014008100050001"], 0x50}}, 0x4000004) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNSETCARRIER(r6, 0x400454e2, &(0x7f0000000040)=0x1) timer_settime(r0, 0x0, &(0x7f0000000000)={{0x77359400}, {0x0, 0x989680}}, 0x0) 8.743520683s ago: executing program 7 (id=3110): open(&(0x7f00009e1000)='./file0\x00', 0x8060, 0x0) r0 = openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) socket(0x1d, 0x4, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) write$P9_RGETLOCK(r0, &(0x7f00000003c0)=ANY=[@ANYBLOB="2300491200000000000000000000000000000000000000001bcdfc5fed0491ac3040d4c68bd26cadf03cde50cde7a7286970666ef9d06fd1ff53458aec4c04a975c1e91f187d458a41aa9c6154f3e0c4e2580b1f7bf499a43e516d4ac6599c57fa17cf4cab9aaada6fde9c12bd3efcfc9344fe3407af27fd529860e89e5c791867f89de78f7a9f17d33ed904a04c218e0081ee67c0fac1738a7dfdd051290ecfbc01214a9789b316a5483052d19a12fd3fc5414a0e9421d6f976ec324db552b02177fb00f207fe431f96", @ANYRES32], 0x23) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$CEC_S_MODE(0xffffffffffffffff, 0x40046109, &(0x7f0000000040)=0x20) sendmsg$FOU_CMD_GET(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x20, 0x0, 0x1, 0x0, 0x0, {}, [@FOU_ATTR_TYPE={0x5}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}]}, 0x20}}, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x20, &(0x7f00000000c0)=[@in={0x2, 0x4e24, @rand_addr=0x64010101}, @in={0x2, 0x4e24, @rand_addr=0x64010101}]}, &(0x7f0000000180)=0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000740)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a4c000000060a0bfe6ecd77084f21c01e020000000900010073797a30000000000900020073797a320000000018000480140001800b0001006c6f6f6b75700000040002800700"], 0x74}}, 0x10) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f00000004c0), 0x8001) openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x14, 0x15, 0x301, 0x0, 0x0, {0xb}}, 0x14}}, 0x0) io_setup(0x222, &(0x7f0000000180)) 7.633584222s ago: executing program 6 (id=3113): socket$nl_generic(0x10, 0x3, 0x10) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) ioctl$VIDIOC_S_INPUT(0xffffffffffffffff, 0xc0045627, 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(0xffffffffffffffff, 0x80047c05, &(0x7f0000000940)) setregid(0xffffffffffffffff, 0x0) unshare(0x2a020400) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/cgroup.procs\x00', 0xa000, 0x1da) r3 = socket$inet6(0xa, 0x4, 0x3) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000002080)) setsockopt$inet6_MCAST_MSFILTER(r3, 0x29, 0x30, 0x0, 0x310) r4 = syz_usb_connect(0x0, 0x36, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0x2, 0xff, 0x71, 0x20, 0x9c4, 0x11, 0xb01c, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x4, 0x10, 0x0, [{{0x9, 0x4, 0x7e, 0x10, 0x2, 0x26, 0xd5, 0x18, 0x8, [], [{{0x9, 0x5, 0x6, 0x2, 0x3ff}}, {{0x9, 0x5, 0x82, 0x2, 0x8}}]}}]}}]}}, 0x0) syz_usb_control_io(r4, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r4, &(0x7f00000004c0)={0xc, 0x0, &(0x7f0000000e00)={0x0, 0x3, 0x74, {0x1a}}}, 0x0) syz_usb_control_io$printer(r4, &(0x7f00000000c0)={0x14, &(0x7f0000000180)={0x0, 0xf, 0xc, {0xc, 0xb, "04f3da68074119011e06"}}, 0x0}, 0x0) setsockopt$inet6_group_source_req(r3, 0x29, 0x2b, &(0x7f00000005c0)={0x0, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x4e22, 0x0, @empty}}}, 0x108) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="600000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0106000000000000400012800e00010069703665727370616e0000002c00028014000500000000000000000000000000000000010400120005001600010000000800150019945c"], 0x60}, 0x1, 0x0, 0x0, 0xcbf2b2b85a7692bb}, 0x40) read$FUSE(r2, &(0x7f0000000040)={0x2020}, 0x2020) close(r2) r6 = syz_open_dev$dri(&(0x7f0000000180), 0x0, 0x0) fsopen(&(0x7f00000000c0)='hfs\x00', 0x1) close_range(r6, 0xffffffffffffffff, 0x0) 7.194346882s ago: executing program 8 (id=3115): fsopen(&(0x7f0000000280)='cifs\x00', 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$IPSET_CMD_GET_BYNAME(0xffffffffffffffff, 0x0, 0xc004004) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x0, 0x1, 0x401, 0x0, 0x92, 0x55, 0x8, 0x7, 0x8}, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000280), 0x0) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b3", 0x40}], 0x1}], 0x1, 0x40800) r4 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_SET_PIT(r5, 0x8048ae66, &(0x7f0000000340)={[{0x122e, 0x3, 0x0, 0x0, 0x0, 0x4, 0xb3, 0x0, 0x5, 0xff, 0x1f}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x4}, {0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0xfd}]}) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000400)={0x10004, 0x0, 0x0, 0x1000, &(0x7f0000ffc000/0x1000)=nil}) ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) r6 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$UI_SET_EVBIT(r6, 0x40045564, 0x11) ioctl$UI_DEV_SETUP(r6, 0x405c5503, &(0x7f0000000100)={{0x100}, 'syz1\x00'}) ioctl$UI_DEV_CREATE(r6, 0x5501) ioctl$TUNSETOFFLOAD(0xffffffffffffffff, 0x400454d0, 0x2) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0) prctl$PR_SET_IO_FLUSHER(0x43, 0x1) openat$sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/mm/ksm/run\x00', 0x1, 0x0) 7.115160576s ago: executing program 4 (id=3116): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000400)=@acquire={0x168, 0x17, 0x1, 0x0, 0x0, {{@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @in=@dev, {@in=@broadcast, @in=@multicast2}, {{@in=@broadcast, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}, 0x6, 0xfff}, [@tmpl={0x44, 0x5, [{{@in6=@ipv4={'\x00', '\xff\xff', @private}, 0x0, 0x33}, 0x2, @in=@multicast2}]}]}, 0x168}}, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x26e1, 0x0) close(r1) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)) ioctl$SIOCSIFHWADDR(r1, 0x8b1b, &(0x7f0000000000)={'wlan1\x00', @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1e}}) 7.044202325s ago: executing program 5 (id=3117): r0 = socket$kcm(0x10, 0x2, 0x4) close(r0) socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000140)="5c000000130025cc9e3be35c6e17aa31076b876c1d0000007ea60864160af36514000cc00800250007000200060019000064bc24280056a705251e618294ff0051f60a84c9f4d4938037e786a6d0001000000e4509c5bbcd72c6c953", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) 6.748239781s ago: executing program 7 (id=3118): socket$nl_route(0x10, 0x3, 0x0) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/wakeup_count', 0x101a02, 0x0) r1 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r4, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r5 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r5, 0x10e, 0x4, &(0x7f0000000140)=0x6, 0x4) setsockopt$sock_int(r5, 0x1, 0x8, &(0x7f0000000200), 0x4) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="980000000001010400000000000000000a0000003c0001802c00018014000300fe8000000000000000000000000000aa14000400ff0100000000000000000000000000010c00028005000100000000003c0002802c00018014000300fe8000000000000000000000000000aa14000400fe8800000000000000000000000000010c0002800500010000000000080007"], 0x98}}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000001c0)=ANY=[], 0x98}, 0x1, 0x0, 0x0, 0x20040800}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r7, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000001800)=[{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000100)="e92c3e5b5fea72d36d0f1ce0c1e16a89594759fe6816116aea0f6829fb0e01d753fdfda29b9fe80d5489652869b6b3eeef2e97fe4757", 0x36}, {&(0x7f0000000180)="aed9403172519ce89a419fce54b6039f63c98c", 0x13}, {&(0x7f00000002c0)="cad2985019f4e01a8f2249dfe45549d98fcd6a3a35f684075f51d7aaccbef8ac16ca395bf2bd16c28eb1461b3e1805515fb57ab53cd8474d379cd3449625c6a5e4e5ef158235d43abbaf354d3e9b6faa62ab7a4a4c06d2e27df772b9719fade7a0cc5e33b9144ee2200d99f4b9060c3d83ac8c0f924df255448d33cfd5e0514fbbea2e0f344bf523cc4ccec5f559768a98de1eef0af76e511ffc9b561f0a0fb1707a2e27f80201d011dd9d6532925b34", 0xb0}, {&(0x7f00000001c0)}, {&(0x7f00000007c0)="6a8262904c848c17c9a4e56f47186fafa59a67f43da0b494903acf72acd56d2253ceee243ade0c0d8ccb80ab242b4cb658af8818b1619a8207960781263eb7efe80e5ef34f96fd985e518b810f1bc9c4e452375a9eaafbd8e88a39372b87b4572ead2e5298794ef3f052bdfb0fb885230aeb07823b72ff44b58975721135c125caf35e7eeee1251390b326967180e1de65ed442a97ed2a513885e4a1c4414a4622bdd87f86900638ed5097a2b42855c3e80694bb8059dd8b1d0ae94f00447cc466410eeadd0a54569d7ec1d193e34beffa5a6a861b5600652a29c5b087fa1967e78c8b4a761303d33b75f2367ac19762631a877f5cfa9cca341d5577b6290de322620f5a5a676638c97b7c6d0b10dcb9209edf15273d150ec6e89814c218997dbcb687d06027cdf3eff025414619e5890215b059ae9425660bf4e291160e3ab4df54bd89ef055f9724a335ef8f7ac81c1751c412e23ec59596a6a800450f20429e8f604f0568b6b4700b799ada6aa0e6963f2ec3b18f42a58c1dd432e6323ce66f95c4f334d7c0c12e74bfe86b4025faecf6070d572f1297652d9bc1d7114e3695698ca7f324e3bd0202577cf2dd362b60b2df225e6ae54f127c1e02ddea1fd9ca48586b654c17d63833d523abf3029386f5f254061c235aa7fc333b87cfbc923c32f73dcbb27bc70a0f0eb5c60a2feea1a33bc198b5ae727e9d216c81c6c76a44e111fa38ce9a49b2d5eab4aa703e5bc5436fa94e146d72754d27097d9d5ecf0e652b12e5fc1d675e81d3c724f7638fa1880255955681437d88cf4431511154da22124bafce9e35187c6f10b90e113c85f1325bef2197baccc66a35251b92329f79e211966e568f397c16f018b5bfc5dc05849ef0bafc47ef3f7d266f478df3b5856369a1be9cce710dc9f85d32e89595f7ad7654ce59c75735f6e52722300e084ae956a354c771e8f0aeabdca1d63289ccc42b52effdcc483b3a8303a63465d88f04789cad5ed5a2cf782eba630d29c5d2ca93de6491cd60ada6e7596c18cc86e573e1352b2fb40dcd92a5bc69ad2280815c8e2bf503b44defb0d2f6105051", 0x300}, {0x0}, {&(0x7f0000000480)="83d763683f984bc11e2488e619ecec7e77667e5032d2412f70cb9cba1a19cf906fed30192629187789f9e15ffd100c9f93e01f614ce40f365be740e3b999a3a6f3db24561582956cc55786315d9a34678472eda3433780f09d8257e2b6c8c8eee3a9", 0x62}], 0x7, &(0x7f0000000500)=[@op={0x10, 0x117, 0x3, 0x1}, @iv={0x110, 0x117, 0x2, 0xff, "d17613b8dc104c2144f2fafb4716f50e3f025a4072d891a4fe04e11884ecb59a160bdd3b3efa9705bec9c72e699ee3fca4dedacd549999e9fa3e829913a00f8a588613c04f8b9352b4e2e773a36f710a6534904571307246e4c5c28913b50d0a6eb1076f615962ef451d9cbce39c6716cfa3e6dd15ea3b2fc51ca378879d924d096783778d467a6943ac870de085b0a16d31d3a1783c61624129ae7d804f60e0d9b24713a9c9927bbd48ec726731d9936c800cf7d88596653d26d6f81031cbd5dfe3f7b2ba1d5501769232f2f97a06f26e423c1ae347bf076a1bb01128092fcf855e2144ae9e9c59656ef68ec60dc51679ab01a6e68f7430a3562514a4b1d1"}], 0x120, 0x4000}, {0x0, 0x0, &(0x7f00000017c0)=[{&(0x7f0000000640)="e5e7b8211e99c98bab5661", 0xb}, {&(0x7f0000000680)="6d0b929817424057ba781098154ccd800898cbf8ea61117d38013ca51b15fcbfb29a234f399facf4041b2f0ff97e5f4c3c9f2def360dd953300ed7a20f6d233710475f5065baffa54256744798c32e95fc5f00cc9d6b053b80d8a9068d70eaf187264bbdb36e518926c81817b1cc9c453c", 0x71}], 0x2, 0x0, 0x0, 0x80}], 0x2, 0x4000) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newqdisc={0x60, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r8, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0xea, 0x2, 0x0, 0x0, 0x9, 0x5}, {0x12, 0x2, 0x0, 0x401, 0x8001, 0x1400}, 0xa5, 0x5, 0x10000000}}, @TCA_TBF_BURST={0x8, 0x6, 0x8057}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x40000}, 0x44080) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000440)=@newqdisc={0x40, 0x24, 0xd0f, 0x70bd29, 0x0, {0x60, 0x0, 0x0, r8, {0x0, 0x6}, {0xffe0, 0xa}, {0x1, 0x10}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x14, 0x2, [@TCA_FQ_TIMER_SLACK={0x8, 0xd, 0x3ff}, @TCA_FQ_RATE_ENABLE={0x8}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x55}, 0x4000) timer_delete(0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) sendfile(r0, r0, 0x0, 0x101) 6.658377633s ago: executing program 4 (id=3119): r0 = syz_open_dev$usbmon(&(0x7f0000000000), 0x4, 0x800) ioctl$MON_IOCX_GET(r0, 0x400c9206, &(0x7f0000000200)={&(0x7f0000000080), &(0x7f0000000100)=""/249, 0xfffffffffffffeb5}) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000500), 0xc2a01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r3, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) set_mempolicy(0x2002, &(0x7f0000000000)=0x9, 0x9) r4 = openat$hwrng(0xffffff9c, &(0x7f0000000340), 0x111000, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r4, 0xc00864bf, &(0x7f0000000380)) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='numa_maps\x00') read$FUSE(r4, &(0x7f00000013c0)={0x2020}, 0x2020) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) syz_usb_connect$uac1(0x0, 0xac, 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000680), r5) sendmsg$L2TP_CMD_TUNNEL_CREATE(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000640)={0x0, 0x44}}, 0x4000) r6 = syz_open_dev$video(0x0, 0x7, 0x28000) ioctl$FS_IOC_SETFSLABEL(r6, 0x41009432, &(0x7f0000000200)="fbefc3ad5b8e7f1d398f24216fd3a3f9e56f40952caec1876a0d87ba07790e53373554809c5915993e2df01420cce89217e7cdfd9a34e6251e93cf3d8e24be566093ba69d066f93fad369948d09b4ad010ef106943c81d6895227895c6ca04db1827c486d2aa39e658fc96ebd8d2868832e4c48c2e19fb1e6b5750e52632fcec444e1e527bc843783bc6eb871635bf046d7ee5c281cd2231fa8d8ccd84119d680902af2e7802dc775236ebf133c995e3e61aff050c429b263f9457072efca8ddb54e3e88c563e526e1c651f654e0083d27a341f87eaa6c83f6a09b3837e5e1b92c6524cd12c682c2a5f96c183aaf08de325375a947577afcf742c9ff248e45cc") preadv(r6, &(0x7f0000001200)=[{&(0x7f0000000c00)=""/113, 0x71}], 0x1, 0x4, 0xb) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f0000000300)=0x2) io_setup(0x6, &(0x7f0000001380)) 6.644351028s ago: executing program 5 (id=3120): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x6a855000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) setuid(0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0x2, 0x0, 0x0, @local}, 0x2) 4.951211793s ago: executing program 5 (id=3121): fsopen(&(0x7f0000000280)='cifs\x00', 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$IPSET_CMD_GET_BYNAME(0xffffffffffffffff, 0x0, 0xc004004) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x0, 0x1, 0x401, 0x0, 0x92, 0x55, 0x8, 0x7, 0x8}, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000280), 0x0) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b3", 0x40}], 0x1}], 0x1, 0x40800) r4 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_SET_PIT(r5, 0x8048ae66, &(0x7f0000000340)={[{0x122e, 0x3, 0x0, 0x0, 0x0, 0x4, 0xb3, 0x0, 0x5, 0xff, 0x1f}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x4}, {0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0xfd}]}) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000400)={0x10004, 0x0, 0x0, 0x1000, &(0x7f0000ffc000/0x1000)=nil}) ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) r6 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$UI_SET_LEDBIT(r6, 0x40045569, 0x7) ioctl$UI_DEV_SETUP(r6, 0x405c5503, &(0x7f0000000100)={{0x100}, 'syz1\x00'}) ioctl$UI_DEV_CREATE(r6, 0x5501) ioctl$TUNSETOFFLOAD(0xffffffffffffffff, 0x400454d0, 0x2) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0) prctl$PR_SET_IO_FLUSHER(0x43, 0x1) openat$sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/mm/ksm/run\x00', 0x1, 0x0) 4.756594348s ago: executing program 8 (id=3122): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)=0x0) clock_gettime(0x2, &(0x7f00000003c0)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {r2, r3+10000000}}, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001140)=ANY=[@ANYBLOB="bf16000000000000b70700000100e0ff5070000028000000770000000000000095000200000000007ae9413df8ff0af5aa35339f4b382c4cad9db67dc983134d04ef2fd6fa7a9b857b72abaca100af1ba23d69883c073ec10500000000000000000000000000ac0e064c27bdfbd301150500000000000000bfdc995279d64072aacbb0595b950600009ad3bf16a461e48e955a772d4062093f4cb1c3d9532abad2085401f098eb039ae4f4103699b9e079229c1a72cb6d47cef1595e84d21951010f0274b1445a2ad6a7ad73827cccc21842599e0ae7b91f0b858b7b67aa0b28d69a74ffdea61be892f0f9ff9468e42aea53ee0cb83ff180aa18b625d1667459c7cba77cff9dc8c2772fe552fecfcd1778b08381000000c0b8e14631d521207e7423d86508416780983c2f380bc01cefe9773a9a5cd5b24aa24a561e72393c0ce2bf44825b05c1779fe74f884c2472ab45c2af60289cb199963312dd1929096c6f49d116f1612a7b97f77169fa5e8a66a372ef8e3ee7167f7d2a26fc6c3cfa4dc5860277223d6eb3460e3b10a0dc9400010000ca11d7beb5e700498b43bdadc916c01264d22d7969530633f94b257fbc5da7a96820e31044c0b0f62619c9e351996185e4015510875b774666ba5c0ba9845ad25b578d7d714ff3a85586b9b452301f5470d0e0ae5d7f82f178f0c7c9c8f44c390c8a2c5be9e24a125420912ec9a3149f87b35ef1169f05e49164a4944e7b4da2097f57020dd4f1f4f15edd7a0b1e24c6f79e1ea72a29c773f40f5bd9a6d7926c5c741f5aa85405273c7967d2c1a14efe0d5322cdcf2bc058ff9acb481926312f04008b1044e8c1c17d8c562edf69f4db96e059c49ec69a6086b5a3d24f4c7810ab5f6a9f9eb5c881883e5671bbca4614df48103ca6e408910000000000f784583b63fcd46293e1ea56bd87915783a144d41669cd2c52dbb03e2b7384f100000000000000000090bd4fa6a2d30dafd3a04d373eaf151dfbbb744f0f1ce962217b32ad159f41671f002c3a25b4efbc3b193e0954f71c7f240a7cdc5bf9be12ca0e82d2a408c8f882760331612a7c3d74386b3268e0c2a95396f6d16b8309cc192295fea2d0ce983baef6deecca6b6268b6cc965f2623bac861e31026a6aba7ebf78a614092257e3a4e52b7b1628dc33a425dce56fc939b96fbb66e131ba7651b542c86650336735d315c26bae977ff5a619b2534a5d1479e9090447aa860b81b905ded2f52ab9c741fc3a05030476b159690a811416d59f9d92c84fcbf0146be0330e1127cc4bb4e4c94d603f449279874e44113e9de94fbc14891af08e20a4701f0f8788b357815cf4ca3da2066ee6604ac6ab6ec54a111bd5b1887e74eb854010cc2dc95b06ceddfbc1b914be267fc29e6cf2301291ca8de0eed796d9e5e356861349b0fc217592e962360e714bb93a2e936f70873e773b9b6c056f28a36185bb8ecdcd3332528ab2d05be93bc69a373ac9d20fa087015481cfba74612d93104db153f89d03d6ce620f1f25be68b9cb2d225711c1b288ec6464111db1b40dbce06fd1bd887d7254476c9c70fe79be0fb7810e054b6e2205c2b4b27f13751639c581dac83889ed6eea54c798f2287c9d5345b0c49f78b9aa27a9c96ce5e43b6ca11bb6375ed390773315d19b596a60500330115bb100d0ea1511e29720d5f712eedd8e165af0c1d591fdbbd84e654b0e60c338c530a9e8ae1316a889134204f9db96e870bc1c5ffc1bdb2394d77e6c751f9d87ef42f6d53293f31ff4b60912fa0777c59db1ff74ba90026eed627e0f8ab250c8c6d51d86030e6be4a8982684c12c1c435d586ce106d0b4cd0f5fabcc5fbe30db5e715646867122ef50f767e215f92d407ad"], &(0x7f0000000140)='GPL\x00'}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r5 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x109842, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r5, 0xc004500a, &(0x7f00000000c0)=0x2) write$dsp(r5, &(0x7f0000000000)="81", 0x1) mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x8012, r5, 0x0) write$dsp(r5, &(0x7f0000000240)="1bde089db4e1f558c1fac0e45331c4859ed4516b05165b37b710ff7130b8b173103d2e91bb97cefcf6cb67cc76e48d72d9a608acfa04246d8e455bc7311505c8", 0x40) close(r5) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r6 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet_int(r6, 0x0, 0xf, &(0x7f0000000340)=0xfffffffffffffff9, 0x4) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r6, 0x84, 0x64, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @local}, @in={0x2, 0x0, @multicast1}], 0x20) getsockopt$inet_sctp_SCTP_RTOINFO(r4, 0x84, 0x0, &(0x7f00000001c0)={0x0, 0x1a6000, 0x6, 0x8000}, &(0x7f0000000280)=0x10) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r6, 0x84, 0x10, &(0x7f0000000480)=@sack_info={r7, 0x8, 0x6d9}, &(0x7f0000000300)=0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r9 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x89901) move_mount(r9, &(0x7f00000001c0)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) chroot(&(0x7f0000000200)='./file0\x00') r10 = syz_open_dev$dri(&(0x7f0000000080), 0x0, 0x0) unshare(0x22020600) sendfile(0xffffffffffffffff, r10, &(0x7f0000000400)=0xfffffffffffffffd, 0xd) r11 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r11, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) r12 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r12, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000440)=ANY=[@ANYRESOCT=r1, @ANYRES32=r8, @ANYRES8=r2], 0x68}, 0x1, 0x0, 0x0, 0x1}, 0x40800) 4.336444459s ago: executing program 8 (id=3123): timer_create(0x3, 0x0, &(0x7f0000000300)=0x0) timer_create(0xfffffffd, 0x0, &(0x7f0000000040)=0x0) timer_settime(r1, 0x0, &(0x7f0000000080)={{}, {0x77359400}}, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000480), 0x77, 0x141341) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, 0x0, &(0x7f0000000040)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$USBDEVFS_CONTROL(r2, 0xc0185500, &(0x7f00000000c0)={0x80, 0x6, 0x2fe, 0xe5, 0xe0, 0xfe, 0x0}) unshare(0x40000000) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r3) ptrace$setsig(0x4203, r3, 0x0, &(0x7f00000003c0)={0x8, 0xaf1, 0x9}) prctl$PR_SCHED_CORE(0x3e, 0x2, r3, 0x1, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r4) unshare(0x10040a80) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001040)={&(0x7f00000000c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r5, @ANYRES32=r6, @ANYBLOB="0400130006001200000000000600b500850100000a000600080211000001000014008100050001"], 0x50}}, 0x4000004) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNSETCARRIER(r7, 0x400454e2, &(0x7f0000000040)=0x1) timer_settime(r0, 0x0, &(0x7f0000000000)={{0x77359400}, {0x0, 0x989680}}, 0x0) 4.196261334s ago: executing program 7 (id=3124): socket$nl_route(0x10, 0x3, 0x0) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/wakeup_count', 0x101a02, 0x0) r1 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r4, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r5 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r5, 0x10e, 0x4, &(0x7f0000000140)=0x6, 0x4) setsockopt$sock_int(r5, 0x1, 0x8, &(0x7f0000000200), 0x4) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="980000000001010400000000000000000a0000003c0001802c00018014000300fe8000000000000000000000000000aa14000400ff0100000000000000000000000000010c00028005000100000000003c0002802c00018014000300fe8000000000000000000000000000aa14000400fe8800000000000000000000000000010c0002800500010000000000080007"], 0x98}}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000340)={0x0, 0x98}, 0x1, 0x0, 0x0, 0x20040800}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000008c0)={0x50, 0x0, 0x1, 0x3, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}]}, 0x50}}, 0x0) sendmmsg$alg(r1, &(0x7f0000001800)=[{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000100)="e92c3e5b5fea72d36d0f1ce0c1e16a89594759fe6816116aea0f6829fb0e01d753fdfda29b9fe80d5489652869b6b3eeef2e97fe4757", 0x36}, {&(0x7f0000000180)="aed9403172519ce89a419fce54b6039f63c98c", 0x13}, {&(0x7f00000002c0)="cad2985019f4e01a8f2249dfe45549d98fcd6a3a35f684075f51d7aaccbef8ac16ca395bf2bd16c28eb1461b3e1805515fb57ab53cd8474d379cd3449625c6a5e4e5ef158235d43abbaf354d3e9b6faa62ab7a4a4c06d2e27df772b9719fade7a0cc5e33b9144ee2200d99f4b9060c3d83ac8c0f924df255448d33cfd5e0514fbbea2e0f344bf523cc4ccec5f559768a98de1eef0af76e511ffc9b561f0a0fb1707a2e27f80201d011dd9d6532925b34", 0xb0}, {&(0x7f00000001c0)}, {&(0x7f00000007c0)="6a8262904c848c17c9a4e56f47186fafa59a67f43da0b494903acf72acd56d2253ceee243ade0c0d8ccb80ab242b4cb658af8818b1619a8207960781263eb7efe80e5ef34f96fd985e518b810f1bc9c4e452375a9eaafbd8e88a39372b87b4572ead2e5298794ef3f052bdfb0fb885230aeb07823b72ff44b58975721135c125caf35e7eeee1251390b326967180e1de65ed442a97ed2a513885e4a1c4414a4622bdd87f86900638ed5097a2b42855c3e80694bb8059dd8b1d0ae94f00447cc466410eeadd0a54569d7ec1d193e34beffa5a6a861b5600652a29c5b087fa1967e78c8b4a761303d33b75f2367ac19762631a877f5cfa9cca341d5577b6290de322620f5a5a676638c97b7c6d0b10dcb9209edf15273d150ec6e89814c218997dbcb687d06027cdf3eff025414619e5890215b059ae9425660bf4e291160e3ab4df54bd89ef055f9724a335ef8f7ac81c1751c412e23ec59596a6a800450f20429e8f604f0568b6b4700b799ada6aa0e6963f2ec3b18f42a58c1dd432e6323ce66f95c4f334d7c0c12e74bfe86b4025faecf6070d572f1297652d9bc1d7114e3695698ca7f324e3bd0202577cf2dd362b60b2df225e6ae54f127c1e02ddea1fd9ca48586b654c17d63833d523abf3029386f5f254061c235aa7fc333b87cfbc923c32f73dcbb27bc70a0f0eb5c60a2feea1a33bc198b5ae727e9d216c81c6c76a44e111fa38ce9a49b2d5eab4aa703e5bc5436fa94e146d72754d27097d9d5ecf0e652b12e5fc1d675e81d3c724f7638fa1880255955681437d88cf4431511154da22124bafce9e35187c6f10b90e113c85f1325bef2197baccc66a35251b92329f79e211966e568f397c16f018b5bfc5dc05849ef0bafc47ef3f7d266f478df3b5856369a1be9cce710dc9f85d32e89595f7ad7654ce59c75735f6e52722300e084ae956a354c771e8f0aeabdca1d63289ccc42b52effdcc483b3a8303a63465d88f04789cad5ed5a2cf782eba630d29c5d2ca93de6491cd60ada6e7596c18cc86e573e1352b2fb40dcd92a5bc69ad2280815c8e2bf503b44defb0d2f6105051", 0x300}, {0x0}, {&(0x7f0000000480)="83d763683f984bc11e2488e619ecec7e77667e5032d2412f70cb9cba1a19cf906fed30192629187789f9e15ffd100c9f93e01f614ce40f365be740e3b999a3a6f3db24561582956cc55786315d9a34678472eda3433780f09d8257e2b6c8c8eee3a9", 0x62}], 0x7, &(0x7f0000000500)=[@op={0x10, 0x117, 0x3, 