last executing test programs: 2m40.294215186s ago: executing program 0 (id=1026): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20702, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_sctp(0xa, 0x5, 0x84) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_io_uring_setup(0x118d7, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000000)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) getsockname$inet(0xffffffffffffffff, 0x0, &(0x7f0000002280)) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x0, 0xb49, 0x9, 0x8, 0x2, 0x3}, 0x0) mkdir(&(0x7f00000000c0)='./file0\x00', 0x22) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r6, 0x1, 0x1a, &(0x7f0000000000)={0x3, &(0x7f00000000c0)=[{0x20, 0x1}, {0x20, 0x6, 0x2, 0x3b63}, {0x6, 0x0, 0xfe}]}, 0x10) sendmmsg(r5, &(0x7f0000000180), 0x4000190, 0x0) close(r2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f00000004c0)={'syzkaller0\x00', @link_local}) write$tun(r1, &(0x7f00000001c0)=ANY=[], 0xc2) write$cgroup_devices(r1, &(0x7f0000000280)=ANY=[], 0xffdd) 2m31.395486478s ago: executing program 0 (id=1041): r0 = openat$dsp(0xffffffffffffff9c, &(0x7f00000003c0), 0x101a02, 0x0) r1 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000), 0x400, 0x0) readv(r1, &(0x7f00000001c0)=[{0x0}], 0x1) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f0000000080)) ioctl$SNDCTL_DSP_SETTRIGGER(r0, 0x40045010, &(0x7f0000000040)) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000680)="3751f02b82f73ccfc7c431617753f5732f765c975ebce8947e5388c4ff26fa3893119fd147a1576d9456136ab5f15493d175754e4b666e989869d01d418adc376ca22d8077c1b54bea92b5977a41d70ebcc4735ce6c012a5fe5ab7fef98e864216699a25d70e26103e294b7894b34a794bc14a2edfdc6978c0c97bcb02de69264d", 0x81}], 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$bind(&(0x7f00000000c0)='./file0/../file0\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x89901) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000080), 0xffffffffffffffff) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000100), r2) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_NEW_SERVICE(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000100000038000180060001000200000008000500000b101d211d7eedcf00000000000000afcb0900000000000800080000000000080006007369700010765ddbd9e8933b7ff5ef8dcc7bc12f050bac3cb2810ab0eca5581bb6e0557fd26da81f369ad743ecdca6a7cf1ebf4934622bf8c64e1be5300c927466ecf6d2b71fee62efed64d8d7f8d98cf93f95eca22efb1f321b35393cd26d5159e724e855b182b3d5b6bb721a2a2c5f43946f7d6b7ef687c28e9dc25b8195e4715839a0b84ee633d305d71adfe8b35c7fbd907a41a7612b20075952971834f2f44b25db5921193984fc510ed45b7b433fbc5acd319cec90e06a05cf9501a8c0c3adcf2ec4b857f2f5c32eb28fbe7e5cfc0992045f7785c912e15f2bafa2e99f5b0c"], 0x4c}}, 0x0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) set_mempolicy(0x3, &(0x7f0000000080)=0x7, 0x8) socketpair(0x2b, 0x1, 0x0, &(0x7f0000000000)={0x0, 0x0}) r8 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newqdisc={0x34, 0x24, 0xf0b, 0x0, 0xfffffffc, {0x0, 0x0, 0x0, 0x0, {0xffea, 0x4}, {0xffff, 0xffff}, {0x3, 0xffe5}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0xc0}, 0x40) r9 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/keys\x00', 0x0, 0x0) ioctl$KDSKBMETA(r9, 0x4b63, &(0x7f0000000240)=0x4) read$FUSE(r9, &(0x7f0000004200)={0x2020}, 0x2020) syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="12010002000008404c05cc090000000000010902240001000090080904000009030003000921fdff080122090009058103"], 0x0) timer_create(0x3, 0x0, &(0x7f0000044000)=0x0) timer_settime(r10, 0x1, &(0x7f0000040fe0)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_gettime(r10, &(0x7f0000000300)) ioctl$sock_SIOCGIFINDEX_802154(r7, 0x8933, &(0x7f0000000980)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_GET_WPAN_PHY(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)={0x1c, r3, 0xb15, 0x70bd2a, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r11}]}, 0x1c}, 0x1, 0x0, 0x0, 0x2600c8c0}, 0xc880) move_mount(r2, &(0x7f00000001c0)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) 2m30.224493495s ago: executing program 1 (id=1047): syz_usb_connect$printer(0x2, 0x2d, &(0x7f0000000780)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x20, 0x4b8, 0x202, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0x0, 0x80, 0x7f}}]}}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.io_service_bytes\x00', 0x26e1, 0x0) renameat(r3, &(0x7f0000000180)='./file0\x00', r3, &(0x7f00000001c0)='\x00') close(r3) r4 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r4, &(0x7f0000000140)={0x28, 0x0, 0x2710, @local}, 0x10) io_uring_setup(0x73e5, &(0x7f0000000640)={0x0, 0xce32, 0x80, 0x2, 0x2c4, 0x0, r3}) socket$vsock_stream(0x28, 0x1, 0x0) r5 = socket(0xa, 0x1, 0x0) listen(r5, 0x7f) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r5, 0x6, 0x23, &(0x7f0000000140)={&(0x7f0000ffc000/0x4000)=nil, 0x3000, 0x0, 0x0, 0x0, &(0x7f0000001b00)=""/4112, 0x1000, 0x1, 0x0}, &(0x7f0000000180)=0x3a) r6 = accept4(r4, 0x0, 0x0, 0x800) sendto(r6, 0x0, 0x0, 0x0, 0x0, 0x0) syz_open_dev$evdev(&(0x7f0000000280), 0xb0d, 0x344c0) mount(&(0x7f0000000080)=@sg0, &(0x7f00000000c0)='./cgroup\x00', &(0x7f00000001c0)='ubifs\x00', 0x208400, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000007c0)=@newtaction={0x1fc, 0x30, 0x1, 0x0, 0x0, {}, [{0x1e8, 0x1, [@m_mpls={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_MPLS_PARMS={0x1c, 0x2, {{0x200000}}}]}, {0x4, 0x4}, {0xc}, {0xc}}}, @m_simple={0x164, 0x14, 0x0, 0x0, {{0xb}, {0xc4, 0x2, 0x0, 0x1, [@TCA_DEF_DATA={0xb, 0x3, '\xc0$.($-\x00'}, @TCA_DEF_PARMS={0x18, 0x2, {0x8, 0xffffffc1, 0x10000000, 0x6c9625be}}, @TCA_DEF_PARMS={0x18, 0x2, {0x9, 0x3e, 0x7, 0x38, 0xfffffff9}}, @TCA_DEF_DATA={0x8, 0x3, ']$=\x00'}, @TCA_DEF_DATA={0x44, 0x3, '\xc6\xc2\x01\'$\xbc?\xc8Q\x88\xe6B\xb4\x06%\xb2\xf2\xbc\xb9p(o\x05\x83PB\xfc0\xa3u\xc3\xcf5j\x15\x90:]\x13_\xd5\v\xf9\a8\x04Y\x9cW\xff\b\xfa*\xf9\x90)$S\xe8[$[\xd5\xbd'}, @TCA_DEF_DATA={0x7, 0x3, '((\x00'}, @TCA_DEF_PARMS={0x18, 0x2, {0x2, 0x9, 0x8, 0x8, 0x7fff}}, @TCA_DEF_PARMS={0x18, 0x2, {0x800, 0x7, 0x4, 0xffffff07, 0xbf43}}]}, {0x76, 0x6, "0c9fea31b833496dd3dc579a9508933872a11c29ca633b50b3a1963a8e4751928ef38729b994f3d5bd3d1aac7a9e7d7c369be1d94d1c77bf68ef358e1d000f29aa2476e5a221277a8452b0ccbf5ce875ece6f5ffda945dfb7a58c1f3aa199a060ed5c72b4342bcc3b5b2d862936e9eae7440"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}, @m_xt={0x34, 0xf, 0x0, 0x0, {{0x7}, {0xc, 0x2, 0x0, 0x1, [@TCA_IPT_INDEX={0x8, 0x3, 0x8}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2, 0x2}}}}]}]}, 0x1fc}}, 0x0) ioctl$VIDIOC_STREAMON(r3, 0x40045612, &(0x7f0000000100)=0x2) unshare(0x62000280) syz_usb_connect(0x0, 0x3b, &(0x7f0000000080)=ANY=[], 0x0) syz_usb_connect$uac3(0x4, 0x117, &(0x7f0000000340)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x40, 0x8e4, 0x163, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x105, 0x3, 0x1, 0xe, 0x80, 0x7, {0x8, 0xb, 0x2, 0x1, 0x1, 0x25, 0x30, 0x8}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0xf, 0x39, 0xc8}, [@power_domain={0x9, 0x24, 0x10, 0xa1, 0x1000, 0x0, 0x80}, @feature_unit={0x1d, 0x24, 0x7, 0x3, 0x5, [0x3, 0x10, 0xb, 0xc, 0x10, 0x7]}, @mixer_unit={0x9, 0x24, 0x5, 0x1, 0x3, "aa031e5c"}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x779, 0x10, 0xfc, 0x6f}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x1, 0x4}, @format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x5, 0x5, 0x4, 0x5, 0x1}]}, {{0x9, 0x5, 0x1, 0x9, 0x200, 0x4, 0x4, 0x7, {0xa, 0x25, 0x25, 0x4, 0x7, 0xc8f}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_i_continuous={0xb, 0x24, 0x2, 0x1, 0x71, 0x3, 0x3, 0x5, "ba", "dfc3"}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x8, 0x3, 0x4, 0x8}, @format_type_ii_discrete={0x12, 0x24, 0x2, 0x2, 0x6, 0x7, 0x1, "20f048565765fd0e8d"}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x2, 0x5}, @as_header={0x17, 0x24, 0x1, 0x5, 0x7, 0x481a, 0x2, 0x97, 0xfb, 0x8, 0xc}, @format_type_ii_discrete={0xb, 0x24, 0x2, 0x2, 0x4, 0x1, 0x4, 't,'}]}, {{0x9, 0x5, 0x82, 0x9, 0x400, 0x8, 0x0, 0x9, {0xa, 0x25, 0x25, 0x2, 0x81, 0x6}}}}}}}}]}}, &(0x7f0000000600)={0xa, &(0x7f0000000480)={0xa, 0x6, 0x201, 0x6, 0x1, 0xb, 0x10, 0x9}, 0xb2, &(0x7f0000000500)={0x5, 0xf, 0xb2, 0x4, [@ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x59, "e8d773328c61affc0ab142df0ad8466d"}, @generic={0x5f, 0x10, 0xb, "3b0aeef33ad4b32a6fba238f000e855eae0908dd22ae8a46e0fac02d2fa65092f74ab0dade941e34e565da5e41f53dcd5bed7b978381b1e8dece064ed96dc31006225c3bedd8f1347c73029e9747abfda7a6e946096446c77486daa5"}, @generic={0x37, 0x10, 0xb, "bb124143736bcb35eac1efcd43beb9396b4931b805ff1bdaf2fc56a1b6c8f7347560821151539521b2f41702e964ef3625ca453a"}]}, 0x1, [{0x4, &(0x7f00000005c0)=@lang_id={0x4, 0x3, 0x457}}]}) 2m29.853435525s ago: executing program 0 (id=1049): pipe2(&(0x7f0000000000)={0x0, 0x0}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x200000000000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) symlinkat(&(0x7f0000000180)='.\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00') mkdirat(0xffffffffffffff9c, 0x0, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./file7\x00', 0x1ac) renameat2(0xffffffffffffff9c, &(0x7f0000000780)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000000)='./file7/file0\x00', 0x0) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file7/file0\x00', 0x101000, 0x0) getdents64(r3, &(0x7f0000000240)=""/157, 0x9d) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0}, 0x48) syz_io_uring_setup(0x6af9, &(0x7f0000000080)={0x0, 0xe04f, 0xa40, 0x1, 0x272}, &(0x7f0000000200), &(0x7f0000000240), &(0x7f0000000280)) r4 = io_uring_setup(0x28bd, 0x0) seccomp$SECCOMP_SET_MODE_STRICT(0x4000, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_RING_FDS(r4, 0x15, &(0x7f0000004c00), 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0600000004000000001a00000a00000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000000f1876412cc9e8de71a5b7f680d3bbe1facdb4390e136edf39ad6c7086489acfed9c1eece8cdd7ec2cc4244797044ebeb6621fb33450cbac0cbc14dd28b572aedb293a0ccc0685a8f1e58b9d5d78cd2732078579e44acc8d5c8e968b899a86d9e6dbefd57bc8161e24eec1d6b1cedac0875bf2b1032b9fb6ed1a3e8695bd3b"], 0x50) 2m28.706079663s ago: executing program 0 (id=1050): r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000040)={0x1c, &(0x7f0000000240)=ANY=[], 0x0, 0x0}) r1 = syz_usb_connect$cdc_ecm(0x2, 0x57, &(0x7f0000000080)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0xff, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x45, 0x1, 0x1, 0x5, 0x0, 0x7, "", [{{0x9, 0x4, 0x0, 0x1, 0x8, 0x2, 0x6, 0x0, 0x4, {{0x6, 0x24, 0x6, 0x0, 0x0, "86"}, {0x5, 0x24, 0x0, 0x9}, {0xd, 0x24, 0xf, 0x1, 0x1ff, 0x5, 0x8, 0x6}}, {[{{0x9, 0x5, 0x81, 0x3, 0x400, 0x6}}], {{0x9, 0x5, 0x82, 0x2, 0x8, 0xc7, 0x31}}, {{0x9, 0x5, 0x3, 0x2, 0x40, 0x8, 0xa, 0x6}}}}}]}}]}}, &(0x7f00000008c0)={0xa, &(0x7f0000000180)={0xa, 0x6, 0x200, 0x9, 0x8, 0x3, 0xe7, 0x6}, 0xe1, &(0x7f00000001c0)={0x5, 0xf, 0xe1, 0x4, [@generic={0xb6, 0x10, 0xa, "47a441e1025be79531e989388a82859bf7810eb6d6584724329a46824bc780df9b0e3294b039a062b157127603b3c9ee2fc53e8aec79384a214e2c2925f4cc84bb6610d1d96582c4cedacaa3a8c837ed7f24a7f0777721c3c8ceea8d377a0ced78da833eab6dba2f0cb19036e183a5c23c79e9c4513a91f54d2e073f86434c4f66afaaed26d92a3256af0af35abcd0794b745513f289889ef6874a36c8d8bc1e76519542be5ec16b811f1911a549a8014f241f"}, @ext_cap={0x7, 0x10, 0x2, 0x8, 0x6, 0x0, 0x8000}, @ssp_cap={0x14, 0x10, 0xa, 0x8, 0x2, 0x81, 0x0, 0x0, [0x3f00, 0xc00f]}, @wireless={0xb, 0x10, 0x1, 0x2, 0xa0, 0x3, 0xde, 0x7, 0x5}]}, 0x9, [{0xf9, &(0x7f00000002c0)=@string={0xf9, 0x3, "70382d648d116b7b9f340b64afbbec752d68a30a505fb8b7ab192b940d94eb640c63ce73aa1e555e1dd69327f5bc1aafbc4e50bde11cf061f34e8929c0742faca063846cf170c82920e5c63b2db19d47f77c251aaef61d7466e748c74679e23d22efef4815c621f4cacbac35625173ace8d08b203da255d6e916ad3327fe82cb788566466ac8606a0bb2b1d00b255078cf48556c49319eabbb513300e5a7e88893cfbe3e4942072edfc3d1002345f824876f76f0b5dd921ec8527f45f768f3c0f88bc387d72ad666c36df1056f4d38785b4658778b8ff4665297f855044ab4b9a0a5e2141b71ec010bf1459b2e7e2801517eeb0fabcf8d"}}, {0x4, &(0x7f00000003c0)=@lang_id={0x4, 0x3, 0x1007}}, {0x4, &(0x7f0000000400)=@lang_id={0x4, 0x3, 0x404}}, {0x71, &(0x7f0000000440)=@string={0x71, 0x3, "4e9351cf97e3ec633eca8c835f9dcb7bc98963b24aaecdd81030026b3ee86a4f22e55fe2bf66339ace74582288988a931f84a0e657976fedfc98a4f6618f32c03c048593ddd8c2b343facaa321713b4349b8ec5bba2c4887f4317ce205aebacbe7978026befabecbfa43d06ce72d79"}}, {0xad, &(0x7f00000004c0)=@string={0xad, 0x3, "1518f8d55b561ef8674fe15cfaa3251aa4c4e150dbf0366f4a9c2c57bde2e92432da9d3f0785313df1a9cc9317b7ebcdb86ce26ae1684cabc40cb9838f84d3fc7c0dca11876792478b361a63168e08c474775d729fb3396c0c6de1d67961b3755d4bb827cd480a56eeacdb9a35ea505fe872b109fb4df3b509c4c4a60408636d130eb1cc95cadad76098476097e546770c5643e82d6162b5ee60014313cb46510b4ddd88e74b6c8950f9d0"}}, {0x4b, &(0x7f0000000580)=@string={0x4b, 0x3, "343eac263f8d47a0573bc097b23315b86d550910691522921c54961b15181ac95b8dc54de9cb533859129d3866894f408151affabeb19eb26a03d185ff4dafc45721661fdb04736a5e"}}, {0x4, &(0x7f0000000600)=@lang_id={0x4, 0x3, 0x457}}, {0x97, &(0x7f0000000640)=@string={0x97, 0x3, "52520852b65e4f343b5bd7988bec1d41a840ee927505db47b80cc279ea0419692deda2c50a9cd6d3cf091dc7860b0a09f915caf1a5cd29b917c47a8a352c52b5013428e4c3a56f9ab455ce49b0789dc829432d63fb137b18175757066c64f1db22aa8570217eb1f172b34c9edacbbf270f1bc34d1ec0d99f441825cbd4950cb11b7296b0e4d58685c7030ee80b364231e50fd5118e"}}, {0x19, &(0x7f0000000700)=@string={0x19, 0x3, "88fd3e2a030eca8b9b3a5120225b41b1e7d96de9310abf"}}]}) syz_usb_control_io$cdc_ecm(r1, 0x0, 0x0) syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000002040)={0x1c, &(0x7f0000000580)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000b40)={0x44, &(0x7f0000000880)={0x20, 0xd}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 2m26.419682511s ago: executing program 1 (id=1056): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="050028bd7000000000001200000008000300", @ANYRES32=r2], 0x28}, 0x1, 0x0, 0x0, 0x40000}, 0x24000000) (fail_nth: 5) 2m25.943430098s ago: executing program 1 (id=1057): unshare(0x22020600) bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000000)={0x1f, 0x0, @any, 0x0, 0x1}, 0xe) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) semget(0x0, 0x1cd984a8fc881fea, 0x6) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0xa}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x13, &(0x7f0000000200), &(0x7f0000000240)=0x4) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r3, 0x107, 0x8, &(0x7f0000000100)=0x40049, 0x4) syz_emit_ethernet(0x66, &(0x7f0000000540)=ANY=[], 0x0) recvmmsg(r3, &(0x7f0000000480)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=""/11, 0x17}}], 0x400000000000179, 0x10022, 0x0) fsopen(&(0x7f0000000040)='ext4\x00', 0x1) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000500)={'syz0\x00', {0x0, 0x0, 0xffff}, 0x0, [0x0, 0x0, 0x0, 0x10001, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0xfffffff9, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x1, 0x8, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000, 0x0, 0x0, 0x0, 0x0, 0x800000, 0x0, 0x2000000], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x1, 0x0, 0x0, 0x2, 0x0, 0x1200, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x3, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x55f8, 0x0, 0x0, 0x4, 0x8, 0x0, 0x0, 0x0, 0xeaef, 0x630, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1], [0x0, 0x7fff, 0x0, 0x0, 0xfffffffd, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3, 0xffffffff, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0xfffffffa, 0x0, 0x0, 0x0, 0xa7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0x3, 0x0, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0xfffffffd, 0x0, 0x2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x5a1, 0x20000], [0x0, 0x0, 0x3, 0x7f2eb16c, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x7, 0x8, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x200004, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x10, 0x0, 0x2, 0x0, 0x0, 0x2, 0x0, 0x0, 0x8000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x400, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x2]}, 0x45c) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000900)=[{0x0}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x404a046) r4 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r4, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x8, @multicast2}}, 0x24) sendmmsg(r4, &(0x7f0000000180)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18, 0xe000}, 0x5}], 0x1, 0x0) recvmmsg(r4, &(0x7f0000000d00), 0xf000, 0x10002, 0x0) 2m25.322611388s ago: executing program 0 (id=1059): prctl$PR_SET_SECCOMP(0x16, 0x0, &(0x7f0000000180)={0x1, &(0x7f00000001c0)=[{0x200000000006, 0x0, 0x0, 0x9}]}) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newlink={0x3c, 0x10, 0xffffff1f, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_ALL_SLAVES_ACTIVE={0x5}]}}}]}, 0x3c}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x17, 0x0, 0x4, 0x72d6e6ed, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x3}, 0x48) r1 = fsopen(&(0x7f0000000140)='configfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) stat(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)) sendmsg$NFT_MSG_GETOBJ(r2, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000b80)={&(0x7f0000000200)=ANY=[@ANYBLOB="34000000130a030000000097f7d36400000000000900000308000340000000070900010073797a31000000000900020073797a3000000000"], 0x34}, 0x1, 0x0, 0x0, 0x1}, 0x80) fsync(r1) r3 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0x25, 0x4, @void}, 0x10) r4 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000013c0)={0x6, 0x19, &(0x7f0000001640)=ANY=[@ANYBLOB="1800000062a00000000000000900000018100000", @ANYRES32, @ANYBLOB="000000000000000018120000", @ANYRES32=0x1, @ANYBLOB="0000000000000000b703000000000000850000000c000000b700000000000000081c0100ff0f00000320ff0f070000009815f8ff000000001832000004000000000000000000000018130000", @ANYRES32=0x1, @ANYBLOB="0000000000000000185a00000c000000000000000000000018110000", @ANYRES32=0x1, @ANYBLOB="0000000000000000b70200000000000085000000860000001859000005000000000000000000000095000000000000001dbb3d4a5122eed0c5052309d21b9a2195bae7f79f679bff1318b9338b19be4674def38593d9ec66fe84febcdd307d980c17ef0884c3b93fba2212fecd36b22970d30c0cd092efab031812e1b2eceff7b300f0b353a3734af34b02b573cff5e87f20edfdbdb680013bf4b09f95fb0a68e5c06f456fb9a8429732f3af407d8f69c8475dcddad58b74907296dd533ac22eba36149a44e21b017a15cf3079b9aac813d45951c5b3762a4c89180dc010"], &(0x7f00000002c0)='syzkaller\x00', 0x2, 0x1004, &(0x7f00000017c0)=""/4100, 0x40f00, 0x1d, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000001300)={0x9, 0x3}, 0x8, 0x10, &(0x7f0000001340)={0x5, 0x6, 0x60bc, 0x5}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000001380)=[0x1, 0xffffffffffffffff, 0xffffffffffffffff, 0x1], 0x0, 0x10, 0x1}, 0x94) ioctl$XFS_IOC_FD_TO_HANDLE(r1, 0xc038586a, &(0x7f0000001580)={r1, &(0x7f0000001480)='configfs\x00', 0x20000, &(0x7f00000014c0)={@_ha_fsid={[0x989b, 0xfffffffc]}, {0x5, 0x571f, 0x1000, 0x6}}, 0x1000, &(0x7f0000001500)={@_ha_fsid}, &(0x7f0000001540)}) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f00000015c0)={r3, r4, 0x0, r5}, 0x10) r6 = fsmount(r1, 0x0, 0x9) ioctl$VIDIOC_S_AUDOUT(r2, 0x40345632, &(0x7f0000000040)={0xff, "6ec6f9d1f45a911ebf79b96e1834e6d7d0c835dea73c4a927ad85b5a46e361cf"}) fchdir(r6) ioctl$OCFS2_IOC_UNRESVSP(r5, 0x40305829, &(0x7f0000000240)={0x1, 0x0, 0x2, 0x7, 0x400, 0x6}) openat$tun(0xffffffffffffff9c, &(0x7f0000001600), 0x40, 0x0) 2m24.888417369s ago: executing program 0 (id=1062): ioprio_set$pid(0x3, 0x0, 0x4007) sync() openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r0 = socket(0x40000000015, 0x5, 0x0) setsockopt$RDS_CONG_MONITOR(r0, 0x114, 0x6, &(0x7f0000000680)=0x1, 0x4) syz_io_uring_setup(0x10d, &(0x7f0000000540)={0x0, 0xa165, 0x400, 0x6}, &(0x7f0000000240), &(0x7f0000000280), &(0x7f0000000000)) r1 = socket$inet_sctp(0x2, 0x3, 0x84) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, 0x0, 0x0) setsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r1, 0x84, 0x12, &(0x7f0000000040)=0x6, 0x4) setsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f0000000080)=0x6, 0x4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) getpeername$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000140)=0x14) setsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000180)={r2, @multicast1, @multicast2}, 0xc) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) eventfd2(0x0, 0x1) ioctl$VHOST_SET_VRING_ERR(r3, 0x4008af22, 0x0) r4 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$KDSKBENT(r4, 0x4b47, &(0x7f0000000280)={0x6, 0x5, 0x200}) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f00000004c0)="32385b2309a927189e50b49c3aff91fa031016f36d81f1b09ffc06391157e0eb88d8009d0fafd7b800a6fedb62ea50a327946ae70ca35911ee16ad144a04579dcf874362264f77882286471c0ab533c2a6ca3a2dce", 0x55) r5 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340), 0x8000, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f00000005c0)=0x8040) connect(r1, &(0x7f00000003c0)=@ll={0x11, 0x1, r2, 0x1, 0x8, 0x6, @random="925e456d0e4c"}, 0x80) ioctl$TIOCOUTQ(r5, 0x5411, &(0x7f0000000440)) ioctl$UFFDIO_WRITEPROTECT(r5, 0xc018aa06, &(0x7f0000000480)={{&(0x7f0000ffa000/0x3000)=nil, 0x3000}, 0x5}) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000002c0)=@newtaction={0x18, 0x30, 0x10, 0x0, 0x0, {}, [{0x4}]}, 0x18}}, 0x0) recvmsg(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f00000018c0)=""/241, 0xf1}, {&(0x7f0000000640)=""/37, 0x25}], 0x2, &(0x7f00000006c0)=""/227, 0xe3}, 0x40002120) getsockopt$IPT_SO_GET_REVISION_TARGET(r5, 0x0, 0x43, 0xffffffffffffffff, &(0x7f0000000800)) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000840)={0xb, 0x1, 0x7}) getsockopt$inet_sctp_SCTP_RTOINFO(r1, 0x84, 0x0, &(0x7f00000008c0)={0x0, 0x81, 0x400, 0x1}, &(0x7f0000000900)=0x10) 2m22.134205473s ago: executing program 1 (id=1067): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='veno', 0x4) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='attr/prev\x00') fdatasync(r1) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x9, 0x100}, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) syz_open_procfs(0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x6) bind$alg(r3, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(fcrypt)\x00'}, 0x58) r7 = accept(r3, 0x0, 0x0) bind$alg(r3, &(0x7f0000000300)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_hmac_sha384\x00'}, 0x58) recvmsg(r7, &(0x7f000000b680)={0x0, 0x0, &(0x7f000000b600), 0x0, 0x0, 0x0, 0x1000000}, 0x0) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000000300)={0x0, 0x7}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, &(0x7f0000000040)={0x0, 0x6d207ee5}, 0x8) bind$inet6(r2, &(0x7f00000002c0)={0xa, 0x4e23, 0x0, @loopback, 0x8}, 0x1c) sendmmsg$inet6(r2, &(0x7f0000001140)=[{{&(0x7f0000000580)={0xa, 0x4e23, 0x1, @loopback, 0x20}, 0x1c, &(0x7f00000006c0)=[{&(0x7f0000001680)='\t', 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000400)}], 0x1}}], 0x2, 0x8020) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x2, 0x3ff, @loopback, 0x8}, 0x1c) 2m21.185517537s ago: executing program 1 (id=1070): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet6(0xa, 0x2, 0x0) close(0x3) r2 = socket$l2tp6(0xa, 0x2, 0x73) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000280)={@mcast1, 0x800, 0x0, 0x103, 0x1}, 0x20) setsockopt$inet6_int(r1, 0x29, 0x1000000000021, &(0x7f0000000040)=0x5, 0x4) sendmsg$inet6(r2, &(0x7f0000000100)={&(0x7f0000000080)={0xa, 0x4e21, 0x2080000, @private0, 0x10}, 0x1c, 0x0, 0x0, &(0x7f00000002c0)=[@hopopts={{0x18, 0x29, 0x36, {0x3a}}}, @hopopts_2292={{0x18, 0x29, 0x36, {0x1d}}}], 0x30}, 0x440e0) socket$inet6(0xa, 0x3, 0x1) syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), r0) 2m20.788342987s ago: executing program 1 (id=1072): openat(0xffffffffffffff9c, &(0x7f0000000080)='./file3\x00', 0x105042, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r2 = syz_open_dev$vbi(&(0x7f00000000c0), 0x2, 0x2) ioctl$VIDIOC_S_FREQUENCY(r2, 0x402c5639, &(0x7f00000002c0)={0x5, 0x2, 0x3}) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_MSG_GETFLOWTABLE(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)={0x2c, 0x17, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x0) r4 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r4, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, 0x0) r7 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r7, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0) gettid() ioctl$VT_RESIZEX(r1, 0x560a, &(0x7f00000006c0)={0x4, 0x0, 0x0, 0x0, 0x132, 0x3}) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2031, 0x60}, [@IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8}]}, @IFLA_GROUP={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x20048054}, 0x0) socket$unix(0x1, 0x5, 0x0) mount(&(0x7f0000000280)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000300)='./file3\x00', &(0x7f0000000340)='gfs2\x00', 0x0, 0x0) 2m9.652928915s ago: executing program 32 (id=1062): ioprio_set$pid(0x3, 0x0, 0x4007) sync() openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r0 = socket(0x40000000015, 0x5, 0x0) setsockopt$RDS_CONG_MONITOR(r0, 0x114, 0x6, &(0x7f0000000680)=0x1, 0x4) syz_io_uring_setup(0x10d, &(0x7f0000000540)={0x0, 0xa165, 0x400, 0x6}, &(0x7f0000000240), &(0x7f0000000280), &(0x7f0000000000)) r1 = socket$inet_sctp(0x2, 0x3, 0x84) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, 0x0, 0x0) setsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r1, 0x84, 0x12, &(0x7f0000000040)=0x6, 0x4) setsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f0000000080)=0x6, 0x4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) getpeername$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000140)=0x14) setsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000180)={r2, @multicast1, @multicast2}, 0xc) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) eventfd2(0x0, 0x1) ioctl$VHOST_SET_VRING_ERR(r3, 0x4008af22, 0x0) r4 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$KDSKBENT(r4, 0x4b47, &(0x7f0000000280)={0x6, 0x5, 0x200}) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f00000004c0)="32385b2309a927189e50b49c3aff91fa031016f36d81f1b09ffc06391157e0eb88d8009d0fafd7b800a6fedb62ea50a327946ae70ca35911ee16ad144a04579dcf874362264f77882286471c0ab533c2a6ca3a2dce", 0x55) r5 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340), 0x8000, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f00000005c0)=0x8040) connect(r1, &(0x7f00000003c0)=@ll={0x11, 0x1, r2, 0x1, 0x8, 0x6, @random="925e456d0e4c"}, 0x80) ioctl$TIOCOUTQ(r5, 0x5411, &(0x7f0000000440)) ioctl$UFFDIO_WRITEPROTECT(r5, 0xc018aa06, &(0x7f0000000480)={{&(0x7f0000ffa000/0x3000)=nil, 0x3000}, 0x5}) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000002c0)=@newtaction={0x18, 0x30, 0x10, 0x0, 0x0, {}, [{0x4}]}, 0x18}}, 0x0) recvmsg(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f00000018c0)=""/241, 0xf1}, {&(0x7f0000000640)=""/37, 0x25}], 0x2, &(0x7f00000006c0)=""/227, 0xe3}, 0x40002120) getsockopt$IPT_SO_GET_REVISION_TARGET(r5, 0x0, 0x43, 0xffffffffffffffff, &(0x7f0000000800)) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000840)={0xb, 0x1, 0x7}) getsockopt$inet_sctp_SCTP_RTOINFO(r1, 0x84, 0x0, &(0x7f00000008c0)={0x0, 0x81, 0x400, 0x1}, &(0x7f0000000900)=0x10) 2m5.690563023s ago: executing program 33 (id=1072): openat(0xffffffffffffff9c, &(0x7f0000000080)='./file3\x00', 0x105042, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r2 = syz_open_dev$vbi(&(0x7f00000000c0), 0x2, 0x2) ioctl$VIDIOC_S_FREQUENCY(r2, 0x402c5639, &(0x7f00000002c0)={0x5, 0x2, 0x3}) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_MSG_GETFLOWTABLE(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)={0x2c, 0x17, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x0) r4 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r4, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, 0x0) r7 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r7, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0) gettid() ioctl$VT_RESIZEX(r1, 0x560a, &(0x7f00000006c0)={0x4, 0x0, 0x0, 0x0, 0x132, 0x3}) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2031, 0x60}, [@IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8}]}, @IFLA_GROUP={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x20048054}, 0x0) socket$unix(0x1, 0x5, 0x0) mount(&(0x7f0000000280)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000300)='./file3\x00', &(0x7f0000000340)='gfs2\x00', 0x0, 0x0) 11.591991659s ago: executing program 4 (id=1428): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) listen(0xffffffffffffffff, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x200000000000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) openat$procfs(0xffffffffffffff9c, &(0x7f0000000280)='/proc/schedstat\x00', 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) pselect6(0x2000, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x300}, 0x0, &(0x7f0000000100)={0x8}, 0x0, 0x0) r1 = getpid() r2 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000003173610ef171e7206de010203010902f3c8010000000009040000000206"], 0x0) syz_usb_control_io$rtl8150(r2, 0x0, &(0x7f00000005c0)={0x2c, &(0x7f0000000080)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0}) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r4, &(0x7f0000000300), 0x0, 0x20000841) ioctl$int_in(r4, 0x5452, &(0x7f0000000340)=0x9) pselect6(0x40, &(0x7f0000000040)={0x0, 