exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:27:34 executing program 2: fsetxattr$security_capability(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=@v2={0x2000000, [{0x9, 0x200}, {0x4, 0x9bc}]}, 0x14, 0x2) r0 = openat(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x0) getdents(r0, 0x0, 0x27c6) getdents64(r0, 0x0, 0x0) utimensat(r0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0) accept4$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2}, &(0x7f0000000100)=0x1c, 0x1800) r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r1, r2, 0x0) getresuid(&(0x7f0000000280), &(0x7f00000002c0), &(0x7f0000000300)=0x0) mount$9p_tcp(&(0x7f00000001c0), &(0x7f0000000200)='./file0\x00', &(0x7f0000000240), 0x922008, &(0x7f0000000340)={'trans=tcp,', {'port', 0x3d, 0x4e20}, 0x2c, {[{}], [{@appraise_type}, {@uid_gt={'uid>', r2}}, {@obj_user={'obj_user', 0x3d, '+*&}'}}, {@permit_directio}, {@euid_eq={'euid', 0x3d, r3}}, {@fsname={'fsname', 0x3d, 'security.capability\x00'}}, {@smackfsroot={'smackfsroot', 0x3d, ']\":},['}}, {@euid_gt={'euid>', 0xee00}}]}}) r4 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r4, &(0x7f0000000000)={0x0, 0xffffffffffffff30, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03003c000505d25a80648c6394f90224fc601000024008000100053582c137153e370248018000f01700d1bd", 0x33fe0}], 0x1}, 0x0) [ 1382.885761][ T7397] usb 4-1: can't set config #0, error -71 [ 1382.927192][ T7397] usb 4-1: USB disconnect, device number 127 [ 1383.015375][ T9468] ubi0: detaching mtd0 [ 1383.040252][ T9468] ubi0: mtd0 is detached [ 1383.054116][ T9469] netlink: 207496 bytes leftover after parsing attributes in process `syz-executor.2'. [ 1383.077891][ T9468] ubi0: attaching mtd0 [ 1383.094504][ T9468] ubi0: scanning is finished [ 1383.117643][ T9476] xt_NFQUEUE: number of total queues is 0 [ 1383.138490][ T9480] netlink: 207496 bytes leftover after parsing attributes in process `syz-executor.2'. [ 1383.146097][ T9474] xt_NFQUEUE: number of total queues is 0 17:27:34 executing program 2: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000940)='tmpfs\x00', 0xa02000, 0x0) r0 = open(&(0x7f00000000c0)='./bus\x00', 0x64600, 0xa1) chdir(&(0x7f0000000380)='./file0\x00') mkdir(&(0x7f0000000400)='./file1\x00', 0x0) open(&(0x7f0000000600)='./file1\x00', 0x400900, 0x79) mount(&(0x7f0000000240)=@loop={'/dev/loop', 0x0}, &(0x7f0000000280)='./bus\x00', &(0x7f00000002c0)='nfs4\x00', 0x400, &(0x7f0000000300)='tmpfs\x00') mkdir(&(0x7f0000000580)='./bus\x00', 0x0) mount(&(0x7f0000000480)=@md0, &(0x7f00000004c0)='./bus\x00', &(0x7f0000000500)='cifs\x00', 0x8000, &(0x7f00000005c0)='security.capability\x00') r1 = openat$vsock(0xffffffffffffff9c, &(0x7f00000003c0), 0x8040, 0x0) creat(&(0x7f0000000640)='./file1\x00', 0x5) renameat(r0, &(0x7f0000000340)='./file0\x00', r1, &(0x7f0000000440)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f00000001c0)=ANY=[@ANYRESOCT=0x0]) chdir(&(0x7f0000000540)='./bus\x00') r2 = open(&(0x7f0000000040)='./file0\x00', 0x161942, 0x0) mknod(&(0x7f0000000200)='./file1\x00', 0x8, 0x4) lsetxattr$security_capability(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x0, 0x0, 0x0) write$P9_RREADLINK(r2, &(0x7f0000002580)=ANY=[], 0x16) 17:27:34 executing program 3: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x98, 0x91, 0xc3, 0x8, 0x8d1, 0x3, 0x3a3d, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x9, 0xb1, 0x16}}]}}]}}, 0x0) syz_usb_control_io(r0, &(0x7f0000000340)={0x2c, &(0x7f0000000100)={0x40, 0xa, 0x7b, {0x7b, 0x8, "78f48f58e208af097e23c37f37fc3edb00c094e662ce6f3e7adc7a74970c9ffd050fc06aa282491a59dc3aa4c15172aaff0e4be676253495f2e0a22449b64fa4500de61f1646b02950a1663005103256f0d6ecd8a37a65b3b528446731b65ee06e1df46d0bb36e91369cdf729e77d47d15efd13dd921466e91"}}, &(0x7f0000000000)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x180a}}, &(0x7f00000001c0)={0x0, 0xf, 0xbd, {0x5, 0xf, 0xbd, 0x4, [@ext_cap={0x7, 0x10, 0x2, 0xa, 0xd, 0x9, 0x8}, @ext_cap={0x7, 0x10, 0x2, 0x0, 0x5, 0x6, 0x81}, @generic={0xa7, 0x10, 0x2, "640575637b2fba7b19340861c6a0c71b3690320c91acd53d5e1930cf9346719375a97600bbb535c43bc10a6fe5d4ec0f38633edfe4584c8c7befbfa0a047cdc37b88e99d4ed9cad86a3b16252d5b864697f88a6f8b2136640b9cae73a5799e9e46eb51a3d51aa9e0eed4e29bf6a396faff5eadea24f1630e7d2cf7648d8abdad68f0fce43d1da6a6a17cb3858417bf52d70521f31ffa877d3d8ae24682d01daec4c8e9d5"}, @ptm_cap={0x3}]}}, &(0x7f00000002c0)={0x20, 0x29, 0xf, {0xf, 0x29, 0x1f, 0x0, 0x0, 0x0, "ba993aa7", "817c564c"}}, &(0x7f0000000300)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x3, 0x4, 0x7, 0x8, 0x7, 0x6, 0xffff}}}, &(0x7f0000000840)={0x84, &(0x7f0000000380)={0x40, 0x12, 0xf1, "3b966af15dc8776603371b336cac0cc764ac8bfd9cb6d6bf6af6f4d04593d7b4bc3638606518f0f29cb26f11dcc8fc87b533f7e975a78306875d1e8b27ef1ac2760c517280b7fc83646e1c8211b0c2795c88e0ddbfa5af8c5ff5f498f8fdade73f6575bdba48914612dc9301e5b4ca3da0701ba155748cbf337ef25690ead18df7d8ece4ee2d15f0d8901651dd71cd16d783ca469be4b496012cee45b27c3f79a22ab791e90ea76678347f830c4f9d9584f0b651520071cce2c54e31d99bd1884821d1311de0c876ff3e66f09ac378a9ffc0a91b82a6fb6559203ce2550156709d43cdc9f7b49858fd1d12e6a066c5ed26"}, &(0x7f0000000480)={0x0, 0xa, 0x1, 0x7}, &(0x7f00000004c0)={0x0, 0x8, 0x1}, &(0x7f0000000500)={0x20, 0x0, 0x4, {0x3, 0x2}}, &(0x7f0000000540)={0x20, 0x0, 0x4, {0x4, 0x8}}, &(0x7f0000000580)={0x40, 0x7, 0x2, 0xb3d6}, &(0x7f00000005c0)={0x40, 0x9, 0x1, 0x2}, &(0x7f0000000600)={0x40, 0xb, 0x2, "d60d"}, &(0x7f0000000640)={0x40, 0xf, 0x2, 0x7}, &(0x7f0000000680)={0x40, 0x13, 0x6, @remote}, &(0x7f00000006c0)={0x40, 0x17, 0x6, @random="3c7db159b1fd"}, &(0x7f0000000700)={0x40, 0x19, 0x2, "bec1"}, &(0x7f0000000740)={0x40, 0x1a, 0x2, 0x2}, &(0x7f0000000780)={0x40, 0x1c, 0x1, 0x1}, &(0x7f00000007c0)={0x40, 0x1e, 0x1, 0x1}, &(0x7f0000000800)={0x40, 0x21, 0x1, 0x8}}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000840)={{0x12, 0x1, 0x0, 0x85, 0x37, 0x4, 0x8, 0x61d, 0xc020, 0x715, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xa3, 0xd9, 0x12}}]}}]}}, 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000001280)={0x84, &(0x7f0000000000)={0x0, 0x0, 0x3, "4e8ef6"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000ac0)={0x24, &(0x7f0000000900)={0x0, 0x6, 0xb2, {0xb2, 0x1c, "c669e2496075b6d544c52e4dc567164214f1740b7b82821ca32a5028f654e6e2e93f65ae050ae854277365089f573eb6c9340c8c5057880f296de5ea711cba774a10ff8423ebf9f021ffd702404b5c07a004f0096902969d90df825330f9c017eac408f4a4b3b09513f68ab623e6b0312d734c2f90bbbf235ff3081b7121560c5e09ca32be994ea1478ad40a3d0faed077f931b0d638c7173849efd7be1aab33f6b9561dd32bfa432debfd05b692e7a5"}}, &(0x7f00000009c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x2001}}, &(0x7f0000000a00)={0x0, 0x22, 0x10, {[@main=@item_012={0x0, 0x0, 0xb}, @main=@item_012={0x2, 0x0, 0x9, "da50"}, @main=@item_012={0x1, 0x0, 0xb, '='}, @main=@item_4={0x3, 0x0, 0xb, "c9083134"}, @global=@item_4={0x3, 0x1, 0x6, "7aac7006"}]}}, &(0x7f0000000a80)={0x0, 0x21, 0x9, {0x9, 0x21, 0x4, 0x6, 0x1, {0x22, 0x505}}}}, &(0x7f0000000c80)={0x2c, &(0x7f0000000e00)=ANY=[@ANYBLOB="2031970000001d25a35c1fec3357d58cf3351b64bbd327095388b899ac50524041dbd9f7dd9c8985f78e515942105684d907d7dd5c5692333e3895475a091fbe8b62726c599e28a6f4900aeb85b744d4ae29ab851be7d7a687d6dab94d9e6879f7a7f5ac3ded20484300d940eb44ccfe82bcf792d231ce195b7f17423cb0dce436610f0583f0c070fed41e462d628c8edb2ee0ccfcb5e493026f633382eef04fb453a9305c9b71890ccfce8c0864f460cff4f0f50d7ae749e51dcb514d857ffd2eb7ce3d00409ba373543decf3718c8d023c3ddf42c3b8"], &(0x7f0000000bc0)={0x0, 0xa, 0x1, 0x1}, &(0x7f0000000c00)={0x0, 0x8, 0x1, 0x9}, &(0x7f0000000d00)={0x20, 0x1, 0xc4, "6aaaa43044f4b2b8b34c703fd280a2f956ec1298aba85b43370cd278e177837b0626e7d7cee030c7787405ac350a76d6e7fcb65e954fd2e18ea37a8ff90f57c57156dad9c6147d99e9d720ccc916f7b733d1646753b71624c0f52057a2b41df1a02f1ab0e21c65c1ae8b25fb9d492c199a62a4f7778c3da95505931921f03cc1c62f024b843f239523d1afab409dd7db70f59e8d16efe7ab5bcca4369f3c8222c91f8c07e942723c46aee30ebaf9ed34e52cfba9f3efdad2e04eede99bc84fc4c921eb95"}, &(0x7f0000000c40)={0x20, 0x3, 0x1, 0x4}}) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000001080)={0x34, &(0x7f0000000080)=ANY=[@ANYBLOB="4901f866592211703653f7b02fea6cb67cd76ee07db9dcd6c66ed4892d83a5a8e6ac15343d28b496d07fb1164c33460b87490fd483340204ad7a5a39dbd31772d5e0"], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000cc0)={0x2c, &(0x7f0000000a40)={0x0, 0x0, 0x2, ']R'}, 0x0, 0x0, 0x0, 0x0}) [ 1383.389081][ T9468] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1383.465936][ T9468] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1383.473213][ T9468] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1383.576982][ T9489] Malformed UNC in devname [ 1383.576982][ T9489] [ 1383.611570][ T9468] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1383.623533][ T9489] CIFS: VFS: Malformed UNC in devname [ 1383.658422][ T9492] overlayfs: unrecognized mount option "00000000000000000000000" or missing value [ 1383.668194][ T9468] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1383.695008][ T9468] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1383.749078][ T9493] Malformed UNC in devname [ 1383.749078][ T9493] [ 1383.760881][ T9468] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 1204783369 17:27:35 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:27:35 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0x0, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1383.793007][ T9493] CIFS: VFS: Malformed UNC in devname [ 1383.803797][ T9489] overlayfs: unrecognized mount option "00000000000000000000000" or missing value [ 1383.865535][ T7397] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 1383.907421][ T9468] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 17:27:35 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1383.952625][ T9497] xt_NFQUEUE: number of total queues is 0 17:27:35 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000480), r2) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=ANY=[@ANYBLOB="2800000010000108002bd62b2fe9a2e951000000", @ANYRES32=r3, @ANYBLOB="fffffffd0000000008001c00ef"], 0x28}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x97ffffff, &(0x7f0000000200)={&(0x7f00000001c0)=@newlink={0x28, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x600, r3}, [@IFLA_TARGET_NETNSID={0x8}]}, 0x28}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000040)={&(0x7f00000000c0)=@gettfilter={0x6c, 0x2e, 0x20, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0x7}, {0xffe0, 0x6}, {0xfff1, 0x9}}, [{0x8, 0xb, 0x1}, {0x8, 0xb, 0x10001}, {0x8, 0xb, 0x7}, {0x8, 0xb, 0x7fff}, {0x8, 0xb, 0x10001}, {0x8, 0xb, 0xfffffff7}, {0x8, 0xb, 0x2}, {0x8, 0xb, 0xfffffffd}, {0x8, 0xb, 0x3}]}, 0x6c}, 0x1, 0x0, 0x0, 0x40}, 0x4840) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_DELETE(r4, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)={0x1c, 0x2, 0x1, 0x801, 0x0, 0x0, {}, [@CTA_STATUS={0x8}]}, 0x1c}}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000400)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000003c0)={&(0x7f00000002c0)=@newae={0xf4, 0x1e, 0x100, 0x70bd25, 0x25dfdbfb, {{@in6=@private1, 0x4d4, 0x2, 0x6c}, @in6=@empty, 0x5, 0x3500}, [@policy={0xac, 0x7, {{@in=@initdev={0xac, 0x1e, 0x1, 0x0}, @in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x4e20, 0x3ff, 0x4e20, 0x6, 0x0, 0x20, 0xa0, 0x2c, 0x0, 0xffffffffffffffff}, {0x3, 0x3, 0x4, 0x1, 0x100, 0xfffffffffffffeff, 0x5, 0x4}, {0x1, 0x2, 0x7f, 0x13c}, 0x81, 0x6e6bbc, 0x0, 0x0, 0x2}}, @extra_flags={0x8, 0x18, 0x626}]}, 0xf4}, 0x1, 0x0, 0x0, 0x40}, 0x4000000) [ 1383.996808][ T9487] ubi0: background thread "ubi_bgt0d" started, PID 9487 17:27:35 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x4, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) [ 1384.145723][ T7397] usb 4-1: Using ep0 maxpacket: 8 [ 1384.195077][ T9503] xt_NFQUEUE: number of total queues is 0 [ 1384.198902][ T9502] xt_NFQUEUE: number of total queues is 0 [ 1384.239935][ T9512] ubi0: detaching mtd0 [ 1384.268432][ T9512] ubi0: mtd0 is detached [ 1384.280758][ T9513] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 1384.402636][ T9512] ubi0: attaching mtd0 [ 1384.419555][ T9527] device veth7 entered promiscuous mode [ 1384.429976][ T7397] usb 4-1: New USB device found, idVendor=08d1, idProduct=0003, bcdDevice=3a.3d [ 1384.462135][ T7397] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1384.485974][ T7397] usb 4-1: Product: syz [ 1384.518934][ T9512] ubi0: scanning is finished [ 1384.525633][ T7397] usb 4-1: Manufacturer: syz [ 1384.552410][ T7397] usb 4-1: SerialNumber: syz [ 1384.598382][ T7397] usb 4-1: config 0 descriptor?? [ 1384.626233][ T9513] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 1384.676462][ T7397] hub 4-1:0.0: bad descriptor, ignoring hub [ 1384.682484][ T7397] hub: probe of 4-1:0.0 failed with error -5 [ 1384.837500][ T9527] device veth7 entered promiscuous mode [ 1384.921671][ T9512] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1384.930636][ T9512] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1384.939524][ T9512] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1384.947592][ T9512] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1384.975220][ T9512] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1385.002412][ T9512] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 17:27:36 executing program 5: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000380)) r4 = perf_event_open$cgroup(&(0x7f0000000200)={0x0, 0x80, 0xfb, 0x2, 0x7, 0x1, 0x0, 0x7, 0x100, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_config_ext={0x7, 0x3}, 0x1400, 0x6, 0x7, 0x0, 0x2, 0x9, 0x3, 0x0, 0x9911, 0x0, 0x80000000}, 0xffffffffffffffff, 0xd, r0, 0x3) perf_event_open(&(0x7f00000000c0)={0x3, 0x80, 0x48, 0x7, 0xf8, 0x2, 0x0, 0x9, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x8, 0x0, @perf_bp={&(0x7f0000000040), 0xa}, 0x10, 0x2, 0xff, 0x0, 0x0, 0x3ff, 0x7, 0x0, 0x3ff, 0x0, 0x8000}, r3, 0xffffffffffffffff, r4, 0x1) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) sendmmsg(r1, &(0x7f0000000280)=[{{0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0xf4010000}}], 0x400000000000085, 0x0) 17:27:36 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0x0, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:27:36 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:27:36 executing program 2: clone(0x8100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000180)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@struct={0x0, 0x0, 0x0, 0x1d}]}}, &(0x7f0000000040)=""/211, 0x26, 0xd3, 0x8}, 