0x1}, @iv={0x110, 0x117, 0x2, 0xff, "d17613b8dc104c2144f2fafb4716f50e3f025a4072d891a4fe04e11884ecb59a160bdd3b3efa9705bec9c72e699ee3fca4dedacd549999e9fa3e829913a00f8a588613c04f8b9352b4e2e773a36f710a6534904571307246e4c5c28913b50d0a6eb1076f615962ef451d9cbce39c6716cfa3e6dd15ea3b2fc51ca378879d924d096783778d467a6943ac870de085b0a16d31d3a1783c61624129ae7d804f60e0d9b24713a9c9927bbd48ec726731d9936c800cf7d88596653d26d6f81031cbd5dfe3f7b2ba1d5501769232f2f97a06f26e423c1ae347bf076a1bb01128092fcf855e2144ae9e9c59656ef68ec60dc51679ab01a6e68f7430a3562514a4b1d1"}], 0x120, 0x4000}, {0x0, 0x0, &(0x7f00000017c0)=[{&(0x7f0000000640)="e5e7b8211e99c98bab5661", 0xb}, {&(0x7f0000000680)="6d0b929817424057ba781098154ccd800898cbf8ea61117d38013ca51b15fcbfb29a234f399facf4041b2f0ff97e5f4c3c9f2def360dd953300ed7a20f6d233710475f5065baffa54256744798c32e95fc5f00cc9d6b053b80d8a9068d70eaf187264bbdb36e518926c81817b1cc9c453c", 0x71}], 0x2, 0x0, 0x0, 0x80}], 0x2, 0x4000) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newqdisc={0x60, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r8, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0xea, 0x2, 0x0, 0x0, 0x9, 0x5}, {0x12, 0x2, 0x0, 0x401, 0x8001, 0x1400}, 0xa5, 0x5, 0x10000000}}, @TCA_TBF_BURST={0x8, 0x6, 0x8057}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x40000}, 0x44080) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000440)=@newqdisc={0x40, 0x24, 0xd0f, 0x70bd29, 0x0, {0x60, 0x0, 0x0, r8, {0x0, 0x6}, {0xffe0, 0xa}, {0x1, 0x10}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x14, 0x2, [@TCA_FQ_TIMER_SLACK={0x8, 0xd, 0x3ff}, @TCA_FQ_RATE_ENABLE={0x8}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x55}, 0x4000) timer_delete(0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) sendfile(r0, r0, 0x0, 0x101) 3.086836451s ago: executing program 4 (id=3125): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@delneigh={0x44, 0x1a, 0x1, 0x70bd2b, 0x0, {0xa, 0x0, 0x0, 0x0, 0x4, 0x0, 0x4}, [@NDA_CACHEINFO={0x14, 0x3, {0x7}}, @NDA_DST_IPV6={0x14, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}]}, 0x44}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0a41, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x4002}) r2 = openat$ttyS3(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = syz_io_uring_setup(0x186, &(0x7f0000000080)={0x0, 0x0, 0x13100}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r4, r5, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x2002, 0x0) close(r6) io_uring_enter(r3, 0x4945, 0x0, 0x2, 0x0, 0x0) ioctl$TCSETS2(r2, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x1020, 0x0, 0x0, "dd0400", 0x0, 0xffff9832}) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r8 = socket(0x400000000010, 0x3, 0x0) r9 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r9, &(0x7f0000000000)={0x0, 0x4, &(0x7f0000000080)=[{&(0x7f0000000200)="2e0400001c008103e00f80ecdb4cb9f207c804a00f00000088080ffb0a0002000a0ada1b40d80800c500c50083b8", 0xfec9}], 0x1, 0x0, 0x0, 0x5865}, 0x0) r10 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r11, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x87f}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x8080}, 0x40020) preadv(r10, &(0x7f0000000280)=[{&(0x7f0000000140)=""/102, 0x66}, {&(0x7f00000001c0)=""/49, 0x31}], 0x2, 0x40, 0x6) accept4(r0, &(0x7f00000002c0)=@nl, &(0x7f0000000340)=0x80, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000001300)=@newtfilter={0x894, 0x2c, 0xd27, 0x70bd25, 0x5, {0x0, 0x0, 0x0, r11, {0x0, 0xfffc}, {}, {0x4, 0x2}}, [@filter_kind_options=@f_bpf={{0x8}, {0x860, 0x2, [@TCA_BPF_POLICE={0x850, 0x2, [@TCA_POLICE_TBF={0x30, 0x1, {0xe, 0x7, 0x4, 0xc, 0x9, {0xd, 0x2, 0x4, 0x4, 0x7, 0x401}, {0x4, 0x1, 0x5, 0x10, 0xfff7, 0x4b2}, 0x6, 0x14ff, 0x3ff}}, @TCA_POLICE_AVRATE={0x8, 0x4, 0x3}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x38, 0x1, 0x1, 0x8, 0x7f, 0x6, 0x3, 0x6, 0x10000, 0x86, 0x9, 0x6, 0x5, 0x9, 0x5f, 0x0, 0x0, 0x13f, 0xfffffffe, 0x0, 0xd31, 0xf54, 0x9, 0x4, 0x4, 0x6, 0x9, 0x7fffffff, 0xfffffffd, 0x7fffffff, 0x8, 0x0, 0xfffffffe, 0x5, 0x5dbd0fd8, 0x8, 0x1887, 0x2, 0x95f, 0x7, 0x6, 0xa, 0x7f, 0xfffffffe, 0x8, 0x2, 0x6, 0x4, 0x6, 0x402f, 0xd, 0x5, 0x6f9d, 0x0, 0x800, 0x3ff, 0x8, 0xa, 0x9, 0x4, 0xd, 0x3, 0xb8f, 0x6, 0x0, 0xffffffff, 0x8000, 0xffffffff, 0x8, 0xfffffffc, 0xee, 0x4, 0x9, 0x2, 0x54eef174, 0xc, 0x9, 0x5, 0xe2, 0x20004, 0x1, 0xffff, 0x5, 0x5, 0x7, 0x5, 0x7, 0x4, 0x4, 0x7, 0x100, 0x8, 0x2, 0x9, 0x0, 0x0, 0xe32, 0x6, 0x8, 0x6, 0x66, 0x7, 0x7, 0x8, 0x5b, 0x7625, 0x51, 0x6, 0xfffffffe, 0x0, 0xa4d, 0x2, 0x10001, 0x7, 0x8, 0x3, 0x8, 0x3, 0x6, 0x6, 0xffffffff, 0x3, 0x0, 0x400000, 0xc55b, 0x8000, 0xf943, 0x4, 0x3000000, 0x2, 0x10000, 0xd, 0xffffffff, 0x9, 0xd3, 0xfffffffb, 0x4, 0x9, 0x401, 0x82baa23, 0xd, 0x0, 0x6, 0x21a, 0xe, 0x1, 0x1430, 0x8, 0x4, 0x7, 0xe, 0x7dab, 0x4, 0x5, 0x4, 0x3, 0xfffffffe, 0x7, 0x6, 0x8ef6, 0x7239, 0x80000001, 0x0, 0xd41, 0x6, 0x2, 0x4, 0x200, 0x8, 0x5, 0xc14, 0x7324, 0x4, 0x50f6, 0x5, 0x4, 0x3, 0x2, 0x7, 0x4, 0x6, 0x5, 0x3, 0x7767, 0x8, 0xe0ba, 0x4f, 0x3, 0x4, 0x7, 0x7fffffff, 0x3, 0x3, 0x5, 0x8, 0x4, 0x80, 0x401, 0x7, 0x1, 0x0, 0x8, 0x7c4, 0x3, 0x6, 0x6, 0xe8, 0x0, 0x6, 0x6, 0x3, 0x8a4, 0x1, 0x9, 0x9, 0x9, 0x200, 0x7, 0xd235, 0x9, 0x7fffffff, 0xf7d, 0x8001, 0x2, 0x7fff, 0x9f7c, 0x7, 0x4, 0xf, 0x1, 0x2, 0x6, 0x400, 0x5, 0x80, 0x400, 0x5, 0xc, 0xff, 0xffff7002, 0x63c, 0x9, 0x1ff, 0xfff, 0x8, 0x8c, 0x40, 0x8, 0xed6, 0xf6, 0x0, 0x3, 0x9, 0x10, 0x9, 0x6]}, @TCA_POLICE_RATE={0x404, 0x2, [0x8, 0x6, 0x8, 0x8000, 0x8, 0x2, 0x9, 0x5, 0xfff, 0x3, 0x101, 0xbf7, 0x8, 0xff, 0x6, 0x113, 0xffff, 0x1, 0x8, 0x7fffffff, 0x6, 0x9, 0x33, 0x5, 0x2f7, 0x100, 0x21, 0x4, 0x7, 0xff, 0x6, 0xfffffffe, 0x7, 0x8, 0x1, 0x8, 0xf33c, 0x3, 0x1, 0x80000000, 0x62e, 0x3, 0xdb2, 0x0, 0xe00, 0x4, 0x2, 0x3, 0x2, 0xfffffff6, 0x5, 0x3, 0x7, 0x8, 0x1, 0x7f, 0x8, 0x6, 0x4, 0x3, 0x0, 0x803, 0x1, 0x5, 0x0, 0x8000, 0xfffffffa, 0xb7, 0xc8b6f5a2, 0x6, 0x2f, 0x7ff, 0x9, 0x8, 0x6, 0x0, 0x8, 0x9, 0x0, 0x5, 0x8b34, 0x2, 0x7e, 0x4, 0x4, 0xfeffffff, 0x1, 0xa, 0xfffffffb, 0x3, 0xffffffff, 0x0, 0x4, 0xd6, 0x7, 0x4, 0x3, 0x8, 0x9, 0x8, 0x2de0, 0x5191, 0x6, 0x401, 0x7, 0x9, 0x7, 0x3, 0x6, 0x1, 0xfffffffb, 0xb839, 0xfffffffa, 0x4, 0x768, 0x7, 0x7f, 0x6, 0x7, 0x4, 0x8b, 0x4, 0x0, 0x5, 0xf0, 0x42490, 0xd, 0x3, 0x5c, 0x80, 0x2, 0x800, 0x8, 0x6, 0xff, 0xffff0000, 0x3, 0x10000, 0x80000001, 0x5, 0xffffffff, 0x4be24694, 0x2, 0x2, 0x100, 0x5, 0x1, 0x5, 0x4, 0xffffff95, 0x5, 0x0, 0xc, 0x6, 0x1000, 0xa, 0x7, 0x4, 0x340, 0x0, 0x0, 0x7, 0x101, 0x2, 0x7ce2352, 0x7fffffff, 0x5e, 0x8e5b, 0x3, 0x8, 0x9, 0x1, 0x80000000, 0x7, 0x301, 0x91, 0x3, 0x80000001, 0x9, 0x1, 0x3e79, 0xffffffff, 0x8, 0x525, 0x7, 0x6, 0x2470a614, 0xe, 0x8, 0x5, 0x7, 0x0, 0x5, 0x4, 0x1, 0x1, 0xfffffc1f, 0x6, 0x2, 0x1, 0x9, 0x7fff, 0xffffffff, 0x4, 0xffff2b7d, 0x4, 0xcdff, 0x9, 0x0, 0x49, 0x6, 0x0, 0x5, 0x9, 0x7, 0x8, 0x7, 0xea, 0x7, 0x7, 0x2, 0x5, 0xff, 0x6, 0xffff, 0x4cd, 0x7, 0x3, 0x3, 0x10001, 0x0, 0x6, 0x7, 0xffffffff, 0xe000000, 0x1, 0x4, 0x7, 0x8, 0xb, 0x7, 0x0, 0xcb65, 0x6, 0xe, 0x240000, 0x9, 0x8, 0x8, 0xfffffff8, 0x9, 0xf, 0x8, 0x5, 0x9, 0x100]}]}, @TCA_BPF_OPS={{0x6}, {0x4}}]}}, @TCA_RATE={0x6, 0x5, {0x2, 0x10}}]}, 0x894}, 0x1, 0x0, 0x0, 0xc004884}, 0x0) write$tun(r1, &(0x7f0000000040)={@val={0x0, 0x18}, @val={0x3, 0x1, 0x3, 0x4, 0xc4, 0x10}, @ipv4=@tcp={{0x5, 0x4, 0x3, 0x4, 0xd8, 0x65, 0x0, 0x8, 0x6, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast}, {{0x4e20, 0x4e22, 0x41424344, 0x41424344, 0x1, 0x0, 0x1c, 0x80, 0x7, 0x0, 0x9, {[@mptcp=@remove_addr={0x1e, 0x59, 0x6, 0x0, "3bcc55e2fb4b662a463b24b28a4fafb428a89d60f9547d33690c48bf9581455479f14cea31faf5212327c508ed14d3cc9f1b20adaecc3b4c664e61295f92adc7b03928e6f24a8ee8e299effe97537d57096d808d21b4"}]}}, {"13d3b3875dfd9a3f6328f33f09ceec09986b30406704e2560f04592cb4869c77658fcb3eca004c77b183c5840dbb0fd30bcd067737d3f07dff1755aac0e628d921d141b089c15306c066b177aab800b11b45b57a"}}}}, 0xe6) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10) connect$inet(0xffffffffffffffff, &(0x7f00000009c0)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x21}}, 0x10) writev(0xffffffffffffffff, &(0x7f0000000200)=[{&(0x7f00000000c0)='X', 0x8030000}], 0x1) r12 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xc20a, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x1, 0x21, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x800, 0x5, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x20, 0x8, 0x2}}, [{{0x9, 0x5, 0x2, 0x3, 0x8, 0x56, 0x8, 0x40}}]}}}]}}]}}, 0x0) syz_usb_control_io(r12, 0x0, 0x0) 2.916250677s ago: executing program 8 (id=3126): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$sock_inet6_tcp_SIOCATMARK(r0, 0x8905, &(0x7f0000000000)) r1 = openat$dma_heap(0xffffff9c, &(0x7f0000000040), 0xc900, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81e8943c, &(0x7f0000000080)={0x0}) ioctl$BTRFS_IOC_INO_LOOKUP(r1, 0xd0009412, &(0x7f0000000280)={r2, 0x8}) mknod$loop(&(0x7f0000001280)='./file0\x00', 0x6000, 0x1) execve(&(0x7f00000012c0)='./file0\x00', &(0x7f0000001340)={[&(0x7f0000001300)='L\x00']}, &(0x7f0000001400)={[&(0x7f0000001380)=',[#&^[))&^\xdc\x00', &(0x7f00000013c0)='/dev/dma_heap/system\x00']}) r3 = io_uring_setup(0x6f95, &(0x7f0000001440)={0x0, 0x5f90, 0x2000, 0x0, 0x99}) io_uring_enter(r3, 0x6447, 0x6ceb, 0x10, &(0x7f00000014c0)={[0xb77, 0x9]}, 0x8) r4 = syz_open_dev$vim2m(&(0x7f0000001500), 0x6b60, 0x2) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000001540)={{0x1, 0x1, 0x18, r3, {0x7}}, './file0\x00'}) write$uinput_user_dev(r5, &(0x7f0000001580)={'syz0\x00', {0x3, 0x7, 0x81, 0x1}, 0xe, [0x7f, 0x54, 0x6dc64709, 0x401, 0xa63, 0x100, 0x8000, 0x6, 0x90f5, 0x7fffffff, 0x8, 0x2, 0x10000, 0x7, 0x6, 0x8d4, 0x1, 0x3a, 0x9, 0x7ff, 0xae85, 0xae05, 0x4, 0x7, 0x10, 0x1, 0x80, 0x1, 0x1, 0x4, 0xe7f, 0x0, 0x5, 0x7ff, 0xfffffff9, 0x0, 0x400, 0x9, 0x0, 0x6, 0x100, 0x1, 0x7fffffff, 0x2, 0x10001, 0x7fffffff, 0x6, 0x7, 0x58b, 0xa6, 0x6, 0x3, 0x7fffffff, 0xfff, 0xc5d9, 0x3, 0x40, 0x8, 0x8b, 0x5, 0x101, 0x81, 0x4, 0x6], [0x5d, 0x8, 0x6, 0x3756, 0x3, 0x8, 0xfffffffc, 0x101, 0x7, 0x7, 0x2, 0x26, 0x1, 0x5, 0x5, 0x2, 0x80000000, 0x5, 0x2, 0x4, 0x1, 0x3, 0x200, 0x3, 0x1, 0x0, 0x7fff, 0x6, 0x0, 0x4, 0x4, 0x0, 0x4d73, 0x3, 0x8ef, 0x2, 0x4, 0x8, 0x3, 0x0, 0x5, 0x200, 0x575, 0x7, 0x200, 0x6, 0x900, 0x7f, 0x4, 0x5a, 0x4, 0x3, 0x6, 0x40, 0x80, 0x2, 0xa5cd, 0x58e, 0xfff, 0x6, 0x8001, 0x1, 0x16e3, 0x4], [0x1ff, 0x2, 0x1, 0x7fff, 0xf09, 0x2, 0x0, 0xfffffa0e, 0x75, 0x6, 0x3800, 0x4, 0x0, 0x80000001, 0x0, 0x8, 0x8, 0x81, 0x1cb5429, 0x4, 0x4c7b, 0x1, 0x2, 0x2, 0x6, 0x6, 0x8001, 0x9, 0x25a, 0x8, 0x0, 0x9, 0xcdc, 0xa42, 0x80000000, 0x66, 0x11a0, 0x80, 0x8001, 0x3, 0x0, 0xfffffffb, 0x2, 0x9, 0x9, 0x0, 0x3, 0x4, 0x0, 0x4, 0x81, 0x0, 0x599, 0xb, 0x7ff, 0xc76, 0x5, 0x6f74, 0x7, 0xfffffffa, 0x3ff, 0xff, 0x4, 0x7ff], [0x1, 0x401, 0xf8, 0xedb6, 0x3, 0x7, 0x3, 0x7, 0x6, 0xfffffffe, 0x1, 0x1, 0x401, 0x3, 0x2, 0x8, 0x1, 0x6c91, 0xf, 0x8, 0x8000, 0x219, 0x200, 0x8, 0x5, 0x10, 0xfffffffe, 0x5, 0x9, 0x4, 0x7, 0x1, 0x3ff, 0x2, 0xfa, 0x701, 0x10000, 0x2ec, 0x70e2, 0x36047261, 0x6, 0x7, 0x4, 0x3, 0x0, 0x1, 0x7, 0x0, 0x200, 0x400, 0x9, 0x21f7, 0x7f, 0x1, 0x8, 0x0, 0x0, 0x81, 0x8001, 0x0, 0x1, 0x3, 0x6, 0x7f]}, 0x45c) socket$inet_tcp(0x2, 0x1, 0x0) r6 = openat$kvm(0xffffff9c, &(0x7f0000001a00), 0x2000, 0x0) pwritev(r6, &(0x7f0000001c80)=[{&(0x7f0000001a40)="de66bd1431a59557b3bdfbcacd717ec9c2430a6e11645ec5e3c2fe9d8c773f42581d515b4f5cf97e1c10fdcd26580ca842bedfc3d29db1c068cb50ec9e9f04198f510a783e396d9aadbb98103d52db1d5e359878777f15f999e4f8cdd8b523bb327566ca63c981770188ed611e8b8af560e1e5e2ad6c0240be490fe5f228ba94", 0x80}, {&(0x7f0000001ac0)="7a87f323878c33e5f1b452814a383997e3365ecb69fd0b7db2e4f745f89b1858fa665d8a31dee122030f094f8436bd8f6227cc49908f7379e781c98deaa538b3bb8b1aaca8b55459ac8f1d935032d6776e3c2d05ac7f010d6196e6bf11d40b31362a9920d5dedcb6d94e1e432c788852ed14f0f5b275e54bf0ad08781c80af7dfb44cd0ea803ec997a0162d80fe6691f30ad9ed59364cf2d7049534575c201d609f0ec648885cd1f8f606ba38fdd202d953a8150858be87583bdbb7ef6d88ebd8e8b7ca8612b37efc7d96487815adc5bab3bbbb9a1f7d41f62af0fdb19503ada616ad3b105dfd9c6cec1f03b2b59", 0xee}, {&(0x7f0000001bc0)="f06875a1b6065a9419c20ebd252ea13d361ba1aa7e27eea6f906b7d0199493815a4fb16d53c222b4455c8e44dff3f40dd383ad13c52b69761e63a04df05fff90d70c8d04749d0ebd523c5a656405f462767f4b73980e7951dd3a90f1b467aec52dd738df82789af5ee2d0d3235999ffd3da04a7a29668724984ad2e86fa01f96c2898a17c29ca388c1a0f625e8201e1dc0d187a39c99b912f221f62f68ac5fa75b777d19a216d0b05ff97004996f148fb2fb8dd7be", 0xb5}], 0x3, 0xa, 0x3) write$sndseq(r5, &(0x7f0000001d40)=[{0xc0, 0x5e, 0x4, 0x8, @time={0x7, 0x5b9}, {0x4b, 0x8e}, {0x9, 0x9}, @quote={{0xc, 0xc7}, 0x5, &(0x7f0000001cc0)={0x5f, 0x6, 0x7, 0xc, @tick=0x2, {0x8, 0xc}, {0xf8, 0x4}, @addr={0xb, 0x1}}}}, {0xff, 0x3b, 0x8, 0x80, @tick=0x80000000, {0x6, 0x7f}, {0x8, 0x5}, @queue={0xa, {0xcfa, 0x56f19813}}}, {0x19, 0x0, 0x40, 0x4, @tick=0xc7, {0xff, 0x4}, {0x3e, 0x7}, @raw32={[0x3, 0x6, 0x1]}}, {0x8, 0xe0, 0x3, 0x4f, @tick=0x1ff, {0x7, 0xd3}, {0x7, 0x81}, @queue={0xe, {0x0, 0x7}}}, {0x7, 0x1, 0x3, 0x9, @time={0x1, 0x100}, {0x3, 0x9}, {0xe, 0x5}, @quote={{0x6, 0x3}, 0xb65c, &(0x7f0000001d00)={0x3, 0x4, 0xa, 0x4, @tick=0x7fffffff, {0x4, 0x2}, {0xc2, 0x8}, @addr={0x6, 0x9}}}}, {0x1, 0x8, 0xe7, 0x60, @time={0x8}, {0x3, 0x7}, {0x9, 0xe9}, @connect={{0x7, 0x8}, {0x3}}}, {0x10, 0x1, 0x1, 0xdf, @tick=0x7, {0x8, 0x7f}, {0xf3, 0x3}, @addr={0x4, 0x6}}, {0x8, 0x3, 0x10, 0x4, @tick=0x1, {0x9, 0x5}, {0x7, 0x4}, @quote={{0x46, 0x4}, 0x6}}, {0x0, 0xb, 0x3, 0x7f, @time={0x5, 0x401}, {0x1, 0xfa}, {0x57, 0xff}, @addr={0xf7, 0x60}}], 0xfc) r7 = syz_genetlink_get_family_id$batadv(&(0x7f0000001e80), r5) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r5, 0x89f1, &(0x7f0000001f80)={'gretap0\x00', &(0x7f0000001ec0)={'gre0\x00', 0x0, 0x7800, 0x700, 0x4, 0x3, {{0x22, 0x4, 0x1, 0x4, 0x88, 0x64, 0x0, 0x0, 0x29, 0x0, @remote, @remote, {[@timestamp={0x44, 0x10, 0x4d, 0x0, 0x2, [0x5, 0x10000, 0x9a2c]}, @timestamp_prespec={0x44, 0x44, 0x43, 0x3, 0x3, [{@multicast1, 0x8}, {@private=0xa010102, 0x1}, {@rand_addr=0x64010101, 0x6}, {@broadcast, 0xffffffff}, {@loopback, 0x9}, {@dev={0xac, 0x14, 0x14, 0x42}, 0x3}, {@multicast2, 0x9}, {@dev={0xac, 0x14, 0x14, 0x1c}, 0xba7a}]}, @generic={0x89, 0x3, ']'}, @ssrr={0x89, 0x1b, 0xb0, [@rand_addr=0x64010102, @dev={0xac, 0x14, 0x14, 0x31}, @remote, @broadcast, @multicast1, @multicast2]}]}}}}}) sendmsg$BATADV_CMD_GET_ORIGINATORS(r5, &(0x7f0000002080)={&(0x7f0000001e40)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000002040)={&(0x7f0000001fc0)={0x64, r7, 0x600, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_ISOLATION_MASK={0x8}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0xffff}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r8}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x8}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x6}]}, 0x64}, 0x1, 0x0, 0x0, 0x40000}, 0x50) r9 = openat$cgroup_root(0xffffff9c, &(0x7f00000020c0)='./cgroup/syz0\x00', 0x200002, 0x0) r10 = openat$cgroup_ro(r9, &(0x7f0000002100)='net_prio.prioidx\x00', 0x0, 0x0) ioctl$TCSETAF(r5, 0x5408, &(0x7f0000002140)={0xe66, 0x0, 0x7, 0x6, 0x12, "f47eafa5f48c4627"}) getresuid(&(0x7f00000021c0)=0x0, &(0x7f0000002200), &(0x7f0000002240)) quotactl$Q_GETINFO(0xffffffff80000501, &(0x7f0000002180)=@nbd={'/dev/nbd', 0x0}, r11, &(0x7f0000002280)) ioctl$sock_inet_udp_SIOCINQ(r10, 0x541b, &(0x7f00000022c0)) ioctl$UFFDIO_COPY(r10, 0xc028aa03, &(0x7f0000002300)={&(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2}) r12 = fcntl$dupfd(r4, 0x406, r1) ioctl$DMA_BUF_SET_NAME_A(r12, 0x40046201, &(0x7f0000002340)=':\'/*{]^\x00') openat$rdma_cm(0xffffff9c, &(0x7f0000002380), 0x2, 0x0) ioctl$TIOCNOTTY(r10, 0x5422) 2.510308542s ago: executing program 5 (id=3127): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x47) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000080)}, {&(0x7f0000000380)="3bc4ede1f4db035ddf201a6b72a3d9ba18ebd838217a8dac25348455376da78b53c5cbeb1057a757de34d2ba16fc68c4f088ed3af5955abfd2d94490d74ed506f1501df9f1ab6f0b36751df7357fdb5186aead31d2dc17c2582e4f0a339bc346deacbb5422c48c71e875b955e10eb16a52432d048f6a692d047c535f8ef072ef8cd795c8fa594249d3e8a5b33cf9587381cdd208d52f", 0x96}, {&(0x7f0000000500)="7061d930f5f82dea12c98d37f2a6d3541b60c33264dd2b11068de4eedbb17a12d733f55208f8d35cee90f8d5192a1c4bf3b290b82227e6c376dd1d97dde811c0cf167691fe7f4881aedbd46477bf36cf7c79671c", 0x54}], 0x3) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000340)=[@timestamp, @window={0x3, 0x6, 0x7}, @mss={0x2, 0x7}, @window={0x3, 0x0, 0x4}, @window={0x3, 0x8, 0x6}, @window={0x3, 0xfffe}, @sack_perm], 0x7) sendto$inet(r0, &(0x7f0000000200)="c342263b84e2a5742cc3a1a33316fab23ecf279b1c706990b5a6e15ebbed1252c005f46bc0b1cc1f1d8a9b20b27655157326e5a2553c8e17ae7c", 0x3a, 0x6000c000, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r0, &(0x7f00000004c0)='<', 0x381, 0x805, 0x0, 0x0) 2.290218371s ago: executing program 8 (id=3128): open(&(0x7f00009e1000)='./file0\x00', 0x8060, 0x0) r0 = openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) socket(0x1d, 0x4, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) write$P9_RGETLOCK(r0, &(0x7f00000003c0)=ANY=[@ANYBLOB="2300491200000000000000000000000000000000000000001bcdfc5fed0491ac3040d4c68bd26cadf03cde50cde7a7286970666ef9d06fd1ff53458aec4c04a975c1e91f187d458a41aa9c6154f3e0c4e2580b1f7bf499a43e516d4ac6599c57fa17cf4cab9aaada6fde9c12bd3efcfc9344fe3407af27fd529860e89e5c791867f89de78f7a9f17d33ed904a04c218e0081ee67c0fac1738a7dfdd051290ecfbc01214a9789b316a5483052d19a12fd3fc5414a0e9421d6f976ec324db552b02177fb00f207fe431f96", @ANYRES32], 0x23) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$CEC_S_MODE(0xffffffffffffffff, 0x40046109, &(0x7f0000000040)=0x20) sendmsg$FOU_CMD_GET(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x20, 0x0, 0x1, 0x0, 0x0, {}, [@FOU_ATTR_TYPE={0x5}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}]}, 0x20}}, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x20, &(0x7f00000000c0)=[@in={0x2, 0x4e24, @rand_addr=0x64010101}, @in={0x2, 0x4e24, @rand_addr=0x64010101}]}, &(0x7f0000000180)=0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000740)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a4c000000060a0bfe6ecd77084f21c01e020000000900010073797a30000000000900020073797a320000000018000480140001800b0001006c6f6f6b75700000040002800700"], 0x74}}, 0x10) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f00000004c0), 0x8001) openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x14, 0x15, 0x301, 0x0, 0x0, {0xb}}, 0x14}}, 0x0) io_setup(0x222, &(0x7f0000000180)) 2.275181658s ago: executing program 6 (id=3129): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newtaction={0x4c, 0x1e, 0x109, 0x0, 0x25dfdbfe, {}, [{0x38, 0x1, [@m_mirred={0x34, 0x0, 0x0, 0x0, {{0xb, 0x9}, {0x4, 0xe}, {0x6, 0x6, "6ed0"}, {0xc}, {0xc, 0x8, {0x1}}}}]}]}, 0x4c}, 0x1, 0x2b1e}, 0x58) 2.207467597s ago: executing program 5 (id=3130): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newtaction={0x4c, 0x1e, 0x109, 0x0, 0x25dfdbfe, {}, [{0x38, 0x1, [@m_mirred={0x34, 0x0, 0x0, 0x0, {{0xb, 0x9}, {0x4, 0xe}, {0x6, 0x6, "6ed0"}, {0xc}, {0xc, 0x8, {0x1}}}}]}]}, 0x4c}, 0x1, 0x2b1e}, 0x58) (fail_nth: 1) 1.682321994s ago: executing program 5 (id=3131): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@delneigh={0x44, 0x1a, 0x1, 0x70bd2b, 0x0, {0xa, 0x0, 0x0, 0x0, 0x4, 0x0, 0x4}, [@NDA_CACHEINFO={0x14, 0x3, {0x7}}, @NDA_DST_IPV6={0x14, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}]}, 0x44}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0a41, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x4002}) r2 = openat$ttyS3(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = syz_io_uring_setup(0x186, &(0x7f0000000080)={0x0, 0x0, 0x13100}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r4, r5, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x2002, 0x0) close(r6) io_uring_enter(r3, 0x4945, 0x0, 0x2, 0x0, 0x0) ioctl$TCSETS2(r2, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x1020, 0x0, 0x0, "dd0400", 0x0, 0xffff9832}) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r8 = socket(0x400000000010, 0x3, 0x0) r9 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r9, &(0x7f0000000000)={0x0, 0x4, &(0x7f0000000080)=[{&(0x7f0000000200)="2e0400001c008103e00f80ecdb4cb9f207c804a00f00000088080ffb0a0002000a0ada1b40d80800c500c50083b8", 0xfec9}], 0x1, 0x0, 0x0, 0x5865}, 0x0) r10 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r11, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x87f}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x8080}, 0x40020) preadv(r10, &(0x7f0000000280)=[{&(0x7f0000000140)=""/102, 0x66}, {&(0x7f00000001c0)=""/49, 0x31}], 0x2, 0x40, 0x6) accept4(r0, &(0x7f00000002c0)=@nl, &(0x7f0000000340)=0x80, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000001300)=@newtfilter={0x894, 0x2c, 0xd27, 0x70bd25, 0x5, {0x0, 0x0, 0x0, r11, {0x0, 0xfffc}, {}, {0x4, 0x2}}, [@filter_kind_options=@f_bpf={{0x8}, {0x860, 0x2, [@TCA_BPF_POLICE={0x850, 0x2, [@TCA_POLICE_TBF={0x30, 0x1, {0xe, 0x7, 0x4, 0xc, 0x9, {0xd, 0x2, 0x4, 0x4, 0x7, 0x401}, {0x4, 0x1, 0x5, 0x10, 0xfff7, 0x4b2}, 0x6, 0x14ff, 0x3ff}}, @TCA_POLICE_AVRATE={0x8, 0x4, 0x3}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x38, 0x1, 0x1, 0x8, 0x7f, 0x6, 0x3, 0x6, 0x10000, 0x86, 0x9, 0x6, 0x5, 0x9, 0x5f, 0x0, 0x0, 0x13f, 0xfffffffe, 0x0, 0xd31, 0xf54, 0x9, 0x4, 0x4, 0x6, 0x9, 0x7fffffff, 0xfffffffd, 0x7fffffff, 0x8, 0x0, 0xfffffffe, 0x5, 0x5dbd0fd8, 0x8, 0x1887, 0x2, 0x95f, 0x7, 0x6, 0xa, 0x7f, 0xfffffffe, 0x8, 0x2, 0x6, 0x4, 0x6, 0x402f, 0xd, 0x5, 0x6f9d, 0x0, 0x800, 0x3ff, 0x8, 0xa, 0x9, 0x4, 0xd, 0x3, 0xb8f, 0x6, 0x0, 0xffffffff, 0x8000, 0xffffffff, 0x8, 0xfffffffc, 0xee, 0x4, 0x9, 0x2, 0x54eef174, 0xc, 0x9, 0x5, 0xe2, 0x20004, 0x1, 0xffff, 0x5, 0x5, 0x7, 0x5, 0x7, 0x4, 0x4, 0x7, 0x100, 0x8, 0x2, 0x9, 0x0, 0x0, 0xe32, 0x6, 0x8, 0x6, 0x66, 0x7, 0x7, 0x8, 0x5b, 0x7625, 0x51, 0x6, 0xfffffffe, 0x0, 0xa4d, 0x2, 0x10001, 0x7, 0x8, 0x3, 0x8, 0x3, 0x6, 0x6, 0xffffffff, 0x3, 0x0, 0x400000, 0xc55b, 0x8000, 0xf943, 0x4, 0x3000000, 0x2, 0x10000, 0xd, 0xffffffff, 0x9, 0xd3, 0xfffffffb, 0x4, 0x9, 0x401, 0x82baa23, 0xd, 0x0, 0x6, 0x21a, 0xe, 0x1, 0x1430, 0x8, 0x4, 0x7, 0xe, 0x7dab, 0x4, 0x5, 0x4, 0x3, 0xfffffffe, 0x7, 0x6, 0x8ef6, 0x7239, 0x80000001, 0x0, 0xd41, 0x6, 0x2, 0x4, 0x200, 0x8, 0x5, 0xc14, 0x7324, 0x4, 0x50f6, 0x5, 0x4, 0x3, 0x2, 0x7, 0x4, 0x6, 0x5, 0x3, 0x7767, 0x8, 0xe0ba, 0x4f, 0x3, 0x4, 0x7, 0x7fffffff, 0x3, 0x3, 0x5, 0x8, 0x4, 0x80, 0x401, 0x7, 0x1, 0x0, 0x8, 0x7c4, 0x3, 0x6, 0x6, 0xe8, 0x0, 0x6, 0x6, 0x3, 0x8a4, 0x1, 0x9, 0x9, 0x9, 0x200, 0x7, 0xd235, 0x9, 0x7fffffff, 0xf7d, 0x8001, 0x2, 0x7fff, 0x9f7c, 0x7, 0x4, 0xf, 0x1, 0x2, 0x6, 0x400, 0x5, 0x80, 0x400, 0x5, 0xc, 0xff, 0xffff7002, 0x63c, 0x9, 0x1ff, 0xfff, 0x8, 0x8c, 0x40, 0x8, 0xed6, 0xf6, 0x0, 0x3, 0x9, 0x10, 0x9, 0x6]}, @TCA_POLICE_RATE={0x404, 0x2, [0x8, 0x6, 0x8, 0x8000, 0x8, 0x2, 0x9, 0x5, 0xfff, 0x3, 0x101, 0xbf7, 0x8, 0xff, 0x6, 0x113, 0xffff, 0x1, 0x8, 0x7fffffff, 0x6, 0x9, 0x33, 0x5, 0x2f7, 0x100, 0x21, 0x4, 0x7, 0xff, 0x6, 0xfffffffe, 0x7, 0x8, 0x1, 0x8, 0xf33c, 0x3, 0x1, 0x80000000, 0x62e, 0x3, 0xdb2, 0x0, 0xe00, 0x4, 0x2, 0x3, 0x2, 0xfffffff6, 0x5, 0x3, 0x7, 0x8, 0x1, 0x7f, 0x8, 0x6, 0x4, 0x3, 0x0, 0x803, 0x1, 0x5, 0x0, 0x8000, 0xfffffffa, 0xb7, 0xc8b6f5a2, 0x6, 0x2f, 0x7ff, 0x9, 0x8, 0x6, 0x0, 0x8, 0x9, 0x0, 0x5, 0x8b34, 0x2, 0x7e, 0x4, 0x4, 0xfeffffff, 0x1, 0xa, 0xfffffffb, 0x3, 0xffffffff, 0x0, 0x4, 0xd6, 0x7, 0x4, 0x3, 0x8, 0x9, 0x8, 0x2de0, 0x5191, 0x6, 0x401, 0x7, 0x9, 0x7, 0x3, 0x6, 0x1, 0xfffffffb, 0xb839, 0xfffffffa, 0x4, 0x768, 0x7, 0x7f, 0x6, 0x7, 0x4, 0x8b, 0x4, 0x0, 0x5, 0xf0, 0x42490, 0xd, 0x3, 0x5c, 0x80, 0x2, 0x800, 0x8, 0x6, 0xff, 0xffff0000, 0x3, 0x10000, 0x80000001, 0x5, 0xffffffff, 0x4be24694, 0x2, 0x2, 0x100, 0x5, 0x1, 0x5, 0x4, 0xffffff95, 0x5, 0x0, 0xc, 0x6, 0x1000, 0xa, 0x7, 0x4, 0x340, 0x0, 0x0, 0x7, 0x101, 0x2, 0x7ce2352, 0x7fffffff, 0x5e, 0x8e5b, 0x3, 0x8, 0x9, 0x1, 0x80000000, 0x7, 0x301, 0x91, 0x3, 0x80000001, 0x9, 0x1, 0x3e79, 0xffffffff, 0x8, 0x525, 0x7, 0x6, 0x2470a614, 0xe, 0x8, 0x5, 0x7, 0x0, 0x5, 0x4, 0x1, 0x1, 0xfffffc1f, 0x6, 0x2, 0x1, 0x9, 0x7fff, 0xffffffff, 0x4, 0xffff2b7d, 0x4, 0xcdff, 0x9, 0x0, 0x49, 0x6, 0x0, 0x5, 0x9, 0x7, 0x8, 0x7, 0xea, 0x7, 0x7, 0x2, 0x5, 0xff, 0x6, 0xffff, 0x4cd, 0x7, 0x3, 0x3, 0x10001, 0x0, 0x6, 0x7, 0xffffffff, 0xe000000, 0x1, 0x4, 0x7, 0x8, 0xb, 0x7, 0x0, 0xcb65, 0x6, 0xe, 0x240000, 0x9, 0x8, 0x8, 0xfffffff8, 0x9, 0xf, 0x8, 0x5, 0x9, 0x100]}]}, @TCA_BPF_OPS={{0x6}, {0x4}}]}}, @TCA_RATE={0x6, 0x5, {0x2, 0x10}}]}, 0x894}, 0x1, 0x0, 0x0, 0xc004884}, 0x0) write$tun(r1, &(0x7f0000000040)={@val={0x0, 