0xfffffffffffffffc, 0x5, 0x0, 0xffffffc, 0x1, 0x0, 0xfffffffffffffffa}, &(0x7f0000000000)={0x18, 0x8, 0x1ff, 0x0, 0x7ff, 0x400000, 0x0, 0x92}, 0x0, 0x0, 0x0) read$msr(r3, &(0x7f0000001a40)=""/102392, 0x18ff8) r5 = syz_open_dev$mouse(&(0x7f00000000c0), 0x0, 0x2042) writev(r5, &(0x7f0000000000)=[{&(0x7f0000000640)="f3", 0xf000}], 0x1) copy_file_range(r3, 0x0, r5, 0x0, 0x7f, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) socket$kcm(0x10, 0x2, 0x0) r6 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mmap$IORING_OFF_SQES(&(0x7f0000ec8000/0xe000)=nil, 0xe000, 0x2000000, 0x13, r6, 0x10000000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) 11.410403061s ago: executing program 5 (id=1429): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010600000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff1b000000020000000900010073797a30000001000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="36616a5e8c3c071826992e654df2477d43be3c72a94a8c035cd9f318a54166019eadccc182614a6571c2ea18bf5ed6b43fd18589c6f80f1708ed3e7b6745edac15074d8a2d5ae64bd2ff2641a2e5ef237bf24cbcca0d23c655ad0d42557685c465e483c770b2bb601b201aff0cf65ba560b12dc7014ed70b49207e4e119b3458f69b2584171dc379719d748986748bc0f13dd28ba6d39ae3d995b41e2c19b3", @ANYRES16=r0], 0x64}}, 0x480d0) sendmsg$NFT_BATCH(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000280)=ANY=[@ANYRES64=r0], 0x70}}, 0x40) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000340), 0x80002, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f0000000140), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) userfaultfd(0x80001) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) write$tun(r3, 0x0, 0xfdef) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0xc, 0x0, 0x0) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000000)=0x1ff, 0x4) getsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x4, &(0x7f0000000040)=""/8, &(0x7f00000001c0)=0x5fff61231fef39f8) socket$packet(0x11, 0x3, 0x300) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r4, 0x6, 0x1e, 0x0, 0x0) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x800, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000300)='./cgroup.net/syz0\x00', 0x1ff) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_freezer_state(r5, &(0x7f0000000140), 0x2, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000400), 0x10f280, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) socketpair$nbd(0x1, 0x1, 0x0, 0x0) 10.41721383s ago: executing program 5 (id=1431): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r2, 0x29, 0x3, &(0x7f0000000000)=0x1, 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x200, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket(0x400000000010, 0x3, 0xfffffffc) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r5 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$fou(&(0x7f0000000b80), 0xffffffffffffffff) sendmsg$FOU_CMD_ADD(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000680)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r7, @ANYBLOB="010027bd7000fddbdf25010000000500ae040002000000ab40ff768c82763accd201942883edc1230ac7ef9c678b2f8e5dac27365c8bfc42984fc87520fdcd860afcd0c648bc9a3f4c5508df0a50dd8ffcf097f2f0af5477634126cfa3c0c5b5851c4ad79e95342f512a4f00e1fdada347934796b24b49ce7d82fd025ca756cba78fd3c6af9ea519018e3f58256806aea5ee72ece55b000cfd32f809f75c5aeef51fe9a67b59a5feef39ccab0c5c9251758220e3a4718e0e7a"], 0x1c}, 0x1, 0x0, 0x0, 0x20004095}, 0x4000000) sendmsg$FOU_CMD_ADD(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000500)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r7, @ANYBLOB="010028bd7000fcdbdf25010035ffffe5b2d3c48b5dccea420600000500040002080000c1e2dda3486e0b70b6fd2962340253a9d60b848448e0813d7280ffa40f0000006669b254c5eb3a5a075f2f0fc6f6e750fb49bef4983f8b7f41396fcbd0902c41d60d4f2fdedeccbfda1814b65b38d738ea1c24d8d55ca2afb0"], 0x1c}}, 0x40080) ptrace(0x10, r5) file_getattr(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x400) r8 = socket(0x2, 0x80805, 0x9) flistxattr(r8, &(0x7f0000000240)=""/53, 0x35) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r1, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000a00)=@gettaction={0x174, 0x32, 0x4, 0x70bd2a, 0x25dfdbff, {}, [@action_gd=@TCA_ACT_TAB={0x48, 0x1, [{0xc, 0x4, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'nat\x00'}}, {0x10, 0x18, 0x0, 0x0, @TCA_ACT_KIND={0xc, 0x1, 'skbedit\x00'}}, {0xc, 0x1c, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x5}}, {0x10, 0xb, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'skbmod\x00'}}, {0xc, 0x5, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x28, 0x1, [{0xc, 0x1d, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xdb7a}}, {0xc, 0xd, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x5}}, {0xc, 0x15, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x1000}}]}, @action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0xffffffeb}, @action_gd=@TCA_ACT_TAB={0x58, 0x1, [{0xc, 0x1e, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x1c8}}, {0xc, 0x19, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x1000}}, {0xc, 0xd, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x1}}, {0xc, 0x4, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x9}}, {0x10, 0x13, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'skbmod\x00'}}, {0x14, 0x10, 0x0, 0x0, @TCA_ACT_KIND={0xd, 0x1, 'connmark\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x8c, 0x1, [{0xc, 0xc, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'nat\x00'}}, {0xc, 0x7, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'nat\x00'}}, {0xc, 0x16, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x5}}, {0xc, 0x1e, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x68000004}}, {0x10, 0x18, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0x10, 0x14, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'csum\x00'}}, {0xc, 0x18, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x4}}, {0xc, 0x1, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x2}}, {0x10, 0x4, 0x0, 0x0, @TCA_ACT_KIND={0xa, 0x1, 'pedit\x00'}}, {0x10, 0x20, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'csum\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x4}]}, 0x174}, 0x1, 0x0, 0x0, 0x4008094}, 0x6d07de3e13bc6751) r10 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) 10.400864082s ago: executing program 3 (id=1432): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) write$UHID_CREATE2(r0, 0x0, 0x119) 10.24947583s ago: executing program 3 (id=1433): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x0, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}, @flat=@binder={0x73622a85, 0x10b}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0x4c, 0x0, &(0x7f00000025c0)=[@transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000002740)={@flat=@handle={0x73682a85, 0x1}, @ptr={0x70742a85, 0x1, 0x0, 0x0, 0x0, 0x15}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x2, 0x22}}, &(0x7f0000000240)={0x0, 0x18, 0x40}}, 0x400}], 0x0, 0x0, 0x0}) 9.278030126s ago: executing program 3 (id=1434): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000780)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0xfffffffe, 0x6361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) r4 = syz_open_dev$usbfs(0x0, 0x9, 0x341341) ioctl$USBDEVFS_ALLOW_SUSPEND(r4, 0x5522) socket$inet6_tcp(0xa, 0x1, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) r5 = socket$unix(0x1, 0x1, 0x0) bind$unix(r5, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r5, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) connect$unix(r6, &(0x7f0000000000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r7 = socket$unix(0x1, 0x1, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, 0x0, 0x0) connect$unix(r7, &(0x7f0000000000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000980)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) openat2$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0) mlock(&(0x7f0000490000/0x2000)=nil, 0x2000) mlock2(&(0x7f00007a4000/0x2000)=nil, 0x2000, 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) socket$xdp(0x2c, 0x3, 0x0) 8.439419404s ago: executing program 4 (id=1435): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) listen(0xffffffffffffffff, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x200000000000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) openat$procfs(0xffffffffffffff9c, &(0x7f0000000280)='/proc/schedstat\x00', 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) pselect6(0x2000, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x300}, 0x0, &(0x7f0000000100)={0x8}, 0x0, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000003173610ef171e7206de010203010902f3c8010000000009040000000206"], 0x0) pselect6(0x40, &(0x7f0000000040)={0x0, 0xfffffffffffffffc, 0x5, 0x0, 0xffffffc, 0x1, 0x0, 0xfffffffffffffffa}, &(0x7f0000000000)={0x18, 0x8, 0x1ff, 0x0, 0x7ff, 0x400000, 0x0, 0x92}, 0x0, 0x0, 0x0) 7.751259249s ago: executing program 6 (id=1437): mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1\x00', 0x0) pipe(&(0x7f0000000100)) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000080)='selinuxfs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000140)='./file1\x00') r0 = socket$alg(0x26, 0x5, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1e, 0x0, 0x0, &(0x7f0000003ff6)='GPL\x00', 0x40000005, 0xc3, &(0x7f00000004c0)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x1c800) r2 = socket$inet6(0xa, 0x2, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, 0x0) setsockopt$inet6_opts(r2, 0x29, 0x3b, &(0x7f00000000c0)=@fragment={0x3c, 0x0, 0x5, 0x1, 0x0, 0x1, 0x8000064}, 0x8) connect$inet6(r2, &(0x7f00000002c0)={0xa, 0x4e24, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x1ffffff}, 0xfffffffffffffe3d) bind$alg(r0, &(0x7f0000010400)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast6-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r3 = accept4(r0, 0x0, 0x0, 0x80800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@assoc={0x18, 0x117, 0x4, 0x3}], 0x18}], 0x1, 0x40884) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000200)=""/111, 0x6f}], 0x1}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$sock_buf(r4, 0x1, 0x52, 0x0, &(0x7f00000001c0)) r5 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) ioctl$AUTOFS_IOC_EXPIRE(r5, 0x810c9365, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 7.645920057s ago: executing program 5 (id=1438): r0 = openat$dsp(0xffffffffffffff9c, &(0x7f00000003c0), 0x101a02, 0x0) r1 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000), 0x400, 0x0) readv(r1, &(0x7f00000001c0)=[{&(0x7f0000000040)=""/188, 0xbc}], 0x1) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f0000000080)) ioctl$SNDCTL_DSP_SETTRIGGER(r0, 0x40045010, &(0x7f0000000040)) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000680)="3751f02b82f73ccfc7c431617753f5732f765c975ebce8947e5388c4ff26fa3893119fd147a1576d9456136ab5f15493d175754e4b666e989869d01d418adc376c", 0x41}], 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$bind(&(0x7f00000000c0)='./file0/../file0\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x89901) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000080), 0xffffffffffffffff) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000100), r2) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_NEW_SERVICE(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000100000038000180060001000200000008000500000b101d211d7eedcf00000000000000afcb0900000000000800080000000000080006007369700010765ddbd9e8933b7ff5ef8dcc7bc12f050bac3cb2810ab0eca5581bb6e0557fd26da81f369ad743ecdca6a7cf1ebf4934622bf8c64e1be5300c927466ecf6d2b71fee62efed64d8d7f8d98cf93f95eca22efb1f321b35393cd26d5159e724e855b182b3d5b6bb721a2a2c5f43946f7d6b7ef687c28e9dc25b8195e4715839a0b84ee633d305d71adfe8b35c7fbd907a41a7612b20075952971834f2f44b25db5921193984fc510ed45b7b433fbc5acd319cec90e06a05cf9501a8c0c3adcf2ec4b857f2f5c32eb28fbe7e5cfc0992045f7785c912e15f2bafa2e99f5b0c"], 0x4c}}, 0x0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) set_mempolicy(0x3, &(0x7f0000000080)=0x7, 0x8) socketpair(0x2b, 0x1, 0x0, &(0x7f0000000000)={0x0, 0x0}) r8 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newqdisc={0x34, 0x24, 0xf0b, 0x0, 0xfffffffc, {0x0, 0x0, 0x0, 0x0, {0xffea, 0x4}, {0xffff, 0xffff}, {0x3, 0xffe5}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0xc0}, 0x40) r9 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/keys\x00', 0x0, 0x0) ioctl$KDSKBMETA(r9, 0x4b63, &(0x7f0000000240)=0x4) read$FUSE(r9, &(0x7f0000004200)={0x2020}, 0x2020) syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="12010002000008404c05cc090000000000010902240001000090080904000009030003000921fdff080122090009058103"], 0x0) timer_create(0x3, 0x0, &(0x7f0000044000)=0x0) timer_settime(r10, 0x1, &(0x7f0000040fe0)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_gettime(r10, &(0x7f0000000300)) ioctl$sock_SIOCGIFINDEX_802154(r7, 0x8933, &(0x7f0000000980)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_GET_WPAN_PHY(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)={0x1c, r3, 0xb15, 0x70bd2a, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r11}]}, 0x1c}, 0x1, 0x0, 0x0, 0x2600c8c0}, 0xc880) move_mount(r2, &(0x7f00000001c0)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) 7.645537608s ago: executing program 2 (id=1439): socket$kcm(0x2, 0x200000000000001, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, 0x0, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0xca02}) preadv(r2, &(0x7f0000000340)=[{&(0x7f0000000000)=""/30, 0x1e}], 0x1, 0x8, 0x2) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='oom_score\x00') pread64(r3, &(0x7f0000000f80)=""/212, 0xd4, 0xffffffff) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$inet6(0xa, 0x3, 0x3) connect$inet6(r4, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendmmsg(r4, &(0x7f0000000480), 0x2e9, 0xffe0) 7.350908431s ago: executing program 3 (id=1440): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'veth1_macvtap\x00', 0x0}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000440)='./cgroup\x00', 0x40000100) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r4, 0xc0d05605, &(0x7f0000000200)={0x1, @meta={0x44564956, 0x35b09d18, 0x2093, 0x8761, 0x4d534547}}) openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0) mount(&(0x7f00000000c0)=@nullb, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000100)='hfs\x00', 0x2000010, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000380), 0xffffffffffffffff) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32, @ANYBLOB="fb060000000000e21000"/21, @ANYRES32=r0, @ANYRES32, @ANYBLOB="04000000000000000300"/28], 0x50) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) r5 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x40000) ioctl$SNDRV_TIMER_IOCTL_SELECT(r5, 0x40345410, &(0x7f0000000100)={{0x1, 0x0, 0x0, 0x3}}) ioctl$SNDRV_TIMER_IOCTL_INFO(r5, 0x80e85411, &(0x7f00000000c0)) 7.251183623s ago: executing program 6 (id=1441): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000400)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x8001, 0xfffffff9, 0x57, 0x1bc4, 0x1, 0x4, 0x5, 0x400, 0x36}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x4008094}, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) close(r6) socket$unix(0x1, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) r7 = socket$kcm(0x11, 0x3, 0x0) r8 = socket(0x400000000010, 0x3, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001300)=@newtfilter={0xe8c, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r10, {0x1, 0x4}, {}, {0x8}}, [@filter_kind_options=@f_matchall={{0xd}, {0xe58, 0x2, [@TCA_MATCHALL_ACT={0xe54, 0x2, [@m_pedit={0xe50, 0x1, 0x0, 0x0, {{0xa}, {0xe24, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS={0xe20, 0x2, {{{0x2, 0x9, 0x5, 0x6}, 0x1, 0xfb}, [{0x2, 0x9c, 0x81, 0x6, 0x2, 0x7}, {0x1, 0x6, 0x4, 0x3, 0xfffffffd, 0x81}, {0x1, 0x80000001, 0x8, 0x101, 0x3}, {0x3, 0x9, 0x0, 0x7, 0x5, 0x4}, {0xf, 0x7, 0x9, 0x51, 0x8}, {0x3, 0x4, 0xc, 0x101, 0x3, 0x84b5}, {0x9c, 0x4, 0x9, 0x2, 0x487, 0x8}, {0x1, 0x10000, 0x5, 0x4, 0x3, 0x8000}, {0x7, 0x9, 0x1ff, 0x8, 0x2, 0x7fff}, {0x439356e7, 0x609, 0x16, 0x0, 0x10000, 0x6}, {0x5, 0x3, 0x8, 0x3, 0x0, 0xffffffff}, {0x5, 0x0, 0x7, 0x7, 0x8, 0x5}, {0x5, 0x8, 0x9, 0x5, 0xfffff000, 0x7}, {0x768d, 0xcd, 0x8, 0x7, 0x5, 0x9}, {0x1, 0xfffffffb, 0x6, 0x5, 0x7ff, 0x6}, {0xfffffffb, 0x3, 0xfffffffe, 0x6, 0x2}, {0xfffff9fd, 0x9, 0xa5f, 0xa, 0x5, 0x2}, {0xffff997c, 0x9, 0x167, 0x2, 0x71, 0xa2}, {0x140, 0x2, 0xc, 0x8, 0x87, 0x60}, {0x5, 0xa, 0x2, 0x4, 0x3, 0x2000}, {0x32d, 0x8, 0x7fff, 0x4, 0x8, 0x9}, {0x8, 0x200, 0x58fe, 0x7ff, 0x4, 0x3}, {0x101, 0xd, 0x101, 0x1, 0x3, 0x8}, {0x0, 0x3, 0x1ff, 0x7437ec78, 0x2, 0x9}, {0xffffffff, 0x1, 0x9, 0x0, 0x1, 0x4}, {0xc, 0xe, 0x0, 0x3, 0x8, 0x81}, {0x3, 0x3, 0x6, 0xe, 0x0, 0x80}, {0xd, 0x0, 0x7ff, 0x0, 0x80000000, 0x2}, {0x4, 0xb, 0x6c5f1878, 0x57c4, 0x8, 0x25ff}, {0x4, 0xd, 0x1fadd976, 0x3074, 0x0, 0x1}, {0x5, 0x800, 0x3, 0x3, 0x3, 0x9}, {0x9, 0x1ff, 0x81, 0x9c, 0x1, 0x5}, {0x9, 0xd76, 0x6, 0xdc2, 0xa16a, 0x2}, {0x1ff, 0x5, 0x7, 0xef20, 0x2, 0x1}, {0x1, 0x32158140, 0x0, 0x8, 0x6, 0x7}, {0xe, 0x4, 0x9000, 0x5, 0x2, 0x7f}, {0x3, 0x2ec74d53, 0x0, 0x0, 0x8, 0x2}, {0x5, 0xfff, 0xffffff13, 0x6, 0x2, 0x6}, {0x1, 0x6, 0x3, 0x4, 0xffb, 0xc}, {0x6, 0x6, 0x1ff, 0x8, 0x7ff, 0x8002}, {0x4, 0xffffffff, 0x0, 0xfffff740, 0x4, 0x4}, {0xffff, 0x5, 0x7, 0xac, 0xf}, {0x5, 0x3, 0x6, 0x1000, 0xd8fe, 0x8001}, {0xd, 0x3, 0x80000000, 0x0, 0xffffff81, 0x7ff}, {0xfffffffb, 0x2, 0x1ff, 0xf9, 0xffff8001}, {0x0, 0x6, 0x7ffc, 0x9, 0x500, 0x7}, {0x1, 0xffffffff, 0x834, 0x7, 0x0, 0x3}, {0x7fff, 0x6, 0x0, 0x2002, 0x2, 0x8}, {0xf61, 0x101, 0x9, 0x2, 0x80000000, 0x7fff}, {0xc7, 0x1, 0x8, 0x2, 0xffff, 0x20000000}, {0x0, 0x5, 0x1, 0xffff, 0x3, 0x3}, {0x8, 0x10001, 0x9f98, 0x1, 0x8, 0x66a}, {0xfff, 0x6, 0x8, 0x80000001, 0x0, 0x7f}, {0x8, 0x6, 0x7f, 0x5, 0x3, 0xb}, {0x4, 0x4b, 0x0, 0x1, 0x7f, 0x7fffffff}, {0xfff, 0x47e4, 0x1, 0x0, 0x80000001, 0x9}, {0x3, 0x9, 0x7, 0x6, 0x3e6b7592, 0xe5}, {0x9, 0x9, 0x1, 0x9, 0x0, 0x2}, {0x8, 0x80000001, 0x7fff, 0xb2d9, 0xfffffffe, 0x8}, {0x80000001, 0x9, 0x5202, 0x2, 0x53ce, 0x3}, {0x6, 0x7, 0x8, 0x8, 0x7f, 0x80000000}, {0xfffffff9, 0x9, 0x6, 0x6, 0x9, 0x3}, {0xfffffffd, 0x8, 0x6, 0x5, 0x3, 0x8f}, {0x741, 0x0, 0x9, 0x7fffffff, 0x2, 0x200}, {0x401, 0x2, 0x8, 0x6, 0x4, 0xc6e9}, {0x1, 0x2d73, 0x3ff, 0x5, 0x9f17, 0xffffff7f}, {0x2, 0x401, 0x2b00, 0xfffff57b, 0xfffffc00, 0xd}, {0x3, 0x4, 0xc52b, 0x9, 0x5, 0xff}, {0x0, 0x4, 0x401, 0x0, 0x1, 0x9}, {0x8, 0x4, 0x1, 0x2, 0x10, 0x1}, {0xff, 0x8, 0x6, 0x5, 0xff, 0x5}, {0x2, 0xb15ce2d, 0x80000001, 0xbeab, 0x8, 0x5}, {0x3, 0x8, 0x3, 0x7, 0x8, 0x4}, {0xfff, 0x9, 0x6, 0x3, 0x100, 0x57}, {0x9, 0x5, 0x4, 0x3, 0xa, 0x2}, {0xb3, 0xe, 0x3, 0x8000, 0x7, 0x9}, {0xff, 0x7, 0x5, 0x10001, 0x6, 0x6}, {0x2, 0x8f, 0x9, 0xffffff46, 0x4, 0x80000000}, {0x9, 0x2, 0xfffffffc, 0x1, 0xd50, 0x3}, {0xd203, 0x7, 0x1, 0x10000, 0x43, 0x1ff}, {0x4, 0x3ff, 0xffffffff, 0x1, 0x5, 0x100}, {0x1ff, 0x3, 0x7ff, 0xfffffff8, 0x1ff, 0xfffffffc}, {0x7, 0x9, 0x3ff, 0x1, 0x7, 0x4}, {0x0, 0x6, 0x0, 0x9, 0xffff0001, 0xcca}, {0x7, 0x1, 0xfffffff1, 0x3ff, 0x100, 0x4}, {0x3, 0x9, 0x0, 0xed4, 0x4, 0x6}, {0x9, 0x7, 0x8001, 0x7, 0x7, 0x2}, {0x3, 0xfff, 0x9, 0x5, 0xb5, 0x3}, {0x0, 0x1, 0x1, 0x5, 0xffffff01, 0xfff}, {0x7, 0x5, 0x2, 0x2, 0x0, 0xfffff9de}, {0x5, 0xffffffff, 0xe6b, 0xb, 0xb, 0x4}, {0x1d, 0xffffff10, 0x1, 0x2, 0xff, 0x52e2}, {0x0, 0x9, 0x0, 0x7, 0xdb, 0x5}, {0x7, 0x2, 0x9, 0x8, 0xa, 0x100}, {0x81, 0x4, 0x988, 0x0, 0x0, 0x7}, {0xdc03, 0x7, 0x402c, 0xffff, 0xfffffff9, 0x4}, {0xa, 0xfffffffe, 0x1, 0x1ff, 0x1ff, 0xc1b7}, {0xa24b, 0x947d, 0x40, 0x4, 0x9, 0x2}, {0x9, 0x401, 0xa89, 0x5ef, 0x9, 0x8}, {0x4, 0x7fff, 0x0, 0x4, 0x7fffffff}, {0x3, 0xb8c, 0x6, 0x21761f6a, 0x1, 0x4}, {0xfff, 0xda, 0x1f, 0x4, 0x8, 0x2}, {0x8, 0x10, 0x100, 0x0, 0xfffffff7, 0x43}, {0xfffff000, 0x8, 0xe96, 0x9, 0x9, 0x34b0}, {0x4, 0x8, 0x8, 0x3, 0x6cf4, 0x1}, {0x3, 0x3, 0x7, 0x4, 0xbe, 0x81}, {0x4, 0x800, 0x0, 0x5, 0x8, 0xfa2f}, {0x3, 0x8d, 0x81, 0x2, 0x8, 0x6}, {0x9, 0x2, 0x6, 0x4, 0xf, 0x5}, {0x100, 0x1, 0x2, 0xffffffff, 0x9, 0x74}, {0x4, 0x4, 0x8, 0x1, 0x0, 0x3}, {0xfffffff8, 0xfffffffb, 0xffffffff, 0x62f, 0x401, 0x30564e0}, {0x9a2f, 0x800, 0x8, 0x7, 0x7}, {0x20000006, 0x2, 0x800, 0x200, 0x9, 0x3}, {0x7, 0x6, 0x8936, 0xdcb, 0x0, 0x2}, {0x6, 0x80000000, 0x8, 0xe, 0xfffffffa, 0x8de3}, {0x0, 0x9, 0x8, 0xfff, 0x6, 0x1ff}, {0x8195, 0x2, 0x1000}, {0x1, 0x5, 0xff, 0x9e0f, 0x5, 0x6}, {0x7fff, 0x6, 0x0, 0x5, 0x8000, 0x3}, {0x7ff, 0x9, 0xa, 0x6, 0x7, 0xe77}, {0x21, 0x5e12, 0x3, 0xfffffffa, 0x2, 0x80000001}, {0xffffff8c, 0x2, 0x1, 0x1, 0x10, 0x5}, {0x4, 0x7, 0x104, 0x78d, 0xffffcff9, 0x9}, {0x1, 0xe, 0x7, 0x2, 0x2, 0x207f}, {0x10, 0x5, 0xfffffffa, 0xff, 0x80000, 0xfff}, {0x1, 0x7ff, 0x696e, 0xa, 0x49d, 0xb}, {0x9bf4, 0x0, 0x5, 0x3, 0x3, 0x1000}], [{0x1, 0x1}, {0x2}, {0x2}, {0x2}, {0x2, 0x745e81639ff0f356}, {0x4}, {0x5}, {0x3, 0x1}, {0x3}, {0x2}, {0x3}, {0x4, 0x1}, {0x0, 0x1}, {0x2}, {0x2}, {}, {0x3, 0x1}, {0x0, 0x1}, {0x0, 0x1}, {0x5, 0x1}, {0x3, 0x1}, {0x1}, {0x2, 0x1}, {0x2}, {0x3, 0x1}, {0x2}, {0x5}, {0x2}, {0x1, 0x1}, {0x1}, {0x1, 0x1}, {0x5}, {0x4}, {0x5, 0x1}, {0x5, 0x1}, {}, {0x4, 0x1}, {0x3, 0x1}, {0x4, 0x1}, {0x1, 0x1}, {0x5}, {0xa}, {0x3}, {0x3}, {0x2, 0x1}, {0x3}, {0x4, 0x1}, {0x2, 0x1}, {0x0, 0x1}, {0x0, 0x1}, {0x2}, {0x4}, {0x4, 0x1}, {0x4}, {0x4}, {0x2, 0x1}, {0x2, 0x1}, {0x5, 0x3}, {0x4, 0x1}, {0x1}, {0x4}, {0x0, 0x1}, {0x2}, {0x1, 0x1}, {0x3, 0x1}, {0x5}, {0x3, 0x1}, {0x1, 0x1}, {0x5, 0x1}, {0x0, 0x1}, {0x2, 0x1}, {0x3, 0x1}, {0x0, 0x1}, {0x0, 0x1}, {0x3}, {0x6}, {0xa}, {0x3, 0x1}, {}, {0x2, 0x1}, {0x1}, {0x4}, {0x5}, {0x3}, {0x3, 0x1}, {0x4}, {0x0, 0x1}, {0x5, 0x1}, {0x3}, {0x2}, {0xb82e57098c7a44ef}, {0x3, 0x1}, {0x1}, {0x5, 0x1}, {0x5}, {0x1, 0x1}, {0x5}, {0x0, 0x1}, {0x4}, {0x4}, {0x0, 0x1}, {0x2}, {0x4, 0x1}, {0x1, 0x1}, {0x1, 0x1}, {0x2}, {0x3}, {0x1, 0x1}, {}, {0x4}, {0x3}, {0x3}, {0x1}, {0x5}, {0x3, 0x1}, {0x4}, {0x3, 0x1}, {0x0, 0x1}, {0x1}, {0x4, 0x1}, {0x1}, {0x5, 0x1}, {0x4}, {0x0, 0x1}, {0x3}, {0x1}, {0x0, 0x1}, {0x4}], 0x1}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}]}]}}]}, 0xe8c}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$kcm(r7, &(0x7f0000002900)={&(0x7f0000000500)=@xdp={0x2c, 0x8, r5, 0x10c, 0xb000000}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000380)="da", 0x1}], 0x1}, 0x4000880) 6.361687442s ago: executing program 6 (id=1442): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="16000000000000000400000001"], 0x50) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r1, 0x3b85, &(0x7f0000000040)={0x28, 0x7, r2, 0x0, &(0x7f00006be000/0x2000)=nil, 0x2000}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, r2, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000080)={0x48, 0x7, r3, 0x0, 0x10000, 0x0, 0x1, 0x2ea473, 0x2eb80c}) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000005c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x41100}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x2, 0x0, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r5 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000180)=0x0, &(0x7f00000001c0)=0x4) sendmsg$nl_route_sched(r5, &(0x7f0000000380)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)=@newtclass={0x2c, 0x28, 0x100, 0x70bd25, 0x10001, {0x0, 0x0, 0x0, r6, {0x3, 0xb}, {0x7, 0x7}, {0x8, 0x6}}, [@TCA_RATE={0x6, 0x5, {0xbb, 0x88}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000}, 0x8c0) socket$unix(0x1, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0xc, 0x13, &(0x7f0000000480)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000696c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000ffffff858500000071000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001700000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000001}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r7 = getpid() sched_setscheduler(r7, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r8, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r9, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r8, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='blkio.bfq.io_wait_time_recursive\x00', 0x26e1, 0x0) r10 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r10, 0x29, 0x20, &(0x7f0000000080)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x800, 0x0, 0x2, 0x1}, 0x20) 6.361059837s ago: executing program 4 (id=1443): r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="f7", @ANYRESOCT], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0/../file0/../file0/../file0\x00', 0x81101) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xd, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = fsopen(&(0x7f0000000080)='binder\x00', 0x0) prlimit64(0x0, 0x7, &(0x7f0000000040)={0x0, 0x100}, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) fsmount(r5, 0x0, 0x1) fsconfig$FSCONFIG_CMD_RECONFIGURE(r5, 0x7, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000080)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) read$msr(0xffffffffffffffff, &(0x7f0000032680)=""/102400, 0x19000) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x10, 0xe, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x94) move_mount(r1, 0x0, 0xffffffffffffff9c, 0x0, 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x89901) newfstatat(0xffffffffffffff9c, 0x0, &(0x7f00000005c0), 0x100) syz_usb_control_io$cdc_ncm(r0, &(0x7f00000001c0)={0x14, &(0x7f0000000100)={0x20, 0x6, 0x86, {0x86, 0x2, "6c7fad95dbcc27a141f97db1afaa8a6eee79830fcf9beeb9bca788aaab200d527cacbec8cf9b02e0f2b96b06987bbbecb385789f70e584806b8590dfc69c300a930f7b11ee76bb875b988b7e6c0ade23076c04609de46407c9a63abf8783cf521d557f75852d3ae115f9e0ddf72a043e1047dbf1473c2d30130bdd422f8d935c88b502c2"}}, 0xffffffffffffffff}, &(0x7f0000000400)={0x44, &(0x7f0000000200)={0x0, 0x14, 0x18, "da4fc65ce6e9189092584ef7a7505719ebe01e7f400824ea"}, &(0x7f0000000240)={0x0, 0xa, 0x1, 0x99}, &(0x7f0000000280)={0x0, 0x8, 0x1, 0xf4}, &(0x7f00000002c0)={0x20, 0x80, 0x1c, {0xfff7, 0xa8, 0xaab9, 0xfff9, 0x7, 0x1, 0x5, 0x4, 0x800, 0x1, 0x0, 0x9}}, &(0x7f0000000300)={0x20, 0x85, 0x4, 0xfffffff9}, &(0x7f0000000340)={0x20, 0x83, 0x2, 0x1}, &(0x7f0000000380)={0x20, 0x87, 0x2, 0x4}, &(0x7f00000003c0)={0x20, 0x89, 0x2}}) syz_usb_ep_write(r0, 0x81, 0x8, &(0x7f00000000c0)="4e2af1ffe6e7993b") 5.676188414s ago: executing program 3 (id=1444): getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x7a, &(0x7f0000000340)={0x0, @in6={{0xa, 0x3, 0x4, @mcast1}}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYRESHEX=r0], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000300)='syzkaller\x00', 0x4, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f00000004c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1, {0xa, 0x4e21, 0x9, @empty, 0xd}}}, 0x3a) getpeername(r3, 0x0, &(0x7f00000000c0)) r4 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="240000001800010000000001fddbdf251d01020008000a00", @ANYRES32, @ANYBLOB="08000900b3e50140835aef15fe18b94166cd26227c945e912643c628526b6316951776ebd03258d8c127b6ac000000000000", @ANYRES32, @ANYBLOB], 0x24}}, 0x0) r5 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) pwritev(r5, &(0x7f0000000600)=[{&(0x7f0000000240)='@', 0x1}], 0x1, 0x1ae, 0x101) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) 5.30536896s ago: executing program 6 (id=1445): syz_usb_connect$printer(0x2, 0x2d, &(0x7f0000000780)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x20, 0x4b8, 0x202, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0x0, 0x80, 0x7f}}]}}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.io_service_bytes\x00', 0x26e1, 0x0) renameat(r3, &(0x7f0000000180)='./file0\x00', r3, &(0x7f00000001c0)='\x00') close(r3) r4 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r4, &(0x7f0000000140)={0x28, 0x0, 0x2710, @local}, 0x10) io_uring_setup(0x73e5, &(0x7f0000000640)={0x0, 0xce32, 0x80, 0x2, 0x2c4, 0x0, r3}) socket$vsock_stream(0x28, 0x1, 0x0) r5 = socket(0xa, 0x1, 0x0) listen(r5, 0x7f) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r5, 0x6, 0x23, &(0x7f0000000140)={&(0x7f0000ffc000/0x4000)=nil, 0x3000, 0x0, 0x0, 0x0, &(0x7f0000001b00)=""/4112, 0x1000, 0x1, 0x0}, &(0x7f0000000180)=0x3a) r6 = accept4(r4, 0x0, 0x0, 0x800) sendto(r6, 0x0, 0x0, 0x0, 0x0, 0x0) syz_open_dev$evdev(&(0x7f0000000280), 0xb0d, 0x344c0) mount(&(0x7f0000000080)=@sg0, &(0x7f00000000c0)='./cgroup\x00', &(0x7f00000001c0)='ubifs\x00', 0x208400, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000007c0)=@newtaction={0x1fc, 0x30, 0x1, 0x0, 0x0, {}, [{0x1e8, 0x1, [@m_mpls={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_MPLS_PARMS={0x1c, 0x2, {{0x200000}}}]}, {0x4, 0x4}, {0xc}, {0xc}}}, @m_simple={0x164, 0x14, 0x0, 0x0, {{0xb}, {0xc4, 0x2, 0x0, 0x1, [@TCA_DEF_DATA={0xb, 0x3, '\xc0$.($-\x00'}, @TCA_DEF_PARMS={0x18, 0x2, {0x8, 0xffffffc1, 0x10000000, 0x6c9625be}}, @TCA_DEF_PARMS={0x18, 0x2, {0x9, 0x3e, 0x7, 0x38, 0xfffffff9}}, @TCA_DEF_DATA={0x8, 0x3, ']$=\x00'}, @TCA_DEF_DATA={0x44, 0x3, '\xc6\xc2\x01\'$\xbc?