0x20) clone(0x200d00, &(0x7f00000001c0)="24e6d13332cb0ec1fa9641ecc0de113a4cd4ce592d4eb32e4efcf2cc5e4fe95bc830722a551fbe7fb45531ee657ad99524a05845bf08a5a90efd254a32b717d4bfb9242ae3cdeef69211042d009203b233bbf9d0aab9bca78074608d79ddb94c06ef031faec484420e6738e06f8ff98b95ef41434e202728421b893d2a65a0753cad1c494035c2691cd0c76eddbc65d99d40c14e176cc514947784ce81c1abedb4e554d16d18fa5883f2ffa5c414c9dd78679c89dd31db9512", &(0x7f0000000140), &(0x7f0000000280), &(0x7f00000002c0)="79533baac30051937bca0911526e86a3fe3e0ba71741c48cd6693a330522fb31361b402aa604b8ed671e0a3209e4bbd27decc4627ebbb13ee91a59860f5aa30fdda441d21b566c9fbc59adeb3602259c5072cb2df0bdafac5b69e20bebad5657dc749b003ef349f6bc8b2ee23753ba663ad336e78884e66f5b4856a68e7ffa1845669e0387ea931d7d48d13f6199a4bd5be2f3e8263e4e1c69aef4ba94eb851aee4e4ec9d4dba6880cd643085fe662cf94f59bc98a7c89d666cdb09f56f9f187d4687cc426b98eecccb2ae805cd5df86f3b8b9d99e3ad8fd7d7f1dec3fd95a368588630aecfac3916cc644b348f81a8d1dc125e87a1a00caa5b0233004ef539beb666f2c8a1d6b3b58c4d9253f3ed6a315960918444a4e071b74d51fdc1892a8fe8ede3048cbf4b7d4bb30cf7b5a5e6b02193b1b4fc62c11e19df403cf5e988c55e95139d3e4a352f465f8d9e784f9a1ce5da6385a6cc6a4ef56778d829af33ec130cda102c487f57446534420f871f015ab8beaa2f3dae457e825df44e6145a15e4668f7b60f1f461331373e21d308729a5d261addb2b40d65f2317febc0d68767fc8c41b58095dde644436a754ca96543a231d22012a59b65bd236d5bd354c2b5c250df4e09b47551b23e28ebb74ca1df909d409e6c23396dab0d3cb8f8df65ab271dd038207c7f40f9121193f6b5ee8b9435cdb96b38039ec3ba441c2d6d3da24b0290728df850db3185b10747e4d278055b16fd83e92639adf626369a4761852442662847f107038449d8ebad4f8819bcf9f7f6037b9cb6833b59dfd1b0959b7ff90ecbcde2669658ff3a893726269cd50eec3b1157ee8074300db2f2673f509076939ab00416ef967cafc093df27dcdd7e5e3c6515d5eae7a58671b29a80c56d532ee5be04203611b2fc3ffb99147da47e44a2c9edb0ebab922ce862d0e2b6b77eeb81a7be799844b591a23595ddb42adb881cb0564c6c06f30e4fdaba70bf03b61106cf8e6e4e53d0a8a8f2470206244ae92da4ff690acc2b26288d4b931bbfc90bf9d033f7c671a116c6f4ce8d84e9b971b529f7175e9ca250c9e5a59ad37821737811ec0567cf59a8ba4916ac975ee3ba591ff4653be536e5402fc53b6a3447b6afdc50b45121b3c3842ef972ed12ce3603b82fd908d248476e8f15a80e5a6bc9a42f2a380101c7caeb78b39cb7fa07aaaed8783d78c9594e2fc2f5ec8d9fadb0c2eec6d43c12c823fb1d23b09ff224cb487b31bb5441944e28eb13c815bfe20b0d87d26188e7ef5b2c5872bc1487125f81b6cc1e0f765ea8d5b8b0f7a99131ac9ed7f93400794a1a7c728fb6bd2a3d25a7ebe6a3e1012cdf40e611a8ea8e3af7c09c079ab1904902855eec15296dade54eb504fcf0ac481f19eea395586f1bf0e84cfb029a31fa5cf9310fe5f031daa6cebddda9f9f7f18ce7ad8c267a013b7f024af7dd5ba1f727ad735ae94d054a51961dbd51b29b3ca58c0f0bdc7ef83e21b41d8556176a1e12ac8cd194cbf774e622c315be6f5e5e7cbc5384a4a9faf2f656802760d22af3dc4e247d913c44182524dc32b90bbb55e3e848b655d7ca8a8a28a729437efe8a609614a56de1e8a69b44ac1500823248fece327eb8e4e2684d034982353fae1a7ffb78732d851fb7d80e791498f4b431bf3cecfe0e2c1d95ee1d742d6266feb0e7effbef4dccb87d7cbde6c679a840870d0cd3b1e04733cdc7e5ac02d63a6db0ed63200dee7668dc776ce661e2825716cab51fefb1728c8c939352d53b1ea398780ab3032149c6b3cebad5fde6be3c6ed2cfda13c69d7f1d6c4e7d3765eeaf9993c27d8b30415599582f589753e45ea0470257e419ed03264111148bfba59333d5a7c31111f0b9d16bd6b38680124280369fe82fed5495037eb656caec20006525618ae1199e537cb8104da785fd847bcdc1e3cf41096dc7904710e19a885564002d0ef54db4bb74e39a1d0c5538a5d3da805b500fa239af46779560662245f5dd2dc7b56bcba3186bf523128b1777e5890f01107187e0d95c0738b125aacc7f2d37e089b60823b834c685b1963bc04cd0bae5d87cdd7a79405b84caf28c6074721a309451d26bff064317675727cebbe9d876e823ae5863d9ff3f47faca71b2431327dc043894dc0e4a6f70d4b16d4c6e30bbaabcb27b7342a6a41a0e500846eb555f80d0e0da94c548351118770b8eea79e42665ce8c4d59e426f348f42d5125a5ee6d1d779ae874f626117ca7fdb25dc44b6869811caac9a8d1c620c21caf8967afde101f3f3bc22c83f0b4e4219d5cc2eda15b2ac9c27f03182b0327f4ac19312cdd0c5643cf5dbdf472a425b50af01f28db6435f2ed39011f7323cf46b8806751f02c07171fc2199d43cfb470b2b220b27c5f56cea97efc2c93e4b60b5433bd7ca25cc590160e3839e1bcd0f0a06765ee46517092bde0dbffd92084c620d2f55053ca557405bdfc70955d24d56f32a498e979343aa9024fc54c9705423ea7624ba47d335630725313d83cbf0c20ef3011360811ce82f98267d1e7d362453c6a200977753ff831397d2db24ee70553bf073fc804be927a714b0b4b7627f8e20a87d2acceaaf3aa40560985900af8164585afef9a043e8bc7db6120103065bd00c77ca23034eb65af96b8845d30ef6f538b666b8f3c9b7a3f53e9ef647dc55fda4e2df2b0b411f1c79a6c0f61d84bae712536ca0f7c94d07249f02837699aa2c3204adc1e175ec3fc87af85665f7d5878873f44b10a95d628e47973d029a6143d01cc0ab2d376c9bca3a2916921c926177ccdbbba8d305d2f19d47a124500cd666b3c0b1cf576480de85501d66890a12e556ff603f4ca8d535cd6b7932aa28d0a59f4b52c4ca6ae256250641efacb4da872cd2c6e1ca247ab043972f93e3968cfb9d73e3bda03498f33fe0da81042f012429cd6e1ee7043c6047faa22c3592f945359022403b4e591d8a2331a2211c168f2bb71053284f2e98850d3f7425e0b4e1189d884761278eb48a0228d6caea678ab842f2db3879219b9a5189ca41c44bee45c47362401e3af407c50fae3583f43f0b3ec7f0e1df618cad3503cc30de19cee32be54f7f19b0683b69815e9b75efe2b99cbf8c8d0f795c2a8719205e8e4f846a75e83fcccb25a29995da57d766901ee6ce6c4854279d1d7a6da96154b0a42f489140f79eafe41a1bdfa2f1d351ff631cf61fe0a2e8767710c14589ee907f31e71671d23c6e41aa72c9b3845ecd33f86b95b83c5cba2cac957066f732e88ba5adf82cc742ada719cc11a739995af47160b47c0e9baef39685482d3c8f34850660cf25af7ac6cc45b51a48f81f60db87dcc9d4cdd0604bade7fa77558d9741d1d6ffed735a4d806c1c50fe028218e2c7419aba7077f94e0bd208384d29908c68222f96f15e4c10f377bf3ff91f7db4bfeac60f5d8ae733eba9bf288e3d562c7169d729772a85e5c2240636b24d943773cdddcb28373c96667b3d6c88ba6c8266addca00e43e809e4e4705a281754c606ea2369b2f66fc1644090ddb6add40b72fd11daae6771a143de718b2d1c3cc2f89be9880945a6d3831c9f563b9cff840311ded794cce1b0f07066263c5e7619f32633261a2f9efc8941afcb4ee6a29d50b816c2efa8f88467d6ab038389945f578068a100cc149f45606d36f7466fc0a7311283d4721b8c78e7a3aeb747a219db05c00e71574ffc9ab02f4cf221f0057ad32e8e9e38b3b770b429ea2409681f6da49ce0b798d5fec4034be4e1980f137f3b24575ba50fec8eecac8a3d7d2ab4b535904e7ef69aad57ee19eb748c19c2ea4f0d064babe304be0eda614aab54e55728792b51c6591e6ad0637b5b9301764f1155252d50c6f02069a413377222f73aa9a0b8d9876484a3356d3a9bed63420bca5e86a9d13164c82a4f3f1339a11416b1c501bb8ec8fd4e79e13dbb0c350aa52380380822f60f0eed9dfef1b08ce23ea0d06b65a4453edb77898785caaefa84680f72f3e55540961e1b06a3b576c0841f255e16174515ffd57f0d58332ec3a8e9c0603fafb12ebb24025f094945d3dd9e50f226bce8939c3a2c2c9d47c7d400f276924bdf99f96e6364b3abbf55e871108b6bea58645f4ce11b201c0c950dcc66d16323653feecad5ab857d3c8d817434b732f30a99a572d619e91971023115845b3fc845c3e0637136120bd468a09fb323dbd7acf691ecb98530efe1ec26bc5615ed869e47c53abacf65fe7475c9b8e9ccc69c269ed1c228a1f13cc7ff8a196a409217259858fb6274675a18a1222dd2dabb1090041c0e8853de7d6966127eeeda3c2c40738b2255b0938a5043a9d782efa96f44b85d8a4c5a25b95e33f3901b40deae4dad2a224cd1b29ed991b4e5a7d1c26962a7ba8126fcd2b378c0e9be96f9d3c587b889f37060ad2994f5265e9172c9a6e582354b5a7b3efb09ce48e4bc75e5be086dd9030361698b1360bafa341891c2e9dc223b1d2fb2994d5da5a187d27b13e2dccc36f8e59eaab16ced8d3407d1303705854e380ba3cbedfc35b286b78ca50e96128d1585d030bb8ade37d693cd9718415d9192be2933fbdae374ce41c2138a63674515a3aa39570059ca5837cd855b9d0bc9869fb0fe0e87f504dd41276cac132cbe6fb2df6e677cb5c0aab8be89b2d3f046144de9f473da8c713ad92667f495c32be8ea9d89d14fbd3bf71a2c03865edd5b85d00b268cc693bb2da71cfa3534d9c62e5f9198db556d9c30d31a6613d1516090866da0011c9d7f432d7b939ac770e4d0650f0b558dd79b8398b4628e850703d5ad1cba5f9e9b4adfc97aec9cf49122e8596def87ec0ce9b527db89044648508d8ae6333a0ee4230aa70b76172a72415724d367100ee2c5c7e6e89359f8dca2b5053dd2d97414d64e954681e166c0a9519715ec10c0dad30378dd498da2334db9412318f78f8bd0ae68dfad3012afc0f5466ae888e44bf3ff392b1a78eab0496035bfb6ce64ccc09cbc5a33c54a67e1750b1ced8b8ffb29bc10343106528503d859cc507199913a1cea80034c9236627d2659bd5c14793f9515b1d35e85817cb018d97e75f70c1451e5a0cb4b4c99982aebcf809b557f7d87f444429907f70268209c5997666fd8ddc2ea40ff6bcdb4d5f8e1864123496f5aff3e0b98b7d5f838afe27972670bc676c0c4f5d51aa75cb368386cfd08761d398839bea4f97fdd7c0e12cb227a7c272994d628372f6894224029c0c4eef38cf5cc106e1ed1ac983d29d84c28f9cd78be9aac704ce2ec4c02632ed2c7ffd3a548183b2c0316b21b2590921fbb59a59649e937e5b667a536ae22cc3779b28ac0e83f2ac989534dcdf0a8dfb8462e85d3c57b4c0ef74420a82effe07023bcf201c76dec92394a999fed18d70ae9c04282e149b543c818df9b88a98987db4fd067cee9829945a923c821a65a54983f89478157283b37c5ca961f5b52307fcfc2644c1f6bfb6856161f37dbe9dd07915a5cbeaf60f056c6c666b5478e04d54d271a909b4c9c13efb1e102beec5560ce958349816632a15be2bee2d538b4c930a303e0a2c44b54b3752c2dbf8ec53391c4a4c556836ef27ebfad3d0ea7ed219017acfb43fbe9fa888ff91b90e02adc626e36ba7060ab358eb67cfe4d352dd90094511073fd3bf553e5c1fa1e1d8d71634ab26ec204d82195399b75927f1a0bc7435bbd24723c2bffb832c1955606455ed59567f4b642f3fb94a5f2c410f0c728f34db9ad0ea506d3e6d6ad6cd1b9e5379240960eeecef9faf4ea360205e8cbc39346fbbf") [ 1385.038404][ T9512] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 1204783369 [ 1385.107628][ T9512] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1385.176821][ T9586] ubi0: background thread "ubi_bgt0d" started, PID 9586 17:27:36 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1385.292403][ T9600] xt_NFQUEUE: number of total queues is 0 [ 1385.329159][ T9599] xt_NFQUEUE: number of total queues is 0 [ 1385.337262][ T9609] BPF:[1] Invalid kind:29 17:27:36 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x4, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) [ 1385.380891][ T9610] BPF:[1] Invalid kind:29 [ 1385.552656][ T9490] UDC core: couldn't find an available UDC or it's busy: -16 [ 1385.570651][ T7397] pegasus: probe of 4-1:0.0 failed with error -32 [ 1385.573668][ T9623] ubi0: detaching mtd0 [ 1385.582218][ T9619] xt_NFQUEUE: number of total queues is 0 [ 1385.601860][ T9490] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 1385.607634][ T9623] ubi0: mtd0 is detached [ 1385.639551][ T9623] ubi0: attaching mtd0 [ 1385.668531][ T9623] ubi0: scanning is finished [ 1386.011071][ T9623] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1386.066558][ T9623] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1386.196145][ T9623] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1386.270162][ T9623] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1386.305518][ T9623] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1386.332798][ T9623] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1386.357171][ T9623] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 1204783369 [ 1386.377374][ T9623] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1386.405452][ T9630] ubi0: background thread "ubi_bgt0d" started, PID 9630 17:27:37 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x0) getdents(r0, 0x0, 0x27c6) getdents64(r0, 0x0, 0x0) utimensat(r0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)=@ipv6_getmulticast={0x14, 0x3a, 0x4, 0x70bd29, 0x25dfdbfc, {}, ["", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x51}, 0x40000804) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x98, 0x91, 0xc3, 0x8, 0x8d1, 0x3, 0x3a3d, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x9, 0xb1, 0x16}}]}}]}}, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$printer(r1, 0x0, &(0x7f0000001080)={0x34, &(0x7f0000000dc0)={0x0, 0x0, 0x1, "cf"}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000cc0)={0x2c, &(0x7f0000000a40)={0x0, 0x0, 0x2, ']R'}, 0x0, 0x0, 0x0, 0x0}) 17:27:37 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0x0, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:27:37 executing program 2: r0 = creat(&(0x7f0000000200)='./bus\x00', 0x26b9cb250783348c) sendmsg$kcm(r0, &(0x7f0000001840)={0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000000280)="5e21a6533145cf388b2a54c8746d03bb176df2e16742dcc99ebf8197009e67874304119f982e49512e085b7b486ada0e2a98fa54c5b722d793d7bb54aeacd544f4e8806d0f97ed4ca018fd3f2a1bb20e4c980a991c76e98027cdda673f549168f46fe584fa54c73c64f1fd16224e25d1c936f97bf9620b87ee2ce1c7a895e4c60a11d569d2559cb09829338a1a96e7", 0x8f}, {&(0x7f0000000340)="a880a9d1a073b5a9875da19587ef6cef944daa6b9494db72ea551bf538ebca627762d413a094d2cfca1038e994a0b2e8661e5b88f220e939db3e99b9b8dcdb59d23bf2e4ab15197ac922c042715add2f32a448aa8b3214baaae23b34a22708befb761f06f9c25bc2ee43d511bfb7f704cdbb69e5478f3d2aac4f34dd874d57cc0d398c7cdf6f25a4025fb235b0869c602235aa7f217752484909734f6fce552c86aae442521272d462b01487f3228f82c1368b8b82b9f7ee29ecd37d6f3a9013547cd566ae0c847c02db47bb750fccfbf9faefe23d50356f5cde3c8c7babf890bc8297e906a93e22de5377f0e3a91b4a9d2b1c5544c969c3649690d838e7a7add620be85cbc9de58b8f8beac5a8b46dabe177327914db0c451757e32ac34ebb0ea7d4832fa8db06b5314327d646fa53bc2229863ca1c921f05f8e9387ee6b126e5a113ae6db41b085669affc036b4b9d5daa5c871d468babfae42d8885cc1701a26ed04762bdf3a910b128990a378efd743d6a1b9a9eb41fd2df0afe050c71a51373c23dcc1d3daafc65356c70c8e465bbdb328670caa628a9ea2a76c9f6815bf2661ba5e5b954fe0acb20da6fee9f03c33955d9ad6b21fd6345e9f7b97ca33df4625c729aae85d6004b811f0dcd5b376785c2a59e3937d84477484a778c7cbfdd603dcbabdb10b6065c7ca314beaf0a2f55b1e13b35b29a9e26be52fe0e42159e62e33f2dd7a025181242661c2dd0281ae5b8abd26be1db97e21370baa6245073db8d5da8b91b8a2b90c90f9aa1a4d134e5d2106f5f7fad827563584f2da59eb6bb84a3ebb84874e6ad8dcdff89f8868fb7f7af5f06dd4e9271ff977d87a7f41e077cfcfad3f012099c79b478f2bcab4f4cd965dc3d30ddff2ba66084d599065f49510aaf6c6e7f2f0bc89f9eb7f4d7c36efbb55eb55719e9951fee494b21b7a0aec0de9c8a45704a6a2c9cd0a625b3003b11a6d8fa74fee045ffc20278ac9a7ae23f4f9b092d10413956a8afb18171f95e47a302d8d832263428096c659a6870f301a114c4de3938f7acf9d013ed9ff487e05e42fe245ac07aaceb726aea36b4149703f3ad09144ab2aeb1758e91034b29ed66f824c5ca11eb90b1a0ad4124a4f04b67b856e7e4b6de9e897f86a21d4b62bdcaaddd287769681d45bb93316053ccced8b9ae825d01f96546016a7842cad311c96d547cad0a7785c6b5a637cea74d3dc2793d5f9547511d5a22c361650b912f0e4aab97428888ce26e963a2a729977fd4f38ca983f231a90bd02a105b29f8ad1c27428c73771944478550ddd979d71d696979bdae829891225995e97f61fd36de2427363f5478f2b168e8a8c822d1837464cba385af09df09fa917521d8e4fedaee4f28ffef4c375bb5205694e5bb9c13c13f82d4985ba199d251ca5644a27a726bbbed8724636d75ef526fdf05102dc51897fc2e25e0551bda126dad700aed456e14ab6d5a33aa672e19cb8666a89c88147efac515930a9e7ffbe4a8a96795eaa1f02f2c5bff291515fc467f7d882d69a6be942fd4e60c31036b9d61b504ad090d6b482184bf4c6455438016a5ad133ea10e7a94c04cdda2f385cf51b360f90f2e5b19f6785ac1d8014714d44199eed7c76636c3d2529869c78d34d78cfba7ee34723a2bf85589f83975c8c717ae9c98d470b6732005e743d17dd76d9170877c7047c8502082300faa01890786defa31b1153a40dbcd2d6aa32494f714fc365fb194a9a2b1566963df9398d56b2aefad475ccf580bb8ebd613a9f81a02e171fac818586c6ab74aeae4f3086b04048016fdb02b38f150ff3e1b15056f1a16b605bf8d95dd7325a3589487ade790af5a894e9c24eda7b0dc5919af8bc4e4ad4c9e60edb120fa3e9d77031964559baa09a9af7f2a672308f8fa29039b3b075de67067cb1854aa80d27e9beea152764d07a0b7178092d33271c1f2e647cb4093130c6267d98c7f50fe7e4f34a97341ffc7b266153fd0d516e3415fa3645f37fe649cb5f0de9f2bef9753fcf9ee87a45bd3619db6d03b255e9c8a62b1b8939b287709ed511ec0eba6cb9cea084b7fbbcf3200bacfdd0fa13ddc53d30b679499b5ec45dc4957c2c8a9f316ce46cbbd8e93d129eb5b189cd45a62398eefefc1cd194617efd3cf46714fff7126f18371f11f4ada7386c7da04fcdaa47fce736a683ae2a53e33f07fb0e4026726c4dd28409e8a1ad1631245e6532f9de909a985cc8f8a48d9779c1339df0c917a6f43707f80c00ddde3c1497c9cd86fc8ce70a8f7151d75659d074eca917de84c98e3a04b3423ff0763f93d35ff9cac91089c125d639276b56385dac67e9a9fdabd6cad74dd1b288a5d2def208aef7d7a34dc53dbd6ea68a295429bcffe2cf93da523e2e765670b5a4a1fb28637209abe9a5aa38c5164e1cde6d754fb71c2f2cee2c85d40ae66191868e5de0dc948be21b95affdfb4de605bd3c6566a6316dd9ae7e0a82d888db4ab120c2a146013bba4021e58b93682059b268711f25d529baf57b6067069b11b88a647f04b5992d1eefe5e14e1789cbb223bd6e75c350b84a508d5f948636b94bb7873cb4dde4fa68cbbbbf22477fd3caf7b06c49b4fb70e3082de14b0bb3cd1a4a8d0a7cc25b5203b728a4651