0x18}, @val={0x3, 0x1, 0x3, 0x4, 0xc4, 0x10}, @ipv4=@tcp={{0x5, 0x4, 0x3, 0x4, 0xd8, 0x65, 0x0, 0x8, 0x6, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast}, {{0x4e20, 0x4e22, 0x41424344, 0x41424344, 0x1, 0x0, 0x1c, 0x80, 0x7, 0x0, 0x9, {[@mptcp=@remove_addr={0x1e, 0x59, 0x6, 0x0, "3bcc55e2fb4b662a463b24b28a4fafb428a89d60f9547d33690c48bf9581455479f14cea31faf5212327c508ed14d3cc9f1b20adaecc3b4c664e61295f92adc7b03928e6f24a8ee8e299effe97537d57096d808d21b4"}]}}, {"13d3b3875dfd9a3f6328f33f09ceec09986b30406704e2560f04592cb4869c77658fcb3eca004c77b183c5840dbb0fd30bcd067737d3f07dff1755aac0e628d921d141b089c15306c066b177aab800b11b45b57a"}}}}, 0xe6) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10) connect$inet(0xffffffffffffffff, &(0x7f00000009c0)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x21}}, 0x10) writev(0xffffffffffffffff, &(0x7f0000000200)=[{&(0x7f00000000c0)='X', 0x8030000}], 0x1) r12 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xc20a, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x1, 0x21, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x800, 0x5, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x20, 0x8, 0x2}}, [{{0x9, 0x5, 0x2, 0x3, 0x8, 0x56, 0x8, 0x40}}]}}}]}}]}}, 0x0) syz_usb_control_io(r12, 0x0, 0x0) 1.680144738s ago: executing program 6 (id=3132): sendmsg$inet(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f00000002c0)=':', 0x1}], 0x1, 0x0, 0x1e8}, 0x1) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a3c000000120a09000000000000000000020000000900020073797a310000000008000440000000000900010073797a3000000000080003400000000114000000110001"], 0x64}}, 0x0) sendmsg$NFT_MSG_GETOBJ(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)={0x20, 0x15, 0xa, 0x201, 0x0, 0x0, {}, [@NFTA_OBJ_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x800}, 0x4040808) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) ioctl$SIOCSIFHWADDR(r1, 0x8949, &(0x7f00000002c0)={'veth0\x00', @random="bc1a091f2845"}) 1.372344562s ago: executing program 7 (id=3133): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'cbcmac(camellia-generic)\x00'}, 0x58) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16, @ANYBLOB="01002cbd7000040000000500b600080009000200000008000c00a60a000006"], 0x40}, 0x1, 0x0, 0x0, 0xc100}, 0x4040) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000001880)=ANY=[@ANYBLOB="b700000081000000bfa30000000000000703000002feffff720af0fff8ffffff71a4f0ff0000000071180000000000001d400500000000004704000001ed00000f030000000000001f44000000000000620a00fe040026ca7203000000000000b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fe51bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51bf900000000000000d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba3a9508f9d6aba582a896a9f1e096df6ecea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350844ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00e10000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d490cba8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e16e1461173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b583cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd84990453f006694d461b76a58d88cf0f520310a1e80dc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6032399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c00000000000000f59dd19e8d525206c0a728cfd42193abe8130bc01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ed1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef67cf0216e2d81e6127bd9d7fab28800eaab2355992f8ce4cd38add4b272c0bee4076ca4847ffa691cf78fb7ec212bad3bef29f577ea7159b7f3025b3d977ff7c91024cf71126233cb8791c3c"], &(0x7f00000001c0)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffd00, 0x0, 0xffffffffffffffff, 0xffffffffffffffb9}, 0x48) syz_usb_control_io$hid(r1, &(0x7f0000000280)={0x24, 0x0, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="00222200000096231aeefcfb818d850dd9988a07f7940ef7000c00000016b8ef0ae9ce83"], 0x0}, 0x0) ioctl$HIDIOCGCOLLECTIONINDEX(0xffffffffffffffff, 0x40184810, &(0x7f0000000440)={0x2, 0x2, 0x8, 0x4, 0xff, 0x5}) r2 = socket$qrtr(0x2a, 0x2, 0x0) recvmsg$qrtr(r2, &(0x7f0000000300)={&(0x7f0000000080), 0xc, &(0x7f00000002c0)=[{&(0x7f00000000c0)=""/47, 0x2f}, {&(0x7f0000000100)=""/131, 0x83}, {&(0x7f0000000540)=""/4096, 0x1000}, {&(0x7f0000001540)=""/4096, 0x1000}, {&(0x7f00000001c0)=""/76, 0x4c}, {&(0x7f0000000240)=""/77, 0x4d}], 0x6, &(0x7f0000002540)=[{0xf8, 0x0, 0x0, ""/236}, {0x8c, 0x0, 0x0, ""/126}, {0xa0, 0x0, 0x0, ""/147}, {0x1c, 0x0, 0x0, ""/15}, {0xd0, 0x0, 0x0, ""/195}, {0x18, 0x0, 0x0, ""/10}, {0xdc, 0x0, 0x0, ""/207}, {0x60, 0x0, 0x0, ""/81}, {0x78, 0x0, 0x0, ""/105}], 0x4dc, 0x40010040}, 0x1c, 0x12000) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000500)="f84c05853a0878f3b5e3f3f2dbf21eb5eb529ae00eac9900", 0x18) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2, 0x20010, r2, 0x45db8000) r3 = socket$l2tp6(0xa, 0x2, 0x73) connect$inet6(r3, &(0x7f0000000340)={0xa, 0x4e22, 0x8000, @dev={0xfe, 0x80, '\x00', 0xc}, 0x8}, 0x1c) syz_emit_ethernet(0x56, &(0x7f0000000380)=ANY=[@ANYBLOB="aaaaaaaaaa3263ea0971f5e1000d010000a011020000985709ea19b4bef7f168f436c9900f5d2d03ed0105a33ae4a679df75bcffa4b8afa066815c3dcb07efd45549d7ab8d577fcd2a6604de2b622319e822"], &(0x7f0000000400)={0x1, 0x2, [0x945, 0xf59, 0xce2, 0x8da]}) 1.233965662s ago: executing program 6 (id=3134): socket$nl_route(0x10, 0x3, 0x0) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/wakeup_count', 0x101a02, 0x0) r1 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r4, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r5 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r5, 0x10e, 0x4, &(0x7f0000000140)=0x6, 0x4) setsockopt$sock_int(r5, 0x1, 0x8, &(0x7f0000000200), 0x4) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="980000000001010400000000000000000a0000003c0001802c00018014000300fe8000000000000000000000000000aa14000400ff0100000000000000000000000000010c00028005000100000000003c0002802c00018014000300fe8000000000000000000000000000aa14000400fe8800000000000000000000000000010c0002800500010000000000080007"], 0x98}}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000001c0)=ANY=[], 0x98}, 0x1, 0x0, 0x0, 0x20040800}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r7, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000001800)=[{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000100)="e92c3e5b5fea72d36d0f1ce0c1e16a89594759fe6816116aea0f6829fb0e01d753fdfda29b9fe80d5489652869b6b3eeef2e97fe4757", 0x36}, {&(0x7f0000000180)="aed9403172519ce89a419fce54b6039f63c98c", 0x13}, {&(0x7f00000002c0)="cad2985019f4e01a8f2249dfe45549d98fcd6a3a35f684075f51d7aaccbef8ac16ca395bf2bd16c28eb1461b3e1805515fb57ab53cd8474d379cd3449625c6a5e4e5ef158235d43abbaf354d3e9b6faa62ab7a4a4c06d2e27df772b9719fade7a0cc5e33b9144ee2200d99f4b9060c3d83ac8c0f924df255448d33cfd5e0514fbbea2e0f344bf523cc4ccec5f559768a98de1eef0af76e511ffc9b561f0a0fb1707a2e27f80201d011dd9d6532925b34", 0xb0}, {&(0x7f00000001c0)}, {&(0x7f00000007c0)="6a8262904c848c17c9a4e56f47186fafa59a67f43da0b494903acf72acd56d2253ceee243ade0c0d8ccb80ab242b4cb658af8818b1619a8207960781263eb7efe80e5ef34f96fd985e518b810f1bc9c4e452375a9eaafbd8e88a39372b87b4572ead2e5298794ef3f052bdfb0fb885230aeb07823b72ff44b58975721135c125caf35e7eeee1251390b326967180e1de65ed442a97ed2a513885e4a1c4414a4622bdd87f86900638ed5097a2b42855c3e80694bb8059dd8b1d0ae94f00447cc466410eeadd0a54569d7ec1d193e34beffa5a6a861b5600652a29c5b087fa1967e78c8b4a761303d33b75f2367ac19762631a877f5cfa9cca341d5577b6290de322620f5a5a676638c97b7c6d0b10dcb9209edf15273d150ec6e89814c218997dbcb687d06027cdf3eff025414619e5890215b059ae9425660bf4e291160e3ab4df54bd89ef055f9724a335ef8f7ac81c1751c412e23ec59596a6a800450f20429e8f604f0568b6b4700b799ada6aa0e6963f2ec3b18f42a58c1dd432e6323ce66f95c4f334d7c0c12e74bfe86b4025faecf6070d572f1297652d9bc1d7114e3695698ca7f324e3bd0202577cf2dd362b60b2df225e6ae54f127c1e02ddea1fd9ca48586b654c17d63833d523abf3029386f5f254061c235aa7fc333b87cfbc923c32f73dcbb27bc70a0f0eb5c60a2feea1a33bc198b5ae727e9d216c81c6c76a44e111fa38ce9a49b2d5eab4aa703e5bc5436fa94e146d72754d27097d9d5ecf0e652b12e5fc1d675e81d3c724f7638fa1880255955681437d88cf4431511154da22124bafce9e35187c6f10b90e113c85f1325bef2197baccc66a35251b92329f79e211966e568f397c16f018b5bfc5dc05849ef0bafc47ef3f7d266f478df3b5856369a1be9cce710dc9f85d32e89595f7ad7654ce59c75735f6e52722300e084ae956a354c771e8f0aeabdca1d63289ccc42b52effdcc483b3a8303a63465d88f04789cad5ed5a2cf782eba630d29c5d2ca93de6491cd60ada6e7596c18cc86e573e1352b2fb40dcd92a5bc69ad2280815c8e2bf503b44defb0d2f6105051", 0x300}, {0x0}, {&(0x7f0000000480)="83d763683f984bc11e2488e619ecec7e77667e5032d2412f70cb9cba1a19cf906fed30192629187789f9e15ffd100c9f93e01f614ce40f365be740e3b999a3a6f3db24561582956cc55786315d9a34678472eda3433780f09d8257e2b6c8c8eee3a9", 0x62}], 0x7, &(0x7f0000000500)=[@op={0x10, 0x117, 0x3, 0x1}, @iv={0x110, 0x117, 0x2, 0xff, "d17613b8dc104c2144f2fafb4716f50e3f025a4072d891a4fe04e11884ecb59a160bdd3b3efa9705bec9c72e699ee3fca4dedacd549999e9fa3e829913a00f8a588613c04f8b9352b4e2e773a36f710a6534904571307246e4c5c28913b50d0a6eb1076f615962ef451d9cbce39c6716cfa3e6dd15ea3b2fc51ca378879d924d096783778d467a6943ac870de085b0a16d31d3a1783c61624129ae7d804f60e0d9b24713a9c9927bbd48ec726731d9936c800cf7d88596653d26d6f81031cbd5dfe3f7b2ba1d5501769232f2f97a06f26e423c1ae347bf076a1bb01128092fcf855e2144ae9e9c59656ef68ec60dc51679ab01a6e68f7430a3562514a4b1d1"}], 0x120, 0x4000}, {0x0, 0x0, &(0x7f00000017c0)=[{&(0x7f0000000640)="e5e7b8211e99c98bab5661", 0xb}, {&(0x7f0000000680)="6d0b929817424057ba781098154ccd800898cbf8ea61117d38013ca51b15fcbfb29a234f399facf4041b2f0ff97e5f4c3c9f2def360dd953300ed7a20f6d233710475f5065baffa54256744798c32e95fc5f00cc9d6b053b80d8a9068d70eaf187264bbdb36e518926c81817b1cc9c453c", 0x71}], 0x2, 0x0, 0x0, 0x80}], 0x2, 0x4000) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newqdisc={0x60, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r8, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0xea, 0x2, 0x0, 0x0, 0x9, 0x5}, {0x12, 0x2, 0x0, 0x401, 0x8001, 0x1400}, 0xa5, 0x5, 0x10000000}}, @TCA_TBF_BURST={0x8, 0x6, 0x8057}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x40000}, 0x44080) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000440)=@newqdisc={0x40, 0x24, 0xd0f, 0x70bd29, 0x0, {0x60, 0x0, 0x0, r8, {0x0, 0x6}, {0xffe0, 0xa}, {0x1, 0x10}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x14, 0x2, [@TCA_FQ_TIMER_SLACK={0x8, 0xd, 0x3ff}, @TCA_FQ_RATE_ENABLE={0x8}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x55}, 0x4000) timer_delete(0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) sendfile(r0, r0, 0x0, 0x101) 35.809804ms ago: executing program 4 (id=3135): r0 = syz_open_dev$usbmon(&(0x7f0000000000), 0x4, 0x800) ioctl$MON_IOCX_GET(r0, 0x400c9206, &(0x7f0000000200)={&(0x7f0000000080), &(0x7f0000000100)=""/249, 0xfffffffffffffeb5}) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000500), 0xc2a01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r3, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) set_mempolicy(0x2002, &(0x7f0000000000)=0x9, 0x9) r4 = openat$hwrng(0xffffff9c, &(0x7f0000000340), 0x111000, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r4, 0xc00864bf, &(0x7f0000000380)) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='numa_maps\x00') read$FUSE(r4, &(0x7f00000013c0)={0x2020}, 0x2020) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) syz_usb_connect$uac1(0x0, 0xac, 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000680), r5) sendmsg$L2TP_CMD_TUNNEL_CREATE(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000640)={0x0, 0x44}}, 0x4000) r6 = syz_open_dev$video(0x0, 0x7, 0x28000) ioctl$FS_IOC_SETFSLABEL(r6, 0x41009432, &(0x7f0000000200)="fbefc3ad5b8e7f1d398f24216fd3a3f9e56f40952caec1876a0d87ba07790e53373554809c5915993e2df01420cce89217e7cdfd9a34e6251e93cf3d8e24be566093ba69d066f93fad369948d09b4ad010ef106943c81d6895227895c6ca04db1827c486d2aa39e658fc96ebd8d2868832e4c48c2e19fb1e6b5750e52632fcec444e1e527bc843783bc6eb871635bf046d7ee5c281cd2231fa8d8ccd84119d680902af2e7802dc775236ebf133c995e3e61aff050c429b263f9457072efca8ddb54e3e88c563e526e1c651f654e0083d27a341f87eaa6c83f6a09b3837e5e1b92c6524cd12c682c2a5f96c183aaf08de325375a947577afcf742c9ff248e45cc") preadv(r6, &(0x7f0000001200)=[{&(0x7f0000000c00)=""/113, 0x71}], 0x1, 0x4, 0xb) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f0000000300)=0x2) io_setup(0x6, &(0x7f0000001380)) 0s ago: executing program 8 (id=3136): timer_create(0x3, 0x0, &(0x7f0000000300)=0x0) timer_create(0xfffffffd, 0x0, &(0x7f0000000040)=0x0) timer_settime(r1, 0x0, &(0x7f0000000080)={{}, {0x77359400}}, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000480), 0x77, 0x141341) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, 0x0, &(0x7f0000000040)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$USBDEVFS_CONTROL(r2, 0xc0185500, &(0x7f00000000c0)={0x80, 0x6, 0x2fe, 0xe5, 0xe0, 0xfe, 0x0}) unshare(0x40000000) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r3) ptrace$setsig(0x4203, r3, 0x0, &(0x7f00000003c0)={0x8, 0xaf1, 0x9}) prctl$PR_SCHED_CORE(0x3e, 0x2, r3, 0x1, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r4) unshare(0x10040a80) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001040)={&(0x7f00000000c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r5, @ANYRES32=r6, @ANYBLOB="0400130006001200000000000600b500850100000a000600080211000001000014008100050001"], 0x50}}, 0x4000004) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNSETCARRIER(r7, 0x400454e2, &(0x7f0000000040)=0x1) timer_settime(r0, 0x0, &(0x7f0000000000)={{0x77359400}, {0x0, 0x989680}}, 0x0) kernel console output (not intermixed with test programs): ep0 maxpacket: 32 [ 1008.415852][ T5938] usb 5-1: config 0 has an invalid interface number: 247 but max is 0 [ 1008.426974][ T5938] usb 5-1: config 0 has no interface number 0 [ 1008.457477][ T5938] usb 5-1: New USB device found, idVendor=1d50, idProduct=60c6, bcdDevice=62.9b [ 1008.485245][ T5938] usb 5-1: New USB device strings: Mfr=1, Product=3, SerialNumber=0 [ 1008.703627][ T5938] usb 5-1: Product: syz [ 1008.726226][ T5938] usb 5-1: Manufacturer: syz [ 1008.789641][ T5938] usb 5-1: config 0 descriptor?? [ 1008.829266][ T5909] usb 1-1: new high-speed USB device number 109 using dummy_hcd [ 1008.998676][ T5909] usb 1-1: Using ep0 maxpacket: 32 [ 1009.008533][ T5909] usb 1-1: config 0 has an invalid interface number: 126 but max is 0 [ 1009.017520][ T5909] usb 1-1: config 0 has no interface number 0 [ 1009.023860][ T5909] usb 1-1: config 0 interface 126 altsetting 16 bulk endpoint 0x6 has invalid maxpacket 1023 [ 1009.040624][T16680] QAT: Stopping all acceleration devices. [ 1009.079237][ T5909] usb 1-1: config 0 interface 126 altsetting 16 bulk endpoint 0x82 has invalid maxpacket 8 [ 1009.119645][ T5909] usb 1-1: config 0 interface 126 has no altsetting 0 [ 1009.156048][ T5909] usb 1-1: New USB device found, idVendor=09c4, idProduct=0011, bcdDevice=b0.1c [ 1009.166480][ T5909] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1009.176764][ T5909] usb 1-1: Product: syz [ 1009.203070][ T5909] usb 1-1: Manufacturer: syz [ 1009.236298][ T5909] usb 1-1: SerialNumber: syz [ 1009.280380][ T5909] usb 1-1: config 0 descriptor?? [ 1009.293453][T16691] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 1009.303632][T16691] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 1009.571152][T16689] netlink: 'syz.0.2653': attribute type 5 has an invalid length. [ 1009.772775][T16702] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2657'. [ 1009.784614][T16702] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2657'. [ 1009.863669][T16702] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2657'. [ 1009.932364][T16702] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2657'. [ 1009.941927][T16702] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2657'. [ 1009.953498][T16702] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2657'. [ 1009.966170][T16702] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 1010.114688][ T5938] usb 5-1: USB disconnect, device number 78 [ 1011.033261][T16714] input: syz1 as /devices/virtual/input/input154 [ 1011.292046][T16716] binder: 16704:16716 ioctl c0306201 80000540 returned -22 [ 1012.402597][ T5909] ir_usb 1-1:0.126: IR Dongle converter detected [ 1012.422469][ T5909] usb 1-1: IRDA class descriptor not found, device not bound [ 1012.501204][ T5909] usb 1-1: USB disconnect, device number 109 [ 1013.529022][T16729] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2662'. [ 1013.538971][T16729] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2662'. [ 1013.549330][T16729] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2662'. [ 1013.592873][T16729] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2662'. [ 1013.618846][T16729] sch_tbf: burst 19872 is lower than device lo mtu (39799) ! [ 1014.201362][T16741] can: request_module (can-proto-4) failed. [ 1014.693188][ T5909] usb 2-1: new high-speed USB device number 82 using dummy_hcd [ 1014.918641][ T5909] usb 2-1: Using ep0 maxpacket: 32 [ 1014.954286][ T5909] usb 2-1: config 0 has an invalid interface number: 247 but max is 0 [ 1014.962662][ T5909] usb 2-1: config 0 has no interface number 0 [ 1014.973517][ T5909] usb 2-1: New USB device found, idVendor=1d50, idProduct=60c6, bcdDevice=62.9b [ 1015.048062][T16753] FAULT_INJECTION: forcing a failure. [ 1015.048062][T16753] name failslab, interval 1, probability 0, space 0, times 0 [ 1015.061848][ T5909] usb 2-1: New USB device strings: Mfr=1, Product=3, SerialNumber=0 [ 1015.070019][ T5909] usb 2-1: Product: syz [ 1015.199161][T16753] CPU: 1 UID: 0 PID: 16753 Comm: syz.2.2670 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) [ 1015.199191][T16753] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1015.199205][T16753] Call Trace: [ 1015.199214][T16753] [ 1015.199224][T16753] dump_stack_lvl+0x189/0x250 [ 1015.199255][T16753] ? __pfx____ratelimit+0x10/0x10 [ 1015.199279][T16753] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1015.199305][T16753] ? __pfx__printk+0x10/0x10 [ 1015.199339][T16753] ? __pfx___might_resched+0x10/0x10 [ 1015.199364][T16753] ? fs_reclaim_acquire+0x7d/0x100 [ 1015.199390][T16753] should_fail_ex+0x414/0x560 [ 1015.199418][T16753] should_failslab+0xa8/0x100 [ 1015.199460][T16753] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 1015.199491][T16753] ? __alloc_skb+0x112/0x2d0 [ 1015.199526][T16753] __alloc_skb+0x112/0x2d0 [ 1015.199559][T16753] netlink_ack+0x146/0xa50 [ 1015.199587][T16753] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1015.199608][T16753] ? ref_tracker_free+0x63a/0x7d0 [ 1015.199631][T16753] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 1015.199652][T16753] ? __pfx_nl80211_post_doit+0x10/0x10 [ 1015.199674][T16753] ? __pfx_ref_tracker_free+0x10/0x10 [ 1015.199709][T16753] netlink_rcv_skb+0x28c/0x470 [ 1015.199740][T16753] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1015.199765][T16753] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1015.199813][T16753] ? down_read+0x1ad/0x2e0 [ 1015.199842][T16753] genl_rcv+0x28/0x40 [ 1015.199862][T16753] netlink_unicast+0x75c/0x8e0 [ 1015.199901][T16753] netlink_sendmsg+0x805/0xb30 [ 1015.199942][T16753] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1015.199976][T16753] ? __import_iovec+0x5d4/0x7f0 [ 1015.200003][T16753] ? aa_sock_msg_perm+0x94/0x160 [ 1015.200028][T16753] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1015.200055][T16753] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1015.200087][T16753] __sock_sendmsg+0x21c/0x270 [ 1015.200116][T16753] ____sys_sendmsg+0x505/0x830 [ 1015.200144][T16753] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1015.200183][T16753] ___sys_sendmsg+0x21f/0x2a0 [ 1015.200206][T16753] ? __pfx____sys_sendmsg+0x10/0x10 [ 1015.200266][T16753] ? __fget_files+0x2a/0x420 [ 1015.200284][T16753] ? __fget_files+0x3a0/0x420 [ 1015.200315][T16753] __sys_sendmsg+0x164/0x220 [ 1015.200334][T16753] ? __pfx___sys_sendmsg+0x10/0x10 [ 1015.200369][T16753] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 1015.200394][T16753] ? lockdep_hardirqs_on+0x9c/0x150 [ 1015.200419][T16753] __do_fast_syscall_32+0xb6/0x2b0 [ 1015.200451][T16753] ? lockdep_hardirqs_on+0x9c/0x150 [ 1015.200479][T16753] do_fast_syscall_32+0x34/0x80 [ 1015.200503][T16753] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1015.200529][T16753] RIP: 0023:0xf70fe539 [ 1015.200548][T16753] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1015.200566][T16753] RSP: 002b:00000000f50ee55c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 1015.200589][T16753] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800006c0 [ 1015.200603][T16753] RDX: 0000000000000080 RSI: 0000000000000000 RDI: 0000000000000000 [ 1015.200616][T16753] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1015.200628][T16753] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1015.200639][T16753] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1015.200665][T16753] [ 1015.625957][ T5909] usb 2-1: Manufacturer: syz [ 1015.646141][ T5909] usb 2-1: config 0 descriptor?? [ 1015.916231][T16750] QAT: Stopping all acceleration devices. [ 1015.944361][ T5909] usb 2-1: USB disconnect, device number 82 [ 1016.149383][T16761] tipc: New replicast peer: 0.0.0.0 [ 1016.155324][T16761] tipc: Enabled bearer , priority 10 [ 1016.341577][T16763] __nla_validate_parse: 2 callbacks suppressed [ 1016.341594][T16763] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2672'. [ 1016.365715][T16763] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2672'. [ 1016.384240][T16763] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2672'. [ 1016.398871][T16763] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2672'. [ 1016.425603][T16763] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 1016.747030][T16765] netlink: 64 bytes leftover after parsing attributes in process `syz.1.2673'. [ 1016.816325][T16766] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2673'. [ 1016.967716][T16765] tipc: Enabling of bearer rejected, already enabled [ 1017.001942][T16766] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2673'. [ 1018.174980][T16776] input: syz1 as /devices/virtual/input/input155 [ 1019.368569][ T5909] usb 5-1: new high-speed USB device number 79 using dummy_hcd [ 1019.567228][ T5909] usb 5-1: config 0 has no interfaces? [ 1019.585233][ T5909] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1019.654473][ T5909] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1019.733177][ T5909] usb 5-1: Product: syz [ 1019.748895][ T5909] usb 5-1: Manufacturer: syz [ 1019.762596][ T5909] usb 5-1: SerialNumber: syz [ 1019.814833][ T5909] usb 5-1: config 0 descriptor?? [ 1020.068485][ T5924] usb 4-1: new high-speed USB device number 89 using dummy_hcd [ 1020.169303][T16793] sg_write: data in/out 3666/98 bytes for SCSI command 0x1-- guessing data in; [ 1020.169303][T16793] program syz.4.2682 not setting count and/or reply_len properly [ 1020.253576][T16793] xt_NFQUEUE: number of queues (65532) out of range (got 66665) [ 1020.275627][ T5924] usb 4-1: Using ep0 maxpacket: 32 [ 1020.306943][ T5924] usb 4-1: config 0 has an invalid interface number: 247 but max is 0 [ 1020.353412][ T5924] usb 4-1: config 0 has no interface number 0 [ 1020.373282][ T5924] usb 4-1: New USB device found, idVendor=1d50, idProduct=60c6, bcdDevice=62.9b [ 1020.389966][ T5924] usb 4-1: New USB device strings: Mfr=1, Product=3, SerialNumber=0 [ 1020.406568][ T5924] usb 4-1: Product: syz [ 1021.287252][ T5924] usb 4-1: Manufacturer: syz [ 1021.387133][ T5924] usb 4-1: config 0 descriptor?? [ 1021.446281][T16811] can: request_module (can-proto-4) failed. [ 1021.687592][T16802] QAT: Stopping all acceleration devices. [ 1022.872068][T16823] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2687'. [ 1022.889390][T16823] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2687'. [ 1022.932649][ T5924] usb 5-1: USB disconnect, device number 79 [ 1022.960710][T16823] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2687'. [ 1023.127682][ T1168] usb 4-1: USB disconnect, device number 89 [ 1023.242627][T16825] tipc: Enabling of bearer rejected, already enabled [ 1023.829845][T16840] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2690'. [ 1023.839084][T16840] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2690'. [ 1023.850686][ T1168] usb 3-1: new high-speed USB device number 78 using dummy_hcd [ 1024.012984][T16840] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2690'. [ 