\xc8Q\x88\xe6B\xb4\x06%\xb2\xf2\xbc\xb9p(o\x05\x83PB\xfc0\xa3u\xc3\xcf5j\x15\x90:]\x13_\xd5\v\xf9\a8\x04Y\x9cW\xff\b\xfa*\xf9\x90)$S\xe8[$[\xd5\xbd'}, @TCA_DEF_DATA={0x7, 0x3, '((\x00'}, @TCA_DEF_PARMS={0x18, 0x2, {0x2, 0x9, 0x8, 0x8, 0x7fff}}, @TCA_DEF_PARMS={0x18, 0x2, {0x800, 0x7, 0x4, 0xffffff07, 0xbf43}}]}, {0x77, 0x6, "0c9fea31b833496dd3dc579a9508933872a11c29ca633b50b3a1963a8e4751928ef38729b994f3d5bd3d1aac7a9e7d7c369be1d94d1c77bf68ef358e1d000f29aa2476e5a221277a8452b0ccbf5ce875ece6f5ffda945dfb7a58c1f3aa199a060ed5c72b4342bcc3b5b2d862936e9eae744093"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}, @m_xt={0x34, 0xf, 0x0, 0x0, {{0x7}, {0xc, 0x2, 0x0, 0x1, [@TCA_IPT_INDEX={0x8, 0x3, 0x8}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2, 0x2}}}}]}]}, 0x1fc}}, 0x0) ioctl$VIDIOC_STREAMON(r3, 0x40045612, &(0x7f0000000100)=0x2) unshare(0x62000280) syz_usb_connect(0x0, 0x3b, &(0x7f0000000080)=ANY=[], 0x0) syz_usb_connect$uac3(0x4, 0x10e, &(0x7f0000000340)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x40, 0x8e4, 0x163, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xfc, 0x3, 0x1, 0xe, 0x80, 0x7, {0x8, 0xb, 0x2, 0x1, 0x1, 0x25, 0x30, 0x8}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0xf, 0x30, 0xc8}, [@power_domain={0x9, 0x24, 0x10, 0xa1, 0x1000, 0x0, 0x80}, @feature_unit={0x1d, 0x24, 0x7, 0x3, 0x5, [0x3, 0x10, 0xb, 0xc, 0x10, 0x7]}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x779, 0x10, 0xfc, 0x6f}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x1, 0x4}, @format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x5, 0x5, 0x4, 0x5, 0x1}]}, {{0x9, 0x5, 0x1, 0x9, 0x200, 0x4, 0x4, 0x7, {0xa, 0x25, 0x25, 0x4, 0x7, 0xc8f}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_i_continuous={0xb, 0x24, 0x2, 0x1, 0x71, 0x3, 0x3, 0x5, "ba", "dfc3"}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x8, 0x3, 0x4, 0x8}, @format_type_ii_discrete={0x12, 0x24, 0x2, 0x2, 0x6, 0x7, 0x1, "20f048565765fd0e8d"}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x2, 0x5}, @as_header={0x17, 0x24, 0x1, 0x5, 0x7, 0x481a, 0x2, 0x97, 0xfb, 0x8, 0xc}, @format_type_ii_discrete={0xb, 0x24, 0x2, 0x2, 0x4, 0x1, 0x4, 't,'}]}, {{0x9, 0x5, 0x82, 0x9, 0x400, 0x8, 0x0, 0x9, {0xa, 0x25, 0x25, 0x2, 0x81, 0x6}}}}}}}}]}}, &(0x7f0000000600)={0xa, &(0x7f0000000480)={0xa, 0x6, 0x201, 0x6, 0x1, 0xb, 0x10, 0x9}, 0xb2, &(0x7f0000000500)={0x5, 0xf, 0xb2, 0x4, [@ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x59, "e8d773328c61affc0ab142df0ad8466d"}, @generic={0x5f, 0x10, 0xb, "3b0aeef33ad4b32a6fba238f000e855eae0908dd22ae8a46e0fac02d2fa65092f74ab0dade941e34e565da5e41f53dcd5bed7b978381b1e8dece064ed96dc31006225c3bedd8f1347c73029e9747abfda7a6e946096446c77486daa5"}, @generic={0x37, 0x10, 0xb, "bb124143736bcb35eac1efcd43beb9396b4931b805ff1bdaf2fc56a1b6c8f7347560821151539521b2f41702e964ef3625ca453a"}]}, 0x1, [{0x4, &(0x7f00000005c0)=@lang_id={0x4, 0x3, 0x457}}]}) 5.05626635s ago: executing program 2 (id=1446): syz_open_dev$video(&(0x7f0000000c80), 0x7, 0x113442) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000440)={'ip_vti0\x00', &(0x7f0000000480)={'syztnl0\x00', 0x0, 0x7800, 0x8000, 0x1, 0x5, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x3, 0x0, 0x1, 0x4, 0x0, @local, @loopback}}}}) bind$inet6(0xffffffffffffffff, &(0x7f0000000240)={0xa, 0x4e20, 0x800, @remote, 0x7}, 0x1c) sendmsg$inet(0xffffffffffffffff, &(0x7f0000003c00)={0x0, 0x0, &(0x7f0000000840)=[{&(0x7f0000000600)="447df50ce4033a7b5ad00b", 0xb}, {&(0x7f0000000580)="3281a1bd38517f12dd42749fd52cf2cdf1730d4c790a478374de091b10f7b95ea4b3660cd9f9a54f3292f37cb69a6f859838766366b3bf2870854eaaced9f207d32bb3443051145ae8", 0x49}, {&(0x7f0000000740)="13a3906a72409426638deed87fb262927d7f5a83058d9e6f0f46562bd02270af130970b3c5fef06f9c3ffc4ac3be8f5a96156fc6407471e68ae2ac5119665f5445dacab0c491759581e199f89db78297e4e5825ab285d4b7e36fb4aab037b1ee9d25b5e1b8881137578cd074b35333c9761a4049abd36547c42ee189c57c682b1044fa748f55a36da6300c8b3dcf546987c210e7f6a8f2d1118a6bc5e7e2726899cf58934e7a844ce7bd5aef45a1ca2b860147dff5f282f4aa45e86e69aeef7db1bede9a965e6b40b6bcb0ed1b490d01611a711ee8422c8e6d7d582a40", 0xdd}], 0x3}, 0x41) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=ANY=[], 0x18}, 0x1, 0x0, 0x0, 0x4c811}, 0x4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='tmpfs\x00', 0x0, &(0x7f00000001c0)='grpquota') r5 = creat(&(0x7f0000000440)='./file0/file0\x00', 0x188) quotactl_fd$Q_SETINFO(r5, 0xffffffff80000601, 0xee01, &(0x7f0000000300)={0xfffffffffffffffc, 0x5, 0x1, 0x2}) sendmmsg(r3, &(0x7f0000001c00), 0x400000000000159, 0x40840) write$dsp(0xffffffffffffffff, &(0x7f00000001c0)="5cba91a4", 0xffffffd9) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR(r5, 0x6, 0x13, &(0x7f0000000080)=0xffffffffffffffff, 0x4) connect$inet(0xffffffffffffffff, &(0x7f0000000200)={0x2, 0x4e24, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000280)=0x1, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r5, 0x8933, &(0x7f0000000140)={'batadv_slave_0\x00'}) bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@base={0x1f, 0x5, 0xcb3b, 0xffff, 0x20300, r5, 0x0, '\x00', r0, r5, 0x5}, 0x50) sendmmsg(0xffffffffffffffff, &(0x7f0000003500)=[{{0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000500)="9f", 0x1}], 0x1, &(0x7f0000000c00)=ANY=[@ANYBLOB="10000000000000000f010000000000003000000000000000ff00000005000000dae7c65afdd9d1d5073fbf984e560f7f7af0377a701ad4e8ab3a00000000000090000000000000000000000004000000474995282b8d35b2efb349cfa55288ab0139064c723f71e2d9ced0cbb2d46df48f8ee505b82850c69ed841ec12c3b6392c378033c46278ff6bc63d6d5bf4c8b718e78b05ad817aac3b5239cd4fe877aff14721f369a8fb6e6daa5710be61d3edc36edbd248ee581a70263663739cac6a0b0dc55ac9b2f56dc43f04dc78a3000058"], 0x128}}, {{0x0, 0x0, &(0x7f0000003380)=[{&(0x7f0000000b40)="a6", 0x1}], 0x1, &(0x7f0000003400)=[{0x10, 0x1, 0xf}], 0x10}}], 0x2, 0x4000045) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x40d, 0x70bd2c, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x10, 0x4d19d45ccbdf4d8}, [@IFLA_ALT_IFNAME={0x14, 0x35, 'macvlan0\x00'}]}, 0x34}}, 0x8000) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)) 4.868799736s ago: executing program 2 (id=1447): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetlb.1GB.usage_in_bytes\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0), 0x208e24b) cachestat(r0, &(0x7f0000000040)={0x405}, &(0x7f000009de80), 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r2, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r3, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) bpf$BPF_GET_BTF_INFO(0xf, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r4, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec778000) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000280), 0x240, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f00000000c0)=0xd) readv(r5, &(0x7f0000000080)=[{&(0x7f00000002c0)=""/245, 0xf5}], 0x1) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000003c0)=ANY=[@ANYBLOB="3c00001010001fff00000600000000000000004add0000865531e14d31d69c927dc307d0d344f7ffffff35dd868a1d68e1b35c33527fabe01b9d1f018faed41b7b301c0bdda94bf00cb85acc3d81fa1374a581ea536370402e06fb61a20a92b05bd6d8e996738e85989446c9c639549561b5538395250093a85f8310a99500d8fd2f84685e74cc044fb29964e8979435af", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800a000100767863616e0000000400028008000a00", @ANYRES32=r3, @ANYBLOB], 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) socket$nl_route(0x10, 0x3, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000001c0)) 4.284492005s ago: executing program 5 (id=1448): io_uring_setup(0x7d98, &(0x7f00000003c0)={0x0, 0xfdcf, 0x2, 0x2}) openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x20080, 0x0) open(&(0x7f0000000240)='./file1\x00', 0x345142, 0x0) mq_open(0x0, 0x42, 0x197, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x2, 0x7}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000140), 0x802, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x804) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000005580)=""/102392, 0x18ff8) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0200000004000000ff0f00000700000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000040006c4e674bf45dcddf34dace96c748b21f55a81f5618c38b9e3cf1d22b9f207c0f07d29271f63e26517391369f118cb343132672ea3349fa216e171fafce26ec89840e642d3e576245fdf24bc947ef437cb2404106bb10902f33b23e139a236e1749e3bdf52fcd0f2f1644f5f3578d97fd169226cd721d2f0b0ed50b6f58"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000208500000025000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000e00000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000006c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x50, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x2}, @NFTA_SET_EXPR={0x14, 0x11, 0x0, 0x1, @counter={{0xc}, @val={0x4}}}]}, @NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "d103"}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xb8}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000000) 3.069716672s ago: executing program 4 (id=1449): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'veth1_macvtap\x00', 0x0}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000440)='./cgroup\x00', 0x40000100) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r4, 0xc0d05605, &(0x7f0000000200)={0x1, @meta={0x44564956, 0x35b09d18, 0x2093, 0x8761, 0x4d534547}}) openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x7f, 0x1}, 0x1001) mount(&(0x7f00000000c0)=@nullb, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000100)='hfs\x00', 0x2000010, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000380), 0xffffffffffffffff) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32, @ANYBLOB="fb060000000000e21000"/21, @ANYRES32=r0, @ANYRES32, @ANYBLOB="04000000000000000300"/28], 0x50) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) r5 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x40000) ioctl$SNDRV_TIMER_IOCTL_SELECT(r5, 0x40345410, &(0x7f0000000100)={{0x1, 0x0, 0x0, 0x3}}) ioctl$SNDRV_TIMER_IOCTL_INFO(r5, 0x80e85411, &(0x7f00000000c0)) 2.359429985s ago: executing program 5 (id=1450): syz_open_dev$video(&(0x7f0000000c80), 0x7, 0x113442) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000440)={'ip_vti0\x00', &(0x7f0000000480)={'syztnl0\x00', 0x0, 0x7800, 0x8000, 0x1, 0x5, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x3, 0x0, 0x1, 0x4, 0x0, @local, @loopback}}}}) bind$inet6(0xffffffffffffffff, &(0x7f0000000240)={0xa, 0x4e20, 0x800, @remote, 0x7}, 0x1c) sendmsg$inet(0xffffffffffffffff, &(0x7f0000003c00)={0x0, 0x0, &(0x7f0000000840)=[{&(0x7f0000000600)="447df50ce4033a7b5ad00b", 0xb}, {&(0x7f0000000580)="3281a1bd38517f12dd42749fd52cf2cdf1730d4c790a478374de091b10f7b95ea4b3660cd9f9a54f3292f37cb69a6f859838766366b3bf2870854eaaced9f207d32bb3443051145ae8", 0x49}, {&(0x7f0000000740)="13a3906a72409426638deed87fb262927d7f5a83058d9e6f0f46562bd02270af130970b3c5fef06f9c3ffc4ac3be8f5a96156fc6407471e68ae2ac5119665f5445dacab0c491759581e199f89db78297e4e5825ab285d4b7e36fb4aab037b1ee9d25b5e1b8881137578cd074b35333c9761a4049abd36547c42ee189c57c682b1044fa748f55a36da6300c8b3dcf546987c210e7f6a8f2d1118a6bc5e7e2726899cf58934e7a844ce7bd5aef45a1ca2b860147dff5f282f4aa45e86e69aeef7db1bede9a965e6b40b6bcb0ed1b490d01611a711ee8422c8e6d7d582a40", 0xdd}], 0x3}, 0x41) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) accept4(r2, 0x0, 0x0, 0x800) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='tmpfs\x00', 0x0, &(0x7f00000001c0)='grpquota') r5 = creat(&(0x7f0000000440)='./file0/file0\x00', 0x188) quotactl_fd$Q_SETINFO(r5, 0xffffffff80000601, 0xee01, &(0x7f0000000300)={0xfffffffffffffffc, 0x5, 0x1, 0x2}) sendmmsg(r3, &(0x7f0000001c00), 0x400000000000159, 0x40840) write$dsp(0xffffffffffffffff, &(0x7f00000001c0)="5cba91a4", 0xffffffd9) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR(r5, 0x6, 0x13, &(0x7f0000000080)=0xffffffffffffffff, 0x4) connect$inet(0xffffffffffffffff, &(0x7f0000000200)={0x2, 0x4e24, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000280)=0x1, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r5, 0x8933, &(0x7f0000000140)={'batadv_slave_0\x00'}) bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@base={0x1f, 0x5, 0xcb3b, 0xffff, 0x20300, r5, 0x0, '\x00', r0, r5, 0x5}, 0x50) sendmmsg(0xffffffffffffffff, &(0x7f0000003500)=[{{0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000500)="9f", 0x1}], 0x1, &(0x7f0000000c00)=ANY=[@ANYBLOB="10000000000000000f010000000000003000000000000000ff00000005000000dae7c65afdd9d1d5073fbf984e560f7f7af0377a701ad4e8ab3a00000000000090000000000000000000000004000000474995282b8d35b2efb349cfa55288ab0139064c723f71e2d9ced0cbb2d46df48f8ee505b82850c69ed841ec12c3b6392c378033c46278ff6bc63d6d5bf4c8b718e78b05ad817aac3b5239cd4fe877aff14721f369a8fb6e6daa5710be61d3edc36edbd248ee581a70263663739cac6a0b0dc55ac9b2f56dc43f04dc78a3000058"], 0x128}}, {{0x0, 0x0, &(0x7f0000003380)=[{&(0x7f0000000b40)="a6", 0x1}], 0x1, &(0x7f0000003400)=[{0x10, 0x1, 0xf}], 0x10}}], 0x2, 0x4000045) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x40d, 0x70bd2c, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x10, 0x4d19d45ccbdf4d8}, [@IFLA_ALT_IFNAME={0x14, 0x35, 'macvlan0\x00'}]}, 0x34}}, 0x8000) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)) 2.290220464s ago: executing program 2 (id=1451): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x14, 0x3a, 0x703, 0x270bd24, 0x25dfdbf8, {0xd}}, 0x14}}, 0x4008800) syz_genetlink_get_family_id$nl80211(0x0, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@abs={0x0, 0x0, 0x4e24}, 0x6e) socket$inet_sctp(0x2, 0x1, 0x84) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(&(0x7f0000000380), 0xffffffffffffffff) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r3, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f00000000c0)={0x30, r4, 0x1, 0xffffffff, 0x0, {}, [@NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r5}}]}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7fff}]}, 0x30}}, 0x20000000) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1c}, 0x1, 0x0, 0x0, 0x24040090}, 0xc0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x90}, 0x40000) sendmsg$NL80211_CMD_PEER_MEASUREMENT_START(r0, &(0x7f0000004280)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000004240)={&(0x7f00000042c0)={0x1510, 0x0, 0x400, 0x70bd29, 0x25dfdbfc, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_PEER_MEASUREMENTS={0x5e8, 0x111, 0x0, 0x1, {0x5e4, 0x5, 0x0, 0x1, [{0x49c, 0x0, 0x0, 0x1, [@NL80211_PMSR_PEER_ATTR_REQ={0x8, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}]}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa, 0x1, @device_b}, @NL80211_PMSR_PEER_ATTR_REQ={0x9c, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x2c, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x28, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xd}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x1b}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x54, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x50, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0xe}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x9}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x81}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x3}]}]}]}, @NL80211_PMSR_PEER_ATTR_REQ={0x284, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0xb4, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x5}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x1}]}, @NL80211_PMSR_TYPE_FTM={0x24, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xa}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x2c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x1a}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0xf}]}, @NL80211_PMSR_TYPE_FTM={0x34, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x12}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xa}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x5}]}, @NL80211_PMSR_TYPE_FTM={0x18, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x8}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x15}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0xd4, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x24, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x1d}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x9}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x13}]}, @NL80211_PMSR_TYPE_FTM={0x3c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x18}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x2}]}, @NL80211_PMSR_TYPE_FTM={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x1b}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0xe}]}, @NL80211_PMSR_TYPE_FTM={0x2c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x6}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x5}]}, @NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x8}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0x80, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x9}]}, @NL80211_PMSR_TYPE_FTM={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x9}]}, @NL80211_PMSR_TYPE_FTM={0x34, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x8}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x3}]}, @NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x1}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x60, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x8}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x7}]}, @NL80211_PMSR_TYPE_FTM={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xd}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x5}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x2}]}, @NL80211_PMSR_TYPE_FTM={0x24, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xd}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x9}]}]}]}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa}, @NL80211_PMSR_PEER_ATTR_REQ={0x4}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa, 0x1, @device_b}, @NL80211_PMSR_PEER_ATTR_REQ={0x148, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_DATA={0x58, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x24, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x70}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x22}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x30, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0xec, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x6}]}, @NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x24, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xb}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xb}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x6}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x20, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x8}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x2c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x19}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x20, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x8}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x30, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x8}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x5}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}]}]}]}]}, {0x144, 0x0, 0x0, 0x1, [@NL80211_PMSR_PEER_ATTR_ADDR={0xa, 0x1, @device_b}, @NL80211_PMSR_PEER_ATTR_REQ={0x4}, @NL80211_PMSR_PEER_ATTR_REQ={0x70, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x64, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x20, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x6}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x3}]}, @NL80211_PMSR_TYPE_FTM={0x30, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xd}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0xf}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x5}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x3}]}, @NL80211_PMSR_TYPE_FTM={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x5}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}]}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa, 0x1, @device_b}, @NL80211_PMSR_PEER_ATTR_REQ={0x90, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_DATA={0x8c, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x30}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x2}]}, @NL80211_PMSR_TYPE_FTM={0x24, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x28, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x39}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}]}]}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa, 0x1, @broadcast}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa, 0x1, @broadcast}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa}]}]}}, @NL80211_ATTR_PEER_MEASUREMENTS={0xc6c, 0x111, 0x0, 0x1, {0xc68, 0x5, 0x0, 0x1, [{0x4}, {0xbc, 0x0, 0x0, 0x1, [@NL80211_PMSR_PEER_ATTR_REQ={0x6c, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_DATA={0x40, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x11}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x8}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}]}, @NL80211_PMSR_PEER_ATTR_CHAN={0x4c, 0x2, 0x0, 0x1, [@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x12b}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x22c}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x99e}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x325}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x5}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x7}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x34}]}]}, {0x5b0, 0x0, 0x0, 0x1, [@NL80211_PMSR_PEER_ATTR_REQ={0xcc, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_DATA={0x5c, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x6}]}, @NL80211_PMSR_TYPE_FTM={0x38, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xe}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x1a}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xc}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0xf}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0xb}]}, @NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x24, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x3}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x1}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x3c, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x38, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x40}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x2}]}]}]}, @NL80211_PMSR_PEER_ATTR_REQ={0x254, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x44, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x34, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x9}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xf}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xb}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x9}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xd}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0x44, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x8, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x20, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xe}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x5}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xf}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0x4c, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0xc}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x24, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x13}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xf}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x76}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x9}]}, @NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0x3c, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x28, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xc}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xd}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x17}]}, @NL80211_PMSR_TYPE_FTM={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x60, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x44, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x5}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x16}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x1d}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0xf6}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x2}]}, @NL80211_PMSR_TYPE_FTM={0x18, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x13}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0x5c, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x28, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x1e}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0xd}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x9}]}, @NL80211_PMSR_TYPE_FTM={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x10}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0xe}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0x7c, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x40, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x6}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x8}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x9}]}, @NL80211_PMSR_TYPE_FTM={0x38, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x9}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x7}]}]}]}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa, 0x1, @broadcast}, @NL80211_PMSR_PEER_ATTR_CHAN={0xc, 0x2, 0x0, 0x1, [@NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x6}]}, @NL80211_PMSR_PEER_ATTR_REQ={0x130, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x74, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x8, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x4}, @NL80211_PMSR_TYPE_FTM={0x8, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x2c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x8}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x9}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x5}]}, @NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x4}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0x30, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x2c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x18}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x40}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0x3c, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xb}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x4}, @NL80211_PMSR_TYPE_FTM={0x4}, @NL80211_PMSR_TYPE_FTM={0x20, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0x48, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x30, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x1c}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xa}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x5}]}, @NL80211_PMSR_TYPE_FTM={0x4}]}]}, @NL80211_PMSR_PEER_ATTR_CHAN={0x1c, 0x2, 0x0, 0x1, [@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x7f}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0xa0}]}, @NL80211_PMSR_PEER_ATTR_REQ={0xdc, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x88, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x18, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x8}]}, @NL80211_PMSR_TYPE_FTM={0x8, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x6}]}, @NL80211_PMSR_TYPE_FTM={0x24, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x11}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x2}]}, @NL80211_PMSR_TYPE_FTM={0x24, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x9}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xe}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0x4c, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x8}]}, @NL80211_PMSR_TYPE_FTM={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x20, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xa}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x3}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}]}]}]}, @NL80211_PMSR_PEER_ATTR_CHAN={0x4c, 0x2, 0x0, 0x1, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x25}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x7}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x19e}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x1af}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x6}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x9}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x5}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x19}]}]}, {0xb0, 0x0, 0x0, 0x1, [@NL80211_PMSR_PEER_ATTR_REQ={0xac, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_DATA={0x98, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x7}]}, @NL80211_PMSR_TYPE_FTM={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x1e}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x9}]}, @NL80211_PMSR_TYPE_FTM={0x28, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x5}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5}]}, @NL80211_PMSR_TYPE_FTM={0x24, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x10}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x18, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xa}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}]}]}, {0x2c8, 0x0, 0x0, 