f07a8926354f2b01c686bd63d13a74ad782c1a2690d5f99ec9cf99fd5208fdb7013ae38c9d406d63d95730333ef02cc2b7ede112da502c8ba2d8b34f6581515ac07b7c153c7e282ebd02f397de8978fee4809ae7cdfc65a3c8f955fdd9e02a40ced5cfd6739fc93358b6bc8960edd1f093f21cf84d79ab866c33b4d815ae09f154bac980f1f4652f0b4798f3cb2d9bffa76745769ba49b6d4ea47581fe4718a6912443a489b23819abb40fb4928ac3b38c9720bb6c61ac6f8ee8b54d68ea512fe8739f6da667329617f57dda3a7d19e31478568b004a77253988de900c9d6faf34a848de133a3c7540f41ded57784986f6a0e998c717da1efd8945fd1f43ac2ef7d32ca474ef42f6cb96dc11bee37b669ccbee10ed105427db6a068bd63ba2af8f1e6a4d160f86dda131f65ddb7a489c421c0b479fe226c09276413addc4bcbb4cffc659afee890b9834522393d601d21bcd5960d785fac4062ccbc10787818e1b59e537ef1bc7f721b045eee07a2b5e64cddd32cfb1d4c9d00547c425734a35830aa77f7e283f2a200c0d7245c322e60c7d4526ade115f01e89c1cccf1e0872e9100adab836749a9948e21aa4e02e7d0e9c7f8dc33c386f3a4673aa0f351614186d640693c05d1e3280b79815c62a0096018c07528474fbded51736343a5ccec275d42a5156b5db3b1622c570b4cbf73de9535aeb3d4f9d88fb981f0baf318008fb3c0f1fd909387199399cb426b415df135bd3ec653a9b899d85da6fd2c5f30257ee2ae6d46d89335f0f0f61d083061a24d9e2c1e25c642c47bdb119cd9fc0997fcb864d637e7677a0a7c318f27478f81da46e2956baaec1b86fc5add928f24da5f48fb00286c14ac38f9cfb7c34faba357f760de8ba90c7bbae97f6de322d98475a7a733d14ae20003985b452350122651c81cfaab3e202d35b73f3961ee362899281a4d50fd2f311219f56471cecf384f7d7d61eda3c93ef45bcface21fd53dd73f32c8d709126f7cfd397e026aa073466b27f3e46c951e659cd471eb77fbb60817dfcb8b3804276c8e264d039043607eb6fceedc30380b097200c895b5c1c808ddd0d2357fa5198b02aa9ce63be1729b7a870cb49982127e6a18606569c897f80013a1efb51900677c05789b6d96c58e3ef755ef9a61111ef1cacd07fb8ae6302ec1dfe579d594934152a625395608217939e28817b00bc9ec707c4206c4b25c2195d6b4d86459dc92da82840c4be3bb5e19f042a612b504f66d79e2bc4182483958693c55bc2be1989113f7a744aa48ff95d9afea624623a1649710e8101e8bfcc7058b64c1655f7ef4af5683ab0bce969079f9915ffbed32827d8d63746d9bbe7f29e16fbecd8dd2536262d85ca300f43a4015640976dbbf446e115aab4aeb3e4dbbf6867d65f599e906a05c4fc00862f5e11a9d209044398006c42231440e2a4a642885d4b62cb3c013b0669f99b0d511a45939240c442bf60c0e37b2c7c2f4a68cee97b19d8bffb67b006ed9d1586d385ae1ada27a73dabfab458794f418334462a3934bc34d760d077c7bda102bdee2a6c9be099f26940c55ce35c919d91366da860f3153a5953eebbda007fa6f8ae7e9807d623ca7739006e1c421cad659cb60c8e5ec13b5fb0365ba446e9f2074577e3f8f2a37f6f3257b1ff13f3152bdc5cdb117546cc265308bee9079fa657e8222a077804851aa4c972e8b6dfa54b996c8e60e4d98f5bcfa55bd2906dc54fc8cfac2eddb69a70d3036854c6cd25ab8380b8af7741d0f370477ce3370fd130838f8fa16b3b32d34d35ae4d674d8e822b046ee39ce42aa49ae01d5936a70c17b8c3807e1c4c901fc60a233859466c8e3ade8bd7b9891098da9f866aeaaf932faf89af983b6273a6071a1f30c14d1f93828c392e5d51f08aa17c33b88f813ab151220a2db9e55455e4e92cd4e33d2ee0cb118167ec79491d130f281bfa8548450202b641821afbdcdf594457647f00a833cd7aea97dd9b8acfc3b748899bff9cdafaafb3a06fb0580c81b61352a9ebdf2543cf80513bd8949a95ab465f960ba9ca04de571232e5932d17282a352c61bfb55470b04c15cdb3c2cd0937a6f19586eb9e97f08c3528f5326dd020ebb5f05bd55c9408f09bd02481127ddd9e6a5c1e081d7e5ed4d97ce73de255fde420cf9da0dc46dbb8c032211d429ee8fe2436f889ca9e83e35bb853cb72b6549f0f62f30a56d97c6bf52ab555ec38a8038956af323c35cb6e274505dfbbb5311e9963770a6ef2166e9abb1236711fe32cc2d34ef294350c386195888a0ebe57cccf63df5793aa67781cb090571fef95ce7f4a80fa11a514a8b1bc087dd3f3a34777b592aed1ec315b5bdaf644906031f57a05d32ee1e755113f1b4785831b3097ca1f34e20534e470d4461129834873b55567d90992deb01a44a5185af67808d7fc2841167265d26c4c8c3882e9f229aadc250f3d4e5b46d3178d06b431ea4c535457323cf82cf5b1c795d92c8e121709ddbd35d3b85486ab700b027b331191d0b496387be42ef4a5a0ffcfeffbcb5c9d8a78b7c0cae4bedf3edad7ea902b54c8a36fcf64172a835d72b687f8274446c2655f2bc2b785b6330665fdb9be41fe752835da30ebecac0d3e1ab54c5b9fed41efcae60799105d52a06d0847e5be8730bb44fe536178d2f163052f68a767f4fed8e71ca2d812c6b4093b779b7a5849dc3b0e855e85e85e9db84996a8043ddd52dba6641c5e692793ce01e11163c0227f140d8860681044a602c9bcc3b93baab1d27b7056ec32eecac4292afa55582cb0e43532eb8bf9cb2a6361b8288211738d20422b44ccb4e8ed67286b92c74056a8aa8458ddb838f3246ea25dc96b7974e853f0322cecabcd64621fa15ae2a264c0f5bce279a339a6c28405a59727797128db5e603d5a3b41278b342de718260189fe4a2e0c307b30d4acf19da4f4c7d1465e295b6dfc07b6b88667e9f4c9472ffcb2c0348757bf7652032be710379bdf69d1473df7af4ac08689265898a159830d108c6bc34e74c81d84c28a4be5cebcab66b4cec9f1e45b2da9b6d1a21ffc070461cbf1737b547ebbdebf9164d4225bd333ea41c194515686e2bd28525d355c77b653b0d30e74d7c14fe038533146ed", 0x1000}, {&(0x7f0000001340)="001d957449a63c8a54ca8110077a15b1d3040054ab0a7b55804aeaea26abfb642f43909fa17ce66cde8c1b2559ea43b3f0fc30fe0f43c85e6cfbf2f935d0ae7eb33ac40d4a333fb627e0e59b103f0787d23761d01ba1ab734825a35557ba27cfc675", 0x62}, {&(0x7f00000013c0)="ea689c5f9c0f2f516d501d74d3a32ca78db3c3b616da42d1ddae0e877c68764e4862b3a6ce8f401b259d9066539af1b97e4d5f937706e0510db9e894eddcde6be75e05a71a21c86c93ff0ac32126a3ef61865816", 0x54}, {&(0x7f0000001440)="f60e86c84d36a70d5307f75bac1a763a975f1b3618e5f37442cde330aff8e765bf6c638d8da8f832878420dc7850a5d29884080d1b2cad405e95a0980984f14a774b419d5a49e36bc7782e57281e11b876a92951b561956865acab6cf3fc32760ee0613153ab17c708b446f2f1faa233c761ba80c3b52bef3d5ac67d15e3caf9783490a7cf4e655791de45aa70cfbc157849de37de1b4b09b44cfdfb79e01c904de2bb77debf694f9be0cbd66e9e7dcf063cef5aba526e237eb84b21c4e1ae82bd72b07c6141878b1a0fb61f567d5730ea7b6207eb40b55c9bbdeabf7d114703286e16d0bd53ff67561b9eeeba76196ba146ca9c61372783a1efec049d", 0xfd}, {&(0x7f0000001540)="f148f160481e5d68cb7a96b4402f7a6587f559b4d47db1d8e100f99400a0e24880f58976a414edaa2dc835cc24783f1762712d9715e4686f858ab007ecafeb843c6acc4605ca766ec7e7bcf830abdd755887d8ac60a8beac894b3ab9a20deccd64dd5df71ba646f0950e637c0e12f9397a70ab53a4cf009582e773d856c51dfe06fb4cfb42570782751f18eecf721926702e", 0x92}], 0x6, &(0x7f0000001680)=[{0x28, 0x109, 0x6, "aaf9cbacdf54748f95aff0d751c6fbf1240b63938e7c"}, {0xa0, 0x101, 0x7, "a37b02a11f9d4bf2109f65242aade007086c0025a078913f96cfe26e221b48768d0198fa1542b04d008fda7312a062ad574230f6e9071e241b09028fe7145dcc7125c9159111b98b7b6e098c4ba0acfde60041656633ec4a05f57f3e4dcb1a714b433503e1313cf4002044b49f628fe1fd6e1e86f0ca3e06a6297a28c9432b5891241c5ac185f1c2d4"}, {0x50, 0x111, 0x0, "7590682c6e66d04e40d24c94a9d484df4f25e208b511b381a7e6d41948832d801376dd0f1b89be793e1275f578b8a6defd39fc9d01871aa3c3ec28"}, {0x28, 0x117, 0xfff, "15b82173c0bd9072b1cbe28a5e498bb54838e69c0e5a8d53"}, {0x70, 0x102, 0x2, "ca4ef972ff046d94e73a93a61cc9a1082747c38c5005368365d4c93a2f6a66e2390d77d97f3dfda8f4efdee9d174158cdef2d85eeed7e0cfd8308eb9024d8cd6edf3bcf3fb3afda8d5a8716ebffcd5d8fd85912dd2ae1423d0e380dd09"}], 0x1b0}, 0x800) r1 = open(&(0x7f0000000080)='./bus\x00', 0x4e141, 0x0) r2 = syz_open_dev$swradio(&(0x7f0000000080), 0x0, 0x2) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000240)={0x0, {0x0, 0x80000001}}) ioctl$VIDIOC_S_CTRL(r2, 0xc008561c, 0x0) ioctl$VIDIOC_TRY_EXT_CTRLS(r2, 0xc0185649, 0x0) ioctl$FS_IOC_SETVERSION(r2, 0x40087602, &(0x7f0000000100)=0x4) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) lsetxattr$security_ima(&(0x7f0000000140)='./bus\x00', &(0x7f0000000180), &(0x7f00000001c0)=@sha1={0x1, "333b98e498bb10c64ef65a04c71d40f90e5e54cf"}, 0x15, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r3, 0x0, 0x401ffc000) setxattr$trusted_overlay_redirect(&(0x7f0000000040)='./bus\x00', &(0x7f00000000c0), 0x0, 0x0, 0x1) 17:27:37 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:27:37 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x4, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) 17:27:37 executing program 5: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000380)) r4 = perf_event_open$cgroup(&(0x7f0000000200)={0x0, 0x80, 0xfb, 0x2, 0x7, 0x1, 0x0, 0x7, 0x100, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_config_ext={0x7, 0x3}, 0x1400, 0x6, 0x7, 0x0, 0x2, 0x9, 0x3, 0x0, 0x9911, 0x0, 0x80000000}, 0xffffffffffffffff, 0xd, r0, 0x3) perf_event_open(&(0x7f00000000c0)={0x3, 0x80, 0x48, 0x7, 0xf8, 0x2, 0x0, 0x9, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x8, 0x0, @perf_bp={&(0x7f0000000040), 0xa}, 0x10, 0x2, 0xff, 0x0, 0x0, 0x3ff, 0x7, 0x0, 0x3ff, 0x0, 0x8000}, r3, 0xffffffffffffffff, r4, 0x1) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) sendmmsg(r1, &(0x7f0000000280)=[{{0x0, 0x84, 0x0, 0x0, 0x0, 0x0, 0xf4010000}}], 0x400000000000085, 0x0) [ 1386.856747][T13281] usb 4-1: USB disconnect, device number 2 [ 1386.941316][ T9658] ubi0: detaching mtd0 [ 1387.005010][ T9658] ubi0: mtd0 is detached [ 1387.022307][ T9655] xt_NFQUEUE: number of total queues is 0 17:27:38 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1387.071230][ T9660] xt_NFQUEUE: number of total queues is 0 [ 1387.090938][ T9658] ubi0: attaching mtd0 17:27:38 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1387.124740][ T9658] ubi0: scanning is finished [ 1387.495390][T13281] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 1387.500257][ T9658] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1387.553204][ T9658] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1387.621231][ T9658] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1387.712404][ T9658] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1387.718680][ T9682] xt_NFQUEUE: number of total queues is 0 [ 1387.735259][T13281] usb 4-1: Using ep0 maxpacket: 8 [ 1387.740315][ T9658] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1387.749181][ T9658] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1387.801295][ T9658] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 1204783369 [ 1387.831039][ T9658] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 17:27:39 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:27:39 executing program 2: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1387.873429][ T9680] ubi0: background thread "ubi_bgt0d" started, PID 9680 17:27:39 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x4, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) [ 1388.015633][T13281] usb 4-1: New USB device found, idVendor=08d1, idProduct=0003, bcdDevice=3a.3d [ 1388.033938][T13281] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1388.061435][T13281] usb 4-1: Product: syz [ 1388.084398][T13281] usb 4-1: Manufacturer: syz [ 1388.151339][T13281] usb 4-1: SerialNumber: syz 17:27:39 executing program 2: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1388.221759][T13281] usb 4-1: config 0 descriptor?? [ 1388.230120][ T9701] xt_NFQUEUE: number of total queues is 0 [ 1388.245057][ T9703] xt_NFQUEUE: number of total queues is 0 [ 1388.338792][T13281] hub 4-1:0.0: bad descriptor, ignoring hub [ 1388.346940][ T9707] ubi0: detaching mtd0 [ 1388.374816][T13281] hub: probe of 4-1:0.0 failed with error -5 [ 1388.375671][ T9707] ubi0: mtd0 is detached [ 1388.479664][ T9707] ubi0: attaching mtd0 [ 1388.484839][ T9707] ubi0: scanning is finished [ 1388.611075][ T9712] xt_NFQUEUE: number of total queues is 0 [ 1388.744688][ T9707] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1388.763842][ T9707] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1388.800493][ T9707] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1388.828725][ T9707] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1388.853731][ T9707] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1388.880784][ T9707] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1388.911519][ T9707] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 1204783369 [ 1388.990633][ T9707] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1389.039551][ T9719] ubi0: background thread "ubi_bgt0d" started, PID 9719 [ 1389.665380][T13281] pegasus 4-1:0.0: can't reset MAC [ 1389.670677][T13281] pegasus: probe of 4-1:0.0 failed with error -5 [ 1389.706389][T13281] usb 4-1: USB disconnect, device number 3 [ 1390.395306][T13281] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 1390.645248][T13281] usb 4-1: Using ep0 maxpacket: 8 17:27:42 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:27:42 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:27:42 executing program 2: r0 = openat$null(0xffffffffffffff9c, 0x0, 0xf2181, 0x0) syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x4, &(0x7f00000002c0)=[{&(0x7f0000010000)="200000004000000003000000aa0000000f000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001000000000000000b00000000020000280200000284", 0x62, 0x400}, {&(0x7f0000010400)="02000000030000000400000030000f", 0xf, 0x1000}, {&(0x7f0000010500)="ffff000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff", 0x1002, 0x2000}, {&(0x7f0000012600)="ed41000000100000dbf4655fdcf4655fdcf4655f000000000000040008", 0x1d, 0x4200}], 0x0, &(0x7f0000000300)=ANY=[]) preadv(0xffffffffffffffff, &(0x7f00000004c0)=[{&(0x7f0000000480)=""/2, 0x2}, {&(0x7f0000001580)=""/248, 0xf8}], 0x2, 0x7f, 0x4) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r0, 0xc018937c, &(0x7f0000000040)=ANY=[@ANYBLOB="010000004100000018000000", @ANYRES32=r0, @ANYBLOB="02000000000000002e2f66696c653000"]) r1 = open(&(0x7f0000000080)='./file0\x00', 0x40c5, 0x0) creat(&(0x7f0000000240)='./file0\x00', 0x80) r2 = openat$vsock(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000001700)=ANY=[@ANYBLOB="b3a7c65e453ea87c6b10c1f7c8b365dc578f102d1f704fd973a92939e33792aa433bdeababe4855834b6d5354b96fb94fe43945727c53ca22741ed57b859cfcde97999875d39df639bba69a0f019b589aeb56496958afcabf962a758c656cf7cd6754b44d69bc43fa633b5fa0b10dfcabc7482e7ee9e7e3620190178fb231e87323fae347e86a81cdd6dcf68be5e307110f82db017575fcd6bd1f90f4488242a849a292f10e7a3dcb3b05151a5894fa318a4361592d278ec11743900bcc4e8b8c24f5734b6349e7ef9a25f0ff0ed0a89e6bed86a3100a4e8e235adbdf898e288c8fcf464470fdb79fbe794d7558216a8b4c1bf1dbc0f4df564ea85770d1fcd8910129877fe932fc39a5b5ba689801bdfb8954eb4c8acea3236936fc68cc52c6b79c9fd5b2cf0", @ANYRESHEX, @ANYRESOCT, @ANYRES64, @ANYRESHEX], 0x3}, 0x1, 0x0, 0x0, 0x4}, 0x40025) ioctl$BTRFS_IOC_DEV_INFO(0xffffffffffffffff, 0xd000941e, &(0x7f0000000580)={0x0, "c686705edb1825f718433031b91c7dcb"}) sendmsg$kcm(r2, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r2) sendmsg$AUDIT_MAKE_EQUIV(0xffffffffffffffff, 0x0, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000440)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)=ANY=[@ANYBLOB="03000000", @ANYRES16=r4, @ANYBLOB="020027bd7000090000000100000008001900ac1414300500210001000000"], 0x24}, 0x1, 0x0, 0x0, 0x8000}, 0x800) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xfffffeffffffffff, 0xffffffffffffffff, 0x0) truncate(&(0x7f00000003c0)='./file0\x00', 0x6) write$P9_RFLUSH(r1, &(0x7f0000000400)={0x7}, 0x7) sendfile(r1, r3, 0x0, 0x1d200) 17:27:42 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x4, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) 17:27:42 executing program 5: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000380)) r4 = perf_event_open$cgroup(&(0x7f0000000200)={0x0, 0x80, 0xfb, 0x2, 0x7, 0x1, 0x0, 0x7, 0x100, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_config_ext={0x7, 0x3}, 0x1400, 0x6, 0x7, 0x0, 0x2, 0x9, 0x3, 0x0, 0x9911, 0x0, 0x80000000}, 0xffffffffffffffff, 0xd, r0, 0x3) perf_event_open(&(0x7f00000000c0)={0x3, 0x80, 0x48, 