1024.023880][T16840] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2690'. [ 1024.081301][ T1168] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1024.093331][ T1168] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1024.115501][ T1168] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1024.221514][ T1168] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1024.250138][ T1168] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1024.332674][ T1168] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1024.348663][ T1168] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1024.411956][T16849] input: syz1 as /devices/virtual/input/input158 [ 1024.430227][ T1168] usb 3-1: Product: syz [ 1024.440268][ T1168] usb 3-1: Manufacturer: syz [ 1024.710866][ T1168] cdc_wdm 3-1:1.0: skipping garbage [ 1024.716164][ T1168] cdc_wdm 3-1:1.0: skipping garbage [ 1024.800194][ T1168] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 1024.806751][ T1168] cdc_wdm 3-1:1.0: Unknown control protocol [ 1025.066885][ T5938] usb 3-1: USB disconnect, device number 78 [ 1026.028581][ T5924] usb 2-1: new high-speed USB device number 83 using dummy_hcd [ 1026.178540][ T5924] usb 2-1: Using ep0 maxpacket: 8 [ 1026.188702][ T5924] usb 2-1: config 135 has an invalid interface number: 230 but max is 0 [ 1026.197223][ T5924] usb 2-1: config 135 has an invalid descriptor of length 0, skipping remainder of the config [ 1026.288710][ T1168] usb 3-1: new high-speed USB device number 79 using dummy_hcd [ 1026.318965][ T5924] usb 2-1: config 135 has no interface number 0 [ 1026.341359][ T5924] usb 2-1: too many endpoints for config 135 interface 230 altsetting 126: 53, using maximum allowed: 30 [ 1026.390146][ T5924] usb 2-1: config 135 interface 230 altsetting 126 has 0 endpoint descriptors, different from the interface descriptor's value: 53 [ 1026.404166][ T5924] usb 2-1: config 135 interface 230 has no altsetting 0 [ 1026.415694][ T5924] usb 2-1: New USB device found, idVendor=18ec, idProduct=3288, bcdDevice=3f.3a [ 1026.430928][ T5924] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1026.439516][ T5924] usb 2-1: Product: syz [ 1026.445135][ T5924] usb 2-1: Manufacturer: syz [ 1026.460884][ T5924] usb 2-1: SerialNumber: syz [ 1026.468590][ T1168] usb 3-1: Using ep0 maxpacket: 32 [ 1026.480785][ T1168] usb 3-1: config 0 has an invalid interface number: 126 but max is 0 [ 1026.490470][ T1168] usb 3-1: config 0 has no interface number 0 [ 1026.506019][ T1168] usb 3-1: config 0 interface 126 altsetting 16 bulk endpoint 0x6 has invalid maxpacket 1023 [ 1026.531248][ T1168] usb 3-1: config 0 interface 126 altsetting 16 bulk endpoint 0x82 has invalid maxpacket 8 [ 1026.552717][ T5924] usb 2-1: Found UVC 0.00 device syz (18ec:3288) [ 1026.564067][ T5924] usb 2-1: No valid video chain found. [ 1026.573686][ T1168] usb 3-1: config 0 interface 126 has no altsetting 0 [ 1026.615539][ T1168] usb 3-1: New USB device found, idVendor=09c4, idProduct=0011, bcdDevice=b0.1c [ 1026.626968][ T1168] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1026.655474][ T1168] usb 3-1: Product: syz [ 1026.661469][ T1168] usb 3-1: Manufacturer: syz [ 1026.667145][ T1168] usb 3-1: SerialNumber: syz [ 1026.732933][ T1168] usb 3-1: config 0 descriptor?? [ 1026.754586][T16858] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1026.765756][T16858] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1026.776840][ T5924] usb 2-1: USB disconnect, device number 83 [ 1026.806172][T16866] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 1026.814707][T16866] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 1027.037431][T16864] netlink: 'syz.2.2698': attribute type 5 has an invalid length. [ 1027.038654][ T5909] usb 5-1: new high-speed USB device number 80 using dummy_hcd [ 1027.205607][T16873] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2700'. [ 1027.214939][ T5909] usb 5-1: Using ep0 maxpacket: 32 [ 1027.217315][ T5909] usb 5-1: config 0 has an invalid interface number: 247 but max is 0 [ 1027.231034][ T5909] usb 5-1: config 0 has no interface number 0 [ 1027.238514][T16873] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2700'. [ 1027.248625][T16873] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2700'. [ 1027.257239][ T5909] usb 5-1: New USB device found, idVendor=1d50, idProduct=60c6, bcdDevice=62.9b [ 1027.267934][ T5909] usb 5-1: New USB device strings: Mfr=1, Product=3, SerialNumber=0 [ 1027.282077][ T5909] usb 5-1: Product: syz [ 1027.286584][ T5909] usb 5-1: Manufacturer: syz [ 1027.315478][T16874] tipc: Enabling of bearer rejected, already enabled [ 1027.327991][ T5909] usb 5-1: config 0 descriptor?? [ 1027.557030][T16869] QAT: Stopping all acceleration devices. [ 1027.989748][T16885] can: request_module (can-proto-4) failed. [ 1028.222864][ T5938] usb 4-1: new high-speed USB device number 90 using dummy_hcd [ 1028.378594][ T5938] usb 4-1: Using ep0 maxpacket: 32 [ 1028.393794][ T5938] usb 4-1: config 0 has an invalid interface number: 126 but max is 0 [ 1028.402695][ T5938] usb 4-1: config 0 has no interface number 0 [ 1028.480569][ T5938] usb 4-1: config 0 interface 126 altsetting 16 bulk endpoint 0x6 has invalid maxpacket 1023 [ 1028.608829][ T5938] usb 4-1: config 0 interface 126 altsetting 16 bulk endpoint 0x82 has invalid maxpacket 8 [ 1028.635526][ T5924] usb 5-1: USB disconnect, device number 80 [ 1028.682742][ T5938] usb 4-1: config 0 interface 126 has no altsetting 0 [ 1028.777349][ T5938] usb 4-1: New USB device found, idVendor=09c4, idProduct=0011, bcdDevice=b0.1c [ 1028.786825][ T5938] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1028.809613][ T5938] usb 4-1: Product: syz [ 1028.828674][ T5938] usb 4-1: Manufacturer: syz [ 1028.868046][ T5938] usb 4-1: SerialNumber: syz [ 1028.915571][ T5938] usb 4-1: config 0 descriptor?? [ 1028.940266][T16888] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 1028.949798][T16888] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 1029.183204][T16883] netlink: 'syz.3.2701': attribute type 5 has an invalid length. [ 1030.214104][T16906] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2708'. [ 1030.224491][T16906] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2708'. [ 1030.237477][T16906] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2708'. [ 1030.247671][T16906] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2708'. [ 1030.480005][ T1168] ir_usb 3-1:0.126: IR Dongle converter detected [ 1030.513326][ T1168] usb 3-1: IRDA class descriptor not found, device not bound [ 1030.577666][ T1168] usb 3-1: USB disconnect, device number 79 [ 1031.770247][ T5938] ir_usb 4-1:0.126: IR Dongle converter detected [ 1031.777307][ T5938] usb 4-1: IRDA class descriptor not found, device not bound [ 1031.823078][ T5938] usb 4-1: USB disconnect, device number 90 [ 1031.850177][T16924] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2711'. [ 1031.952442][T16925] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2711'. [ 1032.002973][T16925] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2711'. [ 1032.049521][T16924] tipc: Enabling of bearer rejected, already enabled [ 1032.077481][T16927] input: syz1 as /devices/virtual/input/input159 [ 1033.008645][ T5924] usb 5-1: new high-speed USB device number 81 using dummy_hcd [ 1033.506374][ T5924] usb 5-1: Using ep0 maxpacket: 32 [ 1033.551886][ T5924] usb 5-1: config 0 has an invalid interface number: 126 but max is 0 [ 1033.560632][ T5924] usb 5-1: config 0 has no interface number 0 [ 1033.570391][ T5924] usb 5-1: config 0 interface 126 altsetting 16 bulk endpoint 0x6 has invalid maxpacket 1023 [ 1033.580927][ T5924] usb 5-1: config 0 interface 126 altsetting 16 bulk endpoint 0x82 has invalid maxpacket 8 [ 1033.984267][ T5924] usb 5-1: config 0 interface 126 has no altsetting 0 [ 1034.003394][ T5924] usb 5-1: New USB device found, idVendor=09c4, idProduct=0011, bcdDevice=b0.1c [ 1034.013179][ T5924] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1034.021716][ T5924] usb 5-1: Product: syz [ 1034.026054][ T5924] usb 5-1: Manufacturer: syz [ 1034.031643][ T5924] usb 5-1: SerialNumber: syz [ 1034.049696][ T5924] usb 5-1: config 0 descriptor?? [ 1034.059373][T16941] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 1034.066960][T16941] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 1034.208847][ T5909] usb 2-1: new high-speed USB device number 84 using dummy_hcd [ 1034.316042][T16937] netlink: 'syz.4.2713': attribute type 5 has an invalid length. [ 1034.478549][ T5909] usb 2-1: Using ep0 maxpacket: 32 [ 1034.487121][ T5909] usb 2-1: config 0 has an invalid interface number: 247 but max is 0 [ 1034.519087][ T1168] usb 3-1: new high-speed USB device number 80 using dummy_hcd [ 1034.543171][ T5909] usb 2-1: config 0 has no interface number 0 [ 1034.576763][T16959] can: request_module (can-proto-4) failed. [ 1034.624325][ T5909] usb 2-1: New USB device found, idVendor=1d50, idProduct=60c6, bcdDevice=62.9b [ 1034.688335][ T5909] usb 2-1: New USB device strings: Mfr=1, Product=3, SerialNumber=0 [ 1034.688583][ T1168] usb 3-1: Using ep0 maxpacket: 32 [ 1035.060144][ T5909] usb 2-1: Product: syz [ 1035.064435][ T5909] usb 2-1: Manufacturer: syz [ 1035.430035][ T5909] usb 2-1: config 0 descriptor?? [ 1035.465571][ T1168] usb 3-1: config 0 has an invalid interface number: 126 but max is 0 [ 1035.477666][ T1168] usb 3-1: config 0 has no interface number 0 [ 1035.496837][ T1168] usb 3-1: config 0 interface 126 altsetting 16 bulk endpoint 0x6 has invalid maxpacket 1023 [ 1035.524584][ T1168] usb 3-1: config 0 interface 126 altsetting 16 bulk endpoint 0x82 has invalid maxpacket 8 [ 1035.595946][ T1168] usb 3-1: config 0 interface 126 has no altsetting 0 [ 1035.635787][ T1168] usb 3-1: New USB device found, idVendor=09c4, idProduct=0011, bcdDevice=b0.1c [ 1035.673658][ T1168] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1035.686725][T16951] QAT: Stopping all acceleration devices. [ 1035.755403][ T1168] usb 3-1: Product: syz [ 1035.798521][ T1168] usb 3-1: Manufacturer: syz [ 1035.810365][ T1168] usb 3-1: SerialNumber: syz [ 1035.835923][ T1168] usb 3-1: config 0 descriptor?? [ 1035.855510][T16955] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 1035.864121][T16955] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 1036.121096][ T5924] ir_usb 5-1:0.126: IR Dongle converter detected [ 1036.135488][ T5924] usb 5-1: IRDA class descriptor not found, device not bound [ 1036.147733][T16954] netlink: 'syz.2.2719': attribute type 5 has an invalid length. [ 1036.208122][ T5924] usb 5-1: USB disconnect, device number 81 [ 1036.742349][T16977] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2724'. [ 1036.754173][T16977] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2724'. [ 1036.768797][T16977] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 1036.799822][T16979] input: syz1 as /devices/virtual/input/input160 [ 1036.822713][ T5938] usb 2-1: USB disconnect, device number 84 [ 1037.452182][ T1168] ir_usb 3-1:0.126: IR Dongle converter detected [ 1037.474780][ T1168] usb 3-1: IRDA class descriptor not found, device not bound [ 1037.571175][ T1168] usb 3-1: USB disconnect, device number 80 [ 1037.808514][ T5938] usb 2-1: new high-speed USB device number 85 using dummy_hcd [ 1037.980657][ T5938] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xD3, changing to 0x83 [ 1038.018906][ T5938] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid maxpacket 115, setting to 64 [ 1038.077407][ T5938] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 1038.104283][ T5938] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1038.183289][ T5938] usb 2-1: config 0 descriptor?? [ 1038.430517][T16990] : entered promiscuous mode [ 1038.543590][ T5938] ath6kl: Failed to submit usb control message: -71 [ 1038.555211][ T5938] ath6kl: unable to send the bmi data to the device: -71 [ 1038.593535][ T5938] ath6kl: Unable to send get target info: -71 [ 1038.632220][ T5938] ath6kl: Failed to init ath6kl core: -71 [ 1038.675978][ T5938] ath6kl_usb 2-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 1038.731338][ T5938] usb 2-1: USB disconnect, device number 85 [ 1040.049072][ T1218] usb 2-1: new high-speed USB device number 86 using dummy_hcd [ 1040.198783][ T1218] usb 2-1: Using ep0 maxpacket: 16 [ 1040.256475][ T1218] usb 2-1: config 5 has an invalid interface number: 93 but max is 2 [ 1040.266050][ T1218] usb 2-1: config 5 has an invalid interface number: 10 but max is 2 [ 1040.285617][ T1218] usb 2-1: config 5 has an invalid interface number: 137 but max is 2 [ 1040.300551][ T1218] usb 2-1: config 5 has no interface number 0 [ 1040.307288][ T1218] usb 2-1: config 5 has no interface number 1 [ 1040.321194][ T1218] usb 2-1: config 5 has no interface number 2 [ 1040.327657][ T1218] usb 2-1: config 5 interface 10 altsetting 6 endpoint 0xB has invalid maxpacket 512, setting to 64 [ 1040.340000][ T1218] usb 2-1: config 5 interface 10 altsetting 6 endpoint 0xE has invalid maxpacket 1024, setting to 64 [ 1040.351852][ T1218] usb 2-1: config 5 interface 137 altsetting 9 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1040.363578][ T1218] usb 2-1: config 5 interface 137 altsetting 9 has a duplicate endpoint with address 0xE, skipping [ 1040.376684][ T1218] usb 2-1: config 5 interface 137 altsetting 9 endpoint 0x1 has invalid maxpacket 1024, setting to 64 [ 1040.392014][ T1218] usb 2-1: config 5 interface 137 altsetting 9 has a duplicate endpoint with address 0x5, skipping [ 1040.467528][ T1218] usb 2-1: config 5 interface 137 altsetting 9 has a duplicate endpoint with address 0xE, skipping [ 1040.483961][ T1218] usb 2-1: config 5 interface 137 altsetting 9 has a duplicate endpoint with address 0x5, skipping [ 1040.496393][ T1218] usb 2-1: config 5 interface 137 altsetting 9 has a duplicate endpoint with address 0x3, skipping [ 1040.515489][ T1218] usb 2-1: config 5 interface 137 altsetting 9 has a duplicate endpoint with address 0x5, skipping [ 1040.535815][ T1218] usb 2-1: config 5 interface 93 has no altsetting 0 [ 1040.542916][ T1218] usb 2-1: config 5 interface 10 has no altsetting 0 [ 1040.581212][ T1218] usb 2-1: config 5 interface 137 has no altsetting 0 [ 1040.617063][ T1218] usb 2-1: New USB device found, idVendor=0fe9, idProduct=db00, bcdDevice= 6.ee [ 1040.626431][ T1218] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1040.637338][ T1218] usb 2-1: Product: 黿责黢쐽㼊⟣䟚巏㎣敔罏揁쫿Ꭓ蚤ꝳᲾ痙행彗迯㵊䭈匇눣ഘIJ人㔒쪹ꂢ寮帍瞵㥱ꀓ砯ᘐ켼쇤绅䩔薎ጼᰝ얻琤폦糵⫥❪귽壖ꤽ굄赼梜鑞ʗꂃ᣷송㢁剫な朘関꟭흭締拠ჸ欑毐ӟᏊ狧䧣ꕵ釁ꐪ㙀 [ 1040.756643][ T1218] usb 2-1: Manufacturer: ࠾ [ 1040.782763][ T1218] usb 2-1: SerialNumber: syz [ 1041.035580][ T1218] dvb-usb: found a 'DViCO FusionHDTV DVB-T USB (LGZ201)' in cold state, will try to load a firmware [ 1041.061980][ T1218] usb 2-1: Direct firmware load for dvb-usb-bluebird-01.fw failed with error -2 [ 1041.088695][ T1218] usb 2-1: Falling back to sysfs fallback for: dvb-usb-bluebird-01.fw [ 1041.358624][ T5938] usb 4-1: new high-speed USB device number 91 using dummy_hcd [ 1041.538984][ T5938] usb 4-1: Using ep0 maxpacket: 32 [ 1042.084604][ T5938] usb 4-1: config 0 has an invalid interface number: 247 but max is 0 [ 1042.088972][ T1168] usb 3-1: new high-speed USB device number 81 using dummy_hcd [ 1042.112408][ T5938] usb 4-1: config 0 has no interface number 0 [ 1042.125467][ T5938] usb 4-1: New USB device found, idVendor=1d50, idProduct=60c6, bcdDevice=62.9b [ 1042.158236][ T5938] usb 4-1: New USB device strings: Mfr=1, Product=3, SerialNumber=0 [ 1042.227648][ T5938] usb 4-1: Product: syz [ 1042.232758][ T5938] usb 4-1: Manufacturer: syz [ 1042.259075][ T5938] usb 4-1: config 0 descriptor?? [ 1042.308461][ T1168] usb 3-1: Using ep0 maxpacket: 32 [ 1042.317283][ T1168] usb 3-1: config 0 has an invalid interface number: 126 but max is 0 [ 1042.345451][ T1168] usb 3-1: config 0 has no interface number 0 [ 1042.393753][ T1168] usb 3-1: config 0 interface 126 altsetting 16 bulk endpoint 0x6 has invalid maxpacket 1023 [ 1042.430163][ T1168] usb 3-1: config 0 interface 126 altsetting 16 bulk endpoint 0x82 has invalid maxpacket 8 [ 1042.484723][ T1168] usb 3-1: config 0 interface 126 has no altsetting 0 [ 1042.544848][T17022] QAT: Stopping all acceleration devices. [ 1042.567754][ T1168] usb 3-1: New USB device found, idVendor=09c4, idProduct=0011, bcdDevice=b0.1c [ 1042.577638][ T1168] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1042.585932][ T1168] usb 3-1: Product: syz [ 1042.603647][ T1168] usb 3-1: Manufacturer: syz [ 1042.614479][ T1168] usb 3-1: SerialNumber: syz [ 1042.642914][ T1168] usb 3-1: config 0 descriptor?? [ 1042.659319][T17042] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 1042.668614][T17042] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 1042.904457][T17038] netlink: 'syz.2.2741': attribute type 5 has an invalid length. [ 1043.638014][ T5938] usb 4-1: USB disconnect, device number 91 [ 1044.698647][ T1168] ir_usb 3-1:0.126: IR Dongle converter detected [ 1044.708767][ T1168] usb 3-1: IRDA class descriptor not found, device not bound [ 1044.768738][ T1168] usb 3-1: USB disconnect, device number 81 [ 1046.088513][ T5938] usb 5-1: new high-speed USB device number 82 using dummy_hcd [ 1046.251009][ T5938] usb 5-1: config 0 has an invalid interface number: 117 but max is 0 [ 1046.262759][ T5938] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1046.280087][ T5938] usb 5-1: config 0 has no interface number 0 [ 1046.370067][ T5938] usb 5-1: config 0 interface 117 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 1046.390124][ T5938] usb 5-1: config 0 interface 117 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1046.435766][ T5938] usb 5-1: New USB device found, idVendor=0afa, idProduct=03e8, bcdDevice=99.d0 [ 1046.474986][ T5938] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1046.575221][ T5938] usb 5-1: Product: syz [ 1046.582689][ T5938] usb 5-1: Manufacturer: syz [ 1046.652462][ T5938] usb 5-1: SerialNumber: syz [ 1046.745073][ T5938] usb 5-1: config 0 descriptor?? [ 1047.554117][ T5938] usb 5-1: USB disconnect, device number 82 [ 1048.015610][T17135] input: syz1 as /devices/virtual/input/input163 [ 1050.793942][T17186] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2788'. [ 1050.910136][ T1168] usb 3-1: new high-speed USB device number 82 using dummy_hcd [ 1050.945325][T17187] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2788'. [ 1051.118901][ T1168] usb 3-1: config 0 has an invalid interface number: 117 but max is 0 [ 1051.130233][T17187] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2788'. [ 1051.208937][ T1168] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1051.219293][ T1168] usb 3-1: config 0 has no interface number 0 [ 1051.225455][ T1168] usb 3-1: config 0 interface 117 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 1051.236024][ T1168] usb 3-1: config 0 interface 117 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1051.290373][ T1168] usb 3-1: New USB device found, idVendor=0afa, idProduct=03e8, bcdDevice=99.d0 [ 1051.328582][ T1168] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1051.337263][T17188] tipc: Enabling of bearer rejected, already enabled [ 1051.392081][ T1168] usb 3-1: Product: syz [ 1051.396352][ T1168] usb 3-1: Manufacturer: syz [ 1051.447271][ T1168] usb 3-1: SerialNumber: syz [ 1051.530450][ T1168] usb 3-1: config 0 descriptor?? [ 1052.284793][T17197] binder: 17191:17197 ioctl c0306201 80000540 returned -22 [ 1052.510399][ T1168] usb 3-1: USB disconnect, device number 82 [ 1053.954857][T17200] netlink: 'syz.1.2791': attribute type 11 has an invalid length. [ 1054.098916][ T5938] usb 5-1: new high-speed USB device number 83 using dummy_hcd [ 1054.270938][ T5938] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1054.299184][ T5938] usb 5-1: New USB device found, idVendor=05a4, idProduct=8003, bcdDevice= 0.00 [ 1054.313210][ T5938] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1054.337947][ T5938] usb 5-1: config 0 descriptor?? [ 1054.620732][T17226] netlink: 52 bytes leftover after parsing attributes in process `syz.1.2798'. [ 1054.665154][ T1304] ieee802154 phy0 wpan0: encryption failed: -22 [ 1054.671785][ T1304] ieee802154 phy1 wpan1: encryption failed: -22 [ 1054.810882][ T5938] ortek 0003:05A4:8003.0011: unknown main item tag 0x0 [ 1054.821881][ T5938] ortek 0003:05A4:8003.0011: unknown main item tag 0x0 [ 1054.831976][T17236] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2800'. [ 1054.845742][ T5938] ortek 0003:05A4:8003.0011: unknown main item tag 0x0 [ 1054.879904][T17236] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2800'. [ 1054.900685][ T5938] ortek 0003:05A4:8003.0011: unknown main item tag 0x0 [ 1054.907745][ T5938] ortek 0003:05A4:8003.0011: unknown main item tag 0x0 [ 1054.935560][T17236] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2800'. [ 1054.991140][ T5938] ortek 0003:05A4:8003.0011: hidraw0: USB HID v0.00 Device [HID 05a4:8003] on usb-dummy_hcd.4-1/input0 [ 1055.035536][ T5938] usb 5-1: USB disconnect, device number 83 [ 1055.110346][T17237] tipc: Enabling of bearer rejected, already enabled [ 1055.193734][T17242] input: syz1 as /devices/virtual/input/input165 [ 1055.487540][T17239] fido_id[17239]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/report_descriptor': No such file or directory [ 1057.178539][ T5938] usb 4-1: new high-speed USB device number 92 using dummy_hcd [ 1057.208493][ T5975] usb 5-1: new high-speed USB device number 84 using dummy_hcd [ 1057.418981][ T5938] usb 4-1: Using ep0 maxpacket: 32 [ 1057.427584][ T5975] usb 5-1: config 0 has an invalid interface number: 117 but max is 0 [ 1057.540468][ T5975] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1057.558774][ T5938] usb 4-1: config 0 has an invalid interface number: 126 but max is 0 [ 1057.572178][ T5975] usb 5-1: config 0 has no interface number 0 [ 1057.616870][ T5938] usb 4-1: config 0 has no interface number 0 [ 1057.627728][ T5975] usb 5-1: config 0 interface 117 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 1057.660685][ T5938] usb 4-1: config 0 interface 126 altsetting 16 bulk endpoint 0x6 has invalid maxpacket 1023 [ 1057.768481][ T5975] usb 5-1: config 0 interface 117 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1057.786515][ T5938] usb 4-1: config 0 interface 126 altsetting 16 bulk endpoint 0x82 has invalid maxpacket 8 [ 1057.822278][ T5938] usb 4-1: config 0 interface 126 has no altsetting 0 [ 1057.879892][ T5975] usb 5-1: New USB device found, idVendor=0afa, idProduct=03e8, bcdDevice=99.d0 [ 1057.889216][ T5975] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1057.900036][ T5975] usb 5-1: Product: syz [ 1057.939650][ T5938] usb 4-1: New USB device found, idVendor=09c4, idProduct=0011, bcdDevice=b0.1c [ 1057.952337][ T5938] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1057.961355][ T5938] usb 4-1: Product: syz [ 1057.965632][ T5938] usb 4-1: Manufacturer: syz [ 1057.973618][ T5975] usb 5-1: Manufacturer: syz [ 1057.978701][ T5938] usb 4-1: SerialNumber: syz [ 1057.983553][ T5975] usb 5-1: SerialNumber: syz [ 1058.087015][ T5938] usb 4-1: config 0 descriptor?? [ 1058.096604][ T5975] usb 5-1: config 0 descriptor?? [ 1058.236047][T17257] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1058.243824][T17257] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1058.582641][T17253] netlink: 'syz.3.2803': attribute type 5 has an invalid length. [ 1058.999230][ T976] usb 5-1: USB disconnect, device number 84 [ 1059.448062][T17284] netlink: 52 bytes leftover after parsing attributes in process `syz.1.2811'. [ 1059.822592][T17277] rtc_cmos 00:00: Alarms can be up to one day in the future [ 1060.097265][ T5938] ir_usb 4-1:0.126: IR Dongle converter detected [ 1060.127274][ T5938] usb 4-1: IRDA class descriptor not found, device not bound [ 1060.199015][ T5938] usb 4-1: USB disconnect, device number 92 [ 1060.248506][T17296] binder: 17291:17296 ioctl c0306201 80000540 returned -22 [ 1060.479456][T17300] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2814'. [ 1060.489727][ T5909] rtc_cmos 00:00: Alarms can be up to one day in the future [ 1060.508193][ T5909] rtc_cmos 00:00: Alarms can be up to one day in the future [ 1060.538251][ T5909] rtc_cmos 00:00: Alarms can be up to one day in the future [ 1060.551120][T17300] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2814'. [ 1060.571157][ T5909] rtc_cmos 00:00: Alarms can be up to one day in the future [ 