0x1, [@NL80211_PMSR_PEER_ATTR_REQ={0x2c4, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_DATA={0x54, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x40, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x15}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x1}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x84, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x18, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x4}]}, @NL80211_PMSR_TYPE_FTM={0x18, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xd}]}, @NL80211_PMSR_TYPE_FTM={0x40, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xc}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x6}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x88, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x24, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x8}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x2c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x20, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xc}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0xf}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0x74, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x34, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x6}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0xd}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x8}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xd}]}, @NL80211_PMSR_TYPE_FTM={0x3c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x13}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x8c, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x40, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xc}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xd}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x18}]}, @NL80211_PMSR_TYPE_FTM={0x30, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0xd1}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0xe}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x2}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x50, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x28, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xe}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8}]}, @NL80211_PMSR_TYPE_FTM={0x8, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x10}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}]}]}]}]}, {0x26c, 0x0, 0x0, 0x1, [@NL80211_PMSR_PEER_ATTR_ADDR={0xa}, @NL80211_PMSR_PEER_ATTR_REQ={0x18, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_DATA={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x10}]}, @NL80211_PMSR_TYPE_FTM={0x4}]}]}, @NL80211_PMSR_PEER_ATTR_REQ={0x198, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x90, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xa}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x28, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x1eb}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0xa0}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x17}]}, @NL80211_PMSR_TYPE_FTM={0x4}, @NL80211_PMSR_TYPE_FTM={0x28, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0x28, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x18, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xc}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x9c, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x24, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x24, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x8}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xd}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0xd}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5}]}, @NL80211_PMSR_TYPE_FTM={0x2c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x9}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xc}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x18, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x8}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x7ff}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x8, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x4}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x2c, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x28, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x1}]}]}]}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa, 0x1, @broadcast}, @NL80211_PMSR_PEER_ATTR_CHAN={0x4}, @NL80211_PMSR_PEER_ATTR_REQ={0x68, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_DATA={0x3c, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x8, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x18, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0x4}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}]}, @NL80211_PMSR_PEER_ATTR_CHAN={0x34, 0x2, 0x0, 0x1, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x1b}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x38}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x2}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x6}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x217}]}]}, {0x10, 0x0, 0x0, 0x1, [@NL80211_PMSR_PEER_ATTR_ADDR={0xa, 0x1, @broadcast}]}]}}, @NL80211_ATTR_PEER_MEASUREMENTS={0xb0, 0x111, 0x0, 0x1, {0xac, 0x5, 0x0, 0x1, [{0x38, 0x0, 0x0, 0x1, [@NL80211_PMSR_PEER_ATTR_ADDR={0xa}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa, 0x1, @broadcast}, @NL80211_PMSR_PEER_ATTR_REQ={0x4}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa, 0x1, @device_b}, @NL80211_PMSR_PEER_ATTR_CHAN={0xc, 0x2, 0x0, 0x1, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x39}]}]}, {0x20, 0x0, 0x0, 0x1, [@NL80211_PMSR_PEER_ATTR_ADDR={0xa}, @NL80211_PMSR_PEER_ATTR_REQ={0x4}, @NL80211_PMSR_PEER_ATTR_CHAN={0xc, 0x2, 0x0, 0x1, [@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x2}]}]}, {0x4}, {0x1c, 0x0, 0x0, 0x1, [@NL80211_PMSR_PEER_ATTR_ADDR={0xa}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa}]}, {0x30, 0x0, 0x0, 0x1, [@NL80211_PMSR_PEER_ATTR_CHAN={0xc, 0x2, 0x0, 0x1, [@NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x33a}]}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa}, @NL80211_PMSR_PEER_ATTR_CHAN={0xc, 0x2, 0x0, 0x1, [@NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x1000}]}, @NL80211_PMSR_PEER_ATTR_REQ={0x8, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}]}]}]}}, @NL80211_ATTR_PEER_MEASUREMENTS={0x118, 0x111, 0x0, 0x1, {0x114, 0x5, 0x0, 0x1, [{0x110, 0x0, 0x0, 0x1, [@NL80211_PMSR_PEER_ATTR_ADDR={0xa, 0x1, @device_b}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa}, @NL80211_PMSR_PEER_ATTR_REQ={0xf4, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_DATA={0xa4, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x9}]}, @NL80211_PMSR_TYPE_FTM={0x8, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0xb}]}, @NL80211_PMSR_TYPE_FTM={0x24, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x9}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x24}]}, @NL80211_PMSR_TYPE_FTM={0x20, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xa}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x8}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x7}]}, @NL80211_PMSR_TYPE_FTM={0x18, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x4}]}, @NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x1f}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x8}]}, @NL80211_PMSR_TYPE_FTM={0x4}]}, @NL80211_PMSR_REQ_ATTR_DATA={0x4c, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x9}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x28, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x5}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x4}]}]}]}]}}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_PEER_MEASUREMENTS={0xa8, 0x111, 0x0, 0x1, {0xa4, 0x5, 0x0, 0x1, [{0x48, 0x0, 0x0, 0x1, [@NL80211_PMSR_PEER_ATTR_CHAN={0xc, 0x2, 0x0, 0x1, [@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8}]}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa, 0x1, @broadcast}, @NL80211_PMSR_PEER_ATTR_REQ={0x10, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x4}]}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa, 0x1, @broadcast}, @NL80211_PMSR_PEER_ATTR_CHAN={0x4}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa, 0x1, @device_b}]}, {0x58, 0x0, 0x0, 0x1, [@NL80211_PMSR_PEER_ATTR_CHAN={0xc, 0x2, 0x0, 0x1, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x15}]}, @NL80211_PMSR_PEER_ATTR_CHAN={0x2c, 0x2, 0x0, 0x1, [@NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x7}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x6}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x5}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x322}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x80}]}, @NL80211_PMSR_PEER_ATTR_CHAN={0x1c, 0x2, 0x0, 0x1, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x16}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x12}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xd}]}]}]}}, @NL80211_ATTR_TIMEOUT={0x8, 0x110, 0x5}, @NL80211_ATTR_TIMEOUT={0x8, 0x110, 0x8001}, @NL80211_ATTR_TIMEOUT={0x8, 0x110, 0x1}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x1510}, 0x1, 0x0, 0x0, 0x40002}, 0x800) mlockall(0x2) r6 = shmget$private(0x0, 0x400000, 0x8, &(0x7f000000e000/0x400000)=nil) r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TIOCSETD(r7, 0x5423, &(0x7f0000000100)=0x3) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x83, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfffffffffffffd71, 0xffffffffffffffff}, 0x78) r8 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x1a01, 0x0) ioctl$PPPIOCSFLAGS1(r8, 0x40047459, 0x0) shmat(r6, &(0x7f0000ffd000/0x1000)=nil, 0x7000) socket$nl_generic(0x10, 0x3, 0x10) 2.115189979s ago: executing program 6 (id=1452): syz_usb_connect(0x0, 0x4a, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)={0x48, 0x2, 0x6, 0x3, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:net\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x5}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x48}}, 0x0) r1 = socket(0x0, 0x800, 0x9) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, 0x0) r2 = openat$nci(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) syz_genetlink_get_family_id$gtp(&(0x7f0000000080), 0xffffffffffffffff) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r3) ioctl$sock_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000040)) ioctl$IOCTL_GET_NCIDEV_IDX(r2, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_VENDOR(r3, &(0x7f00000004c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000480)={&(0x7f0000000300)={0x150, r4, 0x1, 0x70bd27, 0x25dfdbfc, {}, [@NFC_ATTR_VENDOR_ID={0x8, 0x1d, 0x8}, @NFC_ATTR_VENDOR_DATA={0x5f, 0x1f, "22687b7aad16ddb1ca8f0fa0f6e7f9b9cb1fe9f65a765bb8e5e2b1f1756fa2d1ad46dcb3f678c2826c11b05fa36d262601e0eecb5e123c0bc07474306d0174a8bc65552b41c5a8ed9542b0dd804f40dcccec4f08a44638b1d9bc73"}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r5}, @NFC_ATTR_VENDOR_DATA={0xc1, 0x1f, "1909579b003bd853a0f60ac68ac2c22e981043d5985cc895efa15915d6bd84ea68224bd2c319869bc1be2d2933d12e588a66ff055ce1511e2c7cc5bdb278581019aafd371831cb8ee5af195869cc434c9b02edff40cdbe292745765528e0ba00038fbdb7f55edf9cb7de9b190bb2aca6e277722edb50e30894401a39c5e11c53440555a55f02fe765c5eb10486e25024455a3662a02f29e04edc283e42ad0e82fd66b3d2c5759b243cfee0ce68922a33075d748cc2b20e8b771eb6c636"}, @NFC_ATTR_VENDOR_ID={0x8}]}, 0x150}, 0x1, 0x0, 0x0, 0x20000010}, 0x40814) sendmsg$NFC_CMD_DEV_UP(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r4, @ANYBLOB="010026bd7000fcdbdf250200000008000100", @ANYRES32=r5], 0x1c}}, 0x840) write$nci(r2, &(0x7f00000006c0)=@NCI_OP_RF_INTF_ACTIVATED_NTF={0x1, 0x1, 0x3, 0x5, 0x9, @v={0x5, 0x2, 0x3, 0x6, 0x4, 0x6, 0x2, {0x0, 0x5, "7e2df34e1b96497a"}, 0x40, 0x98, 0xc, 0x7}}, 0x19) r6 = openat$mice(0xffffffffffffff9c, &(0x7f0000000140), 0x40000) fcntl$setstatus(r6, 0x4, 0x2000) 1.769102054s ago: executing program 5 (id=1453): sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) syz_open_dev$tty20(0xc, 0x4, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x16, 0xf, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70200000100000085000000860000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007300000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) shmctl$SHM_LOCK(0xffffffffffffffff, 0xb) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r2, 0x0, 0x10, 0x38, &(0x7f00000006c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000700)=""/8, 0x60ff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) 1.578763362s ago: executing program 4 (id=1454): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'veth1_macvtap\x00', 0x0}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000440)='./cgroup\x00', 0x40000100) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r4, 0xc0d05605, &(0x7f0000000200)={0x1, @meta={0x44564956, 0x35b09d18, 0x2093, 0x8761, 0x4d534547}}) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) mount(&(0x7f00000000c0)=@nullb, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000100)='hfs\x00', 0x2000010, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000380), 0xffffffffffffffff) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32, @ANYBLOB="fb060000000000e21000"/21, @ANYRES32=r0, @ANYRES32, @ANYBLOB="04000000000000000300"/28], 0x50) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) r5 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x40000) ioctl$SNDRV_TIMER_IOCTL_SELECT(r5, 0x40345410, &(0x7f0000000100)={{0x1, 0x0, 0x0, 0x3}}) ioctl$SNDRV_TIMER_IOCTL_INFO(r5, 0x80e85411, &(0x7f00000000c0)) 600.2146ms ago: executing program 2 (id=1455): r0 = socket$vsock_stream(0x28, 0x1, 0x0) getsockopt(r0, 0x28, 0x1, 0x0, 0x0) 506.430888ms ago: executing program 6 (id=1456): socket$kcm(0x2, 0x200000000000001, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, 0x0, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) r2 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0xca02}) preadv(r2, &(0x7f0000000340)=[{&(0x7f0000000000)=""/30, 0x1e}], 0x1, 0x8, 0x2) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='oom_score\x00') pread64(r3, &(0x7f0000000f80)=""/212, 0xd4, 0xffffffff) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$inet6(0xa, 0x3, 0x3) connect$inet6(r4, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendmmsg(r4, &(0x7f0000000480), 0x2e9, 0xffe0) 484.611687ms ago: executing program 2 (id=1457): syz_open_dev$video(&(0x7f0000000c80), 0x7, 0x113442) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000440)={'ip_vti0\x00', &(0x7f0000000480)={'syztnl0\x00', 0x0, 0x7800, 0x8000, 0x1, 0x5, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x3, 0x0, 0x1, 0x4, 0x0, @local, @loopback}}}}) bind$inet6(0xffffffffffffffff, &(0x7f0000000240)={0xa, 0x4e20, 0x800, @remote, 0x7}, 0x1c) sendmsg$inet(0xffffffffffffffff, &(0x7f0000003c00)={0x0, 0x0, &(0x7f0000000840)=[{&(0x7f0000000600)="447df50ce4033a7b5ad00b", 0xb}, {&(0x7f0000000580)="3281a1bd38517f12dd42749fd52cf2cdf1730d4c790a478374de091b10f7b95ea4b3660cd9f9a54f3292f37cb69a6f859838766366b3bf2870854eaaced9f207d32bb3443051145ae8", 0x49}, {&(0x7f0000000740)="13a3906a72409426638deed87fb262927d7f5a83058d9e6f0f46562bd02270af130970b3c5fef06f9c3ffc4ac3be8f5a96156fc6407471e68ae2ac5119665f5445dacab0c491759581e199f89db78297e4e5825ab285d4b7e36fb4aab037b1ee9d25b5e1b8881137578cd074b35333c9761a4049abd36547c42ee189c57c682b1044fa748f55a36da6300c8b3dcf546987c210e7f6a8f2d1118a6bc5e7e2726899cf58934e7a844ce7bd5aef45a1ca2b860147dff5f282f4aa45e86e69aeef7db1bede9a965e6b40b6bcb0ed1b490d01611a711ee8422c8e6d7d582a40", 0xdd}], 0x3}, 0x41) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=ANY=[], 0x18}, 0x1, 0x0, 0x0, 0x4c811}, 0x4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='tmpfs\x00', 0x0, &(0x7f00000001c0)='grpquota') r5 = creat(&(0x7f0000000440)='./file0/file0\x00', 0x188) quotactl_fd$Q_SETINFO(r5, 0xffffffff80000601, 0xee01, &(0x7f0000000300)={0xfffffffffffffffc, 0x5, 0x1, 0x2}) sendmmsg(r3, &(0x7f0000001c00), 0x400000000000159, 0x40840) write$dsp(0xffffffffffffffff, &(0x7f00000001c0)="5cba91a4", 0xffffffd9) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR(r5, 0x6, 0x13, &(0x7f0000000080)=0xffffffffffffffff, 0x4) connect$inet(0xffffffffffffffff, &(0x7f0000000200)={0x2, 0x4e24, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000280)=0x1, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r5, 0x8933, &(0x7f0000000140)={'batadv_slave_0\x00'}) bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@base={0x1f, 0x5, 0xcb3b, 0xffff, 0x20300, r5, 0x0, '\x00', r0, r5, 0x5}, 0x50) sendmmsg(0xffffffffffffffff, &(0x7f0000003500)=[{{0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000500)="9f", 0x1}], 0x1, &(0x7f0000000c00)=ANY=[@ANYBLOB="10000000000000000f010000000000003000000000000000ff00000005000000dae7c65afdd9d1d5073fbf984e560f7f7af0377a701ad4e8ab3a00000000000090000000000000000000000004000000474995282b8d35b2efb349cfa55288ab0139064c723f71e2d9ced0cbb2d46df48f8ee505b82850c69ed841ec12c3b6392c378033c46278ff6bc63d6d5bf4c8b718e78b05ad817aac3b5239cd4fe877aff14721f369a8fb6e6daa5710be61d3edc36edbd248ee581a70263663739cac6a0b0dc55ac9b2f56dc43f04dc78a3000058"], 0x128}}, {{0x0, 0x0, &(0x7f0000003380)=[{&(0x7f0000000b40)="a6", 0x1}], 0x1, &(0x7f0000003400)=[{0x10, 0x1, 0xf}], 0x10}}], 0x2, 0x4000045) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x40d, 0x70bd2c, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x10, 0x4d19d45ccbdf4d8}, [@IFLA_ALT_IFNAME={0x14, 0x35, 'macvlan0\x00'}]}, 0x34}}, 0x8000) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)) 414.974839ms ago: executing program 3 (id=1458): io_uring_setup(0x7d98, &(0x7f00000003c0)={0x0, 0xfdcf, 0x2, 0x2}) openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x20080, 0x0) open(&(0x7f0000000240)='./file1\x00', 0x345142, 0x0) mq_open(0x0, 0x42, 0x197, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x2, 0x7}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000140), 0x802, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x804) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000005580)=""/102392, 0x18ff8) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000208500000025000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000e00000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000006c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x50, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x2}, @NFTA_SET_EXPR={0x14, 0x11, 0x0, 0x1, @counter={{0xc}, @val={0x4}}}]}, @NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "d103"}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xb8}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000000) 0s ago: executing program 4 (id=1459): io_uring_setup(0x7d98, &(0x7f00000003c0)={0x0, 0xfdcf, 0x2, 0x2}) openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x20080, 0x0) r0 = open(&(0x7f0000000240)='./file1\x00', 0x345142, 0x0) mq_open(0x0, 0x42, 0x197, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x2, 0x7}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000140), 0x802, 0x0) ioctl$UI_SET_RELBIT(r1, 0x40045566, 0x804) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000005580)=""/102392, 0x18ff8) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0200000004000000ff0f00000700000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000040006c4e674bf45dcddf34dace96c748b21f55a81f5618c38b9e3cf1d22b9f207c0f07d29271f63e26517391369f118cb343132672ea3349fa216e171fafce26ec89840e642d3e576245fdf24bc947ef437cb2404106bb10902f33b23e139a236e1749e3bdf52fcd0f2f1644f5f3578d97fd169226cd721d2f0b0ed50b6f58"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000208500000025000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000e00000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000006c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x50, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x2}, @NFTA_SET_EXPR={0x14, 0x11, 0x0, 0x1, @counter={{0xc}, @val={0x4}}}]}, @NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "d103"}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xb8}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000000) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)={0x2c, 0xd, 0xa, 0x301, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24000801}, 0x8000) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)}, 0x20000041) sendmmsg(0xffffffffffffffff, &(0x7f0000000000), 0x4000000000001f2, 0x0) getsockopt(0xffffffffffffffff, 0x10117, 0xfbfffffe, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x7a98, 0x0, 0x0, 0x0, 0x0) r6 = eventfd2(0xeffffffb, 0x80800) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000040)={&(0x7f0000000000)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x6}) ioctl$KVM_IOEVENTFD(0xffffffffffffffff, 0x4040ae79, &(0x7f0000001340)={0x8, 0x0, 0x0, r6, 0xa}) kernel console output (not intermixed with test programs): 24B). Runtime 270 seconds [ 462.157823][ T2310] block nbd10: Possible stuck request ffff888027ca71c0: control (read@1024,1024B). Runtime 210 seconds [ 462.169017][ T5886] block nbd6: Possible stuck request ffff888027ac7540: control (read@3072,1024B). Runtime 270 seconds [ 462.180155][ T2310] block nbd10: Possible stuck request ffff888027ca7380: control (read@2048,1024B). Runtime 210 seconds [ 462.191320][ T2310] block nbd10: Possible stuck request ffff888027ca7540: control (read@3072,1024B). Runtime 210 seconds [ 462.423271][T10223] mac80211_hwsim hwsim16 wlan0: entered promiscuous mode [ 462.727449][ T991] usb 4-1: new high-speed USB device number 41 using dummy_hcd [ 462.888190][ T991] usb 4-1: Using ep0 maxpacket: 32 [ 462.898487][ T991] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x9 has an invalid bInterval 128, changing to 11 [ 463.009271][T10248] nbd18: detected capacity change from 0 to 63 [ 463.547262][ T991] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xB7, changing to 0x87 [ 463.629706][ T29] audit: type=1800 audit(1778808405.424:753): pid=10258 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.4.1146" name="SYSV00000000" dev="tmpfs" ino=0 res=0 errno=0 [ 463.694702][T10259] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1145'. [ 463.821014][ T5624] block nbd18: Receive control failed (result -32) [ 464.390710][ T991] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 464.402297][ T991] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x87 has invalid wMaxPacketSize 0 [ 464.419462][ T991] usb 4-1: New USB device found, idVendor=0e6f, idProduct=582c, bcdDevice=31.68 [ 464.428961][ T991] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 464.439994][ T991] usb 4-1: Product: syz [ 464.444266][ T991] usb 4-1: Manufacturer: syz [ 464.450837][ T991] usb 4-1: SerialNumber: syz [ 464.489854][ T991] usb 4-1: config 0 descriptor?? [ 464.748150][ T2310] block nbd1: Possible stuck request ffff888027920000: control (read@0,1024B). Runtime 360 seconds [ 464.759135][ T2310] block nbd1: Possible stuck request ffff8880279201c0: control (read@1024,1024B). Runtime 360 seconds [ 464.770976][ T2310] block nbd1: Possible stuck request ffff888027920380: control (read@2048,1024B). Runtime 360 seconds [ 464.782067][ T2310] block nbd1: Possible stuck request ffff888027920540: control (read@3072,1024B). Runtime 360 seconds [ 465.219407][T10242] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 465.222931][ T991] input: Generic X-Box pad as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input53 [ 465.238469][T10242] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 465.588327][T10268] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 465.602003][T10268] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 466.265396][ T5716] usb 4-1: USB disconnect, device number 41 [ 466.275070][ T2310] block nbd5: Possible stuck request ffff888027a50000: control (read@0,1024B). Runtime 300 seconds [ 466.285867][ T2310] block nbd5: Possible stuck request ffff888027a501c0: control (read@1024,1024B). Runtime 300 seconds [ 466.296913][ T2310] block nbd5: Possible stuck request ffff888027a50380: control (read@2048,1024B). Runtime 300 seconds [ 466.297259][ T9555] block nbd2: Possible stuck request ffff888027965080: control (read@0,1024B). Runtime 360 seconds [ 466.308487][ T2310] block nbd5: Possible stuck request ffff888027a50540: control (read@3072,1024B). Runtime 300 seconds [ 466.368962][ T9555] block nbd2: Possible stuck request ffff888027965240: control (read@1024,1024B). Runtime 360 seconds [ 466.382541][ T25] block nbd11: Possible stuck request ffff888027cde000: control (read@0,1024B). Runtime 210 seconds [ 466.393825][ T25] block nbd11: Possible stuck request ffff888027cde1c0: control (read@1024,1024B). Runtime 210 seconds [ 466.405389][ T25] block nbd11: Possible stuck request ffff888027cde380: control (read@2048,1024B). Runtime 210 seconds [ 466.416781][ T25] block nbd11: Possible stuck request ffff888027cde540: control (read@3072,1024B). Runtime 210 seconds [ 466.453263][ T25] block nbd2: Possible stuck request ffff888027965400: control (read@2048,1024B). Runtime 360 seconds [ 466.464597][ T25] block nbd2: Possible stuck request ffff8880279655c0: control (read@3072,1024B). Runtime 360 seconds [ 467.142088][ T29] audit: type=1400 audit(1778808408.974:754): avc: denied { read } for pid=10271 comm="syz.4.1149" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 467.634564][T10280] xt_addrtype: ipv6 PROHIBIT (THROW, NAT ..) matching not supported [ 467.858486][ T2310] block nbd3: Possible stuck request ffff888027a05080: control (read@0,1024B). Runtime 330 seconds [ 467.870232][ T2310] block nbd3: Possible stuck request ffff888027a05240: control (read@1024,1024B). Runtime 330 seconds [ 467.883212][ T2310] block nbd3: Possible stuck request ffff888027a05400: control (read@2048,1024B). Runtime 330 seconds [ 467.894533][ T2310] block nbd3: Possible stuck request ffff888027a055c0: control (read@3072,1024B). Runtime 330 seconds [ 469.410710][ T29] audit: type=1400 audit(1778808411.244:755): avc: denied { ioctl } for pid=10301 comm="syz.4.1160" path="socket:[31279]" dev="sockfs" ino=31279 ioctlcmd=0x89eb scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 469.462153][T10305] netlink: 156 bytes leftover after parsing attributes in process `syz.5.1161'. [ 469.495556][T10305] openvswitch: netlink: Missing key (keys=40, expected=10000000) [ 469.595570][T10309] FAULT_INJECTION: forcing a failure. [ 469.595570][T10309] name failslab, interval 1, probability 0, space 0, times 0 [ 469.609838][T10309] CPU: 1 UID: 0 PID: 10309 Comm: syz.5.1161 Not tainted syzkaller #0 PREEMPT(full) [ 469.609864][T10309] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 469.609874][T10309] Call Trace: [ 469.609880][T10309] [ 469.609887][T10309] dump_stack_lvl+0x100/0x190 [ 469.609917][T10309] should_fail_ex.cold+0x5/0xa [ 469.609942][T10309] should_failslab+0xc2/0x120 [ 469.609962][T10309] __kvmalloc_node_noprof+0xfa/0xa00 [ 469.609988][T10309] ? seq_read_iter+0x819/0x1270 [ 469.610015][T10309] seq_read_iter+0x819/0x1270 [ 469.610046][T10309] proc_reg_read_iter+0x220/0x310 [ 469.610071][T10309] copy_splice_read+0x4ba/0xb90 [ 469.610099][T10309] ? __pfx_copy_splice_read+0x10/0x10 [ 469.610125][T10309] ? look_up_lock_class+0x55/0x120 [ 469.610155][T10309] ? lockdep_init_map_type+0x5c/0x250 [ 469.610181][T10309] ? __pfx_pipe_lock_cmp_fn+0x10/0x10 [ 469.610205][T10309] ? __pfx_copy_splice_read+0x10/0x10 [ 469.610228][T10309] do_splice_read+0x285/0x370 [ 469.610255][T10309] splice_direct_to_actor+0x2a1/0xa30 [ 469.610281][T10309] ? __pfx_direct_splice_actor+0x10/0x10 [ 469.610309][T10309] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 469.610345][T10309] do_splice_direct+0x174/0x240 [ 469.610370][T10309] ? __pfx_do_splice_direct+0x10/0x10 [ 469.610392][T10309] ? avc_policy_seqno+0x9/0x20 [ 469.610410][T10309] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 469.610437][T10309] ? rw_verify_area+0xce/0x6d0 [ 469.610457][T10309] do_sendfile+0xadc/0xe20 [ 469.610482][T10309] ? __pfx_do_sendfile+0x10/0x10 [ 469.610504][T10309] ? __pfx___schedule+0x10/0x10 [ 469.610531][T10309] ? ksys_write+0x7e/0x250 [ 469.610553][T10309] __x64_sys_sendfile64+0x1d8/0x220 [ 469.610576][T10309] ? exit_to_user_mode_loop+0xe2/0x4f0 [ 469.610601][T10309] ? __pfx___x64_sys_sendfile64+0x10/0x10 [ 469.610627][T10309] ? rcu_is_watching+0x12/0xc0 [ 469.610658][T10309] do_syscall_64+0x10b/0xf80 [ 469.610681][T10309] ? clear_bhb_loop+0x40/0x90 [ 469.610703][T10309] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 469.610721][T10309] RIP: 0033:0x7fcbe959ce59 [ 469.610736][T10309] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 469.610752][T10309] RSP: 002b:00007fcbea3eb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 469.610769][T10309] RAX: ffffffffffffffda RBX: 00007fcbe9816090 RCX: 00007fcbe959ce59 [ 469.610780][T10309] RDX: 0000000000000000 RSI: 000000000000000e RDI: 000000000000000d [ 469.610790][T10309] RBP: 00007fcbea3eb090 R08: 0000000000000000 R09: 0000000000000000 [ 469.610800][T10309] R10: 000000000000106f R11: 0000000000000246 R12: 0000000000000001 [ 469.610810][T10309] R13: 00007fcbe9816128 R14: 00007fcbe9816090 R15: 00007ffd8aede0b8 [ 469.610835][T10309] [ 470.097896][ T29] audit: type=1400 audit(1778808411.444:756): avc: denied { read } for pid=10303 comm="syz.5.1161" path="socket:[31284]" dev="sockfs" ino=31284 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 471.967644][ T29] audit: type=1400 audit(1778808413.774:757): avc: denied { watch } for pid=10326 comm="syz.3.1165" path=2F6D656D66643A2D42D54E49C56A9A707070F00884A26D202864656C6574656429 dev="tmpfs" ino=138 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 472.079063][T10320] nbd19: detected capacity change from 0 to 63 [ 472.157601][ T9] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 472.209537][ T5624] block nbd19: Receive control failed (result -32) [ 472.319204][ T9] usb 7-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xE8, changing to 0x88 [ 472.331068][ T9] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x88 has an invalid bInterval 0, changing to 7 [ 472.543105][ T9] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0xA has an invalid bInterval 0, changing to 7 [ 472.842475][ T9] usb 7-1: New USB device found, idVendor=1781, idProduct=0938, bcdDevice=9b.49 [ 472.852604][ T9] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 472.868073][ T9] usb 7-1: Product: syz [ 472.872482][ T9] usb 7-1: Manufacturer: syz [ 472.942222][ T9] usb 7-1: SerialNumber: syz [ 472.949987][ T9] usb 7-1: config 0 descriptor?? [ 473.190645][T10330] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 473.213437][T10330] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 473.469961][T10330] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1166'. [ 473.816048][T10348] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 