0x7, 0xf8, 0x2, 0x0, 0x9, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x8, 0x0, @perf_bp={&(0x7f0000000040), 0xa}, 0x10, 0x2, 0xff, 0x0, 0x0, 0x3ff, 0x7, 0x0, 0x3ff, 0x0, 0x8000}, r3, 0xffffffffffffffff, r4, 0x1) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) sendmmsg(r1, &(0x7f0000000280)=[{{0x0, 0x85, 0x0, 0x0, 0x0, 0x0, 0xf4010000}}], 0x400000000000085, 0x0) [ 1390.865327][T13281] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 1390.884919][T13281] usb 4-1: can't read configurations, error -71 17:27:42 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1391.024923][ T9749] ubi0: detaching mtd0 [ 1391.050128][ T9745] xt_NFQUEUE: number of total queues is 0 [ 1391.071777][ T26] audit: type=1804 audit(1638034062.289:362): pid=9748 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir075826408/syzkaller.gwvnpm/157/file0" dev="sda1" ino=14256 res=1 errno=0 [ 1391.074872][ T9749] ubi0: mtd0 is detached 17:27:42 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, 0x0) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:27:42 executing program 3: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x98, 0x91, 0xc3, 0x8, 0x8d1, 0x3, 0x3a3d, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x9, 0xb1, 0x16}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000001080)={0x34, &(0x7f0000000dc0)={0x0, 0x0, 0x1, "cf"}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000cc0)={0x2c, &(0x7f0000000a40)={0x0, 0x0, 0x2, ']R'}, 0x0, 0x0, 0x0, 0x0}) r1 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_control_io(r1, &(0x7f00000002c0)={0x2c, &(0x7f0000000100)={0x20, 0xe, 0x86, {0x86, 0xe, "a2d3771bd87c90d6baa424bade3b6e4411928718450269bab5f96b63cf50793c25c5f78ff44a1285e87a2d858aff8f2672fa1a8f80dc6417d7e0d43ff8f3a60c2c15d9b894efd4e7602bcb91f4d6aff343dfcdb81f1dd6afb7d52e4e17cc911b2aedce53b29be95e3f274b8158cf2d11018429dc10479db2aa3ee09cd85517d848a22039"}}, &(0x7f00000001c0)={0x0, 0x3, 0x49, @string={0x49, 0x3, "5e8895794c4ac824778d19532e1d01ca5daa70bd24742781c011cd0599c95bd229a12494a9bc683f8e29838f9c2fb5be04c491b82284d20c003a9284700c6229fd2b0edfcfb167"}}, &(0x7f0000000000)={0x0, 0xf, 0x27, {0x5, 0xf, 0x27, 0x3, [@ss_cap={0xa, 0x10, 0x3, 0x0, 0xd, 0x1, 0x40, 0x25d4}, @generic={0xd, 0x10, 0x4, "ff6317ade1147818f4f3"}, @wireless={0xb, 0x10, 0x1, 0x8, 0x0, 0xf7, 0x51, 0xffff, 0x1f}]}}, &(0x7f0000000240)={0x20, 0x29, 0xf, {0xf, 0x29, 0x3f, 0x8, 0x6, 0x1, "678e2bee", "7461c28c"}}, &(0x7f0000000280)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x4, 0x1e, 0x80, 0x1b, 0x22, 0x1524, 0x20}}}, &(0x7f0000000740)={0x84, &(0x7f0000000300)={0x0, 0x17, 0x56, "e27ec2df365cf5c59e59c0542194dc893052abb61a282f796c06fc82613aba390f965c5a830eed5c55a41fafeb56762429d5cdf97e2bbb122e161896dfa312bb3e2a29c11fd35772613cf85b7f32ee2fa606cbd80439"}, &(0x7f0000000380)={0x0, 0xa, 0x1, 0x6}, &(0x7f00000003c0)={0x0, 0x8, 0x1, 0x9}, &(0x7f0000000400)={0x20, 0x0, 0x4, {0x3, 0x1}}, &(0x7f0000000440)={0x20, 0x0, 0x4, {0x1000, 0x6c}}, &(0x7f0000000480)={0x40, 0x7, 0x2, 0x9ca}, &(0x7f00000004c0)={0x40, 0x9, 0x1, 0x40}, &(0x7f0000000500)={0x40, 0xb, 0x2, "e3c1"}, &(0x7f0000000540)={0x40, 0xf, 0x2, 0x5}, &(0x7f0000000580)={0x40, 0x13, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1f}}, &(0x7f00000005c0)={0x40, 0x17, 0x6, @remote}, &(0x7f0000000600)={0x40, 0x19, 0x2, "d8e5"}, &(0x7f0000000640)={0x40, 0x1a, 0x2, 0x1}, &(0x7f0000000680)={0x40, 0x1c, 0x1, 0x24}, &(0x7f00000006c0)={0x40, 0x1e, 0x1}, &(0x7f0000000700)={0x40, 0x21, 0x1, 0x24}}) r2 = syz_usb_connect(0x0, 0x24, &(0x7f0000000840)={{0x12, 0x1, 0x0, 0x85, 0x37, 0x4, 0x8, 0x61d, 0xc020, 0x715, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xa3, 0xd9, 0x12}}]}}]}}, 0x0) syz_usb_control_io(r2, 0x0, &(0x7f0000001280)={0x84, &(0x7f0000000000)={0x0, 0x0, 0x3, "4e8ef6"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io(r2, &(0x7f0000000a80)={0x2c, &(0x7f0000000800)={0x0, 0x4, 0xee, {0xee, 0x11, "38efd4dffa3014bb03cbfd24fbaac929493e743df769d751dd33d64ab0afaf2888b5424cbdcc5ba26a6bfe6dd01a50a139541caab5ad2058f71d8516ebbcc8872eea8d99a2defabad544458b64078c6b34fa4abfa2b956c923ba702d74cc5ddbc24dbc7b919d101fe5a8798f0330614b00faa8501884e6ea4612c2295e56cde3e6187179163e253d53008655e32d6aef2b5ffbc66d3373ac0df7f97d984e292bdeed613726a6f61d00472d9f48db39be58646e5d79af41a9a93ecae9370974250f64ec43d9ae711137f0191a131d3b8b21dabe2776ae0817590adee337598de3070a6cbb7bfc834fec967fda"}}, &(0x7f0000000900)={0x0, 0x3, 0x68, @string={0x68, 0x3, "9abc27a8049ef0c71fdb3b8e7c7ad6720aa9caa43c919a58789ead70f9d6cc07ca18c2802019f3532f7347aea631bd721099d7ab0a72323aa2992bbfeb3241cfca478bcf44c00b40da3001182b4d43225083b5d079be35a6583ae6bcc3b109c741c4f570aeb7"}}, &(0x7f0000001000)=ANY=[@ANYBLOB="0048c913d97a7934ec004d1de56a93204cb3926b53ce1498772fc164"], &(0x7f00000009c0)={0x20, 0x29, 0xf, {0xf, 0x29, 0xff, 0x60, 0x1, 0x6, "aedd0539", "58bb2131"}}, &(0x7f0000000a00)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x6, 0x3, 0x40, 0x30, 0x41, 0x8, 0x400}}}, &(0x7f0000000f40)={0x84, &(0x7f0000000ac0)={0x0, 0x13, 0x31, "2dd961f8078191ab816a404664bc6dc371b72a7c96fc1f0b68f43fb4813ca53370df7bf292f2587c5379e1bcab8fa3d61e"}, &(0x7f0000000b00)={0x0, 0xa, 0x1, 0x1f}, &(0x7f0000000b40)={0x0, 0x8, 0x1}, &(0x7f0000000b80)={0x20, 0x0, 0x4, {0x3, 0x1}}, &(0x7f0000000bc0)={0x20, 0x0, 0x8, {0xc0, 0x40, [0xf0]}}, &(0x7f0000000c00)={0x40, 0x7, 0x2, 0x800}, &(0x7f0000000c40)={0x40, 0x9, 0x1, 0x8}, &(0x7f0000000c80)={0x40, 0xb, 0x2, "8635"}, &(0x7f0000000d00)={0x40, 0xf, 0x2, 0x2}, &(0x7f0000000d40)={0x40, 0x13, 0x6, @multicast}, &(0x7f0000000d80)={0x40, 0x17, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, &(0x7f0000000e00)={0x40, 0x19, 0x2, "d2ef"}, &(0x7f0000000e40)={0x40, 0x1a, 0x2, 0x3}, &(0x7f0000000e80)={0x40, 0x1c, 0x1}, &(0x7f0000000ec0)={0x40, 0x1e, 0x1, 0xff}, &(0x7f0000000f00)={0x40, 0x21, 0x1, 0xe1}}) syz_usb_connect$hid(0x6, 0x3f, &(0x7f0000000980)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0xff, 0x810, 0x1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x6, 0x80, 0x1, [{{0x9, 0x4, 0x0, 0x8, 0x2, 0x3, 0x1, 0x1, 0x7, {0x9, 0x21, 0x0, 0x7f, 0x1, {0x22, 0x165}}, {{{0x9, 0x5, 0x81, 0x3, 0x200, 0x2, 0xfc}}, [{{0x9, 0x5, 0x2, 0x3, 0x20, 0x20, 0x7, 0x3}}]}}}]}}]}}, &(0x7f0000001580)={0xa, &(0x7f0000001040)={0xa, 0x6, 0x201, 0x0, 0x4, 0x9, 0x10, 0x9}, 0x17, &(0x7f00000010c0)={0x5, 0xf, 0x17, 0x2, [@wireless={0xb, 0x10, 0x1, 0xc, 0x4, 0x81, 0x1, 0x101, 0xff}, @ext_cap={0x7, 0x10, 0x2, 0x0, 0x6, 0x1, 0xcda}]}, 0x8, [{0x81, &(0x7f0000001100)=@string={0x81, 0x3, "08b3105ea1df3f77bdea79771d6babc8ba13b6bd159e937eed35047f8d00cbb8ff8cabaa213a265ce69d5821b7877f3c2cf877cac28d41a2cd55d591b9cf8c3032c107c9502d9ef82b660e5dbca5aa6ad31bdfe3b8d38b56f07cdd0deb629b3a92297f5ef126a04dab567af5f4d96273fc72d515980793cb046ce762c6e7da"}}, {0xa, &(0x7f00000011c0)=@string={0xa, 0x3, "30ae0178fe23e01c"}}, {0x3e, &(0x7f0000001200)=@string={0x3e, 0x3, "da2a6905df87404745e0a4eb02bb58936a7fa07090992f3ac62dba5bd46a344bc4caac2def940406b6df73d1ac525cea6b477c8dd78db74e375eb45b"}}, {0x4, &(0x7f0000001240)=@lang_id={0x4, 0x3, 0x801}}, {0xce, &(0x7f0000001340)=@string={0xce, 0x3, "b1ce68ba03609e01e434fa45d4cd2228edea7bb02ba9830a9fc94636759500ecbf2f870f23b20feba20cf0194f060dab21c341828e2f6c413add2b0df027140d47a6b3b2ea8be09cefe1acd3eaea53a24bc02404aab1c4f68c3d9ed7fc782af8c3da8e8107702be0ad27c8d81986d639efef4115fe97d07628cee2c5efd49758fe5bd5d3d8c8eead87b886730304871ec1444af1a663925d9eb17a75c442cc6474cbf4d627ece20b681164ea99052e9066af69f23ded525ad8dd8967f2efa81cbc8b9f670e71dfac164d1e9c"}}, {0x4, &(0x7f0000001440)=@lang_id={0x4, 0x3, 0x419}}, {0xa1, &(0x7f0000001480)=@string={0xa1, 0x3, "df9e5767a2e8021abe1d17129dae2ed894ab8b10023b7bce1acb4a1ce2fd0f6fb467eed7b637058ec174811ce6b8e4753450fa07d27e8a683a95bf8c901563eb88efda23219fbda32ce8e4d499efe35e4bb5418e408bc51a7925009054e68d0988daa2464ec54aa9b566ff002535898dbf1987d918b88bc5a3e5f573b445ecdc5d9682c3c1ec9a0ef449976dd7176f1e26bc1da25907edc1e3ea060a0e2769"}}, {0x4, &(0x7f0000001540)=@lang_id={0x4, 0x3, 0xa8d4}}]}) [ 1391.246730][ T26] audit: type=1804 audit(1638034062.429:363): pid=9755 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir075826408/syzkaller.gwvnpm/157/file0" dev="sda1" ino=14256 res=1 errno=0 17:27:42 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1391.300923][ T9753] ubi0: attaching mtd0 [ 1391.401975][ T9753] ubi0: scanning is finished 17:27:42 executing program 2: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000380)) r4 = perf_event_open$cgroup(&(0x7f0000000200)={0x0, 0x80, 0xfb, 0x2, 0x7, 0x1, 0x0, 0x7, 0x100, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_config_ext={0x7, 0x3}, 0x1400, 0x6, 0x7, 0x0, 0x2, 0x9, 0x3, 0x0, 0x9911, 0x0, 0x80000000}, 0xffffffffffffffff, 0xd, r0, 0x3) perf_event_open(&(0x7f00000000c0)={0x3, 0x80, 0x48, 0x7, 0xf8, 0x2, 0x0, 0x9, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x8, 0x0, @perf_bp={&(0x7f0000000040), 0xa}, 0x10, 0x2, 0xff, 0x0, 0x0, 0x3ff, 0x7, 0x0, 0x3ff, 0x0, 0x8000}, r3, 0xffffffffffffffff, r4, 0x1) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) sendmmsg(r1, &(0x7f0000000280)=[{{0x0, 0x84, 0x0, 0x0, 0x0, 0x0, 0xf4010000}}], 0x400000000000085, 0x0) [ 1391.549407][ T9765] xt_NFQUEUE: number of total queues is 0 17:27:42 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, 0x0) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1391.839692][ T9753] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 1391.848041][T13281] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 1391.886011][ T9779] xt_NFQUEUE: number of total queues is 0 17:27:43 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, 0x0) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:27:43 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x4, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) [ 1391.982557][ T9781] xt_NFQUEUE: number of total queues is 0 [ 1392.105292][T13281] usb 4-1: Using ep0 maxpacket: 8 17:27:43 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x4, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) [ 1392.289010][ T9792] xt_NFQUEUE: number of total queues is 0 17:27:43 executing program 5: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000380)) r4 = perf_event_open$cgroup(&(0x7f0000000200)={0x0, 0x80, 0xfb, 0x2, 0x7, 0x1, 0x0, 0x7, 0x100, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_config_ext={0x7, 0x3}, 0x1400, 0x6, 0x7, 0x0, 0x2, 0x9, 0x3, 0x0, 0x9911, 0x0, 0x80000000}, 0xffffffffffffffff, 0xd, r0, 0x3) perf_event_open(&(0x7f00000000c0)={0x3, 0x80, 0x48, 0x7, 0xf8, 0x2, 0x0, 0x9, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x8, 0x0, @perf_bp={&(0x7f0000000040), 0xa}, 0x10, 0x2, 0xff, 0x0, 0x0, 0x3ff, 0x7, 0x0, 0x3ff, 0x0, 0x8000}, r3, 0xffffffffffffffff, r4, 0x1) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) sendmmsg(r1, &(0x7f0000000280)=[{{0x0, 0x7, 0x0, 0x2, 0x0, 0x0, 0xf4010000}}], 0x400000000000085, 0x0) [ 1392.415593][T13281] usb 4-1: New USB device found, idVendor=08d1, idProduct=0003, bcdDevice=3a.3d [ 1392.451618][T13281] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1392.498214][ T9796] ubi0: attaching mtd0 [ 1392.513871][T13281] usb 4-1: Product: syz 17:27:43 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1392.546161][T13281] usb 4-1: Manufacturer: syz [ 1392.564834][T13281] usb 4-1: SerialNumber: syz [ 1392.601850][ T9796] ubi0: scanning is finished [ 1392.608341][T13281] usb 4-1: config 0 descriptor?? [ 1392.646421][T13281] hub 4-1:0.0: bad descriptor, ignoring hub [ 1392.652373][T13281] hub: probe of 4-1:0.0 failed with error -5 [ 1392.881635][ T9796] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1392.890993][ T9796] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1392.891776][ T9807] xt_NFQUEUE: number of total queues is 0 [ 1392.907600][ T9796] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1392.915818][ T9796] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1392.924177][ T9796] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 17:27:44 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1392.932544][ T9796] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1392.943621][ T9796] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 1204783369 [ 1392.960131][ T9796] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1392.972177][ T9811] ubi0: background thread "ubi_bgt0d" started, PID 9811 17:27:44 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x4, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) 17:27:44 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1393.159221][ T9813] xt_NFQUEUE: number of total queues is 0 [ 1393.192736][ T9819] ubi0: detaching mtd0 [ 1393.228116][ T9819] ubi0: mtd0 is detached [ 1393.297150][ T9823] xt_NFQUEUE: number of total queues is 0 [ 1393.905970][ T9764] UDC core: couldn't find an available UDC or it's busy: -16 [ 1393.913380][ T9764] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 1393.924295][ T9764] UDC core: couldn't find an available UDC or it's busy: -16 [ 1393.931876][ T9764] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 1393.975139][T13281] pegasus 4-1:0.0: can't reset MAC [ 1393.980388][T13281] pegasus: probe of 4-1:0.0 failed with error -5 [ 1394.025812][T13281] usb 4-1: USB disconnect, device number 5 [ 1394.724842][T24088] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 1394.964858][T24088] usb 4-1: Using ep0 maxpacket: 8 17:27:46 executing program 3: ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000040)={0xffffffffffffffff, 0x8, 0x6, 0x16a}) ioctl$TIOCL_PASTESEL(r0, 0x541c, &(0x7f00000008c0)) r1 = syz_usb_connect(0x0, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="120100009891c308af0803003d3a01020301090212000100000000090400000009b116004cde44b4a527a2e2e97bcc5e6c3e024c1e7b91d5c1e999571f44643948ef917fb5cbdb1b6920eac193e314563545eac21267b5eea24e5efdc04b7edfe1d90500e0c9654ff7eac416038871ab4a811b9441500e9f93b9798bb3d9ece7920ca2010a2b5d001af544d5c98cf97ed0c0481830b24816ea499fdcd23d8f5641f9cc170ba9e2f86757499c9e3cd83805603499777196977e5e4b154a64a042102ec27fe2cc909588f5aeee3973fea72ab104f504c834a4beb3506369b1fa8be528cfb9996aa65499"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r1, &(0x7f0000000bc0)={0x2c, &(0x7f0000000900)={0x40, 0x23, 0xa0, {0xa0, 0x22, "2e05028d7c2489becbff64352f95b3426fe0052da1b6ccbaa831f97d8f71bab1341f479ad67fdf74d15563f1a0eda3b7403229ed216c3c02ccf9f535f54e04936e7868c61133a4c003c5ccb364372e4bdf805ce7d3c8a4b4fa810fee8f3d0c054e6edaab24151035fd85790b0061af0f78c5592d52b0ed0300cf7b95413056c9c94be590597d89c37f5304c64c846141cf425dbd214be60565bb47f254b9"}}, &(0x7f00000009c0)={0x0, 0x3, 0x80, @string={0x80, 0x3, "4d053276cc40127f58bd1630187170383d96ffec66753a21f5a17e28ba42660e035f327b25da3aef23d198df2be1b1858e1dcf4efebfbfbe74b6c6fa333bf1496b72eba5e4b8af628766496afa66dab220d774077982296ee103b0992aeb3aee9f9d3fb962cbf1dca27fb02dc7479f622316ebcff967267d1b387dc5b13d"}}, &(0x7f0000000a80)={0x0, 0xf, 0x8c, {0x5, 0xf, 0x8c, 0x4, [@wireless={0xb, 0x10, 0x1, 0x4, 0x20, 0x0, 0x7f, 0xfffd, 0x1}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0xa, 0x12, 0x40, 0x7f}, @wireless={0xb, 0x10, 0x1, 0x4, 