1060.618578][T17300] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2814'. [ 1060.653969][ T5909] rtc rtc0: __rtc_set_alarm: err=-22 [ 1060.774195][T17302] tipc: Enabling of bearer rejected, already enabled [ 1061.149681][T17308] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2816'. [ 1061.180202][T17308] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2816'. [ 1061.192656][T17308] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 1063.544029][T17327] tipc: Enabled bearer , priority 0 [ 1063.583091][T17327] syzkaller0: entered promiscuous mode [ 1063.632242][T17327] syzkaller0: entered allmulticast mode [ 1063.810758][T17326] tipc: Resetting bearer [ 1063.909773][T17326] tipc: Disabling bearer [ 1064.170724][T17339] netlink: 52 bytes leftover after parsing attributes in process `syz.3.2822'. [ 1064.284555][T17346] input: syz1 as /devices/virtual/input/input169 [ 1064.808610][ T5938] usb 1-1: new high-speed USB device number 110 using dummy_hcd [ 1065.088823][ T5938] usb 1-1: config 0 has an invalid interface number: 117 but max is 0 [ 1065.097326][ T5938] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1065.148249][ T5938] usb 1-1: config 0 has no interface number 0 [ 1065.185529][ T5938] usb 1-1: config 0 interface 117 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 1065.228697][ T5938] usb 1-1: config 0 interface 117 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1065.289724][ T5938] usb 1-1: New USB device found, idVendor=0afa, idProduct=03e8, bcdDevice=99.d0 [ 1065.299684][ T5938] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1065.314022][ T5938] usb 1-1: Product: syz [ 1065.320768][ T5938] usb 1-1: Manufacturer: syz [ 1065.328481][ T5938] usb 1-1: SerialNumber: syz [ 1065.368650][ T5938] usb 1-1: config 0 descriptor?? [ 1066.223554][ T5909] usb 1-1: USB disconnect, device number 110 [ 1066.383787][T17376] binder: 17368:17376 ioctl c0306201 80000540 returned -22 [ 1067.314336][T17383] x_tables: duplicate underflow at hook 3 [ 1069.659103][T17410] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2837'. [ 1069.669699][T17410] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2837'. [ 1069.681056][T17410] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 1070.244583][T17418] input: syz1 as /devices/virtual/input/input172 [ 1071.933757][T17431] loop4: detected capacity change from 0 to 524255232 [ 1072.034853][T17428] loop4: detected capacity change from 524255232 to 524287935 [ 1072.193516][T17438] binder: 17433:17438 ioctl c0306201 80000540 returned -22 [ 1072.666073][T17446] netlink: 64 bytes leftover after parsing attributes in process `syz.3.2846'. [ 1072.676969][T17446] netlink: 64 bytes leftover after parsing attributes in process `syz.3.2846'. [ 1072.759737][ T976] usb 1-1: new high-speed USB device number 111 using dummy_hcd [ 1073.078638][ T976] usb 1-1: Using ep0 maxpacket: 32 [ 1073.093421][ T976] usb 1-1: config 0 has an invalid interface number: 126 but max is 0 [ 1073.152928][ T976] usb 1-1: config 0 has no interface number 0 [ 1073.249487][ T976] usb 1-1: config 0 interface 126 altsetting 16 bulk endpoint 0x6 has invalid maxpacket 1023 [ 1073.398452][ T976] usb 1-1: config 0 interface 126 altsetting 16 bulk endpoint 0x82 has invalid maxpacket 8 [ 1073.428403][ T976] usb 1-1: config 0 interface 126 has no altsetting 0 [ 1073.502587][ T976] usb 1-1: New USB device found, idVendor=09c4, idProduct=0011, bcdDevice=b0.1c [ 1073.542550][ T976] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1073.578446][ T976] usb 1-1: Product: syz [ 1073.582736][ T976] usb 1-1: Manufacturer: syz [ 1073.597576][ T976] usb 1-1: SerialNumber: syz [ 1073.626273][ T976] usb 1-1: config 0 descriptor?? [ 1073.641299][T17441] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 1073.650492][T17441] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 1073.775538][T17449] (unnamed net_device) (uninitialized): option ad_user_port_key: mode dependency failed, not supported in mode broadcast(3) [ 1073.872821][T17439] netlink: 'syz.0.2844': attribute type 5 has an invalid length. [ 1075.293988][ T976] ir_usb 1-1:0.126: IR Dongle converter detected [ 1075.431858][ T976] usb 1-1: IRDA class descriptor not found, device not bound [ 1075.512342][ T976] usb 1-1: USB disconnect, device number 111 [ 1077.069420][ T976] usb 5-1: new high-speed USB device number 85 using dummy_hcd [ 1077.220990][ T976] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1077.235953][ T976] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1077.249045][ T976] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1077.262202][ T976] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1077.271497][ T976] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1077.283272][ T976] usb 5-1: config 0 descriptor?? [ 1077.425246][T17475] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2854'. [ 1077.438555][T17475] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2854'. [ 1077.546518][ T976] plantronics 0003:047F:FFFF.0012: unknown main item tag 0x6 [ 1077.588254][ T976] plantronics 0003:047F:FFFF.0012: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 1077.679142][ T976] usb 5-1: USB disconnect, device number 85 [ 1077.936516][T17480] fido_id[17480]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/report_descriptor': No such file or directory [ 1078.693238][T17489] input: syz1 as /devices/virtual/input/input174 [ 1079.177358][T17495] binder: 17490:17495 ioctl c0306201 80000540 returned -22 [ 1080.555726][T17504] netlink: 52 bytes leftover after parsing attributes in process `syz.4.2861'. [ 1080.822420][T17511] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2863'. [ 1080.831900][T17511] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2863'. [ 1080.884349][T17512] tipc: Enabling of bearer rejected, failed to enable media [ 1082.518319][ T5852] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1082.527922][ T5852] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1082.536348][ T5852] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1082.546431][ T5852] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1082.555125][ T5852] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1082.995968][T17527] chnl_net:caif_netlink_parms(): no params data found [ 1083.234876][T17527] bridge0: port 1(bridge_slave_0) entered blocking state [ 1083.244744][T17527] bridge0: port 1(bridge_slave_0) entered disabled state [ 1083.257697][T17527] bridge_slave_0: entered allmulticast mode [ 1083.313397][T17527] bridge_slave_0: entered promiscuous mode [ 1083.327966][T17527] bridge0: port 2(bridge_slave_1) entered blocking state [ 1083.337457][T17527] bridge0: port 2(bridge_slave_1) entered disabled state [ 1083.349707][T17527] bridge_slave_1: entered allmulticast mode [ 1083.371302][T17527] bridge_slave_1: entered promiscuous mode [ 1083.487746][T17527] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1083.569612][T17527] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1083.701129][T17527] team0: Port device team_slave_0 added [ 1083.724694][T17527] team0: Port device team_slave_1 added [ 1083.863623][T17527] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1083.883767][T17527] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1084.046418][T17527] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1084.123048][T17527] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1084.134584][T17527] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1084.202852][T17527] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1084.340455][T17527] hsr_slave_0: entered promiscuous mode [ 1084.354060][T17527] hsr_slave_1: entered promiscuous mode [ 1084.374696][T17527] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1084.405656][T17527] Cannot create hsr debugfs directory [ 1084.658699][ T5852] Bluetooth: hci5: command tx timeout [ 1084.880619][T17546] input: syz1 as /devices/virtual/input/input176 [ 1084.960566][T17527] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 1084.979293][T17527] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 1085.011315][T17527] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 1085.030639][T17527] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 1085.349867][T17527] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1085.401019][T17527] 8021q: adding VLAN 0 to HW filter on device team0 [ 1085.425624][ T1157] bridge0: port 1(bridge_slave_0) entered blocking state [ 1085.432871][ T1157] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1085.447407][ T1157] bridge0: port 2(bridge_slave_1) entered blocking state [ 1085.454688][ T1157] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1085.604489][T17527] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1085.761646][T17527] veth0_vlan: entered promiscuous mode [ 1085.785505][T17527] veth1_vlan: entered promiscuous mode [ 1085.874358][T17527] veth0_macvtap: entered promiscuous mode [ 1085.911510][T17527] veth1_macvtap: entered promiscuous mode [ 1085.964310][T17527] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1085.991147][T17527] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1086.020709][T17527] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1086.054047][T17527] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1086.075473][T17527] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1086.085047][T17527] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1086.313040][ T3532] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1086.327023][ T3532] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1086.339287][T17563] binder: 17554:17563 ioctl c0306201 80000540 returned -22 [ 1086.498298][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1086.522453][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1086.739977][ T5852] Bluetooth: hci5: command tx timeout [ 1086.867476][T17572] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2875'. [ 1086.878479][T17572] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2875'. [ 1087.005865][T17573] tipc: Enabling of bearer rejected, failed to enable media [ 1087.448868][ T5924] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 1087.623281][ T5924] usb 6-1: config 0 has an invalid interface number: 117 but max is 0 [ 1087.646020][ T5924] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1087.677157][ T5924] usb 6-1: config 0 has no interface number 0 [ 1087.683477][ T5924] usb 6-1: config 0 interface 117 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 1087.698465][ T5924] usb 6-1: config 0 interface 117 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1087.734723][ T5924] usb 6-1: New USB device found, idVendor=0afa, idProduct=03e8, bcdDevice=99.d0 [ 1087.745212][ T5924] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1087.765532][ T5924] usb 6-1: Product: syz [ 1087.774909][ T5924] usb 6-1: Manufacturer: syz [ 1087.785042][ T5924] usb 6-1: SerialNumber: syz [ 1087.798211][ T5924] usb 6-1: config 0 descriptor?? [ 1088.786039][ T5938] usb 6-1: USB disconnect, device number 2 [ 1088.818713][ T5852] Bluetooth: hci5: command tx timeout [ 1089.280133][ T5170] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 1089.292310][ T5170] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 1089.302153][ T5170] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 1089.312574][ T5170] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 1089.359782][ T5170] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 1090.112484][T17599] chnl_net:caif_netlink_parms(): no params data found [ 1090.575025][T17613] netlink: 28 bytes leftover after parsing attributes in process `syz.5.2887'. [ 1090.604354][T17613] netlink: 28 bytes leftover after parsing attributes in process `syz.5.2887'. [ 1090.798056][T17616] tipc: Started in network mode [ 1090.804539][T17616] tipc: Node identity aaaaaaaaaa2a, cluster identity 4711 [ 1090.838799][T17616] tipc: Enabled bearer , priority 15 [ 1090.849929][ T5170] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1090.859765][T17599] bridge0: port 1(bridge_slave_0) entered blocking state [ 1090.872628][ T5170] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1090.882830][ T5170] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1090.889885][T17599] bridge0: port 1(bridge_slave_0) entered disabled state [ 1090.890159][T17599] bridge_slave_0: entered allmulticast mode [ 1090.903648][ T5170] Bluetooth: hci5: command tx timeout [ 1090.915806][ T5170] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1090.923809][ T5170] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1090.985327][T17599] bridge_slave_0: entered promiscuous mode [ 1090.999664][T17599] bridge0: port 2(bridge_slave_1) entered blocking state [ 1091.025663][T17599] bridge0: port 2(bridge_slave_1) entered disabled state [ 1091.050860][T17599] bridge_slave_1: entered allmulticast mode [ 1091.097176][T17599] bridge_slave_1: entered promiscuous mode [ 1091.106225][ T5852] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 1091.119637][ T5852] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 1091.129700][ T5852] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 1091.147101][ T5852] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 1091.155223][ T5852] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 1091.264968][T17621] net_ratelimit: 4053 callbacks suppressed [ 1091.264986][T17621] ip6_tunnel: non-ECT from fc01:0000:0000:0000:0000:0000:0000:0001 with DS=0x1 [ 1091.372264][T17599] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1091.381767][ T5852] Bluetooth: hci6: command tx timeout [ 1091.406312][T17599] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1091.637929][T17599] team0: Port device team_slave_0 added [ 1091.764514][T17599] team0: Port device team_slave_1 added [ 1091.791322][T17632] binder: 17626:17632 ioctl c0306201 80000540 returned -22 [ 1091.958943][ T5924] tipc: Node number set to 8432298 [ 1091.992823][T17599] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1092.002645][T17599] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1092.037723][T17599] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1092.051783][T17599] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1092.060618][T17599] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1092.108880][T17599] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1092.207922][T17599] hsr_slave_0: entered promiscuous mode [ 1092.214689][T17599] hsr_slave_1: entered promiscuous mode [ 1092.265691][T17599] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1092.353448][T17599] Cannot create hsr debugfs directory [ 1092.978744][ T5852] Bluetooth: hci1: command tx timeout [ 1093.184919][T17618] chnl_net:caif_netlink_parms(): no params data found [ 1093.228953][ T5852] Bluetooth: hci7: command tx timeout [ 1093.268026][T17643] netlink: 32 bytes leftover after parsing attributes in process `syz.5.2892'. [ 1093.371744][T17622] chnl_net:caif_netlink_parms(): no params data found [ 1093.458720][ T5852] Bluetooth: hci6: command tx timeout [ 1093.592779][T17599] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1093.808933][T17599] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1093.836916][T17618] bridge0: port 1(bridge_slave_0) entered blocking state [ 1093.865355][T17618] bridge0: port 1(bridge_slave_0) entered disabled state [ 1093.884440][T17618] bridge_slave_0: entered allmulticast mode [ 1093.938080][T17618] bridge_slave_0: entered promiscuous mode [ 1094.142676][T17599] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1094.247288][T17618] bridge0: port 2(bridge_slave_1) entered blocking state [ 1094.266558][T17618] bridge0: port 2(bridge_slave_1) entered disabled state [ 1094.293226][T17618] bridge_slave_1: entered allmulticast mode [ 1094.305634][T17618] bridge_slave_1: entered promiscuous mode [ 1094.739038][T17599] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1095.094519][ T5852] Bluetooth: hci1: command tx timeout [ 1095.190674][T17618] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1095.224899][T17618] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1095.259359][T17622] bridge0: port 1(bridge_slave_0) entered blocking state [ 1095.266771][T17622] bridge0: port 1(bridge_slave_0) entered disabled state [ 1095.274261][T17622] bridge_slave_0: entered allmulticast mode [ 1095.282724][T17622] bridge_slave_0: entered promiscuous mode [ 1095.308497][ T5852] Bluetooth: hci7: command tx timeout [ 1095.357524][T17622] bridge0: port 2(bridge_slave_1) entered blocking state [ 1095.379164][T17622] bridge0: port 2(bridge_slave_1) entered disabled state [ 1095.397028][T17622] bridge_slave_1: entered allmulticast mode [ 1095.448624][T17622] bridge_slave_1: entered promiscuous mode [ 1095.539930][ T5852] Bluetooth: hci6: command tx timeout [ 1095.603278][T17670] netlink: 28 bytes leftover after parsing attributes in process `syz.5.2896'. [ 1095.624092][T17670] netlink: 28 bytes leftover after parsing attributes in process `syz.5.2896'. [ 1095.717024][T17622] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1095.747382][T17618] team0: Port device team_slave_0 added [ 1095.756767][T17673] tipc: Enabling of bearer rejected, already enabled [ 1095.837038][T17622] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1095.862985][T17618] team0: Port device team_slave_1 added [ 1096.009696][T17618] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1096.028546][T17618] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1096.046757][T17679] netlink: 52 bytes leftover after parsing attributes in process `syz.5.2899'. [ 1096.064979][T17618] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1096.084628][T17622] team0: Port device team_slave_0 added [ 1096.099132][T17618] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1096.106157][T17618] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1096.132844][T17618] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1096.161668][T17622] team0: Port device team_slave_1 added [ 1096.284034][T17599] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1096.299880][T17622] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1096.306911][T17622] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1096.334968][T17622] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1096.375145][T17599] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1096.388270][T17622] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1096.398796][T17622] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1096.426165][T17622] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1096.460980][T17618] hsr_slave_0: entered promiscuous mode [ 1096.468003][T17618] hsr_slave_1: entered promiscuous mode [ 1096.474818][T17618] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1096.482593][T17618] Cannot create hsr debugfs directory [ 1096.488322][T17599] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1096.549055][T17599] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1096.604146][T17622] hsr_slave_0: entered promiscuous mode [ 1096.611792][T17622] hsr_slave_1: entered promiscuous mode [ 1096.618026][T17622] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1096.626213][T17622] Cannot create hsr debugfs directory [ 1097.140028][ T5852] Bluetooth: hci1: command tx timeout [ 1097.351942][T17622] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 1097.388911][ T5852] Bluetooth: hci7: command tx timeout [ 1097.400451][T17622] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 1097.426364][T17622] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 1097.426630][T17690] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1097.440783][T17690] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1097.447044][T17690] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1097.455429][T17690] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 1097.463737][T17690] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1097.470062][T17690] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 1097.489497][T17690] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 1097.496520][T17599] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1097.508824][T17622] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 1097.517759][T17690] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 1097.524518][T17690] Bluetooth: hci6: Opcode 0x0406 failed: -4 [ 1097.536049][T17690] Bluetooth: hci6: Opcode 0x0406 failed: -4 [ 1097.556105][T17690] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1097.575585][T17690] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 1097.589162][T17690] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 1097.601795][T17690] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 1097.607856][T17690] Bluetooth: hci7: Opcode 0x0406 failed: -4 [ 1097.629400][T17690] Bluetooth: hci7: Opcode 0x0406 failed: -4 [ 1097.797207][T17599] 8021q: adding VLAN 0 to HW filter on device team0 [ 1097.825409][T17618] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 1097.854753][T17618] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 1097.886410][T17618] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 1097.918552][ T3554] bridge0: port 1(bridge_slave_0) entered blocking state [ 1097.925814][ T3554] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1097.948843][T17618] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 1098.006360][ T3532] bridge0: port 2(bridge_slave_1) entered blocking state [ 1098.013598][ T3532] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1098.235450][T17622] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1098.245285][T17599] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1098.343696][T17622] 8021q: adding VLAN 0 to HW filter on device team0 [ 1098.524561][ T44] bridge0: port 1(bridge_slave_0) entered blocking state [ 1098.531830][ T44] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1098.538044][T17716] netlink: 32 bytes leftover after parsing attributes in process `syz.5.2902'. [ 1098.555269][T17599] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1098.595420][T10115] bridge0: port 2(bridge_slave_1) entered blocking state [ 1098.602674][T10115] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1098.800779][T17618] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1098.914672][T17618] 8021q: adding VLAN 0 to HW filter on device team0 [ 1099.059000][ T5852] Bluetooth: hci3: command 0x0406 tx timeout [ 1099.133804][ T1098] bridge0: port 1(bridge_slave_0) entered blocking state [ 1099.141133][ T1098] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1099.210157][T17599] veth0_vlan: entered promiscuous mode [ 1099.246983][T10115] bridge0: port 2(bridge_slave_1) entered blocking state [ 1099.254258][T10115] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1099.538492][ T5852] Bluetooth: hci0: command 0x0405 tx timeout [ 1099.544761][ T5852] Bluetooth: hci2: command 0x0406 tx timeout [ 1099.551392][ T5852] Bluetooth: hci4: command 0x0406 tx timeout [ 1099.557482][ T5852] Bluetooth: hci6: command 0x0c1a tx timeout [ 1099.564285][ T5170] Bluetooth: hci5: command 0x0c1a tx timeout [ 1099.621489][T17526] Bluetooth: hci7: command 0x0c1a tx timeout [ 1099.621511][ T5852] Bluetooth: hci1: command 0x0c1a tx timeout [ 1099.677827][T17599] veth1_vlan: entered promiscuous mode [ 1100.327655][T17622] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1100.353947][T17599] veth0_macvtap: entered promiscuous mode [ 1100.405133][T17599] veth1_macvtap: entered promiscuous mode [ 1100.548963][T17599] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1100.747390][T17599] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1100.845935][T17599] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1100.861071][T17599] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1100.876788][T17599] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1100.894784][T17599] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1100.942636][T17622] veth0_vlan: entered promiscuous mode [ 1100.963573][T17618] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1101.040565][T17622] veth1_vlan: entered promiscuous mode [ 1101.119606][T17734] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2906'. [ 1101.130062][T17734] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2906'. [ 1101.256889][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1101.272892][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1101.410170][ T1157] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1101.418070][ T1157] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1101.426149][T17622] veth0_macvtap: entered promiscuous mode [ 1101.444836][T17622] veth1_macvtap: entered promiscuous mode [ 1101.509597][T17618] veth0_vlan: entered promiscuous mode [ 1101.546700][T17618] veth1_vlan: entered promiscuous mode [ 1101.639199][ T5852] Bluetooth: hci6: command 0x0c1a tx timeout [ 1101.639300][T17526] Bluetooth: hci5: command 0x0c1a tx timeout [ 1101.698864][T17526] Bluetooth: hci7: command 0x0c1a tx timeout [ 1101.708555][T17526] Bluetooth: hci1: command 0x0c1a tx timeout [ 1101.786495][T17622] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1101.825449][T17622] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1101.873056][T17622] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1101.933504][T17622] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1101.984108][T17622] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1102.007411][T17622] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1102.067594][T17618] veth0_macvtap: entered promiscuous mode [ 1102.124661][T17618] veth1_macvtap: entered promiscuous mode [ 1102.160725][T17746] input: syz1 as /devices/virtual/input/input180 [ 1102.489525][T17750] FAULT_INJECTION: forcing a failure. [ 1102.489525][T17750] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1102.496753][T17618] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1102.537517][T17750] CPU: 0 UID: 0 PID: 17750 Comm: syz.5.2908 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) [ 1102.537547][T17750] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1102.537562][T17750] Call Trace: [ 1102.537572][T17750] [ 1102.537583][T17750] dump_stack_lvl+0x189/0x250 [ 1102.537614][T17750] ? __pfx____ratelimit+0x10/0x10 [ 1102.537642][T17750] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1102.537666][T17750] ? __pfx__printk+0x10/0x10 [ 1102.537708][T17750] should_fail_ex+0x414/0x560 [ 1102.537736][T17750] _copy_to_user+0x31/0xb0 [ 1102.537769][T17750] simple_read_from_buffer+0xe1/0x170 [ 1102.537805][T17750] proc_fail_nth_read+0x1df/0x250 [ 1102.537830][T17750] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1102.537855][T17750] ? rw_verify_area+0x258/0x650 [ 1102.537881][T17750] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1102.537904][T17750] vfs_read+0x1fd/0x980 [ 1102.537937][T17750] ? __pfx___mutex_lock+0x10/0x10 [ 1102.537961][T17750] ? __pfx_vfs_read+0x10/0x10 [ 1102.537991][T17750] ? __fget_files+0x2a/0x420 [ 1102.538015][T17750] ? __fget_files+0x3a0/0x420 [ 1102.538033][T17750] ? __fget_files+0x2a/0x420 [ 1102.538061][T17750] ksys_read+0x145/0x250 [ 1102.538092][T17750] ? __pfx_ksys_read+0x10/0x10 [ 1102.538122][T17750] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 1102.538147][T17750] ? lockdep_hardirqs_on+0x9c/0x150 [ 1102.538172][T17750] __do_fast_syscall_32+0xb6/0x2b0 [ 1102.538218][T17750] ? lockdep_hardirqs_on+0x9c/0x150 [ 1102.538244][T17750] do_fast_syscall_32+0x34/0x80 [ 1102.538268][T17750] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1102.538294][T17750] RIP: 0023:0xf7f35539 [ 1102.538311][T17750] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1102.538329][T17750] RSP: 002b:00000000f5056590 EFLAGS: 00000206 ORIG_RAX: 0000000000000003 [ 1102.538351][T17750] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f5056620 [ 1102.538364][T17750] RDX: 000000000000000f RSI: 00000000f73c4ff4 RDI: 0000000000000000 [ 1102.538375][T17750] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 1102.538387][T17750] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1102.538398][T17750] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1102.538427][T17750] [ 1103.132087][T17618] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1103.175831][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1103.213877][T17618] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1103.230960][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1103.250795][T17618] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1103.260253][T17618] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1103.269522][T17618] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1103.420909][T10115] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1103.431293][T10115] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1103.679210][T10115] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1103.697606][T10115] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1103.705166][T17526] Bluetooth: hci5: command 0x0c1a tx timeout [ 1103.709045][T17526] Bluetooth: hci6: command 0x0c1a tx timeout [ 1103.779549][ T5852] Bluetooth: hci7: command 0x0c1a tx timeout [ 1103.785780][T17526] Bluetooth: hci1: command 0x0c1a tx timeout [ 1103.879912][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1103.889080][ T5924] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 1103.913468][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1104.046504][T17763] netlink: 32 bytes leftover after parsing attributes in process `syz.6.2912'. [ 1104.055966][ T5924] usb 6-1: Using ep0 maxpacket: 32 [ 1104.063486][ T5924] usb 6-1: config 0 has an invalid interface number: 247 but max is 0 [ 1104.072672][ T5924] usb 6-1: config 0 has no interface number 0 [ 1104.087793][ T5924] usb 6-1: New USB device found, idVendor=1d50, idProduct=60c6, bcdDevice=62.9b [ 1104.099657][ T5924] usb 6-1: New USB device strings: Mfr=1, Product=3, SerialNumber=0 [ 1104.108147][ T5924] usb 6-1: Product: syz [ 1104.122445][ T5924] usb 6-1: Manufacturer: syz [ 1104.137221][ T5924] usb 6-1: config 0 descriptor?? [ 1104.391664][T17755] QAT: Stopping all acceleration devices. [ 1104.435888][T17559] usb 6-1: USB disconnect, device number 3 [ 1104.731067][T17781] netlink: 'syz.7.2886': attribute type 5 has an invalid length. [ 1104.844639][T17784] netlink: 'syz.4.2913': attribute type 5 has an invalid length. [ 1105.175433][T17790] binder: 17782:17790 ioctl c0306201 80000540 returned -22 [ 1105.607751][T17792] netlink: 28 bytes leftover after parsing attributes in process `syz.5.2915'. [ 1105.742839][T17793] tipc: Enabling of bearer rejected, already enabled [ 1105.786166][T17792] netlink: 28 bytes leftover after parsing attributes in process `syz.5.2915'. [ 1105.899208][ T1218] dvb-usb: did not find the firmware file 'dvb-usb-bluebird-01.fw' (status -110). You can use /scripts/get_dvb_firmware to get the firmware [ 1106.003117][ T1218] dvb_usb_cxusb 2-1:5.93: probe with driver dvb_usb_cxusb failed with error -22 [ 1106.169328][ T1218] dvb-usb: found a 'DViCO FusionHDTV DVB-T USB (LGZ201)' in cold state, will try to load a firmware [ 1106.189601][ T1218] usb 2-1: Direct firmware load for dvb-usb-bluebird-01.fw failed with error -2 [ 1106.377599][ T1218] usb 2-1: Falling back to sysfs fallback for: dvb-usb-bluebird-01.fw [ 1107.351767][ T5975] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 1107.561352][ T5975] usb 6-1: Using ep0 maxpacket: 32 [ 1107.585702][ T5975] usb 6-1: config 0 has an invalid interface number: 126 but max is 0 [ 1107.663600][ T5975] usb 6-1: config 0 has no interface number 0 [ 1107.710167][ T5975] usb 6-1: config 0 interface 126 altsetting 16 bulk endpoint 0x6 has invalid maxpacket 1023 [ 1107.743164][ T5975] usb 6-1: config 0 interface 126 altsetting 16 bulk endpoint 0x82 has invalid maxpacket 8 [ 1107.798456][ T5975] usb 6-1: config 0 interface 126 has no altsetting 0 [ 1107.908862][ T5975] usb 6-1: New USB device found, idVendor=09c4, idProduct=0011, bcdDevice=b0.1c [ 1107.938943][ T5975] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1107.953829][ T5975] usb 6-1: Product: syz [ 1107.958067][ T5975] usb 6-1: Manufacturer: syz [ 1107.988575][ T5975] usb 6-1: SerialNumber: syz [ 1108.008173][ T5975] usb 6-1: config 0 descriptor?? [ 1108.038259][T17800] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1108.047830][T17800] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1108.133927][T17809] input: syz1 as /devices/virtual/input/input181 [ 1108.456106][T17798] netlink: 'syz.5.2916': attribute type 5 has an invalid length. [ 1109.815868][ T5975] ir_usb 6-1:0.126: IR Dongle converter detected [ 1109.866209][ T5975] usb 6-1: IRDA class descriptor not found, device not bound [ 1109.951194][ T5975] usb 6-1: USB disconnect, device number 4 [ 1110.149740][T17824] kvm: pic: single mode not supported [ 1110.150576][T17824] kvm: pic: level sensitive irq not supported [ 1110.160341][T17824] kvm: pic: non byte write [ 1110.320539][T17824] kvm: pic: non byte write [ 1110.325315][T17824] kvm: pic: non byte write [ 1110.331014][T17824] kvm: pic: non byte write [ 1110.335816][T17824] kvm: pic: non byte write [ 1110.341097][T17824] kvm: pic: non byte write [ 1110.345963][T17824] kvm: pic: non byte write [ 1110.351100][T17824] kvm: pic: non byte write [ 1110.355831][T17824] kvm: pic: non byte write [ 1110.361039][T17824] kvm: pic: non byte write [ 1110.378880][T17824] kvm: pic: single mode not supported [ 1110.379132][T17824] kvm: pic: single mode not supported [ 1110.384606][T17824] kvm: pic: level sensitive irq not supported [ 1110.468456][ T5924] usb 5-1: new high-speed USB device number 86 using dummy_hcd [ 1110.621858][T17834] netlink: 28 bytes leftover after parsing attributes in process `syz.6.2926'. [ 1110.632004][T17834] netlink: 28 bytes leftover after parsing attributes in process `syz.6.2926'. [ 1110.644595][ T5924] usb 5-1: Using ep0 maxpacket: 32 [ 1110.663566][ T5924] usb 5-1: config 0 has an invalid interface number: 247 but max is 0 [ 1110.672354][ T5924] usb 5-1: config 0 has no interface number 0 [ 1110.682095][ T5924] usb 5-1: New USB device found, idVendor=1d50, idProduct=60c6, bcdDevice=62.9b [ 1110.920661][ T5924] usb 5-1: New USB device strings: Mfr=1, Product=3, SerialNumber=0 [ 1110.937117][ T5924] usb 5-1: Product: syz [ 1110.987987][ T5924] usb 5-1: Manufacturer: syz [ 1111.014333][ T5924] usb 5-1: config 0 descriptor?? [ 1111.232884][T17831] QAT: Stopping all acceleration devices. [ 1111.313416][ T5975] usb 5-1: USB disconnect, device number 86 [ 1111.372829][T17841] binder: 17837:17841 ioctl c0306201 80000540 returned -22 [ 1112.217400][T17844] netlink: 'syz.4.2928': attribute type 3 has an invalid length. [ 1112.372458][T17844] netlink: 830 bytes leftover after parsing attributes in process `syz.4.2928'. [ 1112.389899][T17844] bond_slave_0: entered promiscuous mode [ 1112.395902][T17844] bond_slave_1: entered promiscuous mode [ 1112.422411][T17844] netlink: 988 bytes leftover after parsing attributes in process `syz.4.2928'. [ 1112.621197][T17851] netlink: 'syz.7.2929': attribute type 5 has an invalid length. [ 1112.739122][ T5909] usb 5-1: new high-speed USB device number 87 using dummy_hcd [ 1113.124067][ T5909] usb 5-1: too many endpoints for config 0 interface 0 altsetting 1: 33, using maximum allowed: 30 [ 1113.151690][ T5909] usb 5-1: config 0 interface 0 altsetting 1 endpoint 0x2 has an invalid bInterval 86, changing to 10 [ 1113.217460][ T5909] usb 5-1: config 0 interface 0 altsetting 1 has 2 endpoint descriptors, different from the interface descriptor's value: 33 [ 1113.309430][ T5909] usb 5-1: config 0 interface 0 has no altsetting 0 [ 1113.316328][ T5909] usb 5-1: New USB device found, idVendor=046d, idProduct=c20a, bcdDevice= 0.00 [ 1113.355694][ T5909] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1113.404255][ T5909] usb 5-1: config 0 descriptor?? [ 1113.466391][T17859] netlink: 'syz.6.2930': attribute type 5 has an invalid length. [ 1113.908631][ T5909] logitech 0003:046D:C20A.0013: hidraw0: USB HID v8.00 Device [HID 046d:c20a] on usb-dummy_hcd.4-1/input0 [ 1113.937924][ T5909] logitech 0003:046D:C20A.0013: no inputs found [ 1114.115382][T17559] usb 5-1: USB disconnect, device number 87 [ 1114.300809][T17863] fido_id[17863]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/report_descriptor': No such file or directory [ 1115.717654][T17873] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2933'. [ 1115.735784][T17873] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2933'. [ 1115.755815][T17873] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 1115.995436][T17879] input: syz1 as /devices/virtual/input/input182 [ 1116.092776][T17881] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2935'. [ 1116.131035][ T1304] ieee802154 phy0 wpan0: encryption failed: -22 [ 1116.137412][ T1304] ieee802154 phy1 wpan1: encryption failed: -22 [ 1116.213111][T17881] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2935'. [ 1116.243825][T17881] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 1116.882261][T17889] snd_dummy snd_dummy.0: control 0:0:4:syz0:0 is already present [ 1118.639304][ T5852] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 1118.658188][ T5852] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9 [ 1118.670725][ T5852] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9 [ 1118.680432][ T5852] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4 [ 1118.689814][ T5852] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2 [ 1119.218774][T17913] binder: 17898:17913 ioctl c0306201 80000540 returned -22 [ 1119.290317][T17907] snd_dummy snd_dummy.0: control 0:0:4:syz0:0 is already present [ 1120.513828][T17909] chnl_net:caif_netlink_parms(): no params data found [ 1120.739628][T17526] Bluetooth: hci8: command tx timeout [ 1121.188520][ T5909] usb 5-1: new high-speed USB device number 88 using dummy_hcd [ 1121.385243][ T5909] usb 5-1: config 0 has an invalid interface number: 117 but max is 0 [ 1121.440309][ T5909] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1121.456231][T17909] bridge0: port 1(bridge_slave_0) entered blocking state [ 1121.487953][T17909] bridge0: port 1(bridge_slave_0) entered disabled state [ 1121.499227][ T5909] usb 5-1: config 0 has no interface number 0 [ 1121.511536][T17909] bridge_slave_0: entered allmulticast mode [ 1121.520660][ T5909] usb 5-1: config 0 interface 117 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 1121.573748][ T5909] usb 5-1: config 0 interface 117 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1121.574620][T17909] bridge_slave_0: entered promiscuous mode [ 1121.590328][ T5909] usb 5-1: New USB device found, idVendor=0afa, idProduct=03e8, bcdDevice=99.d0 [ 1121.604802][ T5909] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1121.613038][ T5909] usb 5-1: Product: syz [ 1121.617355][ T5909] usb 5-1: Manufacturer: syz [ 1121.622851][ T5909] usb 5-1: SerialNumber: syz [ 1121.636886][ T5909] usb 5-1: config 0 descriptor?? [ 1121.716210][T17909] bridge0: port 2(bridge_slave_1) entered blocking state [ 1121.723665][T17909] bridge0: port 2(bridge_slave_1) entered disabled state [ 1121.731855][T17909] bridge_slave_1: entered allmulticast mode [ 1122.009458][T17909] bridge_slave_1: entered promiscuous mode [ 1122.402730][T17559] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 1122.594466][T17559] usb 8-1: Using ep0 maxpacket: 32 [ 1122.613150][T17559] usb 8-1: config 0 has an invalid interface number: 126 but max is 0 [ 1122.621777][T17559] usb 8-1: config 0 has no interface number 0 [ 1122.652225][T17559] usb 8-1: config 0 interface 126 altsetting 16 bulk endpoint 0x6 has invalid maxpacket 1023 [ 1122.709358][T17559] usb 8-1: config 0 interface 126 has no altsetting 0 [ 1122.783647][T17559] usb 8-1: New USB device found, idVendor=09c4, idProduct=0011, bcdDevice=b0.1c [ 1122.793178][T17559] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1122.801307][T17559] usb 8-1: Product: syz [ 1122.818381][T17559] usb 8-1: Manufacturer: syz [ 1122.825507][T17559] usb 8-1: SerialNumber: syz [ 1122.831040][T17526] Bluetooth: hci8: command tx timeout [ 1122.855974][T17559] usb 8-1: config 0 descriptor?? [ 1122.863128][T17945] raw-gadget.1 gadget.7: fail, usb_ep_enable returned -22 [ 1122.974908][T17909] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1122.999447][ T5909] usb 5-1: USB disconnect, device number 88 [ 1123.192736][T17909] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1123.220553][T17943] netlink: 'syz.7.2946': attribute type 5 has an invalid length. [ 1123.443170][T17909] team0: Port device team_slave_0 added [ 1123.513794][T17909] team0: Port device team_slave_1 added [ 1123.821807][T17909] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1124.037726][T17957] snd_dummy snd_dummy.0: control 0:0:4:syz0:0 is already present [ 1124.148951][T17909] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1124.298476][T17909] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1124.464034][T17909] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1124.477616][T17909] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1124.669615][T17909] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1124.884279][T17909] hsr_slave_0: entered promiscuous mode [ 1124.898578][T17526] Bluetooth: hci8: command tx timeout [ 1124.948551][T17909] hsr_slave_1: entered promiscuous mode [ 1124.965473][T17909] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1124.975434][T17909] Cannot create hsr debugfs directory [ 1125.467827][T17559] ir_usb 8-1:0.126: required endpoints missing [ 1125.505904][T17559] usb 8-1: USB disconnect, device number 2 [ 1125.663259][T17966] pci 0000:00:05.0: vgaarb: VGA decodes changed: olddecodes=none,decodes=io+mem:owns=io+mem [ 1125.838459][T17975] input: syz1 as /devices/virtual/input/input186 [ 1126.915314][T17909] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 1126.980804][T17526] Bluetooth: hci8: command tx timeout [ 1127.030750][T17909] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 1127.068965][T17909] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 1127.336056][T17909] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 1127.633231][T17996] binder: 17984:17996 ioctl c0306201 80000540 returned -22 [ 1128.068824][ T5938] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 1128.190108][T17909] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1128.317725][ T5938] usb 6-1: config 0 has an invalid interface number: 117 but max is 0 [ 1128.388632][ T5938] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1128.425057][T17909] 8021q: adding VLAN 0 to HW filter on device team0 [ 1128.452424][ T5938] usb 6-1: config 0 has no interface number 0 [ 1128.477347][ T1098] bridge0: port 1(bridge_slave_0) entered blocking state [ 1128.484614][ T1098] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1128.508644][ T5938] usb 6-1: config 0 interface 117 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 1128.558467][ T5938] usb 6-1: config 0 interface 117 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1128.586393][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 1128.593673][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1128.709722][ T5938] usb 6-1: New USB device found, idVendor=0afa, idProduct=03e8, bcdDevice=99.d0 [ 1128.732201][ T5938] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1128.754025][ T5938] usb 6-1: Product: syz [ 1128.770832][ T5938] usb 6-1: Manufacturer: syz [ 1128.775512][ T5938] usb 6-1: SerialNumber: syz [ 1128.795023][ T5938] usb 6-1: config 0 descriptor?? [ 1128.961537][T18011] snd_dummy snd_dummy.0: control 0:0:4:syz0:0 is already present [ 1129.005044][T17909] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1129.483167][T17909] veth0_vlan: entered promiscuous mode [ 1129.602698][T17909] veth1_vlan: entered promiscuous mode [ 1129.698095][ T1168] usb 6-1: USB disconnect, device number 5 [ 1129.826660][T17909] veth0_macvtap: entered promiscuous mode [ 1129.862741][T17909] veth1_macvtap: entered promiscuous mode [ 1129.946724][T17909] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1130.077872][T17909] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1130.133251][T17909] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1130.166618][T17909] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1130.175628][T17909] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1130.193577][T17909] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1130.786750][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1130.790368][T17738] usb 5-1: new high-speed USB device number 89 using dummy_hcd [ 1130.930387][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1131.139994][T17738] usb 5-1: Using ep0 maxpacket: 32 [ 1131.148939][T17738] usb 5-1: config 0 has an invalid interface number: 126 but max is 0 [ 1131.157544][T17738] usb 5-1: config 0 has no interface number 0 [ 1131.164583][T17738] usb 5-1: config 0 interface 126 altsetting 16 bulk endpoint 0x6 has invalid maxpacket 1023 [ 1131.222014][T17738] usb 5-1: config 0 interface 126 has no altsetting 0 [ 1131.285939][T17738] usb 5-1: New USB device found, idVendor=09c4, idProduct=0011, bcdDevice=b0.1c [ 1131.295456][T17738] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1131.357850][T17738] usb 5-1: Product: syz [ 1131.421812][T17738] usb 5-1: Manufacturer: syz [ 1131.430317][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1131.440521][T17738] usb 5-1: SerialNumber: syz [ 1131.456415][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1131.478198][T17738] usb 5-1: config 0 descriptor?? [ 1131.501621][T18025] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 1131.729936][T18023] netlink: 'syz.4.2961': attribute type 5 has an invalid length. [ 1132.272369][T18041] input: syz1 as /devices/virtual/input/input189 [ 1132.841306][T18048] binder: 18043:18048 ioctl c0306201 80000540 returned -22 [ 1133.235580][T18050] tipc: Started in network mode [ 1133.243623][T18050] tipc: Node identity aaaaaaaaaa2a, cluster identity 4711 [ 1133.488236][T18050] tipc: Enabled bearer , priority 15 [ 1134.198505][T18055] netlink: 12 bytes leftover after parsing attributes in process `syz.8.2966'. [ 1134.229391][T18055] netlink: 12 bytes leftover after parsing attributes in process `syz.8.2966'. [ 1134.253350][T18055] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 1134.534371][ T1168] tipc: Node number set to 8432298 [ 1135.239247][T18061] input: syz1 as /devices/virtual/input/input190 [ 1135.847849][T17738] ir_usb 5-1:0.126: required endpoints missing [ 1135.905384][T17738] usb 5-1: USB disconnect, device number 89 [ 1135.980648][T18067] input: syz1 as /devices/virtual/input/input191 [ 1136.891795][T18082] binder: 18077:18082 ioctl c0306201 80000540 returned -22 [ 1138.376104][T18094] tipc: Started in network mode [ 1138.382003][T18094] tipc: Node identity aaaaaaaaaa2a, cluster identity 4711 [ 1138.391541][T18094] tipc: Enabled bearer , priority 15 [ 1138.557158][T18100] netlink: 'syz.6.2977': attribute type 3 has an invalid length. [ 1138.729549][T18100] netlink: 830 bytes leftover after parsing attributes in process `syz.6.2977'. [ 1138.783332][T18100] bond_slave_0: entered promiscuous mode [ 1138.789221][T18100] bond_slave_1: entered promiscuous mode [ 1138.871311][T18100] netlink: 988 bytes leftover after parsing attributes in process `syz.6.2977'. [ 1139.021687][T18111] input: syz1 as /devices/virtual/input/input192 [ 1139.028754][ T1168] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 1139.162652][ T5975] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 1139.233277][ T1168] usb 8-1: Using ep0 maxpacket: 32 [ 1139.245572][ T1168] usb 8-1: config 0 has an invalid interface number: 126 but max is 0 [ 1139.259069][ T1168] usb 8-1: config 0 has no interface number 0 [ 1139.265543][ T1168] usb 8-1: config 0 interface 126 altsetting 16 bulk endpoint 0x6 has invalid maxpacket 1023 [ 1139.345201][ T1168] usb 8-1: config 0 interface 126 altsetting 16 bulk endpoint 0x82 has invalid maxpacket 8 [ 1139.387101][ T1168] usb 8-1: config 0 interface 126 has no altsetting 0 [ 1139.389854][ T5975] usb 7-1: too many endpoints for config 0 interface 0 altsetting 1: 33, using maximum allowed: 30 [ 1139.394430][ T5924] tipc: Node number set to 8432298 [ 1139.504385][ T5975] usb 7-1: config 0 interface 0 altsetting 1 endpoint 0x2 has an invalid bInterval 86, changing to 10 [ 1139.516316][ T5975] usb 7-1: config 0 interface 0 altsetting 1 has 2 endpoint descriptors, different from the interface descriptor's value: 33 [ 1139.540244][ T5975] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1139.547232][ T5975] usb 7-1: New USB device found, idVendor=046d, idProduct=c20a, bcdDevice= 0.00 [ 1139.556611][ T5975] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1139.577433][ T1168] usb 8-1: New USB device found, idVendor=09c4, idProduct=0011, bcdDevice=b0.1c [ 1139.601431][ T5975] usb 7-1: config 0 descriptor?? [ 1139.635164][ T1168] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1139.663048][ T1168] usb 8-1: Product: syz [ 1139.684066][ T1168] usb 8-1: Manufacturer: syz [ 1139.708554][ T1168] usb 8-1: SerialNumber: syz [ 1139.922311][ T1168] usb 8-1: config 0 descriptor?? [ 1139.946171][T18107] raw-gadget.1 gadget.7: fail, usb_ep_enable returned -22 [ 1139.955201][T18107] raw-gadget.1 gadget.7: fail, usb_ep_enable returned -22 [ 1140.099474][ T5975] logitech 0003:046D:C20A.0014: hidraw0: USB HID v8.00 Device [HID 046d:c20a] on usb-dummy_hcd.6-1/input0 [ 1140.148748][ T5975] logitech 0003:046D:C20A.0014: no inputs found [ 1140.197816][T18101] netlink: 'syz.7.2974': attribute type 5 has an invalid length. [ 1140.311733][ T5975] usb 7-1: USB disconnect, device number 2 [ 1140.721368][T18114] fido_id[18114]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.6/usb7/report_descriptor': No such file or directory [ 1140.997201][T18116] can: request_module (can-proto-4) failed. [ 1142.138511][ T5938] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 1142.272987][T18136] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2982'. [ 1142.316550][T18136] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2982'. [ 1142.388426][ T5938] usb 7-1: Using ep0 maxpacket: 32 [ 1142.458947][ T5938] usb 7-1: config 0 has an invalid interface number: 126 but max is 0 [ 1142.528739][ T5938] usb 7-1: config 0 has no interface number 0 [ 1142.534926][ T5938] usb 7-1: config 0 interface 126 altsetting 16 bulk endpoint 0x6 has invalid maxpacket 1023 [ 1142.605066][ T5938] usb 7-1: config 0 interface 126 has no altsetting 0 [ 1142.677779][ T1168] ir_usb 8-1:0.126: IR Dongle converter detected [ 1142.688558][ T1168] usb 8-1: IRDA class descriptor not found, device not bound [ 1142.720289][ T5938] usb 7-1: New USB device found, idVendor=09c4, idProduct=0011, bcdDevice=b0.1c [ 1142.776723][ T1168] usb 8-1: USB disconnect, device number 3 [ 1142.806442][ T5938] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1142.818719][ T5938] usb 7-1: Product: syz [ 1142.824007][ T5938] usb 7-1: Manufacturer: syz [ 1142.829087][ T5938] usb 7-1: SerialNumber: syz [ 1142.897152][ T5938] usb 7-1: config 0 descriptor?? [ 1142.910504][T18127] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 1142.963082][T18142] netlink: 52 bytes leftover after parsing attributes in process `syz.5.2983'. [ 1143.141761][T18125] netlink: 'syz.6.2980': attribute type 5 has an invalid length. [ 1144.144973][T18159] binder: 18150:18159 ioctl c0306201 80000540 returned -22 [ 1144.180627][T18164] netlink: 12 bytes leftover after parsing attributes in process `syz.7.2985'. [ 1144.194117][T18164] netlink: 12 bytes leftover after parsing attributes in process `syz.7.2985'. [ 1145.050616][T18160] tipc: Enabling of bearer rejected, already enabled [ 1145.141311][T18164] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 1145.481916][ T5938] ir_usb 7-1:0.126: required endpoints missing [ 1145.515539][ T5938] usb 7-1: USB disconnect, device number 3 [ 1145.995385][T18178] binder: 18172:18178 ioctl c0306201 80000540 returned -22 [ 1146.118421][ T5938] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 1146.452036][ T5938] usb 6-1: config 0 has an invalid interface number: 117 but max is 0 [ 1146.466334][ T5938] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1146.803321][T18182] input: syz1 as /devices/virtual/input/input193 [ 1146.856348][ T5938] usb 6-1: config 0 has no interface number 0 [ 1146.862731][ T5938] usb 6-1: config 0 interface 117 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 1146.872874][ T5938] usb 6-1: config 0 interface 117 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1146.888556][ T5938] usb 6-1: New USB device found, idVendor=0afa, idProduct=03e8, bcdDevice=99.d0 [ 1146.897918][ T5938] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1146.906123][ T5938] usb 6-1: Product: syz [ 1146.910527][ T5938] usb 6-1: Manufacturer: syz [ 1146.915586][ T5938] usb 6-1: SerialNumber: syz [ 1146.954141][ T5938] usb 6-1: config 0 descriptor?? [ 1147.675411][T18194] snd_dummy snd_dummy.0: control 0:0:4:syz0:0 is already present [ 1148.411285][T16871] usb 6-1: USB disconnect, device number 6 [ 1149.098639][T18208] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2994'. [ 1149.118490][T18208] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2994'. [ 1149.150255][T18208] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 1149.315042][T18212] input: syz1 as /devices/virtual/input/input195 [ 1149.332892][T18213] input: syz1 as /devices/virtual/input/input196 [ 1151.300754][T18221] can: request_module (can-proto-4) failed. [ 1152.030457][T18237] netlink: 12 bytes leftover after parsing attributes in process `syz.6.3001'. [ 1152.048628][T18237] netlink: 12 bytes leftover after parsing attributes in process `syz.6.3001'. [ 1152.084692][T18236] input: syz1 as /devices/virtual/input/input197 [ 1152.119314][T18239] tipc: Started in network mode [ 1152.126403][T18239] tipc: Node identity aaaaaaaaaa2a, cluster identity 4711 [ 1152.160315][T18239] tipc: Enabled bearer , priority 15 [ 1152.397048][T18237] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 1152.503828][T18244] binder: 18238:18244 ioctl c0306201 80000540 returned -22 [ 1153.278448][T16871] tipc: Node number set to 8432298 [ 1153.958478][T16871] usb 8-1: new high-speed USB device number 4 using dummy_hcd [ 1154.128544][T16871] usb 8-1: Using ep0 maxpacket: 32 [ 1154.163392][T16871] usb 8-1: config 0 has an invalid interface number: 126 but max is 0 [ 1154.192976][T16871] usb 8-1: config 0 has no interface number 0 [ 1154.204200][T16871] usb 8-1: config 0 interface 126 altsetting 16 bulk endpoint 0x6 has invalid maxpacket 1023 [ 1154.278443][T16871] usb 8-1: config 0 interface 126 altsetting 16 bulk endpoint 0x82 has invalid maxpacket 8 [ 1154.338898][T16871] usb 8-1: config 0 interface 126 has no altsetting 0 [ 1154.352284][T16871] usb 8-1: New USB device found, idVendor=09c4, idProduct=0011, bcdDevice=b0.1c [ 1154.361730][T16871] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1154.369936][T16871] usb 8-1: Product: syz [ 1154.374213][T16871] usb 8-1: Manufacturer: syz [ 1154.384409][T16871] usb 8-1: SerialNumber: syz [ 1154.405350][T16871] usb 8-1: config 0 descriptor?? [ 1154.420557][T18254] raw-gadget.0 gadget.7: fail, usb_ep_enable returned -22 [ 1154.432243][T18254] raw-gadget.0 gadget.7: fail, usb_ep_enable returned -22 [ 1154.659045][T18252] netlink: 'syz.7.3004': attribute type 5 has an invalid length. [ 1154.909843][T18263] binder: 18256:18263 ioctl c0306201 80000540 returned -22 [ 1155.033770][T18266] input: syz1 as /devices/virtual/input/input198 [ 1155.677442][T18271] loop4: detected capacity change from 0 to 524255232 [ 1155.928863][T18269] loop4: detected capacity change from 524255232 to 524287935 [ 1156.443396][T16871] ir_usb 8-1:0.126: IR Dongle converter detected [ 1156.451682][T16871] usb 8-1: IRDA class descriptor not found, device not bound [ 1156.544635][T16871] usb 8-1: USB disconnect, device number 4 [ 1157.174968][T18285] binder: 18276:18285 ioctl c0306201 80000540 returned -22 [ 1158.146954][T18292] can: request_module (can-proto-4) failed. [ 1158.258653][T17738] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 1158.453414][T17738] usb 7-1: Using ep0 maxpacket: 32 [ 1158.485417][T17738] usb 7-1: config 0 has an invalid interface number: 126 but max is 0 [ 1158.499018][T17738] usb 7-1: config 0 has no interface number 0 [ 1158.505528][T17738] usb 7-1: config 0 interface 126 altsetting 16 bulk endpoint 0x6 has invalid maxpacket 1023 [ 1158.560227][T17738] usb 7-1: config 0 interface 126 altsetting 16 bulk endpoint 0x82 has invalid maxpacket 8 [ 1158.619001][T17738] usb 7-1: config 0 interface 126 has no altsetting 0 [ 1158.658478][T17738] usb 7-1: New USB device found, idVendor=09c4, idProduct=0011, bcdDevice=b0.1c [ 1158.667752][T17738] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1158.703308][T17738] usb 7-1: Product: syz [ 1158.714522][T17738] usb 7-1: Manufacturer: syz [ 1158.752500][T17738] usb 7-1: SerialNumber: syz [ 1158.780186][T17738] usb 7-1: config 0 descriptor?? [ 1158.820864][T18298] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 1158.845602][T18298] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 1159.102318][T18294] netlink: 'syz.6.3011': attribute type 5 has an invalid length. [ 1160.481269][T18310] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3013'. [ 1160.509310][T18310] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3013'. [ 1160.603711][T18313] tipc: Enabling of bearer rejected, already enabled [ 1161.014567][T18319] input: syz1 as /devices/virtual/input/input199 [ 1161.219467][T17738] ir_usb 7-1:0.126: IR Dongle converter detected [ 1161.247155][T17738] usb 7-1: IRDA class descriptor not found, device not bound [ 1161.366444][T17738] usb 7-1: USB disconnect, device number 4 [ 1161.462408][T18325] netlink: 4 bytes leftover after parsing attributes in process `syz.8.3017'. [ 1161.475972][T18325] netlink: 4 bytes leftover after parsing attributes in process `syz.8.3017'. [ 1161.506804][T18325] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 1163.498152][T18347] snd_dummy snd_dummy.0: control 0:0:4:syz0:0 is already present [ 1165.006893][T18355] netlink: 16 bytes leftover after parsing attributes in process `syz.7.3024'. [ 1165.121165][T18355] netlink: 16 bytes leftover after parsing attributes in process `syz.7.3024'. [ 1165.455005][T18372] tipc: Enabling of bearer rejected, already enabled [ 1165.482652][T18374] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3027'. [ 1165.491981][T18374] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3027'. [ 1165.505186][T18374] netlink: 20 bytes leftover after parsing attributes in process `syz.5.3027'. [ 1165.556134][T18374] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3027'. [ 1165.565269][T18374] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3027'. [ 1165.574289][T18374] netlink: 20 bytes leftover after parsing attributes in process `syz.5.3027'. [ 1165.743924][T18374] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 1165.978267][T18377] can: request_module (can-proto-4) failed. [ 1166.344447][T18384] netlink: 'syz.7.3030': attribute type 3 has an invalid length. [ 1166.585156][T18384] netlink: 830 bytes leftover after parsing attributes in process `syz.7.3030'. [ 1166.687413][T18384] bond_slave_0: entered promiscuous mode [ 1166.693290][T18384] bond_slave_1: entered promiscuous mode [ 1167.318040][ T1218] dvb-usb: did not find the firmware file 'dvb-usb-bluebird-01.fw' (status -110). You can use /scripts/get_dvb_firmware to get the firmware [ 1167.358840][ T1218] dvb_usb_cxusb 2-1:5.10: probe with driver dvb_usb_cxusb failed with error -22 [ 1167.390937][ T1218] dvb-usb: found a 'DViCO FusionHDTV DVB-T USB (LGZ201)' in cold state, will try to load a firmware [ 1167.444789][ T1218] usb 2-1: Direct firmware load for dvb-usb-bluebird-01.fw failed with error -2 [ 1167.473066][ T1218] usb 2-1: Falling back to sysfs fallback for: dvb-usb-bluebird-01.fw [ 1169.154660][T18414] input: syz1 as /devices/virtual/input/input201 [ 1171.910556][T18430] tipc: Enabling of bearer rejected, already enabled [ 1171.933365][T18435] snd_dummy snd_dummy.0: control 0:0:4:syz0:0 is already present [ 1172.742904][ T5938] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 1172.988499][ T5938] usb 6-1: Using ep0 maxpacket: 16 [ 1172.996298][ T5938] usb 6-1: config 255 has an invalid interface number: 122 but max is 0 [ 1173.035365][ T5938] usb 6-1: config 255 has an invalid descriptor of length 0, skipping remainder of the config [ 1173.150910][ T5938] usb 6-1: config 255 has no interface number 0 [ 1173.157271][ T5938] usb 6-1: config 255 interface 122 altsetting 68 endpoint 0x5 has invalid maxpacket 1022, setting to 64 [ 1173.276796][ T5938] usb 6-1: config 255 interface 122 altsetting 68 has an invalid descriptor for endpoint zero, skipping [ 1173.311081][ T5938] usb 6-1: config 255 interface 122 altsetting 68 bulk endpoint 0x8 has invalid maxpacket 32 [ 1173.386886][T18449] netlink: 'syz.6.3045': attribute type 3 has an invalid length. [ 1173.409300][ T5938] usb 6-1: config 255 interface 122 altsetting 68 has an invalid descriptor for endpoint zero, skipping [ 1173.484108][ T5938] usb 6-1: config 255 interface 122 has no altsetting 0 [ 1173.537905][ T5938] usb 6-1: New USB device found, idVendor=05ac, idProduct=0217, bcdDevice=2d.9c [ 1173.589728][T18449] netlink: 830 bytes leftover after parsing attributes in process `syz.6.3045'. [ 1173.610846][ T5938] usb 6-1: New USB device strings: Mfr=3, Product=2, SerialNumber=3 [ 1173.652345][ T5938] usb 6-1: Product: syz [ 1173.668491][ T5938] usb 6-1: Manufacturer: syz [ 1173.687376][ T5938] usb 6-1: SerialNumber: syz [ 1173.729151][T18440] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 1173.942665][T18440] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1173.995877][T18440] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1174.053543][T18440] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1174.095262][T18454] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1174.142762][T18440] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1174.188178][T18454] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1174.235201][ T5938] appletouch 6-1:255.122: Could not find int-in endpoint [ 1174.254650][ T5938] appletouch 6-1:255.122: probe with driver appletouch failed with error -5 [ 1174.285770][ T5938] usbhid 6-1:255.122: couldn't find an input interrupt endpoint [ 1174.308776][T18456] can: request_module (can-proto-4) failed. [ 1174.319963][ T5938] usb 6-1: USB disconnect, device number 7 [ 1175.215162][T18471] snd_dummy snd_dummy.0: control 0:0:4:syz0:0 is already present [ 1176.119210][T18476] netlink: 'syz.7.3052': attribute type 9 has an invalid length. [ 1176.144306][T18476] netlink: 2188 bytes leftover after parsing attributes in process `syz.7.3052'. [ 1176.925314][T18484] binder: 18479:18484 ioctl c0306201 80000540 returned -22 [ 1177.326813][T18491] binder: 18485:18491 ioctl c0306201 80000540 returned -22 [ 1177.545903][ T1304] ieee802154 phy0 wpan0: encryption failed: -22 [ 1177.555649][ T1304] ieee802154 phy1 wpan1: encryption failed: -22 [ 1177.690764][T18496] netlink: 'syz.5.3058': attribute type 3 has an invalid length. [ 1178.208267][T18496] netlink: 830 bytes leftover after parsing attributes in process `syz.5.3058'. [ 1178.227769][T18496] bond_slave_0: entered promiscuous mode [ 1178.233568][T18496] bond_slave_1: entered promiscuous mode [ 1179.698573][ T1168] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 1180.330463][ T1168] usb 6-1: Using ep0 maxpacket: 32 [ 1180.346799][ T1168] usb 6-1: config 0 has an invalid interface number: 126 but max is 0 [ 1180.355669][ T1168] usb 6-1: config 0 has no interface number 0 [ 1180.384435][ T1168] usb 6-1: config 0 interface 126 altsetting 16 bulk endpoint 0x6 has invalid maxpacket 1023 [ 1180.480722][ T1168] usb 6-1: config 0 interface 126 has no altsetting 0 [ 1180.525025][ T1168] usb 6-1: New USB device found, idVendor=09c4, idProduct=0011, bcdDevice=b0.1c [ 1180.574606][ T1168] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1180.628417][ T1168] usb 6-1: Product: syz [ 1180.646704][ T1168] usb 6-1: Manufacturer: syz [ 1180.662690][ T1168] usb 6-1: SerialNumber: syz [ 1180.764461][ T1168] usb 6-1: config 0 descriptor?? [ 1180.782014][T18515] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1181.821927][T18510] netlink: 'syz.5.3062': attribute type 5 has an invalid length. [ 1181.886424][ T1168] ir_usb 6-1:0.126: required endpoints missing [ 1181.897521][ T1168] usb 6-1: USB disconnect, device number 8 [ 1182.614871][T18534] snd_dummy snd_dummy.0: control 0:0:4:syz0:0 is already present [ 1183.904966][T18540] can: request_module (can-proto-4) failed. [ 1184.972857][ T5975] usb 8-1: new high-speed USB device number 5 using dummy_hcd [ 1185.128451][ T5975] usb 8-1: device descriptor read/64, error -71 [ 1185.339643][ T5938] usb 5-1: new high-speed USB device number 90 using dummy_hcd [ 1185.408580][ T5975] usb 8-1: new high-speed USB device number 6 using dummy_hcd [ 1185.529826][ T5938] usb 5-1: Using ep0 maxpacket: 32 [ 1185.562892][ T5938] usb 5-1: config 0 has an invalid interface number: 126 but max is 0 [ 1185.571300][ T5975] usb 8-1: device descriptor read/64, error -71 [ 1185.578209][ T5938] usb 5-1: config 0 has no interface number 0 [ 1185.592164][ T5938] usb 5-1: config 0 interface 126 altsetting 16 bulk endpoint 0x82 has invalid maxpacket 8 [ 1185.659087][ T5938] usb 5-1: config 0 interface 126 has no altsetting 0 [ 1185.714611][ T5975] usb usb8-port1: attempt power cycle [ 1185.838980][ T5938] usb 5-1: New USB device found, idVendor=09c4, idProduct=0011, bcdDevice=b0.1c [ 1185.887044][ T5938] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1185.906678][ T5938] usb 5-1: Product: syz [ 1186.019427][ T5938] usb 5-1: Manufacturer: syz [ 1186.036652][ T5938] usb 5-1: SerialNumber: syz [ 1186.046701][ T5938] usb 5-1: config 0 descriptor?? [ 1186.067844][T18568] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 1186.099548][ T5975] usb 8-1: new high-speed USB device number 7 using dummy_hcd [ 1186.188195][ T5975] usb 8-1: device descriptor read/8, error -71 [ 1186.307049][T18566] netlink: 'syz.4.3073': attribute type 5 has an invalid length. [ 1186.424046][T18574] netlink: 16 bytes leftover after parsing attributes in process `syz.6.3075'. [ 1186.470978][ T5975] usb 8-1: new high-speed USB device number 8 using dummy_hcd [ 1186.535473][ T5975] usb 8-1: device descriptor read/8, error -71 [ 1186.582703][T18574] netlink: 16 bytes leftover after parsing attributes in process `syz.6.3075'. [ 1186.649151][ T5975] usb usb8-port1: unable to enumerate USB device [ 1186.671110][T18579] rtc_cmos 00:00: Alarms can be up to one day in the future [ 1186.690024][T18579] rtc_cmos 00:00: Alarms can be up to one day in the future [ 1188.491042][ T5938] ir_usb 5-1:0.126: required endpoints missing [ 1188.707606][ T5938] usb 5-1: USB disconnect, device number 90 [ 1189.021731][T17559] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 1189.163341][ T5975] usb 8-1: new high-speed USB device number 9 using dummy_hcd [ 1189.217703][T17559] usb 6-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac [ 1189.228344][T17559] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1189.236405][T17559] usb 6-1: Product: syz [ 1189.254264][T17559] usb 6-1: Manufacturer: syz [ 1189.264072][T17559] usb 6-1: SerialNumber: syz [ 1189.303694][T17559] usb 6-1: config 0 descriptor?? [ 1189.329104][T17559] gspca_main: sunplus-2.14.0 probing 055f:c230 [ 1189.348745][ T5975] usb 8-1: Using ep0 maxpacket: 32 [ 1189.364329][ T5975] usb 8-1: config 0 has an invalid interface number: 126 but max is 0 [ 1189.372879][ T5975] usb 8-1: config 0 has no interface number 0 [ 1189.380217][ T5975] usb 8-1: config 0 interface 126 altsetting 16 bulk endpoint 0x6 has invalid maxpacket 1023 [ 1189.391041][ T5975] usb 8-1: config 0 interface 126 has no altsetting 0 [ 1189.422454][ T5975] usb 8-1: New USB device found, idVendor=09c4, idProduct=0011, bcdDevice=b0.1c [ 1189.432815][ T5975] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1189.441386][ T5975] usb 8-1: Product: syz [ 1189.453117][ T5975] usb 8-1: Manufacturer: syz [ 1189.481617][ T5975] usb 8-1: SerialNumber: syz [ 1189.521480][ T5975] usb 8-1: config 0 descriptor?? [ 1189.580244][T18606] raw-gadget.1 gadget.7: fail, usb_ep_enable returned -22 [ 1189.818588][T18602] netlink: 'syz.7.3079': attribute type 5 has an invalid length. [ 1191.792606][ T5975] ir_usb 8-1:0.126: required endpoints missing [ 1191.829069][ T5975] usb 8-1: USB disconnect, device number 9 [ 1192.390935][T18627] netlink: 4 bytes leftover after parsing attributes in process `syz.7.3084'. [ 1192.419684][T18627] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 1192.492019][T18630] input: syz1 as /devices/virtual/input/input206 [ 1192.726917][T18632] can: request_module (can-proto-4) failed. [ 1192.810386][T16871] usb 6-1: USB disconnect, device number 9 [ 1193.588578][ T5924] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 1193.838655][ T5924] usb 7-1: Using ep0 maxpacket: 32 [ 1193.937753][ T5924] usb 7-1: config 0 has an invalid interface number: 126 but max is 0 [ 1194.006841][ T5924] usb 7-1: config 0 has no interface number 0 [ 1194.071460][ T5924] usb 7-1: config 0 interface 126 altsetting 16 bulk endpoint 0x82 has invalid maxpacket 8 [ 1194.173458][ T5924] usb 7-1: config 0 interface 126 has no altsetting 0 [ 1194.184415][ T1168] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 1194.233145][ T5924] usb 7-1: New USB device found, idVendor=09c4, idProduct=0011, bcdDevice=b0.1c [ 1194.264524][ T5924] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1194.314372][ T5924] usb 7-1: Product: syz [ 1194.379893][ T5924] usb 7-1: Manufacturer: syz [ 1194.384573][ T5924] usb 7-1: SerialNumber: syz [ 1194.422416][ T1168] usb 6-1: config 0 has an invalid interface number: 117 but max is 0 [ 1194.448035][ T1168] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1194.461651][ T5924] usb 7-1: config 0 descriptor?? [ 1194.534791][T18643] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 1194.548374][ T1168] usb 6-1: config 0 has no interface number 0 [ 1194.578729][ T1168] usb 6-1: config 0 interface 117 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 1194.696064][ T1168] usb 6-1: config 0 interface 117 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1194.759809][T18642] netlink: 'syz.6.3086': attribute type 5 has an invalid length. [ 1194.848249][ T1168] usb 6-1: New USB device found, idVendor=0afa, idProduct=03e8, bcdDevice=99.d0 [ 1194.872433][ T1168] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1194.893453][ T1168] usb 6-1: Product: syz [ 1194.915041][ T1168] usb 6-1: Manufacturer: syz [ 1194.926224][ T1168] usb 6-1: SerialNumber: syz [ 1195.016726][T18656] binder: 18650:18656 ioctl c0306201 80000540 returned -22 [ 1195.132109][ T1168] usb 6-1: config 0 descriptor?? [ 1196.117402][T18661] tipc: Enabled bearer , priority 0 [ 1196.131641][T18661] syzkaller0: entered promiscuous mode [ 1196.137451][T18661] syzkaller0: entered allmulticast mode [ 1196.337241][T18661] tipc: Resetting bearer [ 1196.388684][T18660] tipc: Resetting bearer [ 1196.469408][T18660] tipc: Disabling bearer [ 1197.476285][ T5938] usb 6-1: USB disconnect, device number 10 [ 1198.247244][ T5924] ir_usb 7-1:0.126: required endpoints missing [ 1198.311338][ T5924] usb 7-1: USB disconnect, device number 5 [ 1198.353716][T18681] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3094'. [ 1198.410379][T18672] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3092'. [ 1198.553671][T18681] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 1198.565303][T18672] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3092'. [ 1199.472729][T18692] IPVS: set_ctl: invalid protocol: 51 224.0.0.2:20001 [ 1200.294632][ T5924] usb 8-1: new high-speed USB device number 10 using dummy_hcd [ 1200.432468][T18706] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3098'. [ 1200.445869][T18706] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 1200.561829][ T5924] usb 8-1: Using ep0 maxpacket: 32 [ 1200.583689][ T5924] usb 8-1: config 0 has an invalid interface number: 126 but max is 0 [ 1200.598082][ T5924] usb 8-1: config 0 has no interface number 0 [ 1200.627619][ T5924] usb 8-1: config 0 interface 126 altsetting 16 bulk endpoint 0x6 has invalid maxpacket 1023 [ 1200.656371][ T5924] usb 8-1: config 0 interface 126 altsetting 16 bulk endpoint 0x82 has invalid maxpacket 8 [ 1200.693035][ T5924] usb 8-1: config 0 interface 126 has no altsetting 0 [ 1200.719056][ T5924] usb 8-1: New USB device found, idVendor=09c4, idProduct=0011, bcdDevice=b0.1c [ 1200.748599][ T5924] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1200.759590][ T5924] usb 8-1: Product: syz [ 1200.763889][ T5924] usb 8-1: Manufacturer: syz [ 1200.777087][ T5924] usb 8-1: SerialNumber: syz [ 1200.802505][ T5924] usb 8-1: config 0 descriptor?? [ 1200.890126][T18701] raw-gadget.0 gadget.7: fail, usb_ep_enable returned -22 [ 1200.903731][T18701] raw-gadget.0 gadget.7: fail, usb_ep_enable returned -22 [ 1201.149245][T18699] netlink: 'syz.7.3097': attribute