473.888290][T10348] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 473.974199][T10330] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1166'. [ 473.994085][T10330] bridge0: port 1(bridge_slave_0) entered disabled state [ 474.045398][T10330] bridge_slave_0 (unregistering): left allmulticast mode [ 474.065280][T10330] bridge_slave_0 (unregistering): left promiscuous mode [ 474.073156][T10330] bridge0: port 1(bridge_slave_0) entered disabled state [ 474.157560][ T5716] usb 3-1: new high-speed USB device number 46 using dummy_hcd [ 474.290347][T10363] nbd20: detected capacity change from 0 to 63 [ 474.307490][ T10] usb 4-1: new full-speed USB device number 42 using dummy_hcd [ 474.337464][ T5716] usb 3-1: Using ep0 maxpacket: 32 [ 474.349508][ T5716] usb 3-1: config index 0 descriptor too short (expected 29220, got 36) [ 474.365741][ T5716] usb 3-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 474.389560][ T5716] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 474.398744][ T5716] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 474.408628][ T5716] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 474.419918][ T5716] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 474.433102][ T5716] usb 3-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 474.442368][ T5716] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 474.454772][ T5716] usb 3-1: config 0 descriptor?? [ 474.487013][T10358] ubi0: attaching mtd0 [ 474.496238][ T10] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 474.504118][ T10] usb 4-1: can't read configurations, error -71 [ 474.683055][ T5716] usblp 3-1:0.0: usblp0: USB Bidirectional printer dev 46 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 474.907533][ T5624] block nbd20: Receive control failed (result -32) [ 475.321538][ T5624] Bluetooth: hci1: unexpected event for opcode 0x1005 [ 475.858646][ T10] usb 4-1: new high-speed USB device number 44 using dummy_hcd [ 476.067843][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 476.094382][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 476.124719][ T10] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 476.151261][ T10] usb 4-1: New USB device found, idVendor=054c, idProduct=09cc, bcdDevice= 0.00 [ 476.163851][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 476.175907][ T10] usb 4-1: config 0 descriptor?? [ 476.944425][ T10] usbhid 4-1:0.0: can't add hid device: -71 [ 476.953281][ T10] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 476.964626][ T10] usb 4-1: USB disconnect, device number 44 [ 476.970878][ T991] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 477.141077][ T991] usb 6-1: Using ep0 maxpacket: 32 [ 477.162828][ T991] usb 6-1: config index 0 descriptor too short (expected 29220, got 36) [ 477.185349][ T991] usb 6-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 477.673047][ T991] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 477.682284][ T991] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 477.693114][ T991] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 477.703295][ T991] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 477.716508][ T991] usb 6-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 477.725773][ T991] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 477.737328][ T991] usb 6-1: config 0 descriptor?? [ 477.752277][ T46] usb 3-1: USB disconnect, device number 46 [ 477.772459][ T46] usblp0: removed [ 477.978694][ T991] usblp 6-1:0.0: usblp0: USB Bidirectional printer dev 3 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 478.492786][T10408] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2509062526 (321160003328 ns) > initial count (61357889024 ns). Using initial count to start timer. [ 478.788062][ T806] usb 3-1: new high-speed USB device number 47 using dummy_hcd [ 478.887734][T10138] usb 4-1: new full-speed USB device number 45 using dummy_hcd [ 478.947734][ T806] usb 3-1: Using ep0 maxpacket: 16 [ 478.959996][ T806] usb 3-1: config 0 interface 0 altsetting 64 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 478.983713][ T806] usb 3-1: config 0 interface 0 has no altsetting 0 [ 479.004790][ T806] usb 3-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 479.025778][ T806] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 479.048990][ T806] usb 3-1: config 0 descriptor?? [ 479.059231][T10138] usb 4-1: config 0 has an invalid interface number: 3 but max is 2 [ 479.068516][T10138] usb 4-1: config 0 has an invalid interface number: 176 but max is 2 [ 479.076884][T10138] usb 4-1: config 0 has no interface number 1 [ 479.083310][T10138] usb 4-1: config 0 has no interface number 2 [ 479.089804][T10138] usb 4-1: too many endpoints for config 0 interface 0 altsetting 253: 255, using maximum allowed: 30 [ 479.101115][T10138] usb 4-1: config 0 interface 0 altsetting 253 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 479.118812][ T991] usb 6-1: USB disconnect, device number 3 [ 479.128568][T10138] usb 4-1: config 0 interface 0 has no altsetting 0 [ 479.143403][ T991] usblp0: removed [ 479.144503][T10138] usb 4-1: New USB device found, idVendor=05c6, idProduct=9205, bcdDevice=29.ac [ 479.248268][T10138] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 479.262216][T10138] usb 4-1: config 0 descriptor?? [ 479.567149][T10138] usb 4-1: Could not set interface, error -71 [ 479.575996][ T806] mcp2221 0003:04D8:00DD.0007: USB HID v0.01 Device [HID 04d8:00dd] on usb-dummy_hcd.2-1/input0 [ 479.590772][T10138] usb 4-1: string descriptor 0 read error: -71 [ 479.601421][T10138] qmi_wwan 4-1:0.0: probe with driver qmi_wwan failed with error -22 [ 479.616737][T10138] usb 4-1: USB disconnect, device number 45 [ 479.927889][T10434] bridge_slave_1: vlans aren't supported yet for dev_uc|mc_add() [ 479.936338][T10435] bridge_slave_1: vlans aren't supported yet for dev_uc|mc_add() [ 479.977263][T10408] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1188'. [ 479.997795][ T991] usb 3-1: USB disconnect, device number 47 [ 480.002690][T10437] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1196'. [ 480.014873][T10435] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1196'. [ 480.026248][T10434] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1196'. [ 480.052733][T10434] netlink: 24 bytes leftover after parsing attributes in process `syz.5.1196'. [ 480.063655][T10434] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1196'. [ 480.072885][T10434] netlink: 24 bytes leftover after parsing attributes in process `syz.5.1196'. [ 480.617584][ T5624] Bluetooth: hci1: unexpected event for opcode 0x0809 [ 481.016064][ T2310] block nbd7: Possible stuck request ffff888027b35080: control (read@0,1024B). Runtime 270 seconds [ 481.027161][ T2310] block nbd7: Possible stuck request ffff888027b35240: control (read@1024,1024B). Runtime 270 seconds [ 481.038355][ T2310] block nbd7: Possible stuck request ffff888027b35400: control (read@2048,1024B). Runtime 270 seconds [ 481.049422][ T2310] block nbd7: Possible stuck request ffff888027b355c0: control (read@3072,1024B). Runtime 270 seconds [ 481.156290][T10447] netlink: 'syz.5.1197': attribute type 1 has an invalid length. [ 482.587776][T10138] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 482.787790][T10138] usb 6-1: Using ep0 maxpacket: 16 [ 482.825515][T10138] usb 6-1: config index 0 descriptor too short (expected 51443, got 18) [ 482.899496][T10138] usb 6-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 482.949911][T10138] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 483.040774][T10138] usb 6-1: Product: syz [ 483.067624][T10138] usb 6-1: Manufacturer: syz [ 483.115930][T10138] usb 6-1: SerialNumber: syz [ 483.176543][ T29] audit: type=1400 audit(1778808425.996:758): avc: denied { write } for pid=10454 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 483.202070][T10138] r8152-cfgselector 6-1: Unknown version 0x0000 [ 483.222551][T10138] r8152-cfgselector 6-1: config 0 descriptor?? [ 483.341272][ T29] audit: type=1400 audit(1778808426.176:759): avc: denied { write } for pid=10492 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 483.555849][T10501] FAULT_INJECTION: forcing a failure. [ 483.555849][T10501] name failslab, interval 1, probability 0, space 0, times 0 [ 483.569897][T10501] CPU: 1 UID: 0 PID: 10501 Comm: syz.3.1211 Not tainted syzkaller #0 PREEMPT(full) [ 483.569920][T10501] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 483.569933][T10501] Call Trace: [ 483.569939][T10501] [ 483.569945][T10501] dump_stack_lvl+0x100/0x190 [ 483.569972][T10501] should_fail_ex.cold+0x5/0xa [ 483.569996][T10501] should_failslab+0xc2/0x120 [ 483.570015][T10501] __kvmalloc_node_noprof+0xfa/0xa00 [ 483.570040][T10501] ? io_rsrc_data_alloc+0x2c/0xa0 [ 483.570058][T10501] ? rcu_is_watching+0x12/0xc0 [ 483.570089][T10501] io_rsrc_data_alloc+0x2c/0xa0 [ 483.570107][T10501] io_sqe_buffers_register.cold+0x16/0x4d2 [ 483.570129][T10501] ? __pfx___mutex_lock+0x10/0x10 [ 483.570159][T10501] ? __pfx_io_sqe_buffers_register+0x10/0x10 [ 483.570181][T10501] ? __fget_files+0x215/0x3d0 [ 483.570209][T10501] ? __fget_files+0x21f/0x3d0 [ 483.570238][T10501] __do_sys_io_uring_register+0x13e5/0x1bd0 [ 483.570265][T10501] ? __pfx___do_sys_io_uring_register+0x10/0x10 [ 483.570287][T10501] ? __fget_files+0x21f/0x3d0 [ 483.570314][T10501] ? fput+0x79/0x100 [ 483.570338][T10501] ? ksys_write+0x1ac/0x250 [ 483.570357][T10501] ? __pfx_ksys_write+0x10/0x10 [ 483.570379][T10501] ? rcu_is_watching+0x12/0xc0 [ 483.570409][T10501] do_syscall_64+0x10b/0xf80 [ 483.570431][T10501] ? clear_bhb_loop+0x40/0x90 [ 483.570452][T10501] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 483.570471][T10501] RIP: 0033:0x7f5d9c99ce59 [ 483.570486][T10501] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 483.570503][T10501] RSP: 002b:00007f5d9d7d1028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ab [ 483.570519][T10501] RAX: ffffffffffffffda RBX: 00007f5d9cc15fa0 RCX: 00007f5d9c99ce59 [ 483.570530][T10501] RDX: 00002000000002c0 RSI: 0000000000000000 RDI: 0000000000000003 [ 483.570539][T10501] RBP: 00007f5d9d7d1090 R08: 0000000000000000 R09: 0000000000000000 [ 483.570549][T10501] R10: 100000000000011a R11: 0000000000000246 R12: 0000000000000001 [ 483.570558][T10501] R13: 00007f5d9cc16038 R14: 00007f5d9cc15fa0 R15: 00007ffead2e8d98 [ 483.570581][T10501] [ 483.985530][ T29] audit: type=1400 audit(1778808426.716:760): avc: denied { write } for pid=10507 comm="syz.3.1212" name="urandom" dev="devtmpfs" ino=9 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:urandom_device_t tclass=chr_file permissive=1 [ 484.105907][ T29] audit: type=1400 audit(1778808426.746:761): avc: denied { read } for pid=10470 comm="syz.5.1206" name="mouse0" dev="devtmpfs" ino=923 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 484.133738][ T29] audit: type=1400 audit(1778808426.816:762): avc: denied { create } for pid=10510 comm="syz.3.1213" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 484.162313][ T29] audit: type=1400 audit(1778808426.876:763): avc: denied { mounton } for pid=10510 comm="syz.3.1213" path="/268/file0" dev="tmpfs" ino=1412 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 484.275739][ T29] audit: type=1400 audit(1778808427.106:764): avc: denied { write } for pid=10496 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 484.610792][T10138] r8152-cfgselector 6-1: Unknown version 0x0000 [ 484.617676][T10138] r8152-cfgselector 6-1: No union descriptors [ 484.630105][ T46] usb 4-1: new high-speed USB device number 46 using dummy_hcd [ 484.807044][T10138] r8152-cfgselector 6-1: USB disconnect, device number 4 [ 484.824769][ T46] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 484.878541][ T29] audit: type=1400 audit(1778808427.506:765): avc: denied { write } for pid=10528 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 484.948427][ T46] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 485.035433][ T46] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 485.168455][ T25] block nbd0: Possible stuck request ffff8880278ce000: control (read@0,1024B). Runtime 390 seconds [ 485.179834][ T25] block nbd0: Possible stuck request ffff8880278ce1c0: control (read@1024,1024B). Runtime 390 seconds [ 485.192332][ T25] block nbd0: Possible stuck request ffff8880278ce380: control (read@2048,1024B). Runtime 390 seconds [ 485.208432][ T25] block nbd0: Possible stuck request ffff8880278ce540: control (read@3072,1024B). Runtime 390 seconds [ 485.243983][ T46] usb 4-1: config 0 descriptor?? [ 485.704448][ T46] ath6kl: Unsupported hardware version: 0x0 [ 485.741456][ T46] ath6kl: Failed to init ath6kl core: -22 [ 485.754124][ T46] ath6kl_usb 4-1:0.0: probe with driver ath6kl_usb failed with error -22 [ 485.881218][ T29] audit: type=1400 audit(1778808428.716:766): avc: denied { write } for pid=10543 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 485.967873][ T29] audit: type=1400 audit(1778808428.766:767): avc: denied { map } for pid=10510 comm="syz.3.1213" path="/dev/raw-gadget" dev="devtmpfs" ino=820 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 486.470089][ T5716] usb 4-1: USB disconnect, device number 46 [ 486.658151][ T991] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 486.867661][ T991] usb 6-1: Using ep0 maxpacket: 32 [ 486.914785][ T991] usb 6-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 64 [ 486.929107][ T991] usb 6-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 1023 [ 487.073295][ T2310] block nbd4: Possible stuck request ffff888027a2e000: control (read@0,1024B). Runtime 330 seconds [ 487.086252][ T2310] block nbd4: Possible stuck request ffff888027a2e1c0: control (read@1024,1024B). Runtime 330 seconds [ 487.101084][ T2310] block nbd4: Possible stuck request ffff888027a2e380: control (read@2048,1024B). Runtime 330 seconds [ 487.137768][ T2310] block nbd4: Possible stuck request ffff888027a2e540: control (read@3072,1024B). Runtime 330 seconds [ 487.157126][ T991] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 487.166890][ T991] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 487.178394][ T991] usb 6-1: Product: syz [ 487.184623][ T991] usb 6-1: Manufacturer: syz [ 487.208026][ T991] usb 6-1: SerialNumber: syz [ 487.600684][T10581] xfrm0 speed is unknown, defaulting to 1000 [ 487.603024][ T991] cdc_ncm 6-1:1.0: bind() failure [ 487.640556][T10581] xfrm0 speed is unknown, defaulting to 1000 [ 487.679735][T10581] xfrm0 speed is unknown, defaulting to 1000 [ 487.690614][ T991] cdc_ncm 6-1:1.1: CDC Union missing and no IAD found [ 487.721960][ T991] cdc_ncm 6-1:1.1: bind() failure [ 487.746457][T10581] smbdirect: ib_dev[syz0]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 487.752467][ T991] usb 6-1: USB disconnect, device number 5 [ 487.833407][T10581] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 487.902921][T10581] smbdirect: ib_dev[syz0]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 488.190799][T10581] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 488.333105][T10591] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1228'. [ 488.467498][ T46] usb 4-1: new full-speed USB device number 47 using dummy_hcd [ 488.634351][T10581] xfrm0 speed is unknown, defaulting to 1000 [ 488.690912][T10581] xfrm0 speed is unknown, defaulting to 1000 [ 488.709080][T10581] xfrm0 speed is unknown, defaulting to 1000 [ 488.872836][T10581] xfrm0 speed is unknown, defaulting to 1000 [ 488.892252][T10581] xfrm0 speed is unknown, defaulting to 1000 [ 488.977843][T10596] Invalid source name [ 489.086226][T10597] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 489.106152][T10597] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 489.123015][ T5708] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 489.135475][ T2310] block nbd9: Possible stuck request ffff888027c3e000: control (read@0,1024B). Runtime 240 seconds [ 489.147850][ T2310] block nbd9: Possible stuck request ffff888027c3e1c0: control (read@1024,1024B). Runtime 240 seconds [ 489.159425][ T2310] block nbd9: Possible stuck request ffff888027c3e380: control (read@2048,1024B). Runtime 240 seconds [ 489.173009][ T2310] block nbd9: Possible stuck request ffff888027c3e540: control (read@3072,1024B). Runtime 240 seconds [ 489.273523][T10596] xfrm0 speed is unknown, defaulting to 1000 [ 489.362272][T10581] xfrm0 speed is unknown, defaulting to 1000 [ 489.390350][T10581] xfrm0 speed is unknown, defaulting to 1000 [ 489.399221][ T5708] usb 6-1: Using ep0 maxpacket: 32 [ 489.412122][T10581] xfrm0 speed is unknown, defaulting to 1000 [ 489.428219][ T5708] usb 6-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 489.461624][ T5708] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 489.510793][ T5708] usb 6-1: config 0 descriptor?? [ 489.562998][ T5708] as10x_usb: device has been detected [ 489.587793][ T5708] dvbdev: DVB: registering new adapter (nBox DVB-T Dongle) [ 489.633510][ T5708] usb 6-1: DVB: registering adapter 1 frontend 0 (nBox DVB-T Dongle)... [ 489.686527][ T29] kauditd_printk_skb: 3 callbacks suppressed [ 489.686544][ T29] audit: type=1400 audit(1778808432.516:771): avc: denied { firmware_load } for pid=5708 comm="kworker/0:4" path="/lib/firmware/as102_data1_st.hex" dev="sda1" ino=297 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:lib_t tclass=system permissive=1 [ 489.719291][ T5708] as10x_usb: error during firmware upload part1 [ 489.728802][ T5708] Registered device nBox DVB-T Dongle [ 489.766387][ T29] audit: type=1400 audit(1778808432.576:772): avc: denied { bind } for pid=10593 comm="syz.5.1230" lport=58 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 489.768482][ T5708] usb 6-1: USB disconnect, device number 6 [ 489.865562][ T29] audit: type=1400 audit(1778808432.576:773): avc: denied { name_bind } for pid=10593 comm="syz.5.1230" src=20007 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 489.940957][ T29] audit: type=1400 audit(1778808432.576:774): avc: denied { node_bind } for pid=10593 comm="syz.5.1230" saddr=fe80::3f src=20007 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=rawip_socket permissive=1 [ 489.943333][ T5708] Unregistered device nBox DVB-T Dongle [ 490.018733][ T5708] as10x_usb: device has been disconnected [ 490.024674][ T29] audit: type=1400 audit(1778808432.576:775): avc: denied { bind } for pid=10599 comm="syz.4.1232" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 490.113953][ T29] audit: type=1400 audit(1778808432.776:776): avc: denied { bind } for pid=10601 comm="syz.4.1233" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 490.187741][ T29] audit: type=1400 audit(1778808432.806:777): avc: denied { write } for pid=10601 comm="syz.4.1233" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 490.271593][T10605] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(5) [ 490.278854][T10605] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 490.313494][T10605] vhci_hcd vhci_hcd.0: Device attached [ 490.378495][ T5708] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 490.697520][ T5708] usb 6-1: Using ep0 maxpacket: 16 [ 490.707587][T10138] usb 42-1: SetAddress Request (2) to port 0 [ 491.428836][ T2310] block nbd12: Possible stuck request ffff888027d37000: control (read@0,1024B). Runtime 210 seconds [ 491.566965][ T46] usb 4-1: unable to get BOS descriptor or descriptor too short [ 491.662884][ T2310] block nbd12: Possible stuck request ffff888027d371c0: control (read@1024,1024B). Runtime 210 seconds [ 491.673664][ T46] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 491.674206][ T2310] block nbd12: Possible stuck request ffff888027d37380: control (read@2048,1024B). Runtime 210 seconds [ 491.684237][T10138] usb 42-1: new SuperSpeed USB device number 2 using vhci_hcd [ 491.703853][ T2310] block nbd12: Possible stuck request ffff888027d37540: control (read@3072,1024B). Runtime 210 seconds [ 491.873994][ T46] usb 4-1: can't read configurations, error -71 [ 491.921550][ T5708] usb 6-1: unable to read config index 0 descriptor/start: -71 [ 491.942433][ T5708] usb 6-1: can't read configurations, error -71 [ 491.994392][T10612] vhci_hcd: sendmsg failed!, ret=-32 for 48 [ 492.001490][T10611] vhci_hcd: connection closed [ 492.008025][ T80] vhci_hcd vhci_hcd.4: stop threads [ 492.079898][ T80] vhci_hcd vhci_hcd.4: release socket [ 492.114569][ T80] vhci_hcd vhci_hcd.4: disconnect device [ 492.177926][ T5886] block nbd10: Possible stuck request ffff888027ca7000: control (read@0,1024B). Runtime 240 seconds [ 492.190048][ T5886] block nbd10: Possible stuck request ffff888027ca71c0: control (read@1024,1024B). Runtime 240 seconds [ 492.203332][ T2310] block nbd6: Possible stuck request ffff888027ac7000: control (read@0,1024B). Runtime 300 seconds [ 492.217127][ T2310] block nbd6: Possible stuck request ffff888027ac71c0: control (read@1024,1024B). Runtime 300 seconds [ 492.228397][ T2310] block nbd6: Possible stuck request ffff888027ac7380: control (read@2048,1024B). Runtime 300 seconds [ 492.244596][ T5886] block nbd10: Possible stuck request ffff888027ca7380: control (read@2048,1024B). Runtime 240 seconds [ 492.256737][ T2310] block nbd6: Possible stuck request ffff888027ac7540: control (read@3072,1024B). Runtime 300 seconds [ 492.268040][ T5886] block nbd10: Possible stuck request ffff888027ca7540: control (read@3072,1024B). Runtime 240 seconds [ 492.504488][T10638] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1241'. [ 492.513431][T10638] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1241'. [ 492.522743][T10638] netlink: 'syz.4.1241': attribute type 11 has an invalid length. [ 492.532218][T10638] netlink: 'syz.4.1241': attribute type 7 has an invalid length. [ 493.297887][ T5624] Bluetooth: hci7: Entering manufacturer mode failed (-110) [ 493.313405][ T5630] Bluetooth: hci7: command 0xfc11 tx timeout [ 493.457578][ T9] iguanair 7-1:0.0: failed to get version [ 493.476948][ T9] iguanair 7-1:0.0: probe with driver iguanair failed with error -110 [ 493.578687][ T9] usb 7-1: USB disconnect, device number 2 [ 494.177467][ T5708] usb 5-1: new high-speed USB device number 49 using dummy_hcd [ 494.820550][ T5708] usb 5-1: Using ep0 maxpacket: 8 [ 494.842266][ T5708] usb 5-1: config 179 has an invalid interface number: 65 but max is 0 [ 494.869562][ T5708] usb 5-1: config 179 has no interface number 0 [ 494.887461][ T5708] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9 [ 494.927533][ T5708] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024 [ 494.939672][ T5708] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0x83 has an invalid bInterval 52, changing to 9 [ 494.952915][ T5708] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0x83 has invalid maxpacket 8241, setting to 1024 [ 494.980250][ T5708] usb 5-1: config 179 interface 65 altsetting 12 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 494.999343][ T5708] usb 5-1: config 179 interface 65 has no altsetting 0 [ 495.030627][ T5708] usb 5-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 495.043673][ T5708] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 495.073752][ T5708] input: Honey Bee Xbox360 dancepad as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:179.65/input/input62 [ 495.137903][ T4965] input input62: unable to receive magic message: -110 [ 495.150211][ T46] usb 4-1: new high-speed USB device number 49 using dummy_hcd [ 495.161188][ T4965] input input62: unable to receive magic message: -32 [ 495.191860][ T4965] input input62: unable to receive magic message: -32 [ 495.216923][ T4965] input input62: unable to receive magic message: -32 [ 495.272446][ T29] audit: type=1400 audit(1778808438.106:778): avc: denied { ioctl } for pid=10642 comm="syz.4.1243" path="/dev/ptyqc" dev="devtmpfs" ino=131 ioctlcmd=0x5423 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bsdpty_device_t tclass=chr_file permissive=1 [ 495.318006][ T5716] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 495.339415][ T46] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 495.350722][ T46] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 495.379341][ T5886] block nbd1: Possible stuck request ffff888027920000: control (read@0,1024B). Runtime 390 seconds [ 495.390931][ T5886] block nbd1: Possible stuck request ffff8880279201c0: control (read@1024,1024B). Runtime 390 seconds [ 495.400200][ T46] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 495.402181][ T5886] block nbd1: Possible stuck request ffff888027920380: control (read@2048,1024B). Runtime 390 seconds [ 495.428361][ T5886] block nbd1: Possible stuck request ffff888027920540: control (read@3072,1024B). Runtime 390 seconds [ 495.457168][ T46] usb 4-1: New USB device found, idVendor=054c, idProduct=09cc, bcdDevice= 0.00 [ 495.491868][ T46] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 495.507489][ T5716] usb 6-1: Using ep0 maxpacket: 32 [ 495.518917][ T5716] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x9 has an invalid bInterval 128, changing to 11 [ 495.531014][ T5716] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xB7, changing to 0x87 [ 495.539071][ T46] usb 4-1: config 0 descriptor?? [ 495.543959][ T5716] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 495.569464][T10643] tipc: Enabling of bearer rejected, failed to enable media [ 495.578981][ T5716] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x87 has invalid wMaxPacketSize 0 [ 495.596189][ T5716] usb 6-1: New USB device found, idVendor=0e6f, idProduct=582c, bcdDevice=31.68 [ 495.600007][ T24] usb 5-1: USB disconnect, device number 49 [ 495.605474][ C0] xpad 5-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 495.624274][ T5716] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 495.632694][ T5716] usb 6-1: Product: syz [ 495.637053][ T5716] usb 6-1: Manufacturer: syz [ 495.642522][ T5716] usb 6-1: SerialNumber: syz [ 495.650116][ T5716] usb 6-1: config 0 descriptor?? [ 495.670649][ T5716] input: Generic X-Box pad as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/input/input63 [ 495.825219][ T46] usbhid 4-1:0.0: can't add hid device: -71 [ 495.831496][ T46] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 495.854659][ T46] usb 4-1: USB disconnect, device number 49 [ 495.884005][T10658] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 495.908665][T10658] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 496.428065][T10660] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 496.444651][T10660] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 496.488098][T10660] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 496.500552][T10660] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 496.859766][ T5624] Bluetooth: hci7: Entering manufacturer mode failed (-110) [ 496.865753][ T5886] block nbd5: Possible stuck request ffff888027a50000: control (read@0,1024B). Runtime 330 seconds [ 496.878930][ T5886] block nbd5: Possible stuck request ffff888027a501c0: control (read@1024,1024B). Runtime 330 seconds [ 496.887683][ T1313] ieee802154 phy1 wpan1: encryption failed: -22 [ 496.894342][ T5716] usb 6-1: USB disconnect, device number 9 [ 496.902179][ T5886] block nbd5: Possible stuck request ffff888027a50380: control (read@2048,1024B). Runtime 330 seconds [ 496.913237][ T5886] block nbd5: Possible stuck request ffff888027a50540: control (read@3072,1024B). Runtime 330 seconds [ 496.952581][ T25] block nbd11: Possible stuck request ffff888027cde000: control (read@0,1024B). Runtime 240 seconds [ 496.952657][T10270] block nbd2: Possible stuck request ffff888027965080: control (read@0,1024B). Runtime 390 seconds [ 496.975655][ T25] block nbd11: Possible stuck request ffff888027cde1c0: control (read@1024,1024B). Runtime 240 seconds [ 496.987707][ T25] block nbd11: Possible stuck request ffff888027cde380: control (read@2048,1024B). Runtime 240 seconds [ 497.000124][T10270] block nbd2: Possible stuck request ffff888027965240: control (read@1024,1024B). Runtime 390 seconds [ 497.011213][ T25] block nbd11: Possible stuck request ffff888027cde540: control (read@3072,1024B). Runtime 240 seconds [ 497.023182][T10270] block nbd2: Possible stuck request ffff888027965400: control (read@2048,1024B). Runtime 390 seconds [ 497.035315][T10270] block nbd2: Possible stuck request ffff8880279655c0: control (read@3072,1024B). Runtime 390 seconds [ 497.057958][T10138] usb 42-1: device descriptor read/8, error -110 [ 497.642214][T10666] ubi16: attaching mtd0 [ 497.674703][T10138] usb usb42-port1: attempt power cycle [ 497.736208][T10666] ubi16: scanning is finished [ 497.760751][T10666] ubi16: empty MTD device detected [ 497.839194][ T5630] Bluetooth: hci1: unexpected cc 0x203e length: 2 > 1 [ 497.847610][ T5630] Bluetooth: hci1: unexpected event for opcode 0x203e [ 497.927944][T10673] netlink: 'syz.6.1252': attribute type 10 has an invalid length. [ 497.936081][T10673] bridge0: port 2(bridge_slave_1) entered disabled state [ 497.941819][ T5886] block nbd3: Possible stuck request ffff888027a05080: control (read@0,1024B). Runtime 360 seconds [ 497.947078][T10673] bridge0: port 2(bridge_slave_1) entered blocking state [ 497.953997][ T5886] block nbd3: Possible stuck request ffff888027a05240: control (read@1024,1024B). Runtime 360 seconds [ 497.961087][T10673] bridge0: port 2(bridge_slave_1) entered forwarding state [ 497.973380][ T5886] block nbd3: Possible stuck request ffff888027a05400: control (read@2048,1024B). Runtime 360 seconds [ 497.983219][T10673] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 497.990479][ T5886] block nbd3: Possible stuck request ffff888027a055c0: control (read@3072,1024B). Runtime 