0x8, 0x6, 0x2}, @generic={0x67, 0x10, 0x3, "55b9ef72c9f33ef0a248a92dbf96595d5328ce4bee8a6387e9b37a8cdfd8b58c3713044f016be06c3566c8c2a3ef073da129412d749c93e0bc11f041f986af2f9faf8c256a957e51654999a708d0763e8b07d3a2466c6d361b0319b6e6c2b746bf95573d"}]}}, &(0x7f0000000b40)={0x20, 0x29, 0xf, {0xf, 0x29, 0x8, 0x0, 0x5, 0x4, "ddf90e04", "78d0ae27"}}, &(0x7f0000000b80)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x3, 0x10, 0x5, 0x4, 0x3f, 0x3, 0x8}}}, &(0x7f0000001140)={0x84, &(0x7f0000000c00)={0x60, 0xa, 0x9d, "8a23141961af5681367e0385ab3b46132844863b6afc912fc1c73e894584207d13ff555bf777b9afd04b836aed9b890989908b1d6b8e51b6da8f503e4dd36a42979170b1228d491c189c3174098e87997935c54dbd1c0b5417904eaf256717f8d15f1bb0703ef23b1a6119f481af26b9af6769106160a77d6987b823f3de3f78e5baa44074e7b9ff3d3a26a34d2dd64ca359826b1d93aa73b3306e2a21"}, &(0x7f0000000d00)={0x0, 0xa, 0x1, 0x1}, &(0x7f0000000d40)={0x0, 0x8, 0x1, 0x9}, &(0x7f0000000d80)={0x20, 0x0, 0x4, {0x1, 0x3}}, &(0x7f0000000e00)={0x20, 0x0, 0x4, {0x20, 0x10}}, &(0x7f0000000e40)={0x40, 0x7, 0x2, 0x5}, &(0x7f0000000e80)={0x40, 0x9, 0x1, 0xad}, &(0x7f0000000ec0)={0x40, 0xb, 0x2, '1L'}, &(0x7f0000000f00)={0x40, 0xf, 0x2, 0x3f}, &(0x7f0000000f40)={0x40, 0x13, 0x6, @remote}, &(0x7f0000000f80)={0x40, 0x17, 0x6, @local}, &(0x7f0000000fc0)={0x40, 0x19, 0x2, "49ea"}, &(0x7f0000001000)={0x40, 0x1a, 0x2, 0x401}, &(0x7f0000001040)={0x40, 0x1c, 0x1, 0x88}, &(0x7f00000010c0)={0x40, 0x1e, 0x1, 0x8}, &(0x7f0000001100)={0x40, 0x21, 0x1, 0x1}}) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$printer(r1, 0x0, &(0x7f0000001080)={0x34, &(0x7f0000000dc0)={0x0, 0x0, 0x1, "cf"}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000cc0)={0x2c, &(0x7f0000000000)={0x20, 0x0, 0x6, "0000dfdc2778"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, &(0x7f0000000240)={0x2c, &(0x7f0000000080)={0x20, 0x0, 0xb7, {0xb7, 0x5, "49081db558c88950c615970c067710a2d40780a0a90acf47d286b2ade3cad7a5795d4ffa0765397d8ce5559d016476b7970e7a640cb105caaf8076637792d1bc7ef36e7a94b138ecddf2169e2f6e5918a90f7feebb2f1fca21300574610138e9f4f3211ed3265202f8edc5b35c5a137e3c89b753e3eda52776724db07614e3edc09291c8978f0fc3fcdfc44799809a7abeef025418ef07d9801272152ec03754a24f3be23d4384a4063beb5d4ccebc837db655471d"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x413}}, &(0x7f0000000180)={0x0, 0xf, 0xf, {0x5, 0xf, 0xf, 0x1, [@ss_cap={0xa, 0x10, 0x3, 0x0, 0x1, 0x0, 0x5, 0x5}]}}, &(0x7f00000001c0)={0x20, 0x29, 0xf, {0xf, 0x29, 0x8, 0x80, 0x4b, 0x4, "ba914046", "96ae2cea"}}, &(0x7f0000000200)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0xc0, 0x10, 0x59, 0x2, 0x6, 0x8, 0x7f}}}, &(0x7f0000000700)={0x84, &(0x7f0000000280)={0x20, 0x0, 0x7b, "82f0a5ead01d327e56e6b6edf70d563a1784bcab734422cde52c17a5300585841beab26bee4ab15bd65a106397ccf70af504b44c5e46eec33520822a37fd39956b4de7717171ec50e2cad856d9b51477790aab6c41d048cf37918ad26d55e0bd36ffdec5daff6bdd9bb5b26755323bace0b35e367ddee62fff7e43"}, &(0x7f0000000340)={0x0, 0xa, 0x1, 0x81}, &(0x7f0000000380)={0x0, 0x8, 0x1, 0x7}, &(0x7f00000003c0)={0x20, 0x0, 0x4}, &(0x7f0000000400)={0x20, 0x0, 0x4, {0x140, 0x8}}, &(0x7f0000000440)={0x40, 0x7, 0x2, 0x400}, &(0x7f0000000480)={0x40, 0x9, 0x1, 0x2}, &(0x7f00000004c0)={0x40, 0xb, 0x2, 'M/'}, &(0x7f0000000500)={0x40, 0xf, 0x2, 0x2}, &(0x7f0000000540)={0x40, 0x13, 0x6, @remote}, &(0x7f0000000580)={0x40, 0x17, 0x6, @multicast}, &(0x7f00000005c0)={0x40, 0x19, 0x2, "e129"}, &(0x7f0000000600)={0x40, 0x1a, 0x2, 0xaae}, &(0x7f0000000640)={0x40, 0x1c, 0x1, 0x20}, &(0x7f0000000680)={0x40, 0x1e, 0x1, 0x8}, &(0x7f00000006c0)={0x40, 0x21, 0x1, 0xf8}}) 17:27:46 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1395.245163][T24088] usb 4-1: New USB device found, idVendor=08d1, idProduct=0003, bcdDevice=3a.3d [ 1395.254391][T24088] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1395.263391][T24088] usb 4-1: Product: syz [ 1395.268094][T24088] usb 4-1: Manufacturer: syz [ 1395.272806][T24088] usb 4-1: SerialNumber: syz [ 1395.280340][T24088] usb 4-1: config 0 descriptor?? 17:27:46 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:27:46 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x4, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) 17:27:46 executing program 5: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000380)) r4 = perf_event_open$cgroup(&(0x7f0000000200)={0x0, 0x80, 0xfb, 0x2, 0x7, 0x1, 0x0, 0x7, 0x100, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_config_ext={0x7, 0x3}, 0x1400, 0x6, 0x7, 0x0, 0x2, 0x9, 0x3, 0x0, 0x9911, 0x0, 0x80000000}, 0xffffffffffffffff, 0xd, r0, 0x3) perf_event_open(&(0x7f00000000c0)={0x3, 0x80, 0x48, 0x7, 0xf8, 0x2, 0x0, 0x9, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x8, 0x0, @perf_bp={&(0x7f0000000040), 0xa}, 0x10, 0x2, 0xff, 0x0, 0x0, 0x3ff, 0x7, 0x0, 0x3ff, 0x0, 0x8000}, r3, 0xffffffffffffffff, r4, 0x1) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) sendmmsg(r1, &(0x7f0000000280)=[{{0x0, 0x7, 0x0, 0x3, 0x0, 0x0, 0xf4010000}}], 0x400000000000085, 0x0) 17:27:46 executing program 2: mkdir(&(0x7f0000000400)='./file0\x00', 0x80) openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000005180)={0x78, 0xfffffffffffffff5, 0x0, {0x4, 0xc940, 0x0, {0x5, 0x9, 0x7f, 0x8, 0x0, 0x99, 0x2, 0x7f, 0x23c, 0x8000, 0x100000, 0x0, 0x0, 0xa8, 0x30a1b538}}}, 0x78) openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/locks\x00', 0x0, 0x0) syz_fuse_handle_req(r0, &(0x7f0000008600)="e0cfd9a2aaf45b57cf3847f53112a10ce1ee9b5bd41a1a5b13df3389305a72e8de3c617cb3123a328317a469969e3edcf5887b6129f7ee9ffe0c210992f42074d7f924e527709772b2b81667c679c07e1faecfbc9eef4f8ae45d024cabc45d27221491a90bd3bce3f537785aa8c95a82f3691d3d46913b7b77299e6a0ac9d6475db49f0aea465bfa646b261a4a01e0ad8264c131c3e67d72223b6ffc29c6d5cc41914d6279914f5ade48295bf03f4c01b3fe6a41032a9e0b0bde139b6a7b9875f792c7ce69c43c64aac4a9a7e975cd1674ba0bcfe1619dd2cdc766939cf01f499f2b578e6e06fd3aadc3f499ca72ff4792cc00c268b0bd12bb0d251df942a44ca83a3a0d4740112a9100169c36f4f07d5ef00a30fed5bd463ee257bb9e6668603c08559223d020e529a59e5c81d10d1b9966496436c77092187ae10a089d638537a99f6c35c269cc8ca165869ea42ec72b756270152cf7659248feba8bea2c3dc3a8fb35a8755c0a957372067d029e337efcb428bf4d4b55b07982873072214f6605708610da86907704ae4e9720aea318ec46bde83ae20e6fd684bed615a0af93de0589ffd95fb6e0b4107bc4655d0e0a9efb6b05f72466d60c94c3a911b961029fa5e2e9f76feb852d2b4cf1b0b56eafcaa985855991e860cbab8d28846beef2c621b22bce57674dffec6217c3e95429d4c4d579a0c63c265dbae00d67cad0bcea3afd6c84bbbf03acb80f1d92802968a28e3894e374ad62ce69e0a5cb9b4e1ab5cbc327de4a70aae1d0edca16890d442a30065a916578ea8350eeea17b95ac012941d5f0160d5f1a9d447074c15412202aba231ea4102d061f76a883ae80f9704170c657084c69ed93d2fcc2df60e2b5f03d04fc2d070e9c9fda361efea7c6fe079673bf980cf6c54e218256f4e17d7e166997dff7a859c990d4143b795869c3dd26e2d7fac94c7863d4b389793c05d639aa3784f634314e300bc40218c80229b48073fc2db1a9d4f673d8c0393adca1fdcec732573e61423983516c8f713224ed593cce153f55486e6f68e0931ee53b3f7e598a84179a3bdfc1529ed902ae676363d66c9fba48450b9aa2059687ecf262b3d280b90c79e1748238ab60878bc3071f8fcd0481f720c75535573e210082684ad24c5b0173811756cdde96028389cb89e0d58cc123bde1d1b60e95e4b26c1d5fdce1c141be217c6cd8aab98bd7b5c0ff2e24315d303e6fe2e5f78b746ffa13416e223b7c3a9f694db96348e331681f126a06fa8fa1688257f746f0b84e2b945b02fab8c99494e5feab688f486c0774e9c5ce7cb0626021fabe6717fc0fbffaee79b24e53edcc540c93565d4566858994319d559f9b786ea7ebede550b7cd7c407548a178b9420d697afae52fab23aa5edc6fab5eaebc3713056c56b0f00690cbdceaef0c2ccd845bd0b2fb8c5cc583cf7bef75f212db439c07b86fc9ac9e1e23c358b30d1b1191462bcdabb6b1d7409153497f615f5ca633ad34024b74365b5f7518eb9a8eb1d999ed8c162d4d62ad8af7c7b2dfe1724738d30c63e89fcfd71323ed394f370f5bf2b822bba1b3561bf428189dc18c79a27e4600bd501600995a3d657f077a16dc7a4fafbc7d2fbcb645cf42c9462a479e35ff11f41d35d47884cb805e7937d677610962ec9cc9777d6a4b18f807e421d956636cbc916886c1980879dea9c681e6da7e6ce8116c5130c13581fea841719f50df72c7400b66b29e806ea4643c2b5294b6ea95ac5ecf63eff01d45a84e07638fb06fdc52adc19d423ed407f5283f805b4e7eb4b084cd2d8393d7a43b74909237e549fef152967fcb547223b73052e7079e207061f3612e821fe10a6ce201856a0664f87868bfa607c3aa87e0a388dff7a02ca53470618f982d8a4840d2ed11428a70aafb588ce0f7058bdf5d0bb133a9c7bc0f124ff333ad8fb3977184329a0e085eba98941619ee74d12517a2f10bdb29a68839131d20292731e76638316c11c18dc0bcff880798921a543cc731ae6c04951487a6f16e595a4841823729b82d6faf579f08d6d74a5c1c6aa639509eb2012cf894573975ffcc39c70ed83674ccc209e1580b7f929ee370fe2947aacf58c42855f8b82a791c958afe45ccbe7349ebb792e3d7e31a66dab8d6da3d23f61ee84fb8386a12bb5300bb947a654a2a4eb2667ac4707fab9735e23b81f7d8ad259e329f6576ec2ab158ba11bf3faefac2f57381383f6fa1a3cac159b3aeef6af054fb84a3ac130e82777f09269ceaabd563f6ed953b112d6c731c86750e6748f205760d07c0ec5c6ce68b8df2385f5d4b523785abb05e26f70642b0b2831588b5cba4057c7fe4a76d37e43274644934a90f2bf20c7f7e7ca53202dc762801db599de7ab0e1fad130f5054fa45af0e6a7178787da4477e14823683878881931c60501b410af514caff62f9dde72fdbced4b2be7d0ea4f093b3554b413115b4a0c46c7e771104c1c561e1acb71870e5d0be6ab8459bdd20af44acf404262c442f7cbcd8445c5b455d658fc2c0bb0c168a697ba4d110cf2baab3ccdf555b0c4c24a8bbaa77d715a140e119249a8d0397298c985582aacc297abb100d1e5dda8233b1ad9b2fdff7935f91b11069a7cb026f2b60214e326539554d568f6431562d35fa5428a762626894c14417580b05909f2e3bf4675f9e30b7a0df0a42be451f56eb6bd2a9790cdee036d810afa2b4087f8f1ac42c7e2c15fc7b17bfd4e60d3440d4c5a460626e0f069a2f7a43af53495455da48d2f38af0a4289b2fa205f6e2b8323d778acda77b2b9445de050bcb1b9124cf1aa3d5210f033fc0880170d82ba6f88b3af7802bd519baf54ca1797281c672423d2b76a91c5a577c45e97e4a1f41e5538f3ffc8d3b7a098cee763b4fd4618f1c04675d23229fa971ea78fa1b9ac88b867449385a351b76ed83de3d817108f6b29cf28356a8402452175dd227d2efeda4fe5e3ac5354610361e42eb0c4ddc2f69407f07b311fa2a5a97faa6cbb111576b1869b845208c55f8eaf9c98b807bf850ceed27e20dffcaa38fa95fd3b2c62d60db59ee4bc8f2005af0b9725d3fe25c6eed0ad8e8be72ab0831c44e822f08d47aaf67c8812aa863ea10e661d0a919b4dbb3499b739b6b89b6b5ef5206ac3b59dbd75093efd75d8aa41911da55542e0a69b3233b1bde7231d70690882143d16cc8c48723b9d87c4b24030c65ca0cd4a6147d3766fe987a4bbdc1b2d98b5ddb6459ed3b4b13bc1baabc768b988cb490ba5dc133877aa1bdb08d147707de6c44b1aa5d1f6c61fe1202934fc1a8c5ea7f7b49f372fe28edf870b23ec4f3e23245756529be07452c0a31d1192fdeb808915aa5ea8a2b5b6489e3043a346f2f2bca88f7bd9cda4d107779fd1b52f6bd562a9cfc4c3928e3ffd459255e45f605a0392792d8a5f2c922ef18ff3e0cbce6fd3f5e82e3761607c674120d794e83f490e19fe78ecd027c384033cb61d99f40f14a78f5c8d1dcf1d6780ee35e524c9f06a37ddd8315abf4085cbfa10eb0f4e2a5ca774e3336eed497883c84e6d756f9ac3f99dd033c2019fc054a4286a94490a0c2fc20f532a339a643840af8e909aa0ae1aa4a74efa5660532a9b601711612dfa3b5bd2ce0c63bc7d4a6da5e7c828b34f6de31d88edb02a646039e922032237f8103cc5e32307b752de28aa4c0a9d46cd30ab631839ec332a8edbd63a84775b8a487a290a05713af738677ca8779fe09ede4d9e5e71756d56e06d18a75843390bae68d6f0ac00cecb9f96476056e9185e1b1013574936dff66c1dd038bd7771e96ebc4855bfcab195741204d00349fd6ead44ce11e3b5b5dd6aa2050644ad1d0c05ad06686802476629acbb618a5406248a5916f8126fd8e2c70f9dd27ddcd0afef43ccaab07a9f3d2f03f4a5e84a7a8d33b42a82172b7c6a7e32d4e692496ec08ae86e7ec14de9ca71d8c16c53b73a9754d9b98bdc3dde21a3da4e16ab9a2b3cfbd5d84106340d18ee95fa55387b24e397f8d0dc0c0ad994288cfec38c1d6a93f60815513aaa974d82d0a2f2a4175f4dc59d84371fc18e7b051e5870a9aa6a912f787fda882374d8e66af603d3395512d0e74edebc4032f5a200cf363143e9eb43bb60d7d51b91485fb2b488243e0884255439ccb7cbe2eef5d39261edb5910f12bb48433ad81566028f0a1f77e09bc940c05728ca118b54b285a402bc83d212180ced70c79afd540dae464bf93769c59c8087d40d390abf06fb61ebcd5fb7b0f34f1ca986516d1d741cf3fd33d8e063281dcd2cd742a990cc23e4c074571e707661eb8be39492bd8b56c6bc26dc5888bf02d43fa585d2ec0628f55a6162cbe127b167d75bf9a45e0fd8bf73df9c056219d307330147b9d912ff800aa462d8cb577b2c3ec955835c5d77f9743327e16431c63cd852da6becf2aa3b363bae248e10d4f1af6aba25c6bcb4ace90a4a598436d6c67931e8769e74468107650134906da3b55b4178be7d6248e7975ee49256cf61434e87ff7ff28148d4b7aa5b3618c1ea375dd36e1ec0179f209cfe3382c1bb75d382306d02a342d8ca8f97d36be3436acb5c990509c4bb2f2e1ca19c22b05fb76a5ee634f0dec125559e8f3242172d727133d4dc04a9554e5bb8d4e5bed2c107a666df6648d93b4455b075a4c14e1f71738df688d71da3d1f4e70971c6cbb54473cf419871fd60905c0b6943e95d36c56b3d41edecfc99c18980af6886563a3daa7a4733db6b6dadaa3d50af4bf4a6e57db7ada184e9dd07a569551ff00b8081fe446a46bf018e315e8cbea2e76b4ca045fd263ca5ddc4b3168eee76467968ca60cdec49dbc9a10bca5884368654590f18cdad3e0065346e9cb98389e4cc893d7fc2651b0de709610c73b4c978885fe4b37ef91f4d02c3233b78cf0aa9fcb64621571e62ea23de6f10ca4769c5b13a3a505ba5a446e80e38dc9ec9ece53bca9248879dccfaacc48a655f5f8a88666bc08e407a787c509076ae79dc97b7686b673f29ffb7cafa7de7af486d66f5d08d094ae03ef5cd4b694664cd91106e020f77993d9f82dc8aa348d3b06bdc84ded8a2b43a693eec7eaca6dc5543d30885debd9979764cacf3f7faad56e066187aa557e630ccb450508861abdd1530137412741155fa5732510cc1c71ac1738f666d6c0de1d8fd044b5755ee8468162aa66d21e0eb83f828ab05ba0e77f0b9576d2bd0a1bbc690a7eba1607ea9f48999a02861421a1467181265b478411c5b553c48b57c4917e8776a5f03d53f9b952daa4f9bbd0658650c3facfe5a7727f398b9d1a7f58c114429a6d88b581b14a0edfb8801b481441c43ba2f8f40419ffd7d52de80ed8a005c4a5cf5ac21c343f2e058c7af0e163ffa6afd99642e59d513b07852a3c513981d77e1999d84ae7cf028b046618c7a4e40990f2334d5fba1fcf4b16cdad43343a94798b9d264754d8d8ce39643019b6e5a1daea401446b8786eb36f750f16e557bf5014153b3823c9e39d9814cbdc696158e8b95de122082d67e32e6850108ddd275d52301a9d18b873e45aae03b4e7949fb64dbb46057c75174606cd95e22d870f5c16d8f3abddf761091aad54ae8eea2fc15984c9dce59407e3f85a518efbb9951f51a0a1ecd610c67d5be46f9e68fd7ea069cbd8f94e183007a4b9499e342fd42d1f2c28c48ed6d6c01843175e1d5ec0dcab1a2e4dc519af5470aa0ce61c044817728cc49c3cb84ca078f5d4252a50d4454be0120d68cbc7b3f3c7b2e08368cfc2d21d4ddfd637e0f66bf74fae47582405651aa68cc1842a162ea96bd321f9429a74700d39fe78637bf43b56272003d550c221e31c4ffd6f3f8a424837c13ebabad25537b21033eee579e3679f025207572e8f19c20e8316ec6e3cc2dfbbb6360f8d1f9aba330f0d98eaa80c3a08bba5c181df7b114ad0f6617e75f1aa58d66c8a70ab709a32bd0d6531e0553d56e8463ecbc1ae51a24f8f0b5e99105169d3ff285764329b2fe6cb590b397fb1247edeb5eb7e124df41f172d441cc27d2e39322415c8a42f8aa0b296e9c2b801cdb6ba9488b003a7d0244db97d125ec3b727dd7af2a304cd965eb3a1da94cbae3c9d857e62ca10d651e21c012bd0ba75a3b1d77a4579340bb6cba66cadbf981866d42cba82c7b4c04f0fc38e00eb4010c289e2919e2aac57c6d063d2a639e17014e624e58378842729d65d9153f313f62ce4a9a4bb844e275b7e02ebba8b33bc3767ee9441253ac5134b4b741fa644a110d9c010f106da0191010e1b5286f477b3c5472842ca7f44d9f25a246687eb3064ad25216eb826cffa13af3fc5ae9fa8900aa156da94f2291291607cea30f74a9506385a4406f9c21b95dd17202a6579c2b2bca87638963ac897d9f9b15b5a0d8e4bcc30e5f60b3b06680361cb47d1aa11bdef8fef6bce10a4a1f6c9648fb4d588cd12c17d7c6be1af412d6856c1b0edbdd6e9370fbc8fea61ae42bc0c3c13c767d1acd71f14a6f6e7285f67e58b7f2363225241361e627223e6d35b15f74dcc384b013be6bb8c339725dfdbc128396d7f83668dbbbc6871617624e47ca3100d846d0d97724804b0df6676c68738283e56f139e584cd81b6f3132206b36d6bb714f73ac0a19ef510fcf441a76b6f548bf944ef353b97839b85bb273cc4be5a1661065fcba840046dcd3d7e4e6fbcbf0b3449fdf75351d476cd595339821de650e74ab583ac0247026d0186da5051c0099c9c6d66e95dc9085532724b43e2fa213008b249c810f2c949c620b4a1bd9562c9241d5e006117460c0cc971e7ccf22a807e38602b5ff600cda21728b9b9bd0bcdcefbde931bde1e212e5c8bf177232ac1ad0f30ab4257bfc13cf74df58bed48364687984531629b060e45a384a8089d6ca5467809da4dfd22e68dbd2dcdf91b82f2ef89fbfa536c57e4df4cfe1febf0854d0e5930b089fec025280f7948515cab09db7051932e66a2eb77929741adcbf03e7b7f5ec8d94872a98fdfb64b85d28b31b1cd88565f4410c0725292bb701715ebe67d5fd7ef5a6be98dcd66b63e6f0c85fbe3342c672e342aced24173b2dbffedeea97ba1792fe4c0350db4b5ca1dc8d5df06a8e6c76a4da885968094f2e0e36cbd5e6db35f5a09634dd4c2385aadf68730f5043765ccbb93fa874c8cfdfa0fee557c0637310169ab3c9f207765922521d512f51d8918a23e1ef159b1045211f6194fe58cedf9a3fe357ca666e0f5dd7e458579317d1057ab36b8a94f897b93f2777d8e506c7903096010fb56521a4b5c2535d3d7fae29f19afe24cd2a371e895b45cf667dbf2ad854d361ebf0da9d77e740e05c0aaebad12d1244b8d0fc92e57e0fa95089a158f02536d2e067510ee427fb19dc14afd2f45f495c6f417ce2d8c7d98791499f679e0ac337acc28efaa7c79a239b84950c090ce0a7086b3b2cc1a2d6e2b48ed4694aaf1560a69a219dd29c373770d587c4316c6e87b206cef0503a680a59df7c45e9f5fe0f5e520ec35d291e8e5e14ee515309012931c5ecbb44642e945189522fa29e25a43fb9832440de5b8dddaadfe5abce4cebd06c85cdceaa571154c2ff61a39087f4329ba90ee7f6cf29dae85432c2649796f908820fe9fb80d966bfac6e6785fd8763eb242afa15077de95966875cc8b47ddfd80d29883bc5085d9d8c894a64269ac09ee7140e4745778c4760d10fa014ebd41d9cf46d6bf2f405d807c189450c6b028d5460fa5e0362bf7939013d4a5d81536a3d1b634ca799bdbbe7dd3ad031263c00faab10d166992dc70f1db493d9a5366bcbe2cb8c5aa62b3b71975e8903742d1e36ecca78a8f0159af80320c4d98a7b82592484899224c4045db15d2e67d3400f2f820c6c12ee704e20894d0e1e2ac760c36d81c5ff1c0d53bbace92fe06c8d18b6b51a0398715bc36d95dc90c23cdf6c7881032b7515a570a82be9fca997487149122bbe14e57eca67d9e9fcf8914461aae0dabddcab5fd089ea67a0b0bb1ca4e7ea83f84cc450c28b66ad10f9c556438b230f52d56af0f96f013b26babbf438fb6046d96a16e1ef28af6b3a79c1aa05bf0776a2459d466ce2a0b4666a7a59e37a74d9c6c2850cd7dd8174f5cfa1649a4694877236e86886096a973e5913e6740ef2deb6a9e4186ce4d87839f4ff51741f840756a0cc16ecf2e77288f5c495100842ca0b6db7b0d9f542c571cdbc4529b01b6ad921f879b6f3e8285797baf1cd913e4b7fa26f3874d75210a78bd715bcf10849e6f4a4370fb5bf931046cbed555a6a341be89aa1a360c4b9cad6e9d8c9447758f1e64cff2f2db744f2f068d7000a4a1e3a62e6eb2c34d99858845b9d1662994c93c96ec5fb0f50cfe80c56e353240709f84c3bc04d21dcf468c9e181085f2c4eb18d9d4da3f22e04d2b4397eda67cb026bdfb215d0df1acf87118a287906c90b9eebbfd9e050cb40f22fac5d5413a7fd45cc20869a9ea5044cfd6482dcf363705aa02845b9454506717d338c89c441a98fef2041cf0d66324cbc39ecf49e972ea3be0782a5f52f3d9ed3b59d38882dcc4ccd2d1476be01888673c9e2320576aebd00738fb79b7f88d1dcd0499989ab796d3ce172b2b7303286d8ea242fe9f48af218602b1f52122342cdc7d8106802d9af7f216c472d6a536db67d37b83825f78fc214d6123bbf4ebd3e03070eb50ff000e1fbe6f7324e7c1d7c6ceb31248ed4b15e27eb49dd9208002cc46bcc986e065f8139bce6845d5fed13d4b6a6c0a5cc0815598f7bfa0b0bd5d556f938bd7a2fe622e861ba38cfbec70f94a6f75c6bf777808422bdfcc917791e59fb728c31882084698940b93ac83883730d0734ed64d9f12cf10f850545b40819096ac6765cbd1ef0ebd01ff3550037d47617add4937efae01ab1d1498ded08b071e755e57099baa0f6aa546169b6607dba5d3ffecf11ea1399f6167368f300cdad5ca6df3d70420d4a6c3810755773416a8f2d111db056a5677c1d4f6e8c9abf5f3222c7aa34d631cc10f8ca4b18411f3cf7946f58797b960e5e2f9ff248324b8e40fb0331644672eecb5500301c79832db82920e911f95ab1d9e05ba514d76e397c6f6f0e7621979bc29bee3993d742815cd4e154fa04b94971a5186da6b900291110f4c1b4a3b6fdef40b3d5e2bfad1f3eaf166b153321178e727cc1af2fe695b0417ba6595e6cb1579794229bd5bc6f5e0bd8c5518f496499908823d58f66c6310e3ee6b014b17a13ec7a6e0e968a2269971527e95a6c93deff24c60a39b6aedee3af3f73310fb0f9cca1d09e77312a77b161835b589380477695539863bdd1ce053c449c3270ae389c1bc0655783a9a1c01639dd9987c690b13f81f28bffca2ed0d7a00cd0977575e2509c2bc586b4fec9506b693b59d6c23f35691ecdde57c42460bc25a78f0ccd60b7266612147e93b6a9c032d7d62a894bddd20decc31db763a38e25f36c0d690a13e27dfffb9d2370fa6227d74cb6edd5be30065baf52e95fae90d41c710176dbf9862423f0b86237078383c97ac938ae8f7114e6c7bcd44e9f164c101a194addef9a3e1b1b17b93f152c058049b68eea9f944e60408908cc1138468b4b2fe9f6f07637a9460d86d7db47fb0aa32d741ff850436590c2e0e3c6fc4ad1bc27cbadbdebd59fe0ad0a4ada26c0f854cdacc3e31beef873a3b6a8398108c5e1d339823fcdd70c71c405bc691536c82380333ee1cfc87e61ee70181cd358cd8458e6830740b9c60217770264559bedea4947bf6f3da4dc376e0ae33ae9250932032b23a9ecca9c873c97c3f472a63941862340c8aa2634c0712472f319033f22426399c035454e57534ac88053e4ca5be82ab978a07c3d5e2ebfea1b2f3958a35cafb820d6722597a6e759b7270c6a2bcf3015ce41b870b130b465696ccaf6b7451e38dfabea97137fe5f537b110a6c2f4f9a6820471ad559787294d8c4d9c1b0c527d23336c90e19d5de9210c3c00d4bdd50164962f37d3571d7b9990eab207936e28f4da0ff185cf72f64edc2f6ce94b9a486f6c1bbb3490ef85f034852ca9ac6541e57ff0ab67d1af8f6d8b1151297b64c2a6145d3ed2a2d344a21a2ae742366caeacf06552a1ca858540062ec56163570a4912797075e0fb2642d887aa9ee315e88f0eb4d606ae1f6b669642b989797ac077424f876e5641d30890a516e779223e002d02aade61313bacd1b28b06b2f4a21bb2c04418862422698d237c3fd1ca7a55a46503f15df81056856b922f669ce4213fa4507d5ccb4715ddcf9c77f830e73b3554cdee44e75d269b43a0204091fc0bec97adb5cae289835da47cb32bfe0d8800036d4a7808828c74639a5309e111ae2a8e1be3cbfc0c7af628ad014a99ce8788ba1ff0368f25fe1c59657b3f41fd9909c1d6ad5a1d110c9bed498534288ae2ad8836d3eecf05b2f5b4cee3389605d534df3134709ec1c7b4165c8112715439ddbea34b597aae8b9e25ce15b75564fef056f61481ad4c818ad8ebec2c1015f61eb1591e7f2bd54d02d0dc784aa7f8047e062879bc5759ed6f5b238cc3fcb98e4f4ec04c7412abe93e59c9961bb7040ec8ac63994e794e0f049e37e3ed36fce2d579c25c8f888878047a0dc587903ab7f9809d71fb4033fa7b8f9d965b8945d1ecdc2b8d1420bfbabb1610229b38f8926269143e13b7db7629db65e383da5231503aef01009362dc6727ff64dee477ad043d629b0a6323b1c5cd07f602c102e8205026c2ca24b4338660537d3160681040f86b50a49cf891c81210ab997820a984a1d456924f55c31d41af3d7fdaab8e545adecd5b181c920091d0db35b5b93841c5c1ce9159c0cd03b4eb1a5713d6eb691592fb69d4133e76512d6184e04a3f0ee1dbc58677fc29b1f6c1368775808111dae5ea0d051b0ad22f7a88dd8c8d78f4296ef9284cc5e5fec1849ff186a2cdec8d21631fb8b5c613269bff02c963f5741b4d2d1fd4b9543ec9ff9a3bf77f0e5c45eea357b6cb60ffae18f1da6f1f496ccf864b9066a7c93c341817101c018720734a81cee8284f60d1fe8945da3926950d4775704e63ac29b5e217d726f605f19553752522fcefffe367d02f58391b13072fbf941bb9a81c58fd6d92e7e3428c71cd838d1239910223d74cad199c9d640de7b03702c294d56833513c96840d4132569f381cd2b26899f5db3b8c62ac92c1a557d5dda491f59ae5d9bc4663e4c75da88ccb9dd4b6f6b0b635b4259b5fa58806c88a8fd32f97dbcc6da3817a5400e48e35e398849716fa7cf65f12572d0a48aed4b913b810bfa112b31fe262c157265dde98ea137afc5b42971146c07f8c8fd97addcd4354ebe23c535567c7544b6a30cfdb6b56442c29b62cab50ee9ec0b6636ece2d03cd31db266398d3749e4f944943a3ea54162460c1dc13caab50d5e1bfbe947ad166a9296819404ae802d3f8a795efbf5e684b6199cf4ed409cb7eb4f1e3fead9a006a0da8ee616a10339bb0792bffc7153537baee58f7d7b8cf1eb8fee2a34dccf5a813467284a6abfe07784cfa681278ec703a4bb72b8ec7d548303356339bf839da68fed4c0b23967e9f45cb0baf98e6a5efd", 0x2000, &(0x7f000000d4c0)={&(0x7f000000a600)={0x50, 0x0, 0x0, {0x7, 0x23, 0x10001, 0x1000000, 0x9, 0xb8e, 0x400}}, &(0x7f000000a680)={0x18, 0x0, 0x1000001, {0x1}}, &(0x7f000000a6c0)={0x18, 0x0, 0x100000001, {0x2}}, &(0x7f000000a700)={0x18, 0x0, 0x0, {0x36319cf5}}, &(0x7f000000a740)={0x18, 0x0, 0x401, {0xffffff01}}, &(0x7f000000a780)={0x28, 0x0, 0x2, {{0x108000, 0x8}}}, &(0x7f000000a7c0)={0x60, 0xfffffffffffffffe, 0x4, {{0x80000001, 0x3f, 0x20, 0x3ff, 0xffffffff, 0x2, 0x48, 0x8}}}, &(0x7f000000a840)={0x18, 0xfffffffffffffffe, 0x1000, {0x1}}, &(0x7f000000a880)={0x14, 0x0, 0x5, {'{(+\x00'}}, &(0x7f000000a8c0)={0x20, 0x0, 0x9, {0x0, 0x6}}, &(0x7f000000c940)={0x78, 0xffffffffffffffda, 0x100, {0x7, 0x6, 0x0, {0x3, 0x0, 0x0, 0x1, 0x3, 0x1, 0x10000, 0x1, 0x2, 0xc000, 0xffffffff, 0x0, 0x0, 0x2, 0x2}}}, &(0x7f000000c9c0)={0x90, 0xffffffffffffffda, 0x5, {0x6, 0x1, 0x1ff, 0x9, 0x8, 0x1000, {0x6, 0x2, 0xe71, 0x5, 0x4, 0x6, 0xf99, 0x7, 0x200, 0x6000, 0xfffffffc, 0x0, 0x0, 0x5, 0x1f}}}, &(0x7f000000ca80)={0x68, 0xfffffffffffffffe, 0x0, [{0x3, 0x72ab, 0x0, 0xfffffffe}, {0x1, 0x3, 0x6, 0x4, 'fowner'}, {0x4, 0x5, 0x2, 0xfff, '^+'}]}, &(0x7f000000cfc0)={0x3e0, 0xfffffffffffffffe, 0xfffffffffffffffa, [{{0x0, 0x0, 0x8, 0x1f, 0x7ebd, 0x1000, {0x1, 0x4, 0x400, 0x0, 0x5, 0x9, 0x0, 0x4, 0x88, 0x1000, 0xfffffffc, 0x0, 0x0, 0xfff, 0x1}}, {0x1, 0x0, 0xc, 0x9, '/proc/locks\x00'}}, {{0x2, 0x0, 0x9, 0x0, 0x10001, 0x0, {0x1, 0x9, 0x59, 0x401, 0x4, 0x74, 0x267eb, 0xfff, 0x400, 0xa000, 0x10000, 0xee01, 0x0, 0x6, 0x6}}, {0x0, 0x6, 0x4, 0x7, ':*:#'}}, {{0x6, 0x1, 0x5, 0x100000001, 0x8, 0xce, {0x2, 0x4, 0x4, 0x5, 0x4, 0x594558fb, 0x7, 0x8, 0x101, 0x6000, 0x0, 0x0, 0x0, 0x4, 0x6}}, {0x4, 0x1, 0xd, 0x8, '/dev/video37\x00'}}, {{0x4, 0x0, 0x5, 0x8, 0x53, 0x5, {0x3, 0x1, 0x1, 0x81, 0x3f, 0x0, 0x43, 0x1f, 0x7, 0x1000, 0x7, 0x0, 0x0, 0x4, 0x3f}}, {0x6, 0x100, 0x6, 0x0, '+\xbf^)-$'}}, {{0x2, 0x2, 0x20, 0x40, 0x3f, 0xfff, {0x5, 0x2, 0x80000000, 0xffffffff, 0x10000, 0x6, 0x3000, 0x6, 0x2000009, 0x8000, 0x1000, 0xee00, 0x0, 0x74, 0xfc82}}, {0x2, 0x81, 0x7, 0xe0, '\x87\'[&*-!'}}, {{0x0, 0x2, 0x3ff, 0x0, 0xa599, 0x0, {0x80, 0xfff, 0xdb, 0x5, 0xfff, 0x10000, 0x3ff, 0x5, 0x3, 0x8000, 0x9, 0xffffffffffffffff, 0x0, 0x71, 0x6}}, {0x1, 0xa75, 0x8, 0x3, 'lazytime'}}]}, &(0x7f000000d3c0)={0xa0, 0xfffffffffffffff5, 0x8, {{0x1, 0xfffffffffffffffa, 0x8, 0x4930, 0x401, 0x22, {0x2, 0x2, 0x1, 0x1a35, 0x3, 0x6, 0x3, 0x5, 0x7, 0xc000, 0xff, 0x0, 0x0, 0x6, 0x2}}, {0x0, 0xc}}}, &(0x7f000000d480)={0x20, 0x0, 0x1, {0x3, 0x4, 0x0, 0xfffffff9}}}) r1 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r1, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r1, &(0x7f000000d180), 0x4000000000000eb, 0x0) recvmmsg(r1, &(0x7f0000001a00)=[{{&(0x7f0000000440)=@l2={0x1f, 0x0, @none}, 0x80, &(0x7f0000000b00)=[{&(0x7f00000004c0)=""/196, 0xc4}, {&(0x7f00000005c0)=""/197, 0xc5}, {&(0x7f00000006c0)=""/83, 0x53}, {&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000000740)=""/200, 0xc8}, {&(0x7f0000000840)=""/219, 0xdb}, {&(0x7f0000000940)=""/207, 0xcf}, {&(0x7f0000000a40)=""/141, 0x8d}], 0x8, &(0x7f0000003080)=""/4096, 0x1000}, 0x20}, {{&(0x7f0000000b80)=@ax25={{}, [@default, @rose, @netrom, @default, @remote, @rose, @netrom, @bcast]}, 0x80, &(0x7f0000000e40)=[{&(0x7f0000000200)=""/57, 0x39}, {&(0x7f0000000c00)=""/2, 0x2}, {&(0x7f0000000c40)=""/154, 0x9a}, {&(0x7f0000000d00)=""/154, 0x9a}, {&(0x7f0000000dc0)=""/73, 0x49}], 0x5}, 0xffff0000}, {{0x0, 0x0, &(0x7f0000001040)=[{&(0x7f0000000ec0)=""/155, 0x9b}, {&(0x7f0000000f80)=""/152, 0x98}, {&(0x7f0000004080)=""/4096, 0x1000}], 0x3}, 0x2}, {{&(0x7f0000001080)=@in={0x2, 0x0, @multicast1}, 0x80, &(0x7f00000011c0)=[{&(0x7f0000001100)=""/163, 0xa3}], 0x1, &(0x7f0000001200)=""/201, 0xc9}, 0x8}, {{0x0, 0x0, &(0x7f0000001840)=[{&(0x7f0000001300)=""/48, 0x30}, {&(0x7f0000001400)=""/69, 0x45}, {&(0x7f0000001480)=""/92, 0x5c}, {&(0x7f0000001500)=""/104, 0x68}, {&(0x7f0000001580)=""/65, 0x41}, {&(0x7f0000001340)=""/27, 0x1b}, {&(0x7f0000001600)=""/65, 0x41}, {&(0x7f0000001680)=""/186, 0xba}, {&(0x7f0000001740)=""/96, 0x60}, {&(0x7f00000017c0)=""/93, 0x5d}], 0xa, &(0x7f0000001900)=""/218, 0xda}, 0x3}], 0x5, 0x1, 0x0) r2 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0x12}, 0x0) syz_mount_image$ext4(&(0x7f0000001e80)='ext4\x00', &(0x7f0000001ec0)='./file0\x00', 0xff, 0xa, &(0x7f0000008480)=[{&(0x7f0000007080)="48fa2a8c9c8fbcd0e9aa48d17f93cde087eb4100a7e1a67a2d38c76ad203126cc8d0621e681469e9da3cba82f8dc13e309be2e475df77aee3f1b7fdbe1b7870faa69c54695b2fbe7c5bcab297f771b3f868d9cbe6bde4650034051e1677789b54bc88297bfbda2d2911723905b554e7e30e6064213804d868c52eea3cbb6dc7b429a4edfdf13f0761a89f8598aca7d576d049da61cad90ef060b434b6c11453593b392c3ae2d0b00a62f8c310b00678266315e6425ed83b8c935690f5f13989393e9107680589ae0a01b0c08ec953c322c8fd593875fedd9c698e368d35e5b724b92418126527226705073cfd1a57e78803ad8da2ba594379d90aea5c11b8ee8fa85826ce8d485f4ea982232082c867d80ca32cbd14554b5a2917c536b57e01be3f43774cae6dadc70d67bf23c5951b8b7eb5ad3d749038f4c0e667f02cc96d2d6c12745b4ad6bc5df30ad725609eddc802986ab04c6a15f15ffd83f929d0a45a64258411f1441d5bfc7b394a6270bdccae9962eb68815f0ad5cd3f2742be2b70dde56e68a19b404200353c0e34ee0615f4deae99ec2ef162239c3df088d6746f268c037b0e8f6da87c79390f5334f64f8d0e3ca5e80bea312826c0fd804c5b3c9136c6a32a77c635bc7db0dd90f23700c44e590ecbc88f3a1e5d52364eab0a5f7d2d138a1a2e4901a8f2f9efdf9bed5b7a84cc0b90078ec2823b96201423fa6842bc398c0b470db65a01c69f3e036b05f527d8bc65f81846bf67839f5ef4e2afa1cf8f11eaf9ae4bb57e098dcadb98685f8790c22910cdb4a6ce0af82b25a82a2c215cc4ddbce8a2e78ee59b595e9b4950e7331f2e202290af2b607e692e835d6abb5233bc1978b095dd157d35f7d9131e743ff22c58e6e0e86328698b994d4ad2d08fe422071f02c67decbcf880eec763c26b4dd0407f31fa0de35776a5e8acb25937f9b99aab4d2cd63425724cceed38f272b16f639f91ad9a8fb077fe89b2d7a68a287005250bb3513c7642783f699d0557feb802d08b5496ba7c3b58a660b5a24c4a3dc32a37c993e60ede2421da99479ede53192eb9c5dda9caf432f5288496cfaedc4001f1cb554c56268c5a5d8e38fe985436c3a10cfaf7b7d8b74ca9970c9fde3603f21a077ff64cf32227bbacfb07f500b88607d9fc0b4f637200519c77a9f5f95b77d2cbe3bb254002adabc7a9d4072e1126b1add1eb075437ee33a177a5c0577d6edc12d25be336c106900087687688f76391c85b03caeb37b6186695c0ee6fca2ff458a796edfea714cbf0700df4746afbdfe93e7e197665ae5ae9d81da6148c9e624cd12353e6446deb452d098463df8bfb3ab0df5e0616a73312cd0464057ccf8c1ce6e4f22135cb284c3a81f2b9df100ac8e2887f347de91d5f0b7e0989f844e0c090a4ef6a417e9b3f544c28792f355dc407947ee5528358669cc29d5db0c1ab32feed0cfffa727236c14ca7bac6813a188c42dca281c8fb8444ec29002a7c802ecdd888aa0fc810f7e00b5b96b54e107759a634f7fd7194d8b075122359ba2efad3dbeadb50dd7ad658733a0d781dfa0e6203df593a7af057f125df5e3bc780b36471190acf4dd36b7a341bc87fc41e33a661bae81970a86f9fa953602743291fd1d8ce9683a0159ff757e9ff2d8ed6b2639fb21396c130fd4d34dba15d0de36eded9c76811aeff322cf73bd6472d4d9dad4f8c7279a1c8a6a750b5adec8021c8403e0555df39b5b742cf20ccec6db7ff3540708b7e709e08cc1eb3f9c8d1d688b5af710023354cdfba494e4a093a4efea3e81b9542fe20f4775df5c3147c5224082d06bba43fcc4ad95e31f0ed526f45b2af650b89bd5a18c0f9bcbcefc2349b55029544e1eb6600ec43942bd0b5c126d93a03e150707dc3443a392ec0ed17b45d68845919d81aec679ed83b4213700ca49ed01dc079521196075f8a0f79e95f5ab83a6bb387f92956998a1621dcd48bbb2c49d04778e4effb486a2fca99cb9e29f364dd0fc52da36784ba1be63f2d251b114c40a6d53c8d39ed513566f04aba7d88dfb4b14298eac15452fcd81ebbb549d63e0f56554076e7ed5eb93513401fe990865d7919b2500f1de9bd117e587cdc1b294d1be7904b78212efaece0c65f86233f17a04a611e06c0932ee598cb14f6cf25d6ae7e2f24fd606ddae86b77101207ce6ff33e434e0e0bc1d55f1fa702f366232d62e752894f3d53aec0796f462ab4d0aac6b1f984aab3a39bccea9b2713d447033dff3a617ee5dd9c70c17661cbc894555ffbbfd20f7cb368542eb11f48cc4dd6ec623eb7bef4ec98fcfd467ef9a19eda9042b0235e4db2260b49926592276abc24af1c4e057f99a482a20b925443d659986870d4eb46ef2f6ddb0125346eeb624ea4adee2889a813d61529f0f0f5ec9d1e11bb950073eac953610ebcbe4cd21a2fa1aa8a1090a28ec468c2202652d10d5d39b0caaaf3b5ce8d5356e6819478afde21794209627e00f04a8e2a55aaa1aced218787a352105c79b3a329ff4836d5e8e137be52e261f02cc8f799eece373785adb04c2c2936a4f82609146fae7a4811cbd4eaaeb3a9ae6570e7f73108cc0267189e9548600a401c78689496ab404f1b64bac5a36ead6c6da37350c694d46a487acee4aacd2fd6c6bfb02a49e75de74380e02730053fc7d4a642c94c5f87f216a8bd0805e0f5d9eb6c33091e5ebd1887ea5b711d1afaa1e84fd4e778377c4ca78abff891a9ab7a5a53d8e4dc682526ca062bb50f2465b00c758f6e9dc8c8053a6981057cf0b4fa274621ce9fc113bd167023419c500dfa433