type 5 has an invalid length. [ 1201.695472][T18713] netlink: 76 bytes leftover after parsing attributes in process `syz.8.3100'. [ 1202.346519][T18717] netlink: 830 bytes leftover after parsing attributes in process `syz.8.3102'. [ 1202.370179][T18717] bond_slave_0: entered promiscuous mode [ 1202.376047][T18717] bond_slave_1: entered promiscuous mode [ 1203.237907][ T5924] ir_usb 8-1:0.126: IR Dongle converter detected [ 1203.293448][ T5924] usb 8-1: IRDA class descriptor not found, device not bound [ 1203.387378][ T5924] usb 8-1: USB disconnect, device number 10 [ 1203.576262][T18727] input: syz1 as /devices/virtual/input/input208 [ 1203.708679][ T30] audit: type=1326 audit(1753743341.076:186): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18728 comm="syz.6.3106" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70ee539 code=0x7ffc0000 [ 1203.781767][ T30] audit: type=1326 audit(1753743341.076:187): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18728 comm="syz.6.3106" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70ee539 code=0x7ffc0000 [ 1203.804705][ T30] audit: type=1326 audit(1753743341.076:188): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18728 comm="syz.6.3106" exe="/root/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf70ee539 code=0x7ffc0000 [ 1203.899289][ T30] audit: type=1326 audit(1753743341.076:189): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18728 comm="syz.6.3106" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70ee539 code=0x7ffc0000 [ 1203.970334][ T30] audit: type=1326 audit(1753743341.076:190): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18728 comm="syz.6.3106" exe="/root/syz-executor" sig=0 arch=40000003 syscall=181 compat=1 ip=0xf70ee539 code=0x7ffc0000 [ 1204.000864][ T30] audit: type=1326 audit(1753743341.076:191): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18728 comm="syz.6.3106" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70ee539 code=0x7ffc0000 [ 1204.024442][ T30] audit: type=1326 audit(1753743341.076:192): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18728 comm="syz.6.3106" exe="/root/syz-executor" sig=0 arch=40000003 syscall=357 compat=1 ip=0xf70ee539 code=0x7ffc0000 [ 1204.047688][ T30] audit: type=1326 audit(1753743341.076:193): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18728 comm="syz.6.3106" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70ee539 code=0x7ffc0000 [ 1204.072365][ T30] audit: type=1326 audit(1753743341.076:194): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18728 comm="syz.6.3106" exe="/root/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf70ee539 code=0x7ffc0000 [ 1204.128851][ T30] audit: type=1326 audit(1753743341.076:195): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18728 comm="syz.6.3106" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70ee539 code=0x7ffc0000 [ 1204.609074][T18740] rtc_cmos 00:00: Alarms can be up to one day in the future [ 1204.679607][T18740] rtc_cmos 00:00: Alarms can be up to one day in the future [ 1205.033627][T18746] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3109'. [ 1205.127358][T18746] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3109'. [ 1205.128508][T18749] can: request_module (can-proto-4) failed. [ 1206.528390][T18774] input: syz1 as /devices/virtual/input/input209 [ 1206.534970][T18774] input: failed to attach handler leds to device input209, error: -6 [ 1206.711738][T18778] netlink: 'syz.5.3117': attribute type 25 has an invalid length. [ 1207.113131][T18791] netlink: 4 bytes leftover after parsing attributes in process `syz.7.3118'. [ 1207.123984][T18791] netlink: 4 bytes leftover after parsing attributes in process `syz.7.3118'. [ 1207.135381][T18791] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 1207.251704][ T5924] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 1207.551279][ T5924] usb 7-1: Using ep0 maxpacket: 32 [ 1207.593476][ T5924] usb 7-1: config 0 has an invalid interface number: 126 but max is 0 [ 1207.634947][ T5924] usb 7-1: config 0 has no interface number 0 [ 1207.678208][ T5924] usb 7-1: config 0 interface 126 altsetting 16 bulk endpoint 0x6 has invalid maxpacket 1023 [ 1207.715515][ T5924] usb 7-1: config 0 interface 126 altsetting 16 bulk endpoint 0x82 has invalid maxpacket 8 [ 1207.814360][ T5924] usb 7-1: config 0 interface 126 has no altsetting 0 [ 1207.867360][ T5924] usb 7-1: New USB device found, idVendor=09c4, idProduct=0011, bcdDevice=b0.1c [ 1207.896628][ T5924] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1207.935925][ T5924] usb 7-1: Product: syz [ 1207.947893][ T5924] usb 7-1: Manufacturer: syz [ 1207.982810][ T5924] usb 7-1: SerialNumber: syz [ 1208.015231][ T5924] usb 7-1: config 0 descriptor?? [ 1208.050570][T18780] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 1208.058949][T18780] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 1208.327127][T18772] netlink: 'syz.6.3113': attribute type 5 has an invalid length. [ 1208.859898][T18799] input: syz1 as /devices/virtual/input/input210 [ 1209.778272][T18807] netlink: 60 bytes leftover after parsing attributes in process `syz.8.3123'. [ 1209.976840][T18812] netlink: 4 bytes leftover after parsing attributes in process `syz.7.3124'. [ 1210.052856][T18812] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 1210.494608][T18816] netlink: 'syz.4.3125': attribute type 3 has an invalid length. [ 1210.949486][T18818] netlink: 830 bytes leftover after parsing attributes in process `syz.4.3125'. [ 1211.129651][T16871] usb 5-1: new high-speed USB device number 91 using dummy_hcd [ 1211.149575][ T5924] ir_usb 7-1:0.126: IR Dongle converter detected [ 1211.198763][ T5924] usb 7-1: IRDA class descriptor not found, device not bound [ 1211.309679][ T5924] usb 7-1: USB disconnect, device number 6 [ 1211.354462][T16871] usb 5-1: too many endpoints for config 0 interface 0 altsetting 1: 33, using maximum allowed: 30 [ 1211.386871][T16871] usb 5-1: config 0 interface 0 altsetting 1 endpoint 0x2 has an invalid bInterval 86, changing to 10 [ 1211.399364][T18828] netlink: 'syz.6.3129': attribute type 9 has an invalid length. [ 1211.444538][T18828] netlink: 'syz.6.3129': attribute type 7 has an invalid length. [ 1211.456220][T18832] FAULT_INJECTION: forcing a failure. [ 1211.456220][T18832] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1211.462347][T16871] usb 5-1: config 0 interface 0 altsetting 1 has 2 endpoint descriptors, different from the interface descriptor's value: 33 [ 1211.482856][T18828] netlink: 'syz.6.3129': attribute type 8 has an invalid length. [ 1211.519253][T18832] CPU: 0 UID: 0 PID: 18832 Comm: syz.5.3130 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) [ 1211.519282][T18832] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1211.519296][T18832] Call Trace: [ 1211.519305][T18832] [ 1211.519315][T18832] dump_stack_lvl+0x189/0x250 [ 1211.519346][T18832] ? __pfx____ratelimit+0x10/0x10 [ 1211.519370][T18832] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1211.519395][T18832] ? __pfx__printk+0x10/0x10 [ 1211.519424][T18832] ? __might_fault+0xb0/0x130 [ 1211.519464][T18832] should_fail_ex+0x414/0x560 [ 1211.519492][T18832] _copy_from_user+0x2d/0xb0 [ 1211.519523][T18832] get_compat_msghdr+0xad/0x4a0 [ 1211.519562][T18832] ? __pfx_get_compat_msghdr+0x10/0x10 [ 1211.519609][T18832] ___sys_sendmsg+0x193/0x2a0 [ 1211.519633][T18832] ? __pfx____sys_sendmsg+0x10/0x10 [ 1211.519700][T18832] ? __fget_files+0x2a/0x420 [ 1211.519718][T18832] ? __fget_files+0x3a0/0x420 [ 1211.519749][T18832] __sys_sendmsg+0x164/0x220 [ 1211.519772][T18832] ? __pfx___sys_sendmsg+0x10/0x10 [ 1211.519808][T18832] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 1211.519834][T18832] ? lockdep_hardirqs_on+0x9c/0x150 [ 1211.519865][T18832] __do_fast_syscall_32+0xb6/0x2b0 [ 1211.519890][T18832] ? lockdep_hardirqs_on+0x9c/0x150 [ 1211.519917][T18832] do_fast_syscall_32+0x34/0x80 [ 1211.519942][T18832] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1211.519967][T18832] RIP: 0023:0xf7f35539 [ 1211.519985][T18832] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1211.520004][T18832] RSP: 002b:00000000f505655c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 1211.520026][T18832] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800009c0 [ 1211.520041][T18832] RDX: 0000000000000058 RSI: 0000000000000000 RDI: 0000000000000000 [ 1211.520054][T18832] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1211.520067][T18832] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1211.520079][T18832] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1211.520109][T18832] [ 1211.535211][T16871] usb 5-1: config 0 interface 0 has no altsetting 0 [ 1211.830210][T16871] usb 5-1: New USB device found, idVendor=046d, idProduct=c20a, bcdDevice= 0.00 [ 1211.856522][T18837] netlink: 'syz.5.3131': attribute type 3 has an invalid length. [ 1211.864642][T18827] can: request_module (can-proto-4) failed. [ 1211.933094][T16871] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1212.025445][T16871] usb 5-1: config 0 descriptor?? [ 1212.054838][T18840] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3132'. [ 1212.164676][T18837] netlink: 830 bytes leftover after parsing attributes in process `syz.5.3131'. [ 1212.266679][T18837] netlink: 988 bytes leftover after parsing attributes in process `syz.5.3131'. [ 1212.498151][T16871] usbhid 5-1:0.0: can't add hid device: -71 [ 1212.505071][T16871] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 1212.534712][T16871] usb 5-1: USB disconnect, device number 91 [ 1212.546242][T18848] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3134'. [ 1212.557181][T18848] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3134'. [ 1212.579573][ T5924] usb 8-1: new high-speed USB device number 11 using dummy_hcd [ 1212.591429][T17559] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 1212.615356][T18848] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 1212.738779][ T5924] usb 8-1: Using ep0 maxpacket: 16 [ 1212.751054][ T5924] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1212.759616][T17559] usb 6-1: too many endpoints for config 0 interface 0 altsetting 1: 33, using maximum allowed: 30 [ 1212.762399][ T5924] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1212.782102][T17559] usb 6-1: config 0 interface 0 altsetting 1 endpoint 0x2 has an invalid bInterval 86, changing to 10 [ 1212.810702][ T5924] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1212.815035][T17559] usb 6-1: config 0 interface 0 altsetting 1 has 2 endpoint descriptors, different from the interface descriptor's value: 33 [ 1212.869029][ T5924] usb 8-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 1212.915491][ T5924] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1212.920748][T17559] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1212.953527][ T5924] usb 8-1: config 0 descriptor?? [ 1212.955024][T17559] usb 6-1: New USB device found, idVendor=046d, idProduct=c20a, bcdDevice= 0.00 [ 1212.995893][T17559] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1213.019020][T17559] usb 6-1: config 0 descriptor?? [ 1213.531707][T17559] usbhid 6-1:0.0: can't add hid device: -71 [ 1213.537881][T17559] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 1213.568031][ T5924] microsoft 0003:045E:07DA.0015: unknown main item tag 0x0 [ 1213.610677][ T5924] microsoft 0003:045E:07DA.0015: unknown main item tag 0x0 [ 1213.648355][ T5924] microsoft 0003:045E:07DA.0015: unknown main item tag 0x0 [ 1213.658643][T17559] usb 6-1: USB disconnect, device number 11 [ 1213.697902][ T5924] microsoft 0003:045E:07DA.0015: hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.7-1/input0 [ 1213.758556][ T5924] microsoft 0003:045E:07DA.0015: no inputs found [ 1213.798509][ T5924] microsoft 0003:045E:07DA.0015: could not initialize ff, continuing anyway [ 1213.861085][ T5924] usb 8-1: USB disconnect, device number 11 [ 1213.972809][T18855] netlink: 60 bytes leftover after parsing attributes in process `syz.8.3136'. [ 1214.023774][T18854] fido_id[18854]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.7/usb8/report_descriptor': No such file or directory [ 1214.029790][ T31] INFO: task syz.2.2830:17380 blocked for more than 143 seconds. [ 1214.046903][ T31] Not tainted 6.16.0-syzkaller #0 [ 1214.056488][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1214.091283][ T31] task:syz.2.2830 state:D stack:28296 pid:17380 tgid:17374 ppid:7410 task_flags:0x400040 flags:0x20004004 [ 1214.134810][ T31] Call Trace: [ 1214.142100][ T31] [ 1214.150595][ T31] __schedule+0x16fd/0x4cf0 [ 1214.166714][ T31] ? schedule+0x165/0x360 [ 1214.180809][ T31] ? __pfx___schedule+0x10/0x10 [ 1214.200537][ T31] ? schedule+0x91/0x360 [ 1214.225799][ T31] schedule+0x165/0x360 [ 1214.248557][ T31] schedule_preempt_disabled+0x13/0x30 [ 1214.275608][ T31] __mutex_lock+0x724/0xe80 [ 1214.314190][ T31] ? __mutex_lock+0x51b/0xe80 [ 1214.319135][ T31] ? usbdev_open+0x16e/0x760 [ 1214.323810][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 1214.330744][ T31] ? bus_find_device+0x273/0x2b0 [ 1214.335787][ T31] ? __pfx_bus_find_device+0x10/0x10 [ 1214.341422][ T31] ? __kasan_kmalloc+0x93/0xb0 [ 1214.346279][ T31] ? usbdev_open+0xa7/0x760 [ 1214.351107][ T31] usbdev_open+0x16e/0x760 [ 1214.355676][ T31] ? __pfx_usbdev_open+0x10/0x10 [ 1214.360739][ T31] ? do_raw_spin_unlock+0x122/0x240 [ 1214.366182][ T31] chrdev_open+0x4cc/0x5e0 [ 1214.370958][ T31] ? __pfx_chrdev_open+0x10/0x10 [ 1214.376017][ T31] ? __pfx_chrdev_open+0x10/0x10 [ 1214.381156][ T31] do_dentry_open+0xdf3/0x1970 [ 1214.385998][ T31] vfs_open+0x3b/0x340 [ 1214.390316][ T31] ? path_openat+0x2ecd/0x3830 [ 1214.395386][ T31] path_openat+0x2ee5/0x3830 [ 1214.400637][ T31] ? arch_stack_walk+0xfc/0x150 [ 1214.405764][ T31] ? __pfx_path_openat+0x10/0x10 [ 1214.411310][ T31] ? do_fast_syscall_32+0x34/0x80 [ 1214.416560][ T31] ? entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1214.423721][ T31] do_filp_open+0x1fa/0x410 [ 1214.435589][ T31] ? __lock_acquire+0xab9/0xd20 [ 1214.441023][ T31] ? __pfx_do_filp_open+0x10/0x10 [ 1214.446265][ T31] ? _raw_spin_unlock+0x28/0x50 [ 1214.457513][ T31] ? alloc_fd+0x64c/0x6c0 [ 1214.465976][ T31] do_sys_openat2+0x121/0x1c0 [ 1214.475643][ T31] ? __pfx_do_sys_openat2+0x10/0x10 [ 1214.486920][ T31] ? rcu_is_watching+0x15/0xb0 [ 1214.501431][ T31] __ia32_compat_sys_openat+0x131/0x160 [ 1214.507452][ T31] __do_fast_syscall_32+0xb6/0x2b0 [ 1214.513453][ T31] do_fast_syscall_32+0x34/0x80 [ 1214.519743][ T31] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1214.526428][ T31] RIP: 0023:0xf70fe539 [ 1214.534975][ T31] RSP: 002b:00000000f50cd100 EFLAGS: 00000206 ORIG_RAX: 0000000000000127 [ 1214.543986][ T31] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000f50cd150 [ 1214.552482][ T31] RDX: 0000000000101301 RSI: 0000000000000000 RDI: 00000000f7464ff4 [ 1214.561175][ T31] RBP: 0000000000101301 R08: 0000000000000000 R09: 0000000000000000 [ 1214.569872][ T31] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1214.578093][ T31] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1214.587191][ T31] [ 1214.590728][ T31] [ 1214.590728][ T31] Showing all locks held in the system: [ 1214.598658][ T31] 1 lock held by khungtaskd/31: [ 1214.603618][ T31] #0: ffffffff8e13f0e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 1214.613752][ T31] 2 locks held by kworker/u8:7/1157: [ 1214.619353][ T31] #0: ffff8881476b6948 ((wq_completion)iou_exit){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 1214.630722][ T31] #1: ffffc90003e7fbc0 ((work_completion)(&ctx->exit_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 1214.644724][ T31] 6 locks held by kworker/0:3/1218: [ 1214.650354][ T31] #0: ffff888143ee5d48 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 1214.662100][ T31] #1: ffffc9000410fbc0 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 1214.674114][ T31] #2: ffff888144ff1198 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4a20 [ 1214.683339][ T31] #3: ffff88807c0dd198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x400 [ 1214.693081][ T31] #4: ffff8880247e3160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x400 [ 1214.702663][ T31] #5: ffffffff8dfe4850 (umhelper_sem){++++}-{4:4}, at: usermodehelper_read_trylock+0xf0/0x2b0 [ 1214.713417][ T31] 2 locks held by getty/5612: [ 1214.718209][ T31] #0: ffff88814d7180a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 1214.728580][ T31] #1: ffffc9000333b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 [ 1214.741417][ T31] 3 locks held by kworker/u8:0/10115: [ 1214.746876][ T31] #0: ffff88801a489148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 1214.760905][ T31] #1: ffffc9000c46fbc0 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 1214.772186][ T31] #2: ffffffff8f51c1c8 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 [ 1214.781558][ T31] 4 locks held by udevd/10348: [ 1214.786513][ T31] #0: ffff88806520c418 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xb7/0xe10 [ 1214.795490][ T31] #1: ffff888034b8a088 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x55/0x3c0 [ 1214.805321][ T31] #2: ffff888059af20f8 (kn->active#28){++++}-{0:0}, at: kernfs_seq_start+0x75/0x3c0 [ 1214.815156][ T31] #3: ffff88807c0dd198 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 [ 1214.832765][ T31] 1 lock held by syz.2.2830/17380: [ 1214.841168][ T31] #0: ffff888144ff1198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x16e/0x760 [ 1214.853554][ T31] 1 lock held by syz.3.2850/17464: [ 1214.860223][ T31] #0: ffff888144ff1198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x16e/0x760 [ 1214.869539][ T31] 1 lock held by syz.0.2852/17465: [ 1214.875358][ T31] #0: ffff888144ff1198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x16e/0x760 [ 1214.885468][ T31] 1 lock held by syz.1.2907/17745: [ 1214.890961][ T31] #0: ffff888144ff1198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x16e/0x760 [ 1214.900310][ T31] 2 locks held by syz.8.3136/18850: [ 1214.905561][ T31] #0: ffffffff8f51c1c8 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 [ 1214.914683][ T31] #1: ffffffff8e144bf8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2f6/0x730 [ 1214.936159][ T31] [ 1214.938681][ T31] ============================================= [ 1214.938681][ T31] [ 1214.950027][ T31] NMI backtrace for cpu 0 [ 1214.950045][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.16.0-syzkaller #0 PREEMPT(full) [ 1214.950069][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1214.950083][ T31] Call Trace: [ 1214.950092][ T31] [ 1214.950101][ T31] dump_stack_lvl+0x189/0x250 [ 1214.950138][ T31] ? __wake_up_klogd+0xd9/0x110 [ 1214.950170][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1214.950196][ T31] ? __pfx__printk+0x10/0x10 [ 1214.950236][ T31] nmi_cpu_backtrace+0x39e/0x3d0 [ 1214.950271][ T31] ? __pfx_nmi_cpu_backtrace+0x10/0x10 [ 1214.950300][ T31] ? _printk+0xcf/0x120 [ 1214.950334][ T31] ? __pfx__printk+0x10/0x10 [ 1214.950364][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 1214.950389][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 1214.950424][ T31] watchdog+0xfee/0x1030 [ 1214.950447][ T31] ? watchdog+0x1de/0x1030 [ 1214.950475][ T31] kthread+0x711/0x8a0 [ 1214.950509][ T31] ? __pfx_watchdog+0x10/0x10 [ 1214.950528][ T31] ? __pfx_kthread+0x10/0x10 [ 1214.950559][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 1214.950580][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 1214.950602][ T31] ? __pfx_kthread+0x10/0x10 [ 1214.950633][ T31] ret_from_fork+0x3fc/0x770 [ 1214.950659][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 1214.950687][ T31] ? __switch_to_asm+0x39/0x70 [ 1214.950713][ T31] ? __switch_to_asm+0x33/0x70 [ 1214.950738][ T31] ? __pfx_kthread+0x10/0x10 [ 1214.950769][ T31] ret_from_fork_asm+0x1a/0x30 [ 1214.950814][ T31] [ 1214.950823][ T31] Sending NMI from CPU 0 to CPUs 1: [ 1215.110072][ C1] NMI backtrace for cpu 1 [ 1215.110102][ C1] CPU: 1 UID: 0 PID: 18141 Comm: kworker/u8:4 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) [ 1215.110123][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1215.110136][ C1] Workqueue: events_unbound nsim_dev_trap_report_work [ 1215.110178][ C1] RIP: 0010:__sanitizer_cov_trace_switch+0x0/0x130 [ 1215.110207][ C1] Code: 89 74 0a 18 48 89 44 0a 20 c3 cc cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1e fa 48 8b 06 48 8b 4e 08 48 83 c1 f8 48 c1 c1 3d 48 83 f9 [ 1215.110223][ C1] RSP: 0018:ffffc90005057448 EFLAGS: 00000093 [ 1215.110237][ C1] RAX: ffffffff84c14fad RBX: ffffc90005057680 RCX: ffff888030ce8000 [ 1215.110251][ C1] RDX: 0000000000000000 RSI: ffffffff8e8ca4e0 RDI: 0000000000000014 [ 1215.110264][ C1] RBP: 0000000000000014 R08: aa83a18ac19d0475 R09: 4442473836c0f7dc [ 1215.110276][ C1] R10: 0000000000000000 R11: 0000000000000000 R12: dffffc0000000000 [ 1215.110288][ C1] R13: ffffc90005057680 R14: ffffc90005057860 R15: ffffc900050575c0 [ 1215.110301][ C1] FS: 0000000000000000(0000) GS:ffff888125d23000(0000) knlGS:0000000000000000 [ 1215.110316][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1215.110328][ C1] CR2: 00000000f7457994 CR3: 000000006471c000 CR4: 00000000003526f0 [ 1215.110344][ C1] Call Trace: [ 1215.110351][ C1] [ 1215.110365][ C1] chacha_permute+0x2b/0xf00 [ 1215.110403][ C1] ? chacha_block_generic+0x49/0xc80 [ 1215.110428][ C1] chacha_block_generic+0x53/0xc80 [ 1215.110455][ C1] crng_fast_key_erasure+0x14f/0x240 [ 1215.110476][ C1] ? __pfx_crng_fast_key_erasure+0x10/0x10 [ 1215.110503][ C1] crng_make_state+0x255/0x700 [ 1215.110522][ C1] ? crng_make_state+0x13a/0x700 [ 1215.110540][ C1] ? __pfx_crng_make_state+0x10/0x10 [ 1215.110565][ C1] _get_random_bytes+0xd5/0x210 [ 1215.110581][ C1] ? __pfx__get_random_bytes+0x10/0x10 [ 1215.110608][ C1] ? skb_put+0x11b/0x210 [ 1215.110636][ C1] nsim_dev_trap_report_work+0x38d/0xb80 [ 1215.110663][ C1] ? process_scheduled_works+0x9ef/0x17b0 [ 1215.110685][ C1] process_scheduled_works+0xae1/0x17b0 [ 1215.110720][ C1] ? __pfx_process_scheduled_works+0x10/0x10 [ 1215.110748][ C1] worker_thread+0x8a0/0xda0 [ 1215.110769][ C1] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 1215.110792][ C1] ? __kthread_parkme+0x7b/0x200 [ 1215.110818][ C1] kthread+0x711/0x8a0 [ 1215.110843][ C1] ? __pfx_worker_thread+0x10/0x10 [ 1215.110863][ C1] ? __pfx_kthread+0x10/0x10 [ 1215.110887][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 1215.110903][ C1] ? lockdep_hardirqs_on+0x9c/0x150 [ 1215.110921][ C1] ? __pfx_kthread+0x10/0x10 [ 1215.110945][ C1] ret_from_fork+0x3fc/0x770 [ 1215.110965][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 1215.110986][ C1] ? __switch_to_asm+0x39/0x70 [ 1215.111009][ C1] ? __switch_to_asm+0x33/0x70 [ 1215.111030][ C1] ? __pfx_kthread+0x10/0x10 [ 1215.111054][ C1] ret_from_fork_asm+0x1a/0x30 [ 1215.111085][ C1] [ 1215.432329][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 1215.439282][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.16.0-syzkaller #0 PREEMPT(full) [ 1215.449046][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1215.459163][ T31] Call Trace: [ 1215.462491][ T31] [ 1215.465458][ T31] dump_stack_lvl+0x99/0x250 [ 1215.470091][ T31] ? __asan_memcpy+0x40/0x70 [ 1215.474717][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1215.479986][ T31] ? __pfx__printk+0x10/0x10 [ 1215.484628][ T31] panic+0x2db/0x790 [ 1215.488570][ T31] ? __pfx_panic+0x10/0x10 [ 1215.493025][ T31] ? nmi_backtrace_stall_check+0x433/0x440 [ 1215.499079][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 1215.504525][ T31] ? nmi_trigger_cpumask_backtrace+0x2b6/0x300 [ 1215.510829][ T31] watchdog+0x102d/0x1030 [ 1215.515191][ T31] ? watchdog+0x1de/0x1030 [ 1215.519641][ T31] kthread+0x711/0x8a0 [ 1215.523750][ T31] ? __pfx_watchdog+0x10/0x10 [ 1215.528451][ T31] ? __pfx_kthread+0x10/0x10 [ 1215.533078][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 1215.538324][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 1215.543572][ T31] ? __pfx_kthread+0x10/0x10 [ 1215.548293][ T31] ret_from_fork+0x3fc/0x770 [ 1215.552961][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 1215.558128][ T31] ? __switch_to_asm+0x39/0x70 [ 1215.563003][ T31] ? __switch_to_asm+0x33/0x70 [ 1215.567802][ T31] ? __pfx_kthread+0x10/0x10 [ 1215.572534][ T31] ret_from_fork_asm+0x1a/0x30 [ 1215.577347][ T31] [ 1215.580724][ T31] Kernel Offset: disabled [ 1215.585065][ T31] Rebooting in 86400 seconds..