360 seconds [ 498.162062][T10668] FAULT_INJECTION: forcing a failure. [ 498.162062][T10668] name failslab, interval 1, probability 0, space 0, times 0 [ 498.207588][T10668] CPU: 1 UID: 0 PID: 10668 Comm: syz.4.1251 Not tainted syzkaller #0 PREEMPT(full) [ 498.207615][T10668] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 498.207626][T10668] Call Trace: [ 498.207632][T10668] [ 498.207638][T10668] dump_stack_lvl+0x100/0x190 [ 498.207667][T10668] should_fail_ex.cold+0x5/0xa [ 498.207692][T10668] should_failslab+0xc2/0x120 [ 498.207713][T10668] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 498.207739][T10668] ? do_getname+0x35/0x390 [ 498.207772][T10668] do_getname+0x35/0x390 [ 498.207801][T10668] user_path_at+0x26/0x60 [ 498.207823][T10668] __x64_sys_mount+0x1fb/0x310 [ 498.207851][T10668] ? __pfx___x64_sys_mount+0x10/0x10 [ 498.207880][T10668] ? rcu_is_watching+0x12/0xc0 [ 498.207911][T10668] do_syscall_64+0x10b/0xf80 [ 498.207934][T10668] ? clear_bhb_loop+0x40/0x90 [ 498.207956][T10668] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 498.207974][T10668] RIP: 0033:0x7fc92e99ce59 [ 498.207989][T10668] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 498.208006][T10668] RSP: 002b:00007fc92f77e028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 498.208024][T10668] RAX: ffffffffffffffda RBX: 00007fc92ec15fa0 RCX: 00007fc92e99ce59 [ 498.208036][T10668] RDX: 0000200000000b80 RSI: 0000200000000080 RDI: 0000000000000000 [ 498.208046][T10668] RBP: 00007fc92f77e090 R08: 0000200000000180 R09: 0000000000000000 [ 498.208057][T10668] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000001 [ 498.208066][T10668] R13: 00007fc92ec16038 R14: 00007fc92ec15fa0 R15: 00007fffd0a8b7b8 [ 498.208091][T10668] [ 498.475947][T10138] usb usb42-port1: unable to enumerate USB device [ 498.562660][T10677] FAULT_INJECTION: forcing a failure. [ 498.562660][T10677] name failslab, interval 1, probability 0, space 0, times 0 [ 498.582300][T10677] CPU: 1 UID: 0 PID: 10677 Comm: syz.2.1253 Not tainted syzkaller #0 PREEMPT(full) [ 498.582327][T10677] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 498.582344][T10677] Call Trace: [ 498.582350][T10677] [ 498.582357][T10677] dump_stack_lvl+0x100/0x190 [ 498.582386][T10677] should_fail_ex.cold+0x5/0xa [ 498.582412][T10677] should_failslab+0xc2/0x120 [ 498.582433][T10677] kmem_cache_alloc_node_noprof+0x81/0x6f0 [ 498.582461][T10677] ? __alloc_skb+0x140/0x710 [ 498.582494][T10677] __alloc_skb+0x140/0x710 [ 498.582519][T10677] ? __alloc_skb+0x5b7/0x710 [ 498.582545][T10677] ? __pfx___alloc_skb+0x10/0x10 [ 498.582571][T10677] ? __kmalloc_noprof+0x320/0x850 [ 498.582602][T10677] __tipc_nl_compat_doit+0x112/0x3d0 [ 498.582621][T10677] ? __lock_acquire+0x4a5/0x2630 [ 498.582645][T10677] ? __pfx___tipc_nl_compat_doit+0x10/0x10 [ 498.582675][T10677] ? bpf_lsm_capable+0x9/0x10 [ 498.582692][T10677] ? security_capable+0x80/0x260 [ 498.582714][T10677] tipc_nl_compat_doit+0x11e/0x290 [ 498.582733][T10677] tipc_nl_compat_recv+0x93e/0xc40 [ 498.582750][T10677] ? __pfx_tipc_nl_compat_recv+0x10/0x10 [ 498.582766][T10677] ? __pfx_tipc_nl_node_set_link+0x10/0x10 [ 498.582784][T10677] ? __pfx_tipc_nl_compat_link_set+0x10/0x10 [ 498.582810][T10677] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1ef/0x2f0 [ 498.582837][T10677] genl_family_rcv_msg_doit+0x214/0x300 [ 498.582860][T10677] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 498.582880][T10677] ? genl_get_cmd+0x3e7/0x760 [ 498.582906][T10677] ? __alloc_skb+0x185/0x710 [ 498.582925][T10677] ? netlink_alloc_large_skb+0x69/0x150 [ 498.582942][T10677] ? __radix_tree_lookup+0x217/0x2b0 [ 498.582964][T10677] genl_rcv_msg+0x560/0x800 [ 498.582987][T10677] ? __pfx_genl_rcv_msg+0x10/0x10 [ 498.583007][T10677] ? __pfx_tipc_nl_compat_recv+0x10/0x10 [ 498.583025][T10677] ? __lock_acquire+0x4a5/0x2630 [ 498.583047][T10677] netlink_rcv_skb+0x159/0x420 [ 498.583065][T10677] ? __pfx_genl_rcv_msg+0x10/0x10 [ 498.583087][T10677] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 498.583114][T10677] ? netlink_deliver_tap+0x1ae/0xcc0 [ 498.583134][T10677] genl_rcv+0x28/0x40 [ 498.583152][T10677] netlink_unicast+0x585/0x850 [ 498.583173][T10677] ? __pfx_netlink_unicast+0x10/0x10 [ 498.583197][T10677] netlink_sendmsg+0x8b0/0xda0 [ 498.583218][T10677] ? __pfx_netlink_sendmsg+0x10/0x10 [ 498.583235][T10677] ? __might_fault+0x30/0x140 [ 498.583262][T10677] ____sys_sendmsg+0x9e1/0xb70 [ 498.583278][T10677] ? __pfx_netlink_sendmsg+0x10/0x10 [ 498.583301][T10677] ? __pfx_____sys_sendmsg+0x10/0x10 [ 498.583330][T10677] ___sys_sendmsg+0x190/0x1e0 [ 498.583356][T10677] ? __pfx____sys_sendmsg+0x10/0x10 [ 498.583403][T10677] __sys_sendmsg+0x170/0x220 [ 498.583417][T10677] ? __pfx___sys_sendmsg+0x10/0x10 [ 498.583440][T10677] ? rcu_is_watching+0x12/0xc0 [ 498.583465][T10677] do_syscall_64+0x10b/0xf80 [ 498.583484][T10677] ? clear_bhb_loop+0x40/0x90 [ 498.583501][T10677] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 498.583515][T10677] RIP: 0033:0x7f1e1cd9ce59 [ 498.583528][T10677] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 498.583541][T10677] RSP: 002b:00007f1e1dcbb028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 498.583555][T10677] RAX: ffffffffffffffda RBX: 00007f1e1d015fa0 RCX: 00007f1e1cd9ce59 [ 498.583563][T10677] RDX: 0000000000000000 RSI: 0000200000001980 RDI: 0000000000000003 [ 498.583571][T10677] RBP: 00007f1e1dcbb090 R08: 0000000000000000 R09: 0000000000000000 [ 498.583578][T10677] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 498.583586][T10677] R13: 00007f1e1d016038 R14: 00007f1e1d015fa0 R15: 00007fffe5b0f348 [ 498.583606][T10677] [ 499.010115][T10666] ubi16: attached mtd0 (name "mtdram test device", size 0 MiB) [ 499.036994][T10666] ubi16: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 499.217321][T10666] ubi16: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 499.236955][T10666] ubi16: VID header offset: 64 (aligned 64), data offset: 128 [ 499.408227][T10666] ubi16: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 499.526644][ T29] audit: type=1400 audit(1778808442.346:779): avc: denied { write } for pid=10680 comm="syz.2.1255" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 499.616602][T10666] ubi16: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 499.623471][T10686] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1255'. [ 499.640961][T10666] ubi16: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 358608751 [ 499.701689][T10666] ubi16: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 499.731226][T10688] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1255'. [ 499.751143][T10679] ubi16: background thread "ubi_bgt16d" started, PID 10679 [ 500.374350][T10691] netlink: 136 bytes leftover after parsing attributes in process `syz.2.1255'. [ 500.897731][ T29] audit: type=1400 audit(1778808443.706:780): avc: denied { ioctl } for pid=10692 comm="syz.4.1256" path="socket:[33310]" dev="sockfs" ino=33310 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 500.934158][ T29] audit: type=1400 audit(1778808443.706:781): avc: denied { bind } for pid=10692 comm="syz.4.1256" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 501.174137][ T29] audit: type=1400 audit(1778808443.796:782): avc: denied { read } for pid=10692 comm="syz.4.1256" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 501.618101][T10138] usb 3-1: new high-speed USB device number 48 using dummy_hcd [ 501.793336][T10138] usb 3-1: Using ep0 maxpacket: 8 [ 501.848982][T10138] usb 3-1: config 0 has an invalid interface number: 186 but max is 0 [ 501.892216][ T5624] Bluetooth: hci1: Controller not accepting commands anymore: ncmd = 0 [ 501.905260][ T5624] Bluetooth: hci1: Injecting HCI hardware error event [ 501.920591][ T5624] Bluetooth: hci1: hardware error 0x00 [ 502.056113][T10138] usb 3-1: config 0 has no interface number 0 [ 502.107791][ T5630] Bluetooth: hci7: Entering manufacturer mode failed (-110) [ 502.257467][T10138] usb 3-1: config 0 interface 186 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 502.514933][T10138] usb 3-1: config 0 interface 186 altsetting 0 endpoint 0x1 has an invalid bInterval 18, changing to 8 [ 502.725385][T10138] usb 3-1: config 0 interface 186 altsetting 0 has an endpoint descriptor with address 0x9A, changing to 0x8A [ 502.920806][T10138] usb 3-1: config 0 interface 186 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 502.956138][T10138] usb 3-1: config 0 interface 186 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 502.989674][T10138] usb 3-1: New USB device found, idVendor=07c0, idProduct=1505, bcdDevice=b8.c5 [ 502.999316][T10138] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 503.008465][T10138] usb 3-1: Product: syz [ 503.012935][T10138] usb 3-1: Manufacturer: syz [ 503.017713][T10138] usb 3-1: SerialNumber: syz [ 503.024709][T10138] usb 3-1: config 0 descriptor?? [ 503.191012][ T991] usb 5-1: new high-speed USB device number 50 using dummy_hcd [ 503.321038][T10138] iowarrior 3-1:0.186: IOWarrior product=0x1505, serial=42424242 interface=186 now attached to iowarrior0 [ 503.555007][ T991] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 503.568435][ T991] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 503.588726][ T991] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 503.615024][ T991] usb 5-1: New USB device found, idVendor=054c, idProduct=09cc, bcdDevice= 0.00 [ 503.636370][ T991] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 503.706362][ T991] usb 5-1: config 0 descriptor?? [ 504.352892][ T5624] Bluetooth: hci1: Opcode 0x0c03 failed: -110 [ 504.775311][ T991] usbhid 5-1:0.0: can't add hid device: -71 [ 504.800718][ T991] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 504.832594][T10138] usb 3-1: USB disconnect, device number 48 [ 505.067600][ T991] usb 5-1: USB disconnect, device number 50 [ 505.384679][ T5808] usb 6-1: new full-speed USB device number 10 using dummy_hcd [ 505.811571][T10746] Invalid source name [ 505.883980][T10746] xfrm0 speed is unknown, defaulting to 1000 [ 506.039543][T10747] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 506.049291][T10747] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 506.700688][ T29] audit: type=1400 audit(506.665:783): avc: denied { read write } for pid=10760 comm="syz.2.1273" name="loop-control" dev="devtmpfs" ino=646 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 506.771852][ T29] audit: type=1400 audit(506.665:784): avc: denied { open } for pid=10760 comm="syz.2.1273" path="/dev/loop-control" dev="devtmpfs" ino=646 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 506.889886][ T29] audit: type=1400 audit(506.845:785): avc: denied { block_suspend } for pid=10762 comm="syz.6.1274" capability=36 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 506.999739][ T9] usb 4-1: new high-speed USB device number 50 using dummy_hcd [ 507.055552][ T8146] Bluetooth: hci7: Frame reassembly failed (-84) [ 507.070863][ T8146] Bluetooth: hci7: Frame reassembly failed (-84) [ 507.147427][ T9] usb 4-1: device descriptor read/64, error -71 [ 507.427521][ T9] usb 4-1: new high-speed USB device number 51 using dummy_hcd [ 507.439829][ T5808] usb 6-1: unable to get BOS descriptor or descriptor too short [ 507.449240][ T5808] usb 6-1: unable to read config index 0 descriptor/start: -71 [ 507.457551][ T5808] usb 6-1: can't read configurations, error -71 [ 507.598775][ T9] usb 4-1: device descriptor read/64, error -71 [ 508.205037][ T9] usb usb4-port1: attempt power cycle [ 508.807702][ T9] usb 4-1: new high-speed USB device number 52 using dummy_hcd [ 508.897487][ T9] usb 4-1: device descriptor read/8, error -71 [ 508.968519][ T29] audit: type=1400 audit(508.915:786): avc: denied { bind } for pid=10779 comm="syz.5.1279" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 509.047973][ T29] audit: type=1326 audit(509.005:787): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10779 comm="syz.5.1279" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fcbe959ce59 code=0x0 [ 509.077508][ T5624] Bluetooth: hci7: Opcode 0x1003 failed: -110 [ 509.085953][ T5630] Bluetooth: hci7: command 0x1003 tx timeout [ 509.157560][ T9] usb 4-1: new high-speed USB device number 53 using dummy_hcd [ 509.228183][ T9] usb 4-1: device descriptor read/8, error -71 [ 509.439164][ T991] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 509.446985][ T9] usb usb4-port1: unable to enumerate USB device [ 509.517506][ T5630] Bluetooth: hci0: unexpected event for opcode 0x0809 [ 509.917682][ T991] usb 7-1: Using ep0 maxpacket: 32 [ 509.924705][ T991] usb 7-1: config 0 has an invalid interface number: 67 but max is 0 [ 509.933002][T10802] fuse: Bad value for 'group_id' [ 509.933413][ T991] usb 7-1: config 0 has no interface number 0 [ 509.940277][T10802] fuse: Bad value for 'group_id' [ 509.949249][ T991] usb 7-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 509.949275][ T991] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 509.949293][ T991] usb 7-1: Product: syz [ 509.949306][ T991] usb 7-1: Manufacturer: syz [ 509.949319][ T991] usb 7-1: SerialNumber: syz [ 509.964046][ T991] usb 7-1: config 0 descriptor?? [ 510.067506][ T9] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 510.122475][ T29] audit: type=1400 audit(510.075:788): avc: denied { write } for pid=10801 comm="syz.4.1286" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 510.343419][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 510.366125][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 510.396927][ T9] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 510.521655][ T9] usb 6-1: New USB device found, idVendor=054c, idProduct=09cc, bcdDevice= 0.00 [ 510.531127][ T9] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 510.561324][ T9] usb 6-1: config 0 descriptor?? [ 511.295371][ T991] smsc95xx 7-1:0.67 (unnamed net_device) (uninitialized): EEPROM read operation timeout [ 511.325783][T10824] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1290'. [ 511.362713][ T29] audit: type=1400 audit(767.318:789): avc: denied { create } for pid=10821 comm="syz.4.1290" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=caif_socket permissive=1 [ 511.384391][ T5886] block nbd7: Possible stuck request ffff888027b35080: control (read@0,1024B). Runtime 300 seconds [ 511.395227][ T5886] block nbd7: Possible stuck request ffff888027b35240: control (read@1024,1024B). Runtime 300 seconds [ 511.406251][ T5886] block nbd7: Possible stuck request ffff888027b35400: control (read@2048,1024B). Runtime 300 seconds [ 511.417258][ T5886] block nbd7: Possible stuck request ffff888027b355c0: control (read@3072,1024B). Runtime 300 seconds [ 511.694464][T10828] openvswitch: netlink: Unexpected mask (mask=840, allowed=10048) [ 511.777649][ T29] audit: type=1400 audit(767.678:790): avc: denied { ioctl } for pid=10821 comm="syz.4.1290" path="socket:[33613]" dev="sockfs" ino=33613 ioctlcmd=0x8946 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 512.175897][T10815] nbd21: detected capacity change from 0 to 63 [ 512.184147][T10788] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=10788 comm=syz.6.1280 [ 512.217968][ T9] usbhid 6-1:0.0: can't add hid device: -71 [ 512.236287][ T991] smsc95xx 7-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 512.247753][ T9] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 512.275013][ T991] smsc95xx 7-1:0.67: probe with driver smsc95xx failed with error -71 [ 512.283792][ T9] usb 6-1: USB disconnect, device number 12 [ 512.318975][ T991] usb 7-1: USB disconnect, device number 3 [ 512.525413][ T5630] block nbd21: Receive control failed (result -32) [ 513.027798][T10138] usb 4-1: new high-speed USB device number 54 using dummy_hcd [ 513.188285][T10841] xfrm0 speed is unknown, defaulting to 1000 [ 513.621720][T10138] usb 4-1: Using ep0 maxpacket: 16 [ 513.630819][T10138] usb 4-1: config index 0 descriptor too short (expected 51443, got 18) [ 513.645004][T10138] usb 4-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 513.654204][T10138] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 513.662666][T10138] usb 4-1: Product: syz [ 513.666904][T10138] usb 4-1: Manufacturer: syz [ 513.672175][T10138] usb 4-1: SerialNumber: syz [ 513.852318][T10138] r8152-cfgselector 4-1: Unknown version 0x0000 [ 513.890772][T10138] r8152-cfgselector 4-1: config 0 descriptor?? [ 513.902948][ T29] audit: type=1400 audit(769.818:791): avc: denied { create } for pid=10845 comm="syz.4.1295" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=key permissive=1 [ 514.731240][ T5630] Bluetooth: hci0: unexpected event for opcode 0x0809 [ 515.088118][T10868] netlink: 'syz.2.1301': attribute type 1 has an invalid length. [ 515.123168][T10868] bond1: entered promiscuous mode [ 515.128915][T10868] bond1: entered allmulticast mode [ 515.134668][T10868] 8021q: adding VLAN 0 to HW filter on device bond1 [ 515.167508][ T24] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 515.168478][T10873] erspan1: entered allmulticast mode [ 515.185655][T10873] bond1: (slave erspan1): making interface the new active one [ 515.193413][T10873] erspan1: entered promiscuous mode [ 515.204122][T10873] bond1: (slave erspan1): Enslaving as an active interface with an up link [ 515.219015][T10270] block nbd0: Possible stuck request ffff8880278ce000: control (read@0,1024B). Runtime 420 seconds [ 515.232871][T10270] block nbd0: Possible stuck request ffff8880278ce1c0: control (read@1024,1024B). Runtime 420 seconds [ 515.244202][T10270] block nbd0: Possible stuck request ffff8880278ce380: control (read@2048,1024B). Runtime 420 seconds [ 515.258410][T10270] block nbd0: Possible stuck request ffff8880278ce540: control (read@3072,1024B). Runtime 420 seconds [ 515.280771][T10138] r8152-cfgselector 4-1: Unknown version 0x0000 [ 515.292496][T10138] r8152-cfgselector 4-1: No union descriptors [ 515.304381][T10138] r8152-cfgselector 4-1: USB disconnect, device number 54 [ 515.357768][ T24] usb 6-1: Using ep0 maxpacket: 32 [ 515.374158][ T24] usb 6-1: config index 0 descriptor too short (expected 29220, got 36) [ 515.394375][ T24] usb 6-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 515.407465][ T24] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 515.416780][ T24] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 515.429342][ T24] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 515.442512][ T24] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 515.459474][ T24] usb 6-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 515.471282][ T24] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 515.522701][ T24] usb 6-1: config 0 descriptor?? [ 515.974698][ T24] usblp 6-1:0.0: usblp0: USB Bidirectional printer dev 13 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 517.012024][T10138] usb 3-1: new high-speed USB device number 49 using dummy_hcd [ 517.360174][ T5886] block nbd4: Possible stuck request ffff888027a2e000: control (read@0,1024B). Runtime 360 seconds [ 517.371564][ T5886] block nbd4: Possible stuck request ffff888027a2e1c0: control (read@1024,1024B). Runtime 360 seconds [ 517.383262][ T5886] block nbd4: Possible stuck request ffff888027a2e380: control (read@2048,1024B). Runtime 360 seconds [ 517.394358][ T5886] block nbd4: Possible stuck request ffff888027a2e540: control (read@3072,1024B). Runtime 360 seconds [ 517.439408][T10138] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 517.555410][T10138] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 517.577510][T10138] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 517.597444][T10138] usb 3-1: New USB device found, idVendor=054c, idProduct=09cc, bcdDevice= 0.00 [ 518.003380][T10138] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 518.048947][ T24] usb 6-1: USB disconnect, device number 13 [ 518.055731][T10138] usb 3-1: config 0 descriptor?? [ 518.070942][ T24] usblp0: removed [ 518.362658][T10138] usbhid 3-1:0.0: can't add hid device: -71 [ 518.372369][T10138] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 518.392572][T10138] usb 3-1: USB disconnect, device number 49 [ 518.666277][T10907] mmap: syz.6.1306 (10907) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 519.147365][T10899] comedi comedi0: reset error (fatal) [ 519.305196][T10915] nbd22: detected capacity change from 0 to 63 [ 519.393407][ T29] audit: type=1326 audit(775.348:792): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10920 comm="syz.4.1313" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fc92e99ce59 code=0x0 [ 519.577613][T10138] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 519.783956][ T5630] block nbd22: Receive control failed (result -32) [ 519.797839][ T5886] block nbd9: Possible stuck request ffff888027c3e000: control (read@0,1024B). Runtime 270 seconds [ 519.808644][ T5886] block nbd9: Possible stuck request ffff888027c3e1c0: control (read@1024,1024B). Runtime 270 seconds [ 519.819728][ T5886] block nbd9: Possible stuck request ffff888027c3e380: control (read@2048,1024B). Runtime 270 seconds [ 519.830777][ T5886] block nbd9: Possible stuck request ffff888027c3e540: control (read@3072,1024B). Runtime 270 seconds [ 519.861098][T10138] usb 7-1: Using ep0 maxpacket: 16 [ 519.944795][T10138] usb 7-1: config index 0 descriptor too short (expected 51443, got 18) [ 519.964215][T10138] usb 7-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 519.973480][T10138] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 519.984271][T10138] usb 7-1: Product: syz [ 519.989063][T10138] usb 7-1: Manufacturer: syz [ 519.993833][T10138] usb 7-1: SerialNumber: syz [ 520.010255][T10138] r8152-cfgselector 7-1: Unknown version 0x0000 [ 520.019017][T10138] r8152-cfgselector 7-1: config 0 descriptor?? [ 520.064990][T10931] netlink: 'syz.4.1315': attribute type 1 has an invalid length. [ 520.124521][T10933] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1316'. [ 520.265431][T10931] 8021q: adding VLAN 0 to HW filter on device bond2 [ 520.425261][T10931] mac80211_hwsim hwsim8 wlan0: entered promiscuous mode [ 520.447539][ T5808] usb 3-1: new low-speed USB device number 50 using dummy_hcd [ 520.473052][T10931] bond2: (slave wlan0): Enslaving as an active interface with a down link [ 520.609460][ T5808] usb 3-1: config 168 descriptor has 1 excess byte, ignoring [ 520.617423][ T9] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 520.622162][ T5808] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 520.654089][ T5808] usb 3-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 520.654123][ T5808] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 520.654145][ T5808] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 520.655184][ T5808] usb 3-1: config 168 descriptor has 1 excess byte, ignoring [ 520.655228][ T5808] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 520.655245][ T5808] usb 3-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 520.655259][ T5808] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 520.655273][ T5808] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 520.656088][ T5808] usb 3-1: config 168 descriptor has 1 excess byte, ignoring [ 520.656124][ T5808] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 520.656139][ T5808] usb 3-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 520.656154][ T5808] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 520.656168][ T5808] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 520.659628][ T5808] usb 3-1: string descriptor 0 read error: -22 [ 520.659705][ T5808] usb 3-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 520.659719][ T5808] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 520.671888][ T5808] adutux 3-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 520.767527][ T9] usb 6-1: Using ep0 maxpacket: 16 [ 520.769226][ T9] usb 6-1: config index 0 descriptor too short (expected 51443, got 18) [ 520.771232][ T9] usb 6-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 520.771258][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 520.771276][ T9] usb 6-1: Product: syz [ 520.771291][ T9] usb 6-1: Manufacturer: syz [ 520.771305][ T9] usb 6-1: SerialNumber: syz [ 520.776286][ T9] r8152-cfgselector 6-1: Unknown version 0x0000 [ 521.017521][T10933] netlink: 'syz.2.1316': attribute type 12 has an invalid length. [ 521.046309][ T24] usb 3-1: USB disconnect, device number 50 [ 521.068732][T10138] r8152-cfgselector 7-1: Unknown version 0x0000 [ 521.090937][T10138] r8152-cfgselector 7-1: No union descriptors [ 521.112667][T10949] capability: warning: `syz.6.1320' uses 32-bit capabilities (legacy support in use) [ 521.126841][ T9] r8152-cfgselector 6-1: config 0 descriptor?? [ 521.129125][T10138] r8152-cfgselector 7-1: USB disconnect, device number 4 [ 521.162865][ T29] audit: type=1400 audit(777.118:793): avc: denied { read write } for pid=10948 comm="syz.6.1320" name="cachefiles" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cachefiles_device_t tclass=chr_file permissive=1 [ 521.169330][T10949] loop6: detected capacity change from 0 to 8 [ 521.210379][ T29] audit: type=1400 audit(777.118:794): avc: denied { open } for pid=10948 comm="syz.6.1320" path="/dev/cachefiles" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cachefiles_device_t tclass=chr_file permissive=1 [ 521.597574][T10138] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 522.199034][T10959] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1322'. [ 522.240433][T10138] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 522.258041][ T5886] block nbd10: Possible stuck request ffff888027ca7000: control (read@0,1024B). Runtime 270 seconds [ 522.269151][ T5886] block nbd10: Possible stuck request ffff888027ca71c0: control (read@1024,1024B). Runtime 270 seconds [ 522.285926][ T2310] block nbd6: Possible stuck request ffff888027ac7000: control (read@0,1024B). Runtime 330 seconds [ 522.290807][ T29] audit: type=1400 audit(778.238:795): avc: denied { mount } for pid=10958 comm="syz.4.1323" name="/" dev="ramfs" ino=35003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 522.296852][ T2310] block nbd6: Possible stuck request ffff888027ac71c0: control (read@1024,1024B). Runtime 330 seconds [ 522.329401][T10138] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 522.329484][T10138] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 522.329685][T10138] usb 7-1: New USB device found, idVendor=054c, idProduct=09cc, bcdDevice= 0.00 [ 522.329746][T10138] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 522.340925][ T2310] block nbd6: Possible stuck request ffff888027ac7380: control (read@2048,1024B). Runtime 330 seconds [ 522.386550][ T7828] block nbd12: Possible stuck request ffff888027d37000: control (read@0,1024B). Runtime 240 seconds [ 522.398562][ T7828] block nbd12: Possible stuck request ffff888027d371c0: control (read@1024,1024B). Runtime 240 seconds [ 522.412407][ T7828] block nbd12: Possible stuck request ffff888027d37380: control (read@2048,1024B). Runtime 240 seconds [ 522.427662][ T7828] block nbd12: Possible stuck request ffff888027d37540: control (read@3072,1024B). Runtime 240 seconds [ 522.446737][ T5886] block nbd10: Possible stuck request ffff888027ca7380: control (read@2048,1024B). Runtime 270 seconds [ 522.706242][ T5886] block nbd10: Possible stuck request ffff888027ca7540: control (read@3072,1024B). Runtime 270 seconds [ 522.718210][ T9] r8152-cfgselector 6-1: Unknown version 0x0000 [ 522.729405][ T9] r8152-cfgselector 6-1: No union descriptors [ 522.736030][ T2310] block nbd6: Possible stuck request ffff888027ac7540: control (read@3072,1024B). Runtime 330 seconds [ 522.781302][T10138] usb 7-1: config 0 descriptor?? [ 523.334552][ T9] r8152-cfgselector 6-1: USB disconnect, device number 14 [ 523.382018][T10138] usbhid 7-1:0.0: can't add hid device: -71 [ 523.492486][T10138] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 523.508590][T10138] usb 7-1: USB disconnect, device number 5 [ 523.963704][T10978] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1328'. [ 523.975406][T10978] team0: No ports can be present during mode change [ 524.851708][ T9] usb 5-1: new high-speed USB device number 51 using dummy_hcd [ 525.047471][ T9] usb 5-1: Using ep0 maxpacket: 16 [ 525.061192][ T9] usb 5-1: config index 0 descriptor too short (expected 51443, got 18) [ 525.082285][ T9] usb 5-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 525.099723][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 525.157526][ T9] usb 5-1: Product: syz [ 525.181019][ T9] usb 5-1: Manufacturer: syz [ 525.209846][ T9] usb 5-1: SerialNumber: syz [ 525.253302][ T9] r8152-cfgselector 5-1: Unknown version 0x0000 [ 525.283560][ T9] r8152-cfgselector 5-1: config 0 descriptor?? [ 525.561712][ T5630] Bluetooth: hci0: unexpected event for opcode 0x0809 [ 525.912190][ T5886] block nbd1: Possible stuck request ffff888027920000: control (read@0,1024B). Runtime 420 seconds [ 525.933971][ T5886] block nbd1: Possible stuck request ffff8880279201c0: control (read@1024,1024B). Runtime 420 seconds [ 525.948274][ T5886] block nbd1: Possible stuck request ffff888027920380: control (read@2048,1024B). Runtime 420 seconds [ 525.959761][ T5886] block nbd1: Possible stuck request ffff888027920540: control (read@3072,1024B). Runtime 420 seconds [ 526.267542][ T5808] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 526.455803][ T5808] usb 7-1: Using ep0 maxpacket: 32 [ 526.641455][ T5808] usb 7-1: config index 0 descriptor too short (expected 29220, got 36) [ 526.661249][ T5808] usb 7-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 