cb05974f8b885a228daf1139aa6c46b98e48d4c603328763219ac131523705858e180e9f67178750bd4d0d6b37e64301d6fa93b91fb488219aec1750497875cc47e10a2df0cf81871cbf902b5df4a0ee88e31701cdd8d8cd614a8397ae27bb83845f2a4f60bf351c42be3f88870bb1cbdfdb4025a45d7f9f76406c6776ae720d2d7eec7c5c2f0998c72c186368d92f528c87a2fec7b72e867afcc55189818424ddfd2221857511596deee32f1da9ed78bb9462f6f8cead96931fc45698fb6434ab26dcdeef973da817f0624b0a6c79c8376e8bbbf3aaa4bd1ec3ede6f361c3bd0b5a4bd70bd752289e82b31b29cb9decd94d83aebafb4777911300a5989b1e76dc51b702e9ba3ffc693718f5e760933d5a25280dfb4dd34be76e070bd4f2976773b38c122c9db80f70704f30234914b698e25efc558c01d12e9fd5a7ec744896a1e50af282f096a4daeaf355fddeae85b813c6d84e93c99c30bec99a54493a2d108b494511a2ab74d90cfabef396fcf0f2ed7971d95da24cb06254676996105aae8436eb40722f9718f1768e6d3e4aad3fcc736feababd1c13ac5a3f826aa5bfcc2a7486723f120a8a3cbe58bbd804e4b624f70ac50692cfa717da1dca0301fbf82fa5eeb71e403680e7a6c4fa9ac3eabef49091e3e14e885471264d22d047b0fd43d8d902983251ac696fc0e460ccbfbfaff8c1b58010602a11820618a71602186d127b2ddc65d24811710f033752e1a66d37a2d47139e5b37b08c89f06e5908cd1a8a0d2c5c67f4b7188a1c27a97d5f5c0790e64983d1bcbc163968b23116dac81beeb7da8329ae2856fe1f78ee9aab38ae21b2e535898d9f4b0f434a1127a8b4f625161a9b6574b42f773079a03c875e5524c789906cd0e9b3d4cf6f91b8a08008ce08961ad5f9abdce8b4eac98e654423e55a0c994ca842f41bf06e20b918e4af9633e6b41dadca4d7b83423592da3e32c415f4b0d73540dd36d7f765c8844e17357cafb22d58de69f61297ccfe1d73855494c36bdb777ec4f1c736da7f069ab71edc0ec7a15b56dd58e265223d338a0429f91311fac4d72baf8426884aabce1d17e36c7d97d4f0e40a0b0061fd1977b640a4ada73f8f20c670a0a686cfd08834b263a111a50d616c6133418cf1cff188c9c4a7683e54239587c038637a32f419784e6b7c0dc9d7edd8c622910eaba2f2f79e7c520c3ade22b087d1605c5fb6a8dcbd66d50c2d0f1e99855c7df6ca0b45c5d9f35f49dc5534dcc669f02767c02f77ee930a9773d5ecb60950bb0b36d67fde16c8a33dcff7065bb0096433acb5e34c146366e6fb478843e9eb567c3a5552248f608077199a63f2b026e5069b9ec293ee40abfe7804fccc7037c664e76bd524db56c47d337e24e08f839d67d660e2496bc7bced6a8ee7bbc5abe1ae7bddc1a5ba77e098ec210ad58f9cb11f0fdac26b5dfa33baae80bca76d1464d3bceb4eb9784c9968094292b0ba4b20217013c691c288a11f3e098d162a5ce522bf198142f08889a6ec2fc64e8e37cc8cc60d7f18e357cc7304fb1fa3cdcd045f65228024d05f717ebed2085f633782c2858ccab5c554c9768d51ff12e3fcff8ac32320d613d1053043dd9ba889e3a586b3d49542f2365b4400f4ef50f46fe74f837f5115c17274c7539a0f45784a6785d352b537a8a9e2415616e515d49e940f6c4ae7a63159fcf4763646cb9e0b030f31207a784f1ac6053b3911946c60536c64e0b39a1d8ebd8ce82bd9bc2c11f076f4f029ddcaf63cce291066e9cb591202abfa463c55f50465305eaad819e654fa932b63f59c7e959e6329ac8e17b52f9b4d42aed8501ec1690b8bc794aec2ece911c420cb592a79e2467348b55877393da505685b653e64189e030b544d04dbfbcd66386d41c829e50dc978b8a3a074f016da37782bf542914a20aaa3ca5617a02d724a63914de7467f92ec036fc534ac3a4bcd7f537c84589743d2afc97abcc002f7e5948735760291a04edefa06d575884cae59fa6a64af67967caf8957da1a439ce7af713d704e9f3162d56819490328d64a53a40aa62d2f78c77cf734faf3c61517950d06561a0394dfcc181bf1dd0a76f6546b9e64a25a7015d80e6c97cb2c8468a23d28162152d4d1e30cd71d374d64ce40a67e23fcb52f7c16e32f8cbec89f465aafccdc0facb8a294c370629f5fe55ff3562cf5bf28c71c5cb4fccbcb3a1fd68d290c1d497df84847cc6537d444f6f90c122da7ad606b53c838e5df1f9e875ec413221bcea775bec1002ea347c98f0be2d53261060608aef84564cf74dad93595725fbff12206d807b82f29c48b6c3bb2a02ab5f0990253965e8ff6a4b000dd9008049bb2622469fd0cae9d7be9943ae61d10ec622267fedd06b693ab83076591b1b6dd69aa873a3a7c8db73f4cc3b1b7fee2bc3f10a790d60cfadbde9ff38c1fa87d71237f2e9bbb69e6bfce16f6fb3b76024699e7af3d69bfcda2b5a19fc9e88ac6d2659739c10a37f5ac1b3a8d9a2a14b1ef69cb621a5a3d746ce08a029c76ea98bf7a03aa4550b5773ef909a03577a49cb14245f37440afc67fa3bfca5d9f0e1c2220e83a6b88cd186920bbfdb9e41bd688f56557b46459ccec2cc47ed4b3f24eebc0cdd7452f115ae88b19e4c3a4c927875c2d424dd8b7552946733d84a8517ac0c42fa286b6bd75001cb789a185a443c8cb7ce99b76caa5184b98bc3794dd2a1cfc73d1b7ac0d87bd9bba285c42ce7c2d29c56d78a701d89a6ad221f18cae4705ea2bab10928d8bb6aa85ca7f81970458278a452af480943dd4b187374305e6392bd1fcbaf0ab3197061a5d72ef9c2cc6187751de552626b6c2b60c9b8260ec14e84a367e377095332b025ff9b442ef764a0c03e95a62120fefa8223d1b6785007eab3e377263868785b6d456407190b5eef2db173c85b07b051e1135428e0aa6c4e715cf9c5c91938a1aa62ec92d72ce7ca0f", 0x1000, 0x80000001}, {&(0x7f0000001f00)="ff70c3207ebca373ac14b66f4298182bf7b22163ba0f049ee284eae09a12a603f6361a5272404dfe7114919f4792bc320dac54729f99b4c0f3bb379403a3c9e06da81b18d46c3b5316", 0x49, 0x8000}, {&(0x7f0000001f80)="274c77d67c799f091eca74c1308ec7f64ea4ac49f743e78d5a51053e9ee04c6bf0f4d0be2ca9366074d008183bb5ff1e146f57a3e524ce313ba68c940fd39e77dbbe6c23e2583097091e65716f7ed7af427ef384cd14edaf3c3a2a056f0f2b8935d5e4740390384ee1440c62267e1ab6b205910c1364e55e829515cb359ea3c0e13c411163c04346d3f55178942e3febdf2c4351d8e968123457e820", 0x9c, 0x4}, {&(0x7f0000008080)="e74147f7f59ff574519d48ea9900fd855b672084a6f81601e234f4ea4b8ebabc35de4816835a8577e2c2e09aa03e1804f4b459aa3af8da703415fe7e40022f76d27891086d7c8bda44", 0x49, 0x1}, {&(0x7f0000008100)="223f6c4dc542c99fc27f67222a11ab6e29e78298b24c82f3ddc0735aa98ae459544acf6bb4b7a67b130e6bdb5a6ec366816ed4ce5de0eeb83916e8656418fd37cbe798150db0769c80b2530f435ba126263d9d917882bf5f175789207018ab85a93e5d190913e2d907f634abbf71151a4a5b58840a39e3e74c2488d90ff993789e", 0x81, 0x2}, {&(0x7f00000081c0)="690a1f978afc347e365fc3adeea160e02d3eaace012374f961dd13caf7604457f750c22802b841b4b86fbd3bcb7ea08349e978bbd9769bceec4e24be0149d2a69951398d1990649d469afcc7a5c7f711840506aa639b96a46f18566f4eebd3e0e42726e8b3ac9d0731a627220541a82b524869265feb6e7de82e7156d287b42d84a62528fa1b56419003660aa3127c24f10c7ed7e54b8f68129c93964f228f1b0c08b8267c0d44f35df32d53569452b8221605a1f5ade104b380dfe960fc2881756b2495b9d6b796eb8cdb544ca1b419656120fc2b5b2f0d6279531c51a018938732dc2548bd8f810223de66", 0xec, 0xfffffffffffffff8}, {&(0x7f00000082c0)="f9631d5f128d43e6df5c3f21852c71f4ca04ca51a5485b6d2ce11364271e093eacfa53d8635a2df5e894", 0x2a, 0x6}, {&(0x7f0000008300)="c09097dcb90dabd315c5b5c77628726b80abc582cd5c6d7805a8a5f2581502f0af5a0fd27c87739f465634cc186bf03f1f2271b1aa7f5b493adcc34722a9c68c9fdda808305c9d42443d4c75136711c7e0efeee01a0f3a565c2ac8ebe7131f74a93556be2f2667f6c8fb06cbcd91be29f8a1b2a8b1880d02b9145e58e5f6ca669f07c5465bb317f1d49971ddeca25964941139a7b79d684c300586ce209545a32424b37c45884d65ecd7", 0xaa, 0x9}, {&(0x7f00000083c0)="57dad557d9a09615417798cc834a0ed6c958f4e4110668d393f554fb8d85af2c16e4ccd18f921dde4f9bb375711998bcca", 0x31, 0xffff}, {&(0x7f0000008400)="386d92d50cc73b96383d5d691ea37d93177b2e4c994d20791501eca678a8f4444c79224d3955453ad639d216beb6efcdacfb21e7e3819bf520db5167a65bedf5ca7b3224fc8427f935df35987eeb32bf3eebaff6ec749d58d074586efca91b0a01f1f1aaea00993e851cfa54fe879c349c373c69c90894a7", 0x78, 0x4}], 0x54040, &(0x7f0000008580)={[{@minixdf}, {@lazytime}, {@jqfmt_vfsv1}], [{@fowner_eq}, {@smackfsfloor={'smackfsfloor', 0x3d, '@'}}]}) openat$vicodec1(0xffffffffffffff9c, &(0x7f0000001b80), 0x2, 0x0) ioctl$sock_inet_SIOCSIFDSTADDR(r1, 0x8918, &(0x7f0000001b40)={'lo\x00', {0x2, 0x0, @initdev}}) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f0000005200)=ANY=[@ANYBLOB="010000000100000018000000e6c0c463a0034a14d9c02601597096f944df6cd1e82ebf08d086e6ffd6c9df3dcdf09599f1075a5c8dca4e82ab68e3c874cc7c24f8ed919a998057c06577f5d49ff6f432e510b2e2936cb15411547e890ee08172ddf6098ac3d7e4099f67debf3fe961fa599676b710155295f81091bb6c551a7cd298e722a11f59363362185e4066fb60a9362051935c88beb2bcfffd6a63c4c581772237876000000000473e40812f99f2b5e26667ee72d6e91a62abc6e620714ba2310d5f81d112349a2c372adfc4b2794605d415fbaf9c76b7ad00b84efa2a0c052a3b32b18e080dd40e26550339b22d7da30aa9d5c41c512cf2cd3412d09d272087a9e903bf6511f66ca4c2a193cef6b7181a5e301509d01965ae0396bf3ff5667fa8e0fde9757189cb00000000cf62f5c170115dcb021e29eb2b3527f41587fb3955df6f90d6393d5a023117213f08015684ed27c6ca81cc3b4bacaf8af984fa55a63fd7082eeb0dae637e9d9d7b1f7adeb8e3f750905a842a9f61bad7d4606e2d0b3a46c4efa0c3869724f93a02a6ae5a3d2711a5c62d75d3756767f354d55bac961263b008f145a32d944d86b976031fd4df2ea108f4d0c1f4260cbc8e8f7bc8671fe80bbc3d29284b7bd8041ee53f8da73710a518db9daf376c88c0476612666efe6a99e86de16917a0410bdfa55821a8769325d58d64cd98a53b79055061726b04b7ebeaf8898a0f81ab657d823e8bb4e0ba999a", @ANYRES32=0xffffffffffffffff, @ANYBLOB="0000000008d65a74f5376d796bcdc9268a28d13d40d20fea73de6c0ff0cb72c56c6c8dde9141ec89948b76e7a8abc7fa008335ebacf3375c9c62836597e9a89438dcd646260447fe4f86a9f5cd59105f3d3b7553eeff2509a08f8400ef412fd6c22aba9e1b9e705627a9d7c7ef07ecd7552149ae9cfe7268db0c7cb075519653596fe4d89d8cb0c7ae0053100ccd1448246616346ba184"]) ioctl$EVIOCGUNIQ(r5, 0x80404508, &(0x7f00000002c0)=""/255) sendmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{&(0x7f0000001380)=@in6={0xa, 0x0, 0x0, @private0}, 0x80, 0x0}}], 0x1, 0x0) io_uring_enter(r2, 0x2ff, 0x0, 0x0, 0x0, 0x0) [ 1395.341091][T24088] usb 4-1: can't set config #0, error -71 [ 1395.356519][T24088] usb 4-1: USB disconnect, device number 6 [ 1395.554695][ T9854] ubi0: attaching mtd0 [ 1395.561632][ T9862] xt_NFQUEUE: number of total queues is 0 [ 1395.583958][ T9856] xt_NFQUEUE: number of total queues is 0 17:27:46 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(0x0, &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:27:46 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1395.699017][ T9854] ubi0: scanning is finished 17:27:47 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1395.935030][ T5] usb 4-1: new high-speed USB device number 7 using dummy_hcd 17:27:47 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1396.029640][ T9854] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1396.066944][ T9854] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1396.105086][ T9854] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1396.149573][ T9854] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1396.174865][ T5] usb 4-1: Using ep0 maxpacket: 8 [ 1396.194268][ T9854] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 17:27:47 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1396.230358][ T9891] nfqueue_tg_check: 3 callbacks suppressed [ 1396.230377][ T9891] xt_NFQUEUE: number of total queues is 0 [ 1396.233530][ T9854] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1396.304351][ T9854] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 1204783369 [ 1396.332997][ T9854] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 17:27:47 executing program 2: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1396.357747][ T9887] ubi0: background thread "ubi_bgt0d" started, PID 9887 [ 1396.465456][ T5] usb 4-1: New USB device found, idVendor=08af, idProduct=0003, bcdDevice=3a.3d [ 1396.474543][ T5] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1396.529323][ T5] usb 4-1: Product: syz [ 1396.533815][ T9900] xt_NFQUEUE: number of total queues is 0 [ 1396.544792][ T5] usb 4-1: Manufacturer: syz [ 1396.552071][ T9902] xt_NFQUEUE: number of total queues is 0 [ 1396.576327][ T5] usb 4-1: SerialNumber: syz [ 1396.602467][ T5] usb 4-1: config 0 descriptor?? [ 1396.675546][ T5] hub 4-1:0.0: bad descriptor, ignoring hub [ 1396.684031][ T5] hub: probe of 4-1:0.0 failed with error -5 17:27:49 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(0x0, &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:27:49 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x4, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) 17:27:49 executing program 5: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000380)) r4 = perf_event_open$cgroup(&(0x7f0000000200)={0x0, 0x80, 0xfb, 0x2, 0x7, 0x1, 0x0, 0x7, 0x100, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_config_ext={0x7, 0x3}, 0x1400, 0x6, 0x7, 0x0, 0x2, 0x9, 0x3, 0x0, 0x9911, 0x0, 0x80000000}, 0xffffffffffffffff, 0xd, r0, 0x3) perf_event_open(&(0x7f00000000c0)={0x3, 0x80, 0x48, 0x7, 0xf8, 0x2, 0x0, 0x9, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x8, 0x0, @perf_bp={&(0x7f0000000040), 0xa}, 0x10, 0x2, 0xff, 0x0, 0x0, 0x3ff, 0x7, 0x0, 0x3ff, 0x0, 0x8000}, r3, 0xffffffffffffffff, r4, 0x1) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) sendmmsg(r1, &(0x7f0000000280)=[{{0x0, 0x7, 0x0, 0x4, 0x0, 0x0, 0xf4010000}}], 0x400000000000085, 0x0) 17:27:49 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:27:49 executing program 2: syz_open_procfs(0x0, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x0, &(0x7f0000130000/0x800000)=nil) r0 = perf_event_open(&(0x7f00000003c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c4b, 0x4101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x800}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x8100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = perf_event_open(&(0x7f0000000080)={0x3, 0x80, 0x1, 0x9, 0x7, 0x5, 0x0, 0xad, 0x802, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x0, @perf_bp={&(0x7f0000000040), 0xc}, 0x40804, 0x7, 0x1, 0x2, 0x1, 0x6, 0x1, 0x0, 0x40}, 0x0, 0x2, r0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) perf_event_open(&(0x7f00000001c0)={0x1, 0x80, 0x4, 0x0, 0x7, 0x0, 0x0, 0x7fffffff, 0x20440, 0xc, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x4, @perf_bp={&(0x7f0000000180), 0x6}, 0x40c4, 0x6, 0x0, 0x6, 0xd0, 0xfffffffc, 0xca53, 0x0, 0x3f92c1c5, 0x0, 0x3}, 0x0, 0x9, r1, 0x3) keyctl$describe(0x6, 0x0, &(0x7f0000000ec0)=""/204, 0xcc) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000000440)={0x0, [], 0x5, "a59f7995f969f9"}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r1, 0x81f8943c, &(0x7f000004e240)={0x0}) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x51c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = syz_open_dev$usbfs(&(0x7f0000000180), 0x77, 0x1) ioctl$USBDEVFS_IOCTL(r5, 0xc0105512, &(0x7f0000000040)=@usbdevfs_connect={0x0, 0x5517, 0x48000000}) ioctl$USBDEVFS_IOCTL(r5, 0x8108551b, &(0x7f0000000380)) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r5, 0x81f8943c, &(0x7f000005a700)={0x0, ""/256, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(r4, 0xd000943d, &(0x7f0000000440)={0x0, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, r6}], 0x5, "a59f7995f969f9"}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f000004e440)={0x1, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r3, r6}], 0x1, "e75459df3d4470"}) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f00000003c0)=@raw={'raw\x00', 0x8, 0x3, 0x270, 0x64000000, 0x4, 0xd0e0011, 0x0, 0xc6, 0x1d8, 0x1d8, 0x190, 0x1d8, 0x1d8, 0x3, 0x0, {[{{@ip={@multicast1, @multicast1, 0x0, 0x0, 'veth0_macvtap\x00', '\x00', {}, {}, 0x1}, 0x0, 0xd8, 0x100, 0x0, {}, [@common=@icmp={{0x28}, {0x0, "a7a9"}}, @common=@unspec=@connlimit={{0x40}}]}, @common=@unspec=@NFQUEUE1={0x28, 'NFQUEUE\x00', 0x3}}, {{@uncond, 0x0, 0x70, 0xd8}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x1a030000, 0x0, 