526.682246][ T9] r8152-cfgselector 5-1: Unknown version 0x0000 [ 526.703320][ T5808] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 526.721878][ T9] r8152-cfgselector 5-1: No union descriptors [ 526.751431][ T5808] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 526.792588][ T5808] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 526.832539][ T9] r8152-cfgselector 5-1: USB disconnect, device number 51 [ 526.836963][ T5808] usb 7-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 526.910539][ T5808] usb 7-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 526.960397][ T5808] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 527.020901][ T5808] usb 7-1: config 0 descriptor?? [ 527.284669][ T5808] usblp 7-1:0.0: usblp0: USB Bidirectional printer dev 6 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 527.380235][ T5886] block nbd5: Possible stuck request ffff888027a50000: control (read@0,1024B). Runtime 360 seconds [ 527.410472][T10270] block nbd2: Possible stuck request ffff888027965080: control (read@0,1024B). Runtime 420 seconds [ 527.410577][ T5886] block nbd5: Possible stuck request ffff888027a501c0: control (read@1024,1024B). Runtime 360 seconds [ 527.421722][T10270] block nbd2: Possible stuck request ffff888027965240: control (read@1024,1024B). Runtime 420 seconds [ 527.432253][ T5886] block nbd5: Possible stuck request ffff888027a50380: control (read@2048,1024B). Runtime 360 seconds [ 527.432277][ T5886] block nbd5: Possible stuck request ffff888027a50540: control (read@3072,1024B). Runtime 360 seconds [ 527.448340][T11018] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1338'. [ 527.517633][ T25] block nbd11: Possible stuck request ffff888027cde000: control (read@0,1024B). Runtime 270 seconds [ 527.529813][ T25] block nbd11: Possible stuck request ffff888027cde1c0: control (read@1024,1024B). Runtime 270 seconds [ 527.547601][ T25] block nbd11: Possible stuck request ffff888027cde380: control (read@2048,1024B). Runtime 270 seconds [ 527.561142][T10270] block nbd2: Possible stuck request ffff888027965400: control (read@2048,1024B). Runtime 420 seconds [ 527.572665][ T25] block nbd11: Possible stuck request ffff888027cde540: control (read@3072,1024B). Runtime 270 seconds [ 527.583964][T10270] block nbd2: Possible stuck request ffff8880279655c0: control (read@3072,1024B). Runtime 420 seconds [ 527.942513][ T29] audit: type=1400 audit(783.898:796): avc: denied { getopt } for pid=11020 comm="syz.2.1339" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 528.020384][ T5886] block nbd3: Possible stuck request ffff888027a05080: control (read@0,1024B). Runtime 390 seconds [ 528.031385][ T5886] block nbd3: Possible stuck request ffff888027a05240: control (read@1024,1024B). Runtime 390 seconds [ 528.044949][ T5886] block nbd3: Possible stuck request ffff888027a05400: control (read@2048,1024B). Runtime 390 seconds [ 528.056672][ T5886] block nbd3: Possible stuck request ffff888027a055c0: control (read@3072,1024B). Runtime 390 seconds [ 528.089569][ T5808] usb 7-1: USB disconnect, device number 6 [ 528.142997][ T5808] usblp0: removed [ 528.190389][T11025] FAULT_INJECTION: forcing a failure. [ 528.190389][T11025] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 528.217519][T11025] CPU: 0 UID: 0 PID: 11025 Comm: syz.5.1340 Not tainted syzkaller #0 PREEMPT(full) [ 528.217546][T11025] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 528.217556][T11025] Call Trace: [ 528.217562][T11025] [ 528.217569][T11025] dump_stack_lvl+0x100/0x190 [ 528.217595][T11025] should_fail_ex.cold+0x5/0xa [ 528.217621][T11025] _copy_from_iter+0x1f4/0x1690 [ 528.217651][T11025] ? __asan_memset+0x23/0x50 [ 528.217678][T11025] ? __pfx__copy_from_iter+0x10/0x10 [ 528.217703][T11025] ? __pfx___alloc_skb+0x10/0x10 [ 528.217741][T11025] netlink_sendmsg+0x808/0xda0 [ 528.217770][T11025] ? __pfx_netlink_sendmsg+0x10/0x10 [ 528.217792][T11025] ? __might_fault+0x30/0x140 [ 528.217826][T11025] ____sys_sendmsg+0x9e1/0xb70 [ 528.217847][T11025] ? __pfx_netlink_sendmsg+0x10/0x10 [ 528.217871][T11025] ? __pfx_____sys_sendmsg+0x10/0x10 [ 528.217903][T11025] ___sys_sendmsg+0x190/0x1e0 [ 528.217927][T11025] ? __pfx____sys_sendmsg+0x10/0x10 [ 528.217980][T11025] __sys_sendmsg+0x170/0x220 [ 528.217999][T11025] ? __pfx___sys_sendmsg+0x10/0x10 [ 528.218027][T11025] ? rcu_is_watching+0x12/0xc0 [ 528.218056][T11025] do_syscall_64+0x10b/0xf80 [ 528.218078][T11025] ? clear_bhb_loop+0x40/0x90 [ 528.218099][T11025] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 528.218124][T11025] RIP: 0033:0x7fcbe959ce59 [ 528.218139][T11025] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 528.218155][T11025] RSP: 002b:00007fcbea40c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 528.218173][T11025] RAX: ffffffffffffffda RBX: 00007fcbe9815fa0 RCX: 00007fcbe959ce59 [ 528.218184][T11025] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000003 [ 528.218194][T11025] RBP: 00007fcbea40c090 R08: 0000000000000000 R09: 0000000000000000 [ 528.218204][T11025] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 528.218213][T11025] R13: 00007fcbe9816038 R14: 00007fcbe9815fa0 R15: 00007ffd8aede0b8 [ 528.218237][T11025] [ 528.987830][ T10] usb 6-1: new full-speed USB device number 15 using dummy_hcd [ 529.302676][ T10] usb 6-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 530.133943][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 530.142699][ T10] usb 6-1: Product: syz [ 530.146895][ T10] usb 6-1: Manufacturer: syz [ 530.153614][ T10] usb 6-1: SerialNumber: syz [ 530.163269][ T10] usb 6-1: config 0 descriptor?? [ 530.381012][ T10] usb 6-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 530.453175][T11042] netlink: 56 bytes leftover after parsing attributes in process `syz.2.1346'. [ 530.537682][ T5708] usb 7-1: new full-speed USB device number 7 using dummy_hcd [ 531.542803][T11052] Invalid source name [ 531.638822][T11052] xfrm0 speed is unknown, defaulting to 1000 [ 532.063700][ T10] dvb_usb_rtl28xxu 6-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 532.089214][T11061] netlink: 'syz.2.1350': attribute type 1 has an invalid length. [ 532.440728][T11061] 8021q: adding VLAN 0 to HW filter on device bond2 [ 532.567532][T11057] nbd23: detected capacity change from 0 to 63 [ 532.624677][T11067] mac80211_hwsim hwsim5 wlan0: entered promiscuous mode [ 532.718304][T11067] bond2: (slave wlan0): Enslaving as an active interface with a down link [ 533.129109][ T5630] block nbd23: Receive control failed (result -32) [ 533.380786][ T5708] usb 7-1: unable to get BOS descriptor or descriptor too short [ 533.394893][ T5708] usb 7-1: unable to read config index 0 descriptor/start: -71 [ 533.413227][ T5708] usb 7-1: can't read configurations, error -71 [ 533.678198][ T5744] usb 4-1: new high-speed USB device number 55 using dummy_hcd [ 533.828216][ T5708] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 533.842535][T11076] tmpfs: Unknown parameter '' [ 533.857558][ T5744] usb 4-1: Using ep0 maxpacket: 32 [ 533.873177][ T5744] usb 4-1: config index 0 descriptor too short (expected 29220, got 36) [ 533.879478][T11077] binder: 11075:11077 ioctl c0306201 2000000001c0 returned -14 [ 533.889586][T11076] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1353'. [ 533.908767][T11076] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1353'. [ 533.937921][ T5744] usb 4-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 533.940333][T11077] binder_alloc: 11075: binder_alloc_buf, no vma [ 533.956826][ T5744] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 533.976209][ T5744] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 533.997796][ T5744] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 534.019151][ T5708] usb 7-1: Using ep0 maxpacket: 32 [ 534.033185][ T5708] usb 7-1: config 0 has an invalid interface number: 89 but max is 0 [ 534.064277][ T5708] usb 7-1: config 0 has no interface number 0 [ 534.095844][ T5708] usb 7-1: config 0 interface 89 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 534.145815][ T5744] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 534.159604][ T5744] usb 4-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 534.168807][ T5744] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 534.193912][T10138] usb 6-1: USB disconnect, device number 15 [ 534.868963][ T5708] usb 7-1: config 0 interface 89 has no altsetting 0 [ 534.877654][ T5708] usb 7-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4a [ 534.886893][ T5708] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 534.894993][ T5708] usb 7-1: Product: syz [ 534.899262][ T5708] usb 7-1: Manufacturer: syz [ 534.903884][ T5708] usb 7-1: SerialNumber: syz [ 535.023147][ T5744] usb 4-1: config 0 descriptor?? [ 535.069407][ T5708] usb 7-1: config 0 descriptor?? [ 535.089895][ T5708] em28xx 7-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 535.107419][ T5708] em28xx 7-1:0.89: Video interface 89 found: [ 535.198953][ T29] audit: type=1400 audit(791.148:797): avc: denied { write } for pid=11087 comm="syz.2.1357" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 535.260486][ T5744] usblp 4-1:0.0: usblp0: USB Bidirectional printer dev 55 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 535.507616][ T10] usb 5-1: new high-speed USB device number 52 using dummy_hcd [ 536.625833][ T5708] em28xx 7-1:0.89: unknown em28xx chip ID (0) [ 536.636020][ T10] usb 5-1: Using ep0 maxpacket: 32 [ 536.666697][ T9] usb 4-1: USB disconnect, device number 55 [ 536.681703][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x9 has an invalid bInterval 128, changing to 11 [ 536.706275][ T9] usblp0: removed [ 536.742948][ T10] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xB7, changing to 0x87 [ 536.777053][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 536.805056][ T29] audit: type=1400 audit(792.758:798): avc: denied { setopt } for pid=11103 comm="syz.5.1362" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 536.896192][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x87 has invalid wMaxPacketSize 0 [ 536.932072][ T10] usb 5-1: New USB device found, idVendor=0e6f, idProduct=582c, bcdDevice=31.68 [ 536.944360][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 536.974248][ T10] usb 5-1: Product: syz [ 536.989657][ T10] usb 5-1: Manufacturer: syz [ 537.001158][ T10] usb 5-1: SerialNumber: syz [ 537.016756][ T10] usb 5-1: config 0 descriptor?? [ 537.033868][ T10] input: Generic X-Box pad as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/input/input73 [ 537.119381][ T5708] em28xx 7-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 537.136173][ T5708] em28xx 7-1:0.89: board has no eeprom [ 537.207406][ T5708] em28xx 7-1:0.89: Identified as Terratec Grabby (card=67) [ 537.221505][ T5708] em28xx 7-1:0.89: analog set to bulk mode. [ 537.227817][T10138] usb 6-1: new high-speed USB device number 16 using dummy_hcd [ 537.239550][T11093] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 537.248994][ T10] em28xx 7-1:0.89: Registering V4L2 extension [ 537.260788][T11093] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 537.274729][ T5708] usb 7-1: USB disconnect, device number 8 [ 537.290910][ T5708] em28xx 7-1:0.89: Disconnecting em28xx [ 537.591125][T11110] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 537.607220][T11110] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 537.645195][T11110] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 537.657443][T11110] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 538.227617][ T9] usb 5-1: USB disconnect, device number 52 [ 538.284203][ T10] em28xx 7-1:0.89: Config register raw data: 0xffffffed [ 538.309738][T10138] usb 6-1: Using ep0 maxpacket: 16 [ 538.322263][T10138] usb 6-1: config index 0 descriptor too short (expected 51443, got 18) [ 538.326174][ T10] em28xx 7-1:0.89: AC97 chip type couldn't be determined [ 538.347787][T10138] usb 6-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 538.357027][T10138] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 538.365622][T10138] usb 6-1: Product: syz [ 538.407755][T10138] usb 6-1: Manufacturer: syz [ 538.414107][T10138] usb 6-1: SerialNumber: syz [ 538.423997][T10138] r8152-cfgselector 6-1: Unknown version 0x0000 [ 538.428079][ T10] em28xx 7-1:0.89: No AC97 audio processor [ 538.430420][T10138] r8152-cfgselector 6-1: config 0 descriptor?? [ 538.530250][ T10] usb 7-1: Decoder not found [ 538.557091][ T10] em28xx 7-1:0.89: failed to create media graph [ 538.577191][ T10] em28xx 7-1:0.89: V4L2 device video103 deregistered [ 538.772658][T11119] syz.6.1367 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 538.812663][T11119] netlink: 'syz.6.1367': attribute type 1 has an invalid length. [ 538.820579][T11119] netlink: 1384 bytes leftover after parsing attributes in process `syz.6.1367'. [ 539.091510][ T5630] Bluetooth: Frame is too long (len 12, expected len 4) [ 539.532750][ T10] em28xx 7-1:0.89: Registering snapshot button... [ 539.592655][T10138] r8152-cfgselector 6-1: Unknown version 0x0000 [ 539.613171][ T10] input: em28xx snapshot button as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.89/input/input75 [ 539.639294][T10138] r8152-cfgselector 6-1: No union descriptors [ 539.696036][ T10] em28xx 7-1:0.89: Remote control support is not available for this card. [ 539.744259][ T5708] em28xx 7-1:0.89: Closing input extension [ 539.774205][T10138] r8152-cfgselector 6-1: USB disconnect, device number 16 [ 539.812176][ T5708] em28xx 7-1:0.89: Deregistering snapshot button [ 540.435838][ T5708] em28xx 7-1:0.89: Freeing device [ 540.764536][ T29] audit: type=1400 audit(796.718:799): avc: denied { read } for pid=11130 comm="syz.6.1371" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 540.954879][T11135] FAULT_INJECTION: forcing a failure. [ 540.954879][T11135] name failslab, interval 1, probability 0, space 0, times 0 [ 541.081224][T11135] CPU: 1 UID: 0 PID: 11135 Comm: syz.3.1373 Tainted: G L syzkaller #0 PREEMPT(full) [ 541.081256][T11135] Tainted: [L]=SOFTLOCKUP [ 541.081262][T11135] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 541.081272][T11135] Call Trace: [ 541.081278][T11135] [ 541.081286][T11135] dump_stack_lvl+0x100/0x190 [ 541.081312][T11135] should_fail_ex.cold+0x5/0xa [ 541.081338][T11135] should_failslab+0xc2/0x120 [ 541.081364][T11135] __kmalloc_cache_noprof+0x7a/0x6f0 [ 541.081388][T11135] ? ip_set_create+0x342/0x14f0 [ 541.081406][T11135] ? __rcu_read_unlock+0x27f/0x5e0 [ 541.081434][T11135] ip_set_create+0x342/0x14f0 [ 541.081462][T11135] ? __pfx_ip_set_create+0x10/0x10 [ 541.081494][T11135] ? rcu_is_watching+0x12/0xc0 [ 541.081524][T11135] nfnetlink_rcv_msg+0x9d5/0x11e0 [ 541.081548][T11135] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 541.081565][T11135] ? __lock_acquire+0x4a5/0x2630 [ 541.081602][T11135] ? avc_has_perm_noaudit+0x145/0x3b0 [ 541.081623][T11135] netlink_rcv_skb+0x159/0x420 [ 541.081642][T11135] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 541.081658][T11135] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 541.081686][T11135] ? ns_capable+0xd2/0xf0 [ 541.081708][T11135] nfnetlink_rcv+0x1b3/0x440 [ 541.081724][T11135] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 541.081737][T11135] ? rcu_is_watching+0x12/0xc0 [ 541.081763][T11135] netlink_unicast+0x585/0x850 [ 541.081786][T11135] ? __pfx_netlink_unicast+0x10/0x10 [ 541.081810][T11135] netlink_sendmsg+0x8b0/0xda0 [ 541.081832][T11135] ? __pfx_netlink_sendmsg+0x10/0x10 [ 541.081853][T11135] ? __pfx_netlink_sendmsg+0x10/0x10 [ 541.081875][T11135] ____sys_sendmsg+0x9e1/0xb70 [ 541.081894][T11135] ? __pfx_netlink_sendmsg+0x10/0x10 [ 541.081914][T11135] ? __pfx_____sys_sendmsg+0x10/0x10 [ 541.081930][T11135] ? rcu_is_watching+0x12/0xc0 [ 541.081954][T11135] ? hrtimer_start_range_ns+0x860/0x1a50 [ 541.081977][T11135] ? find_held_lock+0x2b/0x80 [ 541.081995][T11135] ___sys_sendmsg+0x190/0x1e0 [ 541.082016][T11135] ? __pfx____sys_sendmsg+0x10/0x10 [ 541.082059][T11135] __sys_sendmsg+0x170/0x220 [ 541.082074][T11135] ? __pfx___sys_sendmsg+0x10/0x10 [ 541.082086][T11135] ? irqentry_exit+0x24d/0x7e0 [ 541.082105][T11135] ? trace_reschedule_exit.constprop.0+0x6b/0x220 [ 541.082136][T11135] do_syscall_64+0x10b/0xf80 [ 541.082154][T11135] ? clear_bhb_loop+0x40/0x90 [ 541.082172][T11135] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 541.082187][T11135] RIP: 0033:0x7f5d9c99ce59 [ 541.082201][T11135] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 541.082215][T11135] RSP: 002b:00007f5d9d7d1028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 541.082230][T11135] RAX: ffffffffffffffda RBX: 00007f5d9cc15fa0 RCX: 00007f5d9c99ce59 [ 541.082239][T11135] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 541.082248][T11135] RBP: 00007f5d9d7d1090 R08: 0000000000000000 R09: 0000000000000000 [ 541.082256][T11135] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 541.082264][T11135] R13: 00007f5d9cc16038 R14: 00007f5d9cc15fa0 R15: 00007ffead2e8d98 [ 541.082284][T11135] [ 541.511097][ T5886] block nbd7: Possible stuck request ffff888027b35080: control (read@0,1024B). Runtime 330 seconds [ 541.521912][ T5886] block nbd7: Possible stuck request ffff888027b35240: control (read@1024,1024B). Runtime 330 seconds [ 541.532917][ T5886] block nbd7: Possible stuck request ffff888027b35400: control (read@2048,1024B). Runtime 330 seconds [ 541.544170][ T5886] block nbd7: Possible stuck request ffff888027b355c0: control (read@3072,1024B). Runtime 330 seconds [ 541.563320][T11124] comedi comedi0: reset error (fatal) [ 541.664243][ T29] audit: type=1400 audit(797.038:800): avc: denied { getopt } for pid=11130 comm="syz.6.1371" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 542.208316][T11149] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(6) [ 542.215696][T11149] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 542.275633][T11149] vhci_hcd vhci_hcd.0: Device attached [ 542.299704][T11146] vhci_hcd vhci_hcd.0: port 0 already used [ 542.328384][ T29] audit: type=1400 audit(798.278:801): avc: denied { create } for pid=11143 comm="syz.2.1374" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 542.517504][ T806] usb 38-1: SetAddress Request (2) to port 0 [ 542.527872][T10138] usb 6-1: new high-speed USB device number 17 using dummy_hcd [ 542.589974][ T806] usb 38-1: new SuperSpeed USB device number 2 using vhci_hcd [ 542.592862][ T9] usb 5-1: new high-speed USB device number 53 using dummy_hcd [ 542.615735][T11150] vhci_hcd: connection closed [ 542.643826][ T1162] vhci_hcd vhci_hcd.2: stop threads [ 542.720512][ T1162] vhci_hcd vhci_hcd.2: release socket [ 542.765302][ T1162] vhci_hcd vhci_hcd.2: disconnect device [ 542.892343][ T9] usb 5-1: Using ep0 maxpacket: 32 [ 542.922373][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x9 has an invalid bInterval 128, changing to 11 [ 542.960411][ T9] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xB7, changing to 0x87 [ 543.011625][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 543.088602][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x87 has invalid wMaxPacketSize 0 [ 543.164222][ T9] usb 5-1: New USB device found, idVendor=0e6f, idProduct=582c, bcdDevice=31.68 [ 543.196598][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 543.240524][ T9] usb 5-1: Product: syz [ 543.260514][ T9] usb 5-1: Manufacturer: syz [ 543.279987][ T9] usb 5-1: SerialNumber: syz [ 543.345395][ T9] usb 5-1: config 0 descriptor?? [ 543.356125][T10138] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 543.359394][ T9] input: Generic X-Box pad as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/input/input77 [ 543.373329][T10138] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8E has invalid maxpacket 0 [ 543.386062][T10138] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 543.395898][ T806] usb 38-1: enqueue for inactive port 0 [ 543.460041][T10138] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0xA has invalid maxpacket 0 [ 543.568429][T10138] usb 6-1: New USB device found, idVendor=05ab, idProduct=0301, bcdDevice= 1.00 [ 543.656477][T10138] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 543.718016][T11160] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 543.734077][T10138] usb 6-1: Product: syz [ 543.772038][T10138] usb 6-1: Manufacturer: syz [ 543.810751][T10138] usb 6-1: SerialNumber: syz [ 543.833028][T11160] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 543.931635][ T5808] usb 4-1: new high-speed USB device number 56 using dummy_hcd [ 543.941663][T10138] usb 6-1: config 0 descriptor?? [ 544.308963][T11171] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 544.322198][T11171] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 544.359815][T11171] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 544.373502][T11171] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 544.955210][ T806] usb usb38-port1: attempt power cycle [ 545.018112][T10138] ums-isd200 6-1:0.0: USB Mass Storage device detected [ 545.180504][ T9] usb 5-1: USB disconnect, device number 53 [ 545.187434][ T5808] usb 4-1: Using ep0 maxpacket: 16 [ 545.194787][T10138] scsi host1: usb-storage 6-1:0.0 [ 545.201247][ T5808] usb 4-1: config index 0 descriptor too short (expected 51443, got 18) [ 545.221403][ T5808] usb 4-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 545.234868][T10138] usb 6-1: USB disconnect, device number 17 [ 545.242774][ T5808] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 545.253716][ T5808] usb 4-1: Product: syz [ 545.258394][ T5808] usb 4-1: Manufacturer: syz [ 545.263110][ T5808] usb 4-1: SerialNumber: syz [ 545.280092][ T5808] r8152-cfgselector 4-1: Unknown version 0x0000 [ 545.286421][ T5808] r8152-cfgselector 4-1: config 0 descriptor?? [ 545.307774][T10270] block nbd0: Possible stuck request ffff8880278ce000: control (read@0,1024B). Runtime 450 seconds [ 545.321989][T10270] block nbd0: Possible stuck request ffff8880278ce1c0: control (read@1024,1024B). Runtime 450 seconds [ 545.333198][T10270] block nbd0: Possible stuck request ffff8880278ce380: control (read@2048,1024B). Runtime 450 seconds [ 545.344641][T10270] block nbd0: Possible stuck request ffff8880278ce540: control (read@3072,1024B). Runtime 450 seconds [ 545.490330][T11179] FAULT_INJECTION: forcing a failure. [ 545.490330][T11179] name failslab, interval 1, probability 0, space 0, times 0 [ 545.528908][T11179] CPU: 0 UID: 0 PID: 11179 Comm: syz.2.1383 Tainted: G L syzkaller #0 PREEMPT(full) [ 545.528938][T11179] Tainted: [L]=SOFTLOCKUP [ 545.528945][T11179] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 545.528956][T11179] Call Trace: [ 545.528964][T11179] [ 545.528971][T11179] dump_stack_lvl+0x100/0x190 [ 545.528999][T11179] should_fail_ex.cold+0x5/0xa [ 545.529025][T11179] should_failslab+0xc2/0x120 [ 545.529045][T11179] __kmalloc_node_track_caller_noprof+0xe3/0x850 [ 545.529082][T11179] ? hwsim_del_radio_nl+0xf6f/0x1500 [ 545.529109][T11179] ? trace_kmalloc+0xe3/0x110 [ 545.529133][T11179] kstrndup+0x64/0x120 [ 545.529152][T11179] hwsim_del_radio_nl+0xf6f/0x1500 [ 545.529180][T11179] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1e5/0x2f0 [ 545.529207][T11179] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1ef/0x2f0 [ 545.529241][T11179] genl_family_rcv_msg_doit+0x214/0x300 [ 545.529271][T11179] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 545.529307][T11179] ? bpf_lsm_capable+0x9/0x10 [ 545.529324][T11179] ? security_capable+0x80/0x260 [ 545.529345][T11179] ? ns_capable+0xd2/0xf0 [ 545.529373][T11179] genl_rcv_msg+0x560/0x800 [ 545.529402][T11179] ? __pfx_genl_rcv_msg+0x10/0x10 [ 545.529429][T11179] ? __pfx_hwsim_del_radio_nl+0x10/0x10 [ 545.529457][T11179] ? __lock_acquire+0x4a5/0x2630 [ 545.529484][T11179] netlink_rcv_skb+0x159/0x420 [ 545.529507][T11179] ? __pfx_genl_rcv_msg+0x10/0x10 [ 545.529535][T11179] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 545.529570][T11179] ? netlink_deliver_tap+0x1ae/0xcc0 [ 545.529597][T11179] genl_rcv+0x28/0x40 [ 545.529619][T11179] netlink_unicast+0x585/0x850 [ 545.529647][T11179] ? __pfx_netlink_unicast+0x10/0x10 [ 545.529678][T11179] netlink_sendmsg+0x8b0/0xda0 [ 545.529706][T11179] ? __pfx_netlink_sendmsg+0x10/0x10 [ 545.529728][T11179] ? __might_fault+0x30/0x140 [ 545.529764][T11179] ____sys_sendmsg+0x9e1/0xb70 [ 545.529786][T11179] ? __pfx_netlink_sendmsg+0x10/0x10 [ 545.529810][T11179] ? __pfx_____sys_sendmsg+0x10/0x10 [ 545.529845][T11179] ___sys_sendmsg+0x190/0x1e0 [ 545.529872][T11179] ? __pfx____sys_sendmsg+0x10/0x10 [ 545.529926][T11179] __sys_sendmsg+0x170/0x220 [ 545.529946][T11179] ? __pfx___sys_sendmsg+0x10/0x10 [ 545.529976][T11179] ? rcu_is_watching+0x12/0xc0 [ 545.530008][T11179] do_syscall_64+0x10b/0xf80 [ 545.530033][T11179] ? clear_bhb_loop+0x40/0x90 [ 545.530056][T11179] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 545.530079][T11179] RIP: 0033:0x7f1e1cd9ce59 [ 545.530096][T11179] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 545.530113][T11179] RSP: 002b:00007f1e1dcbb028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 545.530132][T11179] RAX: ffffffffffffffda RBX: 00007f1e1d015fa0 RCX: 00007f1e1cd9ce59 [ 545.530144][T11179] RDX: 0000000004000010 RSI: 0000200000000100 RDI: 0000000000000003 [ 545.530154][T11179] RBP: 00007f1e1dcbb090 R08: 0000000000000000 R09: 0000000000000000 [ 545.530166][T11179] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 545.530176][T11179] R13: 00007f1e1d016038 R14: 00007f1e1d015fa0 R15: 00007fffe5b0f348 [ 545.530201][T11179] [ 545.651890][ T806] usb usb38-port1: unable to enumerate USB device [ 546.028340][T11186] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=57616 sclass=netlink_route_socket pid=11186 comm=syz.2.1385 [ 546.310888][ T5808] r8152-cfgselector 4-1: Unknown version 0x0000 [ 546.321027][ T5808] r8152-cfgselector 4-1: No union descriptors [ 546.346464][ T5808] r8152-cfgselector 4-1: USB disconnect, device number 56 [ 547.301885][T11196] kAFS: unable to lookup cell '' [ 547.549792][ T29] audit: type=1400 audit(803.508:802): avc: denied { listen } for pid=11206 comm="syz.2.1391" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 547.601359][T11209] netlink: 'syz.5.1389': attribute type 1 has an invalid length. [ 548.189052][ T5886] block nbd4: Possible stuck request ffff888027a2e000: control (read@0,1024B). Runtime 390 seconds [ 548.199908][ T5886] block nbd4: Possible stuck request ffff888027a2e1c0: control (read@1024,1024B). Runtime 390 seconds [ 548.211614][ T5886] block nbd4: Possible stuck request ffff888027a2e380: control (read@2048,1024B). Runtime 390 seconds [ 548.222586][ T5886] block nbd4: Possible stuck request ffff888027a2e540: control (read@3072,1024B). Runtime 390 seconds [ 548.293537][ T29] audit: type=1326 audit(804.248:803): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11206 comm="syz.2.1391" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=9 arch=c000003e syscall=39 compat=0 ip=0x7f1e1cd96bd7 code=0x0 [ 548.340955][T11209] 8021q: adding VLAN 0 to HW filter on device bond1 [ 548.413148][T11225] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1388'. [ 548.556246][T11217] mac80211_hwsim hwsim14 wlan0: entered promiscuous mode [ 548.571706][ T29] audit: type=1400 audit(804.528:804): avc: denied { accept } for pid=11206 comm="syz.2.1391" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 548.596898][T11216] nbd24: detected capacity change from 0 to 63 [ 548.625569][T11217] bond1: (slave wlan0): Enslaving as an active interface with a down link [ 548.988551][ T5624] block nbd24: Receive control failed (result -32) [ 550.267997][ T5624] Bluetooth: hci7: command 0xfc11 tx timeout [ 550.287791][ T5630] Bluetooth: hci7: Entering manufacturer mode failed (-110) [ 550.446992][ T5886] block nbd9: Possible stuck request ffff888027c3e000: control (read@0,1024B). Runtime 300 seconds [ 550.457796][ T5886] block nbd9: Possible stuck request ffff888027c3e1c0: control (read@1024,1024B). Runtime 300 seconds [ 550.469334][ T5886] block nbd9: Possible stuck request ffff888027c3e380: control (read@2048,1024B). Runtime 300 seconds [ 550.480345][ T5886] block nbd9: Possible stuck request ffff888027c3e540: control (read@3072,1024B). Runtime 300 seconds [ 552.233536][T11271] FAULT_INJECTION: forcing a failure. [ 552.233536][T11271] name failslab, interval 1, probability 0, space 0, times 0 [ 552.261305][T11271] CPU: 0 UID: 0 PID: 11271 Comm: syz.4.1401 Tainted: G L syzkaller #0 PREEMPT(full) [ 552.261336][T11271] Tainted: [L]=SOFTLOCKUP [ 552.261343][T11271] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 552.261353][T11271] Call Trace: [ 552.261360][T11271] [ 552.261367][T11271] dump_stack_lvl+0x100/0x190 [ 552.261394][T11271] should_fail_ex.cold+0x5/0xa [ 552.261419][T11271] should_failslab+0xc2/0x120 [ 552.261439][T11271] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 552.261465][T11271] ? skb_clone+0x190/0x400 [ 552.261487][T11271] skb_clone+0x190/0x400 [ 552.261504][T11271] netlink_deliver_tap+0xaed/0xcc0 [ 552.261532][T11271] netlink_unicast+0x62b/0x850 [ 552.261558][T11271] ? __pfx_netlink_unicast+0x10/0x10 [ 552.261587][T11271] netlink_sendmsg+0x8b0/0xda0 [ 552.261614][T11271] ? __pfx_netlink_sendmsg+0x10/0x10 [ 552.261635][T11271] ? __might_fault+0x30/0x140 [ 552.261669][T11271] ____sys_sendmsg+0x9e1/0xb70 [ 552.261690][T11271] ? __pfx_netlink_sendmsg+0x10/0x10 [ 552.261714][T11271] ? __pfx_____sys_sendmsg+0x10/0x10 [ 552.261747][T11271] ___sys_sendmsg+0x190/0x1e0 [ 552.261772][T11271] ? __pfx____sys_sendmsg+0x10/0x10 [ 552.261824][T11271] __sys_sendmsg+0x170/0x220 [ 552.261842][T11271] ? __pfx___sys_sendmsg+0x10/0x10 [ 552.261870][T11271] ? rcu_is_watching+0x12/0xc0 [ 552.261900][T11271] do_syscall_64+0x10b/0xf80 [ 552.261923][T11271] ? clear_bhb_loop+0x40/0x90 [ 552.261943][T11271] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 552.261959][T11271] RIP: 0033:0x7fc92e99ce59 [ 552.261973][T11271] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 552.261989][T11271] RSP: 002b:00007fc92f77e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 552.262006][T11271] RAX: ffffffffffffffda RBX: 00007fc92ec15fa0 RCX: 00007fc92e99ce59 [ 552.262016][T11271] RDX: 0000000000000000 RSI: 0000200000000180 RDI: 0000000000000003 [ 552.262025][T11271] RBP: 00007fc92f77e090 R08: 0000000000000000 R09: 0000000000000000 [ 552.262035][T11271] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 552.262045][T11271] R13: 00007fc92ec16038 R14: 00007fc92ec15fa0 R15: 00007fffd0a8b7b8 [ 552.262069][T11271] [ 552.262100][T11271] netlink: 'syz.4.1401': attribute type 10 has an invalid length. [ 552.418181][ T5630] Bluetooth: hci8: command 0xfc11 tx timeout [ 552.434976][ T2310] block nbd10: Possible stuck request ffff888027ca7000: control (read@0,1024B). Runtime 300 seconds [ 552.446176][ T5624] Bluetooth: hci8: Entering manufacturer mode failed (-110) [ 552.519445][ T2310] block nbd10: Possible stuck request ffff888027ca71c0: control (read@1024,1024B). Runtime 300 seconds [ 552.524906][T11271] team0: Device batadv0 is up. Set it down before adding it as a team port [ 552.532938][ T5886] block nbd6: Possible stuck request ffff888027ac7000: control (read@0,1024B). Runtime 360 seconds [ 552.557682][ T5886] block nbd6: Possible stuck request ffff888027ac71c0: control (read@1024,1024B). Runtime 360 seconds [ 552.568752][ T5886] block nbd6: Possible stuck request ffff888027ac7380: control (read@2048,1024B). Runtime 360 seconds [ 552.580044][ T2310] block nbd10: Possible stuck request ffff888027ca7380: control (read@2048,1024B). Runtime 300 seconds [ 552.727547][ T2310] block nbd10: Possible stuck request ffff888027ca7540: control (read@3072,1024B). Runtime 300 seconds [ 552.732635][T11271] A link change request failed with some changes committed already. Interface batadv0 may have been left with an inconsistent configuration, please check. [ 552.811528][ T2310] block nbd6: Possible stuck request ffff888027ac7540: control (read@3072,1024B). Runtime 360 seconds [ 552.905122][T11283] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1402'. [ 553.037259][ T2310] block nbd12: Possible stuck request ffff888027d37000: control (read@0,1024B). Runtime 270 seconds [ 553.051871][ T2310] block nbd12: Possible stuck request ffff888027d371c0: control (read@1024,1024B). Runtime 270 seconds [ 553.065630][ T2310] block nbd12: Possible stuck request ffff888027d37380: control (read@2048,1024B). Runtime 270 seconds [ 553.080216][ T2310] block nbd12: Possible stuck request ffff888027d37540: control (read@3072,1024B). Runtime 270 seconds [ 553.139264][ T5716] usb 7-1: new high-speed USB device number 9 using dummy_hcd [ 553.247057][T11286] bridge1: entered promiscuous mode [ 553.267460][T11286] bridge1: entered allmulticast mode [ 553.301073][ T5716] usb 7-1: Using ep0 maxpacket: 32 [ 553.323600][ T5716] usb 7-1: config index 0 descriptor too short (expected 29220, got 36) [ 553.343898][ T5716] usb 7-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 553.362011][ T5716] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 553.385944][ T5716] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 553.421111][ T5716] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 553.444044][ T5716] usb 7-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 553.477158][ T5716] usb 7-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 553.506601][ T5716] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 553.531733][ T5716] usb 7-1: config 0 descriptor?? [ 553.671151][T11293] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 553.788124][T11293] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 554.350518][ T5716] usblp 7-1:0.0: usblp0: USB Bidirectional printer dev 9 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 554.817567][ T5624] Bluetooth: hci0: command 0x0406 tx timeout [ 554.916657][ T5716] usb 7-1: USB disconnect, device number 9 [ 554.936243][ T5716] usblp0: removed [ 556.193881][ T2310] block nbd1: Possible stuck request ffff888027920000: control (read@0,1024B). Runtime 450 seconds [ 556.211935][ T2310] block nbd1: Possible stuck request ffff8880279201c0: control (read@1024,1024B). Runtime 450 seconds [ 556.223340][ T2310] block nbd1: Possible stuck request ffff888027920380: control (read@2048,1024B). Runtime 450 seconds [ 556.235891][ T2310] block nbd1: Possible stuck request ffff888027920540: control (read@3072,1024B). Runtime 450 seconds [ 557.508594][ T1313] ieee802154 phy1 wpan1: encryption failed: -22 [ 557.645976][T10270] block nbd2: Possible stuck request ffff888027965080: control (read@0,1024B). Runtime 450 seconds [ 557.646072][ T2310] block nbd5: Possible stuck request ffff888027a50000: control (read@0,1024B). Runtime 390 seconds [ 557.670707][T10270] block nbd2: Possible stuck request ffff888027965240: control (read@1024,1024B). Runtime 450 seconds [ 557.670710][ T2310] block nbd5: Possible stuck request ffff888027a501c0: control (read@1024,1024B). Runtime 390 seconds [ 557.670746][T10270] block nbd2: Possible stuck request ffff888027965400: control (read@2048,1024B). Runtime 450 seconds [ 557.681844][ T2310] block nbd5: Possible stuck request ffff888027a50380: control (read@2048,1024B). Runtime 390 seconds [ 557.681870][ T2310] block nbd5: Possible stuck request ffff888027a50540: control (read@3072,1024B). Runtime 390 seconds [ 557.727303][T10270] block nbd2: Possible stuck request ffff8880279655c0: control (read@3072,1024B). Runtime 450 seconds [ 558.116414][T10270] block nbd11: Possible stuck request ffff888027cde000: control (read@0,1024B). Runtime 300 seconds [ 558.116574][ T2310] block nbd3: Possible stuck request ffff888027a05080: control (read@0,1024B). Runtime 420 seconds [ 558.127754][T10270] block nbd11: Possible stuck request ffff888027cde1c0: control (read@1024,1024B). Runtime 300 seconds [ 558.138215][ T2310] block nbd3: Possible stuck request ffff888027a05240: control (read@1024,1024B). Runtime 420 seconds [ 558.149170][T10270] block nbd11: Possible stuck request ffff888027cde380: control (read@2048,1024B). Runtime 300 seconds [ 558.160243][ T2310] block nbd3: Possible stuck request ffff888027a05400: control (read@2048,1024B). Runtime 420 seconds [ 558.160274][ T2310] block nbd3: Possible stuck request ffff888027a055c0: control (read@3072,1024B). Runtime 420 seconds [ 558.195863][T10270] block nbd11: Possible stuck request ffff888027cde540: control (read@3072,1024B). Runtime 300 seconds [ 558.687782][T11347] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1416'. [ 559.137673][ T5624] Bluetooth: hci0: command 0x0406 tx timeout [ 559.144039][ T5630] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 559.867517][T11367] netlink: 'syz.3.1418': attribute type 30 has an invalid length. [ 559.938629][T11368] netlink: 'syz.3.1418': attribute type 30 has an invalid length. [ 560.027438][ T29] audit: type=1400 audit(815.968:805): avc: denied { bind } for pid=11363 comm="syz.3.1418" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 560.384004][T11359] comedi comedi0: reset error (fatal) [ 561.338812][ T5716] usb 3-1: new low-speed USB device number 51 using dummy_hcd [ 561.428158][ T29] audit: type=1400 audit(817.388:806): avc: denied { read } for pid=11383 comm="syz.6.1425" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 561.481807][ T5716] usb 3-1: device descriptor read/64, error -71 [ 561.748824][ T5716] usb 3-1: new low-speed USB device number 52 using dummy_hcd [ 561.787748][ T5808] usb 7-1: new high-speed USB device number 10 using dummy_hcd [ 561.907596][ T9] usb 5-1: new high-speed USB device number 54 using dummy_hcd [ 561.968139][ T5808] usb 7-1: Using ep0 maxpacket: 32 [ 562.128808][ T5716] usb 3-1: device descriptor read/64, error -71 [ 562.531720][ T5808] usb 7-1: config 0 has an invalid interface number: 89 but max is 0 [ 562.556697][ T5808] usb 7-1: config 0 has no interface number 0 [ 562.575071][ T5808] usb 7-1: config 0 interface 89 altsetting 225 bulk endpoint 0x82 has invalid maxpacket 6 [ 562.590544][ T5716] usb usb3-port1: attempt power cycle [ 562.614926][ T5808] usb 7-1: config 0 interface 89 has no altsetting 0 [ 562.627380][ T9] usb 5-1: Using ep0 maxpacket: 16 [ 562.634921][ T9] usb 5-1: config index 0 descriptor too short (expected 51443, got 18) [ 562.646633][ T9] usb 5-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 562.656086][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 562.664760][ T9] usb 5-1: Product: syz [ 562.666604][ T5808] usb 7-1: New USB device found, idVendor=12d1, idProduct=7ef3, bcdDevice=54.68 [ 562.669827][ T9] usb 5-1: Manufacturer: syz [ 562.683003][ T9] usb 5-1: SerialNumber: syz [ 562.699154][ T9] r8152-cfgselector 5-1: Unknown version 0x0000 [ 562.714360][ T9] r8152-cfgselector 5-1: config 0 descriptor?? [ 562.724891][ T5808] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 562.747293][ T5808] usb 7-1: Product: syz [ 562.757444][ T5808] usb 7-1: Manufacturer: syz [ 562.768580][ T5808] usb 7-1: SerialNumber: syz [ 562.788426][ T5808] usb 7-1: config 0 descriptor?? [ 562.812423][T11388] raw-gadget.1 gadget.6: fail, usb_ep_enable returned -22 [ 562.851402][ T5808] hub 7-1:0.89: bad descriptor, ignoring hub [ 562.859621][ T29] audit: type=1400 audit(818.818:807): avc: denied { read write } for pid=11402 comm="syz.3.1432" name="uhid" dev="devtmpfs" ino=1272 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 562.869730][ T5808] hub 7-1:0.89: probe with driver hub failed with error -5 [ 562.957734][ T5716] usb 3-1: new low-speed USB device number 53 using dummy_hcd [ 562.996514][ T29] audit: type=1400 audit(818.858:808): avc: denied { open } for pid=11402 comm="syz.3.1432" path="/dev/uhid" dev="devtmpfs" ino=1272 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 563.044572][ T5808] option 7-1:0.89: GSM modem (1-port) converter detected [ 563.066082][ T5716] usb 3-1: device descriptor read/8, error -71 [ 563.096660][T11407] binder: BINDER_SET_CONTEXT_MGR already set [ 563.109282][ T5808] usb 7-1: GSM modem (1-port) converter now attached to ttyUSB0 [ 563.124165][T11407] binder: 11406:11407 ioctl 4018620d 200000004a80 returned -16 [ 563.650691][ T5716] usb 3-1: new low-speed USB device number 54 using dummy_hcd [ 563.866375][ T5716] usb 3-1: device descriptor read/8, error -71 [ 563.998785][ T5716] usb usb3-port1: unable to enumerate USB device [ 564.220149][ T5708] usb 7-1: USB disconnect, device number 10 [ 564.649214][ T9] r8152-cfgselector 5-1: Unknown version 0x0000 [ 564.679325][ T5708] option1 ttyUSB0: GSM modem (1-port) converter now disconnected from ttyUSB0 [ 564.696789][ T9] r8152-cfgselector 5-1: No union descriptors [ 564.794350][T11405] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1431'. [ 564.814133][ T9] r8152-cfgselector 5-1: USB disconnect, device number 54 [ 564.826248][ T5708] option 7-1:0.89: device disconnected [ 564.895567][T11423] FAULT_INJECTION: forcing a failure. [ 564.895567][T11423] name failslab, interval 1, probability 0, space 0, times 0 [ 564.945866][T11423] CPU: 0 UID: 0 PID: 11423 Comm: syz.2.1436 Tainted: G L syzkaller #0 PREEMPT(full) [ 564.945895][T11423] Tainted: [L]=SOFTLOCKUP [ 564.945901][T11423] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 564.945910][T11423] Call Trace: [ 564.945917][T11423] [ 564.945923][T11423] dump_stack_lvl+0x100/0x190 [ 564.945951][T11423] should_fail_ex.cold+0x5/0xa [ 564.945973][T11423] ? __pfx_cgroup_show_path+0x10/0x10 [ 564.945993][T11423] should_failslab+0xc2/0x120 [ 564.946010][T11423] ? __pfx_cgroup_show_path+0x10/0x10 [ 564.946030][T11423] __kmalloc_cache_noprof+0x7a/0x6f0 [ 564.946056][T11423] ? cgroup_show_path+0xb2/0x730 [ 564.946078][T11423] ? find_held_lock+0x2b/0x80 [ 564.946097][T11423] ? __pfx_cgroup_show_path+0x10/0x10 [ 564.946117][T11423] cgroup_show_path+0xb2/0x730 [ 564.946141][T11423] ? __pfx_cgroup_show_path+0x10/0x10 [ 564.946161][T11423] kernfs_sop_show_path+0xe9/0x160 [ 564.946186][T11423] ? __pfx_kernfs_sop_show_path+0x10/0x10 [ 564.946205][T11423] show_path+0x9e/0x100 [ 564.946222][T11423] show_mountinfo+0x1d8/0x820 [ 564.946245][T11423] ? __pfx_show_mountinfo+0x10/0x10 [ 564.946265][T11423] ? __kvmalloc_node_noprof+0x37b/0xa00 [ 564.946297][T11423] traverse.part.0.constprop.0+0x107/0x650 [ 564.946326][T11423] seq_read_iter+0x93f/0x1270 [ 564.946355][T11423] copy_splice_read+0x4ba/0xb90 [ 564.946384][T11423] ? __pfx_copy_splice_read+0x10/0x10 [ 564.946408][T11423] ? look_up_lock_class+0x55/0x120 [ 564.946435][T11423] ? lockdep_init_map_type+0x5c/0x250 [ 564.946457][T11423] ? __pfx_pipe_lock_cmp_fn+0x10/0x10 [ 564.946479][T11423] ? __pfx_copy_splice_read+0x10/0x10 [ 564.946501][T11423] do_splice_read+0x285/0x370 [ 564.946524][T11423] splice_direct_to_actor+0x2a1/0xa30 [ 564.946547][T11423] ? __pfx_direct_splice_actor+0x10/0x10 [ 564.946572][T11423] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 564.946601][T11423] do_splice_direct+0x174/0x240 [ 564.946624][T11423] ? __pfx_do_splice_direct+0x10/0x10 [ 564.946644][T11423] ? avc_policy_seqno+0x9/0x20 [ 564.946661][T11423] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 564.946687][T11423] ? rw_verify_area+0xce/0x6d0 [ 564.946707][T11423] do_sendfile+0xadc/0xe20 [ 564.946731][T11423] ? __pfx_do_sendfile+0x10/0x10 [ 564.946759][T11423] __x64_sys_sendfile64+0x154/0x220 [ 564.946783][T11423] ? __pfx___x64_sys_sendfile64+0x10/0x10 [ 564.946810][T11423] ? rcu_is_watching+0x12/0xc0 [ 564.946840][T11423] do_syscall_64+0x10b/0xf80 [ 564.946863][T11423] ? clear_bhb_loop+0x40/0x90 [ 564.946882][T11423] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 564.946899][T11423] RIP: 0033:0x7f1e1cd9ce59 [ 564.946912][T11423] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 564.946927][T11423] RSP: 002b:00007f1e1dcbb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 564.946943][T11423] RAX: ffffffffffffffda RBX: 00007f1e1d015fa0 RCX: 00007f1e1cd9ce59 [ 564.946953][T11423] RDX: 0000200000000000 RSI: 0000000000000006 RDI: 0000000000000006 [ 564.946962][T11423] RBP: 00007f1e1dcbb090 R08: 0000000000000000 R09: 0000000000000000 [ 564.946971][T11423] R10: 00000002000007ff R11: 0000000000000246 R12: 0000000000000001 [ 564.946980][T11423] R13: 00007f1e1d016038 R14: 00007f1e1d015fa0 R15: 00007fffe5b0f348 [ 564.947005][T11423] [ 565.481814][T11425] selinuxfs: Unknown parameter './file1' [ 565.639443][ T9] usb 5-1: new high-speed USB device number 55 using dummy_hcd [ 565.847628][ T9] usb 5-1: Using ep0 maxpacket: 16 [ 565.859410][ T9] usb 5-1: config index 0 descriptor too short (expected 51443, got 18) [ 565.896769][ T9] usb 5-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 565.929445][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 565.947439][ T9] usb 5-1: Product: syz [ 565.957640][ T9] usb 5-1: Manufacturer: syz [ 565.971485][ T9] usb 5-1: SerialNumber: syz [ 565.993608][ T9] r8152-cfgselector 5-1: Unknown version 0x0000 [ 566.089293][ T9] r8152-cfgselector 5-1: config 0 descriptor?? [ 566.632917][T11438] tc action pedit 'at' offset 6 out of bounds [ 566.838452][ T9] r8152-cfgselector 5-1: Unknown version 0x0000 [ 566.864202][ T9] r8152-cfgselector 5-1: No union descriptors [ 566.897546][ T5716] usb 6-1: new high-speed USB device number 18 using dummy_hcd [ 566.911583][ T9] r8152-cfgselector 5-1: USB disconnect, device number 55 [ 567.113274][ T5716] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 567.147759][ T5716] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 567.282261][ T9] usb 5-1: new high-speed USB device number 56 using dummy_hcd [ 567.525648][ T5716] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 567.539372][ T5716] usb 6-1: New USB device found, idVendor=054c, idProduct=09cc, bcdDevice= 0.00 [ 567.548685][ T5716] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 567.560003][ T5716] usb 6-1: config 0 descriptor?? [ 567.764556][ T9] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 567.855094][ T9] usb 5-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 567.865745][ T9] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 567.876550][ T9] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 567.900220][ T9] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 567.921390][ T5716] usbhid 6-1:0.0: can't add hid device: -71 [ 567.935043][ T5716] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 567.959814][ T9] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 567.982501][ T5716] usb 6-1: USB disconnect, device number 18 [ 567.990166][ T9] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 568.015969][ T9] usb 5-1: Product: syz [ 568.036449][ T9] usb 5-1: Manufacturer: syz [ 568.066550][ T9] cdc_wdm 5-1:1.0: skipping garbage [ 568.075290][ T9] cdc_wdm 5-1:1.0: skipping garbage [ 568.082462][ T9] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 568.092635][ T9] cdc_wdm 5-1:1.0: Unknown control protocol [ 568.317570][T10138] usb 7-1: new full-speed USB device number 11 using dummy_hcd [ 569.015984][T11464] netlink: 'syz.2.1447': attribute type 1 has an invalid length. [ 569.258229][T11468] Invalid source name [ 569.351630][T11468] xfrm0 speed is unknown, defaulting to 1000 [ 569.576551][T11469] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 569.585276][T11469] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 569.777777][ T5624] Bluetooth: hci5: command 0x0406 tx timeout [ 570.071464][ T5808] usb 5-1: USB disconnect, device number 56 [ 570.410848][T11464] 8021q: adding VLAN 0 to HW filter on device bond3 [ 571.080950][T10138] usb 7-1: unable to get BOS descriptor or descriptor too short [ 571.108838][T10138] usb 7-1: unable to read config index 0 descriptor/start: -71 [ 571.116470][T10138] usb 7-1: can't read configurations, error -71 [ 571.537816][ T2310] block nbd7: Possible stuck request ffff888027b35080: control (read@0,1024B). Runtime 360 seconds [ 571.548921][ T2310] block nbd7: Possible stuck request ffff888027b35240: control (read@1024,1024B). Runtime 360 seconds [ 571.560200][ T2310] block nbd7: Possible stuck request ffff888027b35400: control (read@2048,1024B). Runtime 360 seconds [ 571.587566][ T2310] block nbd7: Possible stuck request ffff888027b355c0: control (read@3072,1024B). Runtime 360 seconds [ 571.631668][T11485] nbd25: detected capacity change from 0 to 63 [ 572.506214][ T5630] block nbd25: Receive control failed (result -32) [ 573.478320][ T30] INFO: task syz.0.1062:9846 blocked for more than 143 seconds. [ 573.646655][ T30] Tainted: G L syzkaller #0 [ 573.658570][ T30] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 573.674833][ T30] task:syz.0.1062 state:D stack:27800 pid:9846 tgid:9845 ppid:6802 task_flags:0x400040 flags:0x00080002 [ 573.705914][ T30] Call Trace: [ 573.713399][ T30] [ 573.722735][ T30] __schedule+0x1295/0x67a0 [ 573.732758][ T30] ? __pfx___schedule+0x10/0x10 [ 573.744241][ T30] ? find_held_lock+0x2b/0x80 [ 573.751976][ T30] ? schedule+0x2bf/0x390 [ 573.756371][ T30] schedule+0xdd/0x390 [ 573.761083][ T30] schedule_preempt_disabled+0x13/0x30 [ 573.766638][ T30] __mutex_lock+0xced/0x1b10 [ 573.771594][ T30] ? sync_bdevs+0x153/0x480 [ 573.776122][ T30] ? __pfx___mutex_lock+0x10/0x10 [ 573.781510][ T30] ? __mutex_unlock_slowpath+0x15d/0x8a0 [ 573.787187][ T30] ? iput.part.0+0x1a0/0xf50 [ 573.795209][ T30] ? sync_bdevs+0x153/0x480 [ 573.810226][ T30] sync_bdevs+0x153/0x480 [ 573.817624][ T30] ksys_sync+0xb0/0xf0 [ 573.824549][ T30] ? __pfx_ksys_sync+0x10/0x10 [ 573.833731][ T30] ? rcu_is_watching+0x12/0xc0 [ 573.838608][ T30] ? do_syscall_64+0x90/0xf80 [ 573.843839][ T30] __do_sys_sync+0xe/0x20 [ 573.849000][ T30] do_syscall_64+0x10b/0xf80 [ 573.853610][ T30] ? clear_bhb_loop+0x40/0x90 [ 573.859351][ T30] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 573.865281][ T30] RIP: 0033:0x7f352df9ce59 [ 573.870035][ T30] RSP: 002b:00007f352eec4028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a2 [ 573.880456][ T30] RAX: ffffffffffffffda RBX: 00007f352e215fa0 RCX: 00007f352df9ce59 [ 573.888618][ T30] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 573.896678][ T30] RBP: 00007f352e215fa0 R08: 0000000000000000 R09: 0000000000000000 [ 573.904858][ T30] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 573.913184][ T30] R13: 00007f352e216038 R14: 00007f352e215fa0 R15: 00007ffea3570df8 [ 573.921195][ T30] [ 573.925425][ T30] [ 573.925425][ T30] Showing all locks held in the system: [ 573.933281][ T30] 1 lock held by khungtaskd/30: [ 573.972659][ T30] #0: ffffffff8e7e5760 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 [ 573.995988][ T30] 2 locks held by kworker/u8:10/3356: [ 574.007469][ T30] 2 locks held by kworker/u9:1/4931: [ 574.018307][ T30] #0: ffff888027aee940 ((wq_completion)nbd8-recv){+.+.}-{0:0}, at: process_one_work+0x12d6/0x1980 [ 574.033624][ T30] #1: ffffc90007da7d08 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x973/0x1980 [ 574.044982][ T30] 2 locks held by getty/5371: [ 574.050987][ T30] #0: ffff888037cb80a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 [ 574.061952][ T30] #1: ffffc9000322b2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x14f0 [ 574.074623][ T30] 1 lock held by syz-executor/5598: [ 574.080009][ T30] #0: ffff8880b843b2a0 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x88/0x140 [ 574.090320][ T30] 1 lock held by udevd/5620: [ 574.094927][ T30] #0: ffff888027888350 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 [ 574.105149][ T30] 3 locks held by kworker/u9:5/5624: [ 574.111478][ T30] #0: ffff88805df50140 ((wq_completion)hci6){+.+.}-{0:0}, at: process_one_work+0x12d6/0x1980 [ 574.123091][ T30] #1: ffffc900045d7d08 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x973/0x1980 [ 574.135697][ T30] #2: ffff888082158ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x18a/0x470 [ 574.147293][ T30] 1 lock held by udevd/5625: [ 574.153817][ T30] #0: ffff888027c2b350 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 [ 574.169836][ T30] 1 lock held by udevd/5626: [ 574.175541][ T30] #0: ffff88802788c350 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 [ 574.187751][ T30] 2 locks held by kworker/u9:7/5628: [ 574.193088][ T30] #0: ffff888027aee940 ((wq_completion)nbd8-recv){+.+.}-{0:0}, at: process_one_work+0x12d6/0x1980 [ 574.204048][ T30] #1: ffffc90004617d08 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x973/0x1980 [ 574.216417][ T30] 2 locks held by kworker/u9:8/5629: [ 574.222718][ T30] #0: ffff888027aee940 ((wq_completion)nbd8-recv){+.+.}-{0:0}, at: process_one_work+0x12d6/0x1980 [ 574.233574][ T30] #1: ffffc90004627d08 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x973/0x1980 [ 574.246077][ T30] 1 lock held by udevd/5821: [ 574.250858][ T30] #0: ffff888027cf3350 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 [ 574.261520][ T30] 1 lock held by udevd/5863: [ 574.266148][ T30] #0: ffff888027a8f350 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 [ 574.275944][ T30] 1 lock held by udevd/5995: [ 574.280756][ T30] #0: ffff888027394350 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 [ 574.292212][ T30] 1 lock held by udevd/6228: [ 574.296862][ T30] #0: ffff888027c2f350 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 [ 574.308058][ T30] 1 lock held by udevd/6321: [ 574.312704][ T30] #0: ffff8880278f9350 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 [ 574.322763][ T30] 1 lock held by udevd/6500: [ 574.327686][ T30] #0: ffff888027983350 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 [ 574.337003][ T30] 1 lock held by udevd/6501: [ 574.345181][ T30] #0: ffff888027985350 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 [ 574.354702][ T30] 1 lock held by udevd/6983: [ 574.360164][ T30] #0: ffff888027981350 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 [ 574.370412][ T30] 1 lock held by udevd/6984: [ 574.375021][ T30] #0: ffff8880279d9350 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 [ 574.384395][ T30] 1 lock held by syz.0.1062/9846: [ 574.389696][ T30] #0: ffff888027cf3350 (&disk->open_mutex){+.+.}-{4:4}, at: sync_bdevs+0x153/0x480 [ 574.400272][ T30] 2 locks held by syz.1.1072/9893: [ 574.405397][ T30] #0: ffff888077ad20d8 (&type->s_umount_key#85/1){+.+.}-{4:4}, at: alloc_super+0x244/0xd20 [ 574.417095][ T30] #1: ffff888027888350 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xa2/0xe40 [ 574.428734][ T30] 1 lock held by syz.6.1456/11508: [ 574.434952][ T30] [ 574.437271][ T30] ============================================= [ 574.437271][ T30] [ 574.446162][ T30] NMI backtrace for cpu 1 [ 574.446180][ T30] CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 574.446202][ T30] Tainted: [L]=SOFTLOCKUP [ 574.446208][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 574.446217][ T30] Call Trace: [ 574.446223][ T30] [ 574.446229][ T30] dump_stack_lvl+0x100/0x190 [ 574.446254][ T30] nmi_cpu_backtrace.cold+0x12d/0x151 [ 574.446277][ T30] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 574.446298][ T30] nmi_trigger_cpumask_backtrace+0x1d7/0x230 [ 574.446320][ T30] sys_info+0x141/0x190 [ 574.446346][ T30] watchdog+0xcb1/0x1030 [ 574.446372][ T30] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 574.446396][ T30] ? __pfx_watchdog+0x10/0x10 [ 574.446418][ T30] ? __kthread_parkme+0x18c/0x230 [ 574.446440][ T30] ? kthread+0x13a/0x450 [ 574.446458][ T30] ? __pfx_watchdog+0x10/0x10 [ 574.446475][ T30] kthread+0x370/0x450 [ 574.446496][ T30] ? __pfx_kthread+0x10/0x10 [ 574.446518][ T30] ret_from_fork+0x72b/0xd50 [ 574.446543][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 574.446567][ T30] ? __switch_to+0x800/0x1100 [ 574.446592][ T30] ? __pfx_kthread+0x10/0x10 [ 574.446613][ T30] ret_from_fork_asm+0x1a/0x30 [ 574.446650][ T30] [ 574.446658][ T30] Sending NMI from CPU 1 to CPUs 0: [ 574.580535][ C0] NMI backtrace for cpu 0 [ 574.580553][ C0] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G L syzkaller #0 PREEMPT(full) [ 574.580572][ C0] Tainted: [L]=SOFTLOCKUP [ 574.580577][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 574.580585][ C0] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 574.580608][ C0] Code: c6 92 02 e9 c3 42 03 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d a3 f1 20 00 fb f4 cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 [ 574.580622][ C0] RSP: 0018:ffffffff8e407e00 EFLAGS: 00000242 [ 574.580634][ C0] RAX: 0000000001d73a79 RBX: ffffffff8e4955c0 RCX: ffffffff8b8aa095 [ 574.580644][ C0] RDX: 0000000000000000 RSI: ffffffff8df215d0 RDI: ffffffff8c1c3800 [ 574.580653][ C0] RBP: 0000000000000000 R08: 0000000000000001 R09: ffffed10170867b5 [ 574.580662][ C0] R10: ffff8880b8433dab R11: 0000000000000000 R12: 0000000000000000 [ 574.580670][ C0] R13: fffffbfff1c92ab8 R14: 0000000000000000 R15: ffffffff90d7bc50 [ 574.580679][ C0] FS: 0000000000000000(0000) GS:ffff888124370000(0000) knlGS:0000000000000000 [ 574.580694][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 574.580703][ C0] CR2: 00002000001d5000 CR3: 00000000297af000 CR4: 00000000003526f0 [ 574.580713][ C0] Call Trace: [ 574.580719][ C0] [ 574.580727][ C0] default_idle+0x9/0x10 [ 574.580747][ C0] default_idle_call+0x6c/0xb0 [ 574.580758][ C0] do_idle+0x464/0x590 [ 574.580775][ C0] ? __pfx_do_idle+0x10/0x10 [ 574.580791][ C0] cpu_startup_entry+0x4f/0x60 [ 574.580804][ C0] rest_init+0x251/0x260 [ 574.580817][ C0] ? __pfx_x86_late_time_init+0x10/0x10 [ 574.580840][ C0] start_kernel+0x484/0x490 [ 574.580859][ C0] x86_64_start_reservations+0x24/0x30 [ 574.580878][ C0] x86_64_start_kernel+0x12b/0x130 [ 574.580897][ C0] common_startup_64+0x13e/0x148 [ 574.580923][ C0] [ 574.769913][ T30] Kernel panic - not syncing: hung_task: blocked tasks [ 574.776771][ T30] CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 574.787448][ T30] Tainted: [L]=SOFTLOCKUP [ 574.791763][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 574.801799][ T30] Call Trace: [ 574.805079][ T30] [ 574.807998][ T30] dump_stack_lvl+0x100/0x190 [ 574.812664][ T30] vpanic+0x552/0x970 [ 574.816632][ T30] ? __pfx_vpanic+0x10/0x10 [ 574.821122][ T30] ? nmi_trigger_cpumask_backtrace+0x182/0x230 [ 574.827274][ T30] ? nmi_trigger_cpumask_backtrace+0x182/0x230 [ 574.833438][ T30] panic+0xd1/0xe0 [ 574.837154][ T30] ? __pfx_panic+0x10/0x10 [ 574.841572][ T30] ? nmi_trigger_cpumask_backtrace+0x1b5/0x230 [ 574.847711][ T30] ? nmi_trigger_cpumask_backtrace+0x1f6/0x230 [ 574.853880][ T30] ? nmi_trigger_cpumask_backtrace+0x200/0x230 [ 574.860014][ T30] ? watchdog.cold+0x1ec/0x234 [ 574.864760][ T30] ? watchdog+0xcc1/0x1030 [ 574.869164][ T30] watchdog.cold+0x1fd/0x234 [ 574.873754][ T30] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 574.879544][ T30] ? __pfx_watchdog+0x10/0x10 [ 574.884217][ T30] ? __kthread_parkme+0x18c/0x230 [ 574.889233][ T30] ? kthread+0x13a/0x450 [ 574.893458][ T30] ? __pfx_watchdog+0x10/0x10 [ 574.898118][ T30] kthread+0x370/0x450 [ 574.902183][ T30] ? __pfx_kthread+0x10/0x10 [ 574.906759][ T30] ret_from_fork+0x72b/0xd50 [ 574.911334][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 574.916426][ T30] ? __switch_to+0x800/0x1100 [ 574.921091][ T30] ? __pfx_kthread+0x10/0x10 [ 574.925681][ T30] ret_from_fork_asm+0x1a/0x30 [ 574.930442][ T30] [ 574.933942][ T30] Kernel Offset: disabled [ 574.938252][ T30] Rebooting in 86400 seconds..