'netbios-ns\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x31f) clone(0x208280, &(0x7f00000006c0)="849ddbb53078adaa6e60346d89608e55293e9418b6328f8762b67ea1dd4686abea62873f58015c480f40fb26de922a429273b99f71d1df08ca82fadf67b25a8588f486ab2704e22fba87967e5443d56a3b7fb02ca204b9d5c3b2754d3f5229195596a698b8b81c89522480baa3b105f3297fa75298b0155472880e329b7e090471e20383985672fb0654d9d2ecbab2029cf239f3c4ba4026a94a36e86277a72bc9234dd062dc509445e97742eda9ead69d32d022d42d2459cac25d1821c71593b98267", &(0x7f00000002c0), &(0x7f0000000300), &(0x7f00000007c0)="2cf75b21bef14faaba7c344cbe5c4bcf2eabe6b3a22b28c48529cc3f82b0bcd3b9805a330214bb730dc089ec87b184f36a4d8d038d5a6c7bcb8b9b765915e39aeae5ae4d5be1e2dacf5d52e6246c3483275182fe7d02af912b793d47271d1ab7bd12903e71474fce0ae69c4f92c3bc805e5dbb14cd3f9f36edcec612e4f65a0561e596edc6988a70bf394e4a7e7b5e3462") 17:27:49 executing program 3: readahead(0xffffffffffffffff, 0x1370, 0x9) r0 = openat(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x0) getdents(r0, 0x0, 0x27c6) getdents64(r0, 0x0, 0x0) utimensat(r0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0) ioctl$KVM_GET_DEBUGREGS(r0, 0x8080aea1, &(0x7f0000000080)) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x98, 0x91, 0xc3, 0x8, 0x8d1, 0x3, 0x3a3d, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x9, 0xb1, 0x16}}]}}]}}, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$printer(r1, 0x0, &(0x7f0000001080)={0x34, &(0x7f0000000dc0)={0x0, 0x0, 0x1, "cf"}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000cc0)={0x2c, &(0x7f0000000a40)={0x0, 0x0, 0x2, ']R'}, 0x0, 0x0, 0x0, 0x0}) [ 1398.594928][ T7421] usb 4-1: USB disconnect, device number 7 [ 1398.639351][ T9926] ubi0: detaching mtd0 17:27:49 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(0x0, &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1398.707269][ T9923] xt_NFQUEUE: number of total queues is 0 [ 1398.708545][ T9926] ubi0: mtd0 is detached 17:27:50 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1398.752672][ T9935] xt_NFQUEUE: number of total queues is 0 [ 1398.777684][ T9940] xt_NFQUEUE: number of total queues is 0 17:27:50 executing program 2: syz_open_procfs(0x0, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x0, &(0x7f0000130000/0x800000)=nil) r0 = perf_event_open(&(0x7f00000003c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c4b, 0x4101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x800}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x8100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = perf_event_open(&(0x7f0000000080)={0x3, 0x80, 0x1, 0x9, 0x7, 0x5, 0x0, 0xad, 0x802, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x0, @perf_bp={&(0x7f0000000040), 0xc}, 0x40804, 0x7, 0x1, 0x2, 0x1, 0x6, 0x1, 0x0, 0x40}, 0x0, 0x2, r0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) perf_event_open(&(0x7f00000001c0)={0x1, 0x80, 0x4, 0x0, 0x7, 0x0, 0x0, 0x7fffffff, 0x20440, 0xc, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x4, @perf_bp={&(0x7f0000000180), 0x6}, 0x40c4, 0x6, 0x0, 0x6, 0xd0, 0xfffffffc, 0xca53, 0x0, 0x3f92c1c5, 0x0, 0x3}, 0x0, 0x9, r1, 0x3) keyctl$describe(0x6, 0x0, &(0x7f0000000ec0)=""/204, 0xcc) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000000440)={0x0, [], 0x5, "a59f7995f969f9"}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r1, 0x81f8943c, &(0x7f000004e240)={0x0}) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x51c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = syz_open_dev$usbfs(&(0x7f0000000180), 0x77, 0x1) ioctl$USBDEVFS_IOCTL(r5, 0xc0105512, &(0x7f0000000040)=@usbdevfs_connect={0x0, 0x5517, 0x48000000}) ioctl$USBDEVFS_IOCTL(r5, 0x8108551b, &(0x7f0000000380)) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r5, 0x81f8943c, &(0x7f000005a700)={0x0, ""/256, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(r4, 0xd000943d, &(0x7f0000000440)={0x0, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, r6}], 0x5, "a59f7995f969f9"}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f000004e440)={0x1, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r3, r6}], 0x1, "e75459df3d4470"}) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f00000003c0)=@raw={'raw\x00', 0x8, 0x3, 0x270, 0x64000000, 0x4, 0xd0e0011, 0x0, 0xc6, 0x1d8, 0x1d8, 0x190, 0x1d8, 0x1d8, 0x3, 0x0, {[{{@ip={@multicast1, @multicast1, 0x0, 0x0, 'veth0_macvtap\x00', '\x00', {}, {}, 0x1}, 0x0, 0xd8, 0x100, 0x0, {}, [@common=@icmp={{0x28}, {0x0, "a7a9"}}, @common=@unspec=@connlimit={{0x40}}]}, @common=@unspec=@NFQUEUE1={0x28, 'NFQUEUE\x00', 0x3}}, {{@uncond, 0x0, 0x70, 0xd8}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x1a030000, 0x0, 'netbios-ns\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x31f) clone(0x208280, &(0x7f00000006c0)="849ddbb53078adaa6e60346d89608e55293e9418b6328f8762b67ea1dd4686abea62873f58015c480f40fb26de922a429273b99f71d1df08ca82fadf67b25a8588f486ab2704e22fba87967e5443d56a3b7fb02ca204b9d5c3b2754d3f5229195596a698b8b81c89522480baa3b105f3297fa75298b0155472880e329b7e090471e20383985672fb0654d9d2ecbab2029cf239f3c4ba4026a94a36e86277a72bc9234dd062dc509445e97742eda9ead69d32d022d42d2459cac25d1821c71593b98267", &(0x7f00000002c0), &(0x7f0000000300), &(0x7f00000007c0)="2cf75b21bef14faaba7c344cbe5c4bcf2eabe6b3a22b28c48529cc3f82b0bcd3b9805a330214bb730dc089ec87b184f36a4d8d038d5a6c7bcb8b9b765915e39aeae5ae4d5be1e2dacf5d52e6246c3483275182fe7d02af912b793d47271d1ab7bd12903e71474fce0ae69c4f92c3bc805e5dbb14cd3f9f36edcec612e4f65a0561e596edc6988a70bf394e4a7e7b5e3462") 17:27:50 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x4, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) [ 1399.013527][ T9950] xt_NFQUEUE: number of total queues is 0 17:27:50 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), 0x0, 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1399.084620][T24088] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 1399.109650][ T9957] xt_NFQUEUE: number of total queues is 0 [ 1399.109717][ T9955] ubi0: attaching mtd0 [ 1399.232815][ T9961] xt_NFQUEUE: number of total queues is 0 [ 1399.251926][ T9955] ubi0: scanning is finished [ 1399.287649][ T9965] xt_NFQUEUE: number of total queues is 0 17:27:50 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), 0x0, 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1399.334937][T24088] usb 4-1: Using ep0 maxpacket: 8 17:27:50 executing program 2: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(0xffffffffffffffff, 0xc0189379, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0}, './bus\x00'}) ioctl$VIDIOC_G_EXT_CTRLS(r2, 0xc0205647, &(0x7f0000000500)={0xf000000, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}) setsockopt$WPAN_SECURITY(r1, 0x0, 0x1, &(0x7f0000000300), 0x4) setsockopt$WPAN_SECURITY(0xffffffffffffffff, 0x0, 0x1, 0x0, 0x0) setsockopt$WPAN_SECURITY(r1, 0x0, 0x1, &(0x7f0000000280), 0x4) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000040), &(0x7f0000000080)=0xc) bind$802154_dgram(r1, &(0x7f0000000240)={0x24, @short={0x2, 0x1, 0xaaa0}}, 0x14) sendmmsg$sock(0xffffffffffffffff, &(0x7f0000002240), 0x0, 0x0) open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000000580), 0x10000005c) [ 1399.555925][ T9955] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1399.572491][ T9955] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1399.592808][ T9955] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1399.611433][ T9955] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1399.628672][T24088] usb 4-1: New USB device found, idVendor=08d1, idProduct=0003, bcdDevice=3a.3d [ 1399.654726][T24088] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1399.662814][T24088] usb 4-1: Product: syz [ 1399.669038][ T9955] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1399.685908][T24088] usb 4-1: Manufacturer: syz [ 1399.696977][ T9955] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1399.721844][T24088] usb 4-1: SerialNumber: syz [ 1399.737434][T24088] usb 4-1: config 0 descriptor?? 17:27:51 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1399.750235][ T9955] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 1204783369 [ 1399.775676][T24088] hub 4-1:0.0: bad descriptor, ignoring hub [ 1399.781625][T24088] hub: probe of 4-1:0.0 failed with error -5 [ 1399.804854][ T9955] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1399.825046][ T9975] ubi0: background thread "ubi_bgt0d" started, PID 9975 17:27:51 executing program 2: perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000380)) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000023c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) perf_event_open(0x0, 0xffffffffffffffff, 0x6, 0xffffffffffffffff, 0x9) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000240)=[@text32={0x20, &(0x7f0000000000)="66b8dc008ed866b837008ee02e0fc799a2b43f50650f07670f001e000167360fe169ad0f20e035200000000f22e0b9800000c00f3235000800000f30c4e1b1dbb75813a80f0f0018", 0x48}], 0x1, 0x49, 0x0, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) dup(r4) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41be, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000001680)=ANY=[], 0x50}}, 0x0) ioctl$BTRFS_IOC_ADD_DEV(r6, 0x5000940a, &(0x7f00000004c0)={{r4}, "36c1cb20e8ba51f7c0b8c7858308eb8b62de59be2433c7dae1f8134078d20cd5a75252c163d5a3db90e5be9fed53ed0e93b1746adc5f296f92b8d655802f1d875ac6a9983a6bb932118a1fb49e45bc0f7f863fb791b2bcda03dde798924c455e904e97a7e492e55dc9decca5afc146af1c65c3e359538e503a6ac1a5c2c6fe1f40683cbd6bec552baeca983162f95423e57d67b7f170282aecea77fadd78168832e649cebca92bcf962b3420e6f63ed043f886427cfab3bb6a4186fc4ef4650d4b28a672f4d7cffc0495b08c6ad270eb5e25ab69f410516b7443988d35ff213a84c3dcc564a22137452f95fc386c10ab6ad94083e1d023f62be534596c231d16ec0dbdaa320a74a9edbedee11390e595b0a974accec00f7c221d19fdd03386fcb7a714956ad69db630418f7a44a31cf99981f41bc753f89c8d8ac9d990d920ac390d70eae1df16491e6cb9f588a052003d2d6836130b954e735767a9cd6e25f1fe2238666dab38c5464f6a134a92cde21218611670f760851945f1d294ebd83104bb174464de580e898cae9c9c391a6001d389e8f5470537f06c9f541f2e1454c46766bdd9a8a176aa5fb5b548645af27c8a8b3968db325d87f98c95c5d3470e1508ebbfba182d02691fb7e13f869e7077590ffa73707e4296635291f18f3440f615316ef9402fbd0bf1eca44dae7f01c42ceb5063d8048429e486ccfdaf962f2d3075ce99f8a9e01a5eac158c0b3a338671a3409690741a8bff5b9e4f020a706384e5a0c45481a154806d776eccc274f4ddf627032d1f1b4f6e9a2cf7507e926871c721635b6f4124904d0e6ca5dbcb47b7b4e206a700e573134a9a84935e88c2094e50f0640255063bdcebb2b8fa88d058e15d9934851abd5a90e3e65767743464d9c4ec14d3f06bd7e4de2582fa6ce27826f4a38d4debc760e12fcbbac17426aa6cc353af7916c210213d99dc3d93db031ef8709583a45491f747028dc2ea4114326fcc4e39fc3b549f3b570b826373d8ec45134969676d2bc57aa73ea5ded8b3167be7c89c2d0c2e94b58a45b319be5ecc23df226a1ba883ebc91c6436b2e70dfaa8fa8ea79baf5d046cc33c80d927b373f2c84db31422a05bfb09f118855b2de39817668d79af3b8bc670bfed69950eedd9b015bff6e4ec0da37690064737d1a25ac92565644ae46bd29807fce96ba9f4a8f287529a2758eab93189bcc7d90462e7ed7a51eda451f45e2b6a290f3237b51d11ffe125722038ad1e39b5b130e4ed4c3337ebb55c4dd5d486025000f52880a018e5b1607a34b175b8452e3379526307d3bad76b5780556acf1ebaffa28ee17fcee8feec6e29baeeacbfcd3cb614698ca3a95bcaf4bea542d9cf70d503a32ba2662cd353412c2634262f3c871f8b1c50236c57f2f31cc762b3c29ea7b1629b0cc2ec008c99ac82b4e39f9a7781241ba6cb8098157a5d38332e7656b33c734763842deb2e943bf2ca400a4a95e113732d0af5501d33da819b81a76190df6a27570996a923dc02cd7d55a4ffe37ec77de71adfd3cae7d1905a52f691ca7323220633cea98f48d1b169822e372919e1778ea19c686cf9d36e76c46cbd42387d44f9776294dced00ef446035db8c9317d87a7192a035a5e098a779e1aea98f270bf17a52533a24f679cc250595b972bc4ae4fc8826d5f1c8421d1b931175eb2e3569afd3a04b7fa11adafe2da77c08f1dfd1e4d13d05274b146ca7a6489e94987103c129c3182484a18c9a4143a43adc6818b7391c3f2b260b4cb6209b1f00457fc0de71571e53d54b931c7537c5521e25efbc3b03c29dbbe91c902033757a9f1d8c3b4f25eca772a43bc1f06198c86ee213b1bd2a2782347749d5c26ebe6ece598676745dbd48f95429d927863a44f6e50f20a5c3b55171b758c208bebe414aea5c0984fb7b4dd29aacbe89a879d86ecb1c94da6959ec4d3e74a502085edc8cd340dc55b08b0d54ce7768ddf2186f1c155c6004db441879c660034d9f709b81f1898f30898521b3830f377f28e57b3281d516dfb79d1e8fc812d421ee006366653d6c4e224d2edb8173a7d75aeb7a4d1622e300c1449c74ff4644273cd9b3be0ef1d0c5f6b02660f833a65c58788282e4a43bacde1f66fa59278fea4239cdbb7c81fd689a9773dc9cc391e5541571634d527bb6ddae9ea83f1ab1d774d954339df3d8bb2871ec57a995dc5e5dea89e32cc135961919ab4cb47e0a31c5643bf311493f85116c53a9689d79124a8e4a8b1e7df2cd6750d9105b08eb78cf389cdf03a7fb20325d61d4259af75d7f40e25df0b6dda29975d98606c923153ce4ec1fd14f4a8009fe94df177e7ff098ea724fbade352c72e4658fef501fc96ed18397731ef20928b846e6f61b0503311d3718680b6962fb7056b10dd505c94a9b099d38b4a3c06e006fd0f84b410b4a07e2daf507d9d4bb1c219c5246e065199368bf468d8477dcae448cb85f7c1fb4d0f08b38808471fa9c91be0872145406e79f8e735ef78ee60316e0c67e2c24a4b4f618a07909243e8c5fb5fab757a35a3f44a7ccfc261b015c50b9823d4858547ccb340482c415c150bc01c4503c24fcf282fae6edeaf9af3e9e4cd84ebf4ed60041a40bc8835cc43c935ff51ebe15314ad3c94cfdee49ecba2625a3787d223e2156c2cfc0e3ffe3cf184bf1b6bb2bd2fadf00ea2c05038e41e77ec1c7b984ad0552cf33820d74a78b320c29ed41edaf06b8cbd6305292eabbddbab8c978a504b2c869a694c4b6bf7a2afd3eb824c3c172682275719064de4943f15ecc5fad42220ad4bacd8f0d195b4dad449e4e496a2794b51ad15c8a5fc870f014ba24d27d89b07e1ba79260bcf5270aecbcad1b905051e215c7b10df61c4f15cd40f13d3a811921638a3eaf2c0592dff29ba01a24071a5c550cc72c726d67e129a28eb28fd58d5acab0fce75f9ed05000c6658531073ad925d447bbc6e7b1b5346aad949d7e74679f229ac9191538f77467390287a4bbbe2509311ef437192f228703122aa3ad201cc7b3cbf88b62653f554ff2fc9254f4b5a77b0b71cf26c2e1cd1419155cdd0cc11fc31f1d3a8d9cfcccf97fe9e9f8641973081ee1fb359ba9a3ff8b7cf991d749c9febae3c3cc39c3a34247dea192cb10a2b4f613214f4f983616a403a4d059d853132ad9b7d049ba81e29c922f42db24044e980cae3b652cc48fe633dd774e9450fdcf6ec5576040338492a40120249c0eb0bb1802db1e26f1c0de39c869baee7e2aad7d4dce5debd30a3cd8431f52d6074aadaf9bd68b2a34a7eb2207e210632fe182489309ba270907a845f795d4e84f27d996a42b89b07ce61a552293725aa946425758a6b92749beb37b3c0de8c697b080cc2ff6ff76a18bdeb67dbc5b372e2d6faa54ed13e67a2b5e526e4b791c42e2b5284844e5a387ada36ec7c659767abd3c5b2dd0eb131df2100b9757c4f9ab19725dbb8666ebbc1acf7f2a8d042c9ccfcc5b745a2ab968b831d54fc2ddd43713eb7409e870b241c680693463618bf4a197c52c6c40065462e89ee3a5ba86dd56a26bc035921074068fa1e5fe765e3179f5243fba65526db13eedeca94d7fe7e3e78b4c7f0f2ab9d988446c6ac6b860c46f3542001ad74bb58251a1eadf2c7ee209f6c03e2c2a4a804d5fe318d91f65146309fd481b2a797d1212b6bdfce1c0b9414ab9831e744bdc8531f575b17b7aafe4cebeae18455d97776aa705a83a0bb73c5fa76d74fa1986f935955e70720546dc865f0ee99b16bcb0e5d1d91268fe5a9fdd123516b6752cba34dfc81529192a4254f99844ac080cdfaba9a1ec2dbe3684240ce30556c0b18f8f80fff7e69474328896b3fbce24bea2743be9b30d5ebac30374a37db2bd7ae2d58270dfa588030b76d76f28c50233c313bd29190907ff1267ecee4e0e1a6d77457cf066da49fc73dcf95c325e09f3f0799a4917e966505af159da640852f82d387fc3f2167ea1c7ab578643b36c01b72ad7377b686c57d89184929951edefb92621fbc2323fa9bbc0c70af9ae0ce6137ca2be3cde6dfd2111456274dfb95fb1ef8905514ddf8f2806a219c452f8de8086521a12bf2b36c8e6a9dcd50a053bd13fd461f32764b8348a2d04594704555f3c54e73478bcb2f5775ceb391d4301deb8c8e13d424981a333e7cc5d20bd1e71b1c9b3b16551f2c0e67f8248c1922362023f1cfb9674018edccac60a4f15742dcc9c68c58e971441617f96299d5a037520309720e23bce6518f1888af7dd1ccd5120fc8d21873d2c54babc12af72a5a28bda16a094c6445b4038d8016b002b790e9c40ea12f3bc5a2e635f48ef79d9731b079e76b4b832abce4c8493ccc084ce7dfb5c972a2a6916d194c738847aec6aec8e38c36f0a041c04fec498edb3d58e9dcbdb81a088e2157cf6591a6db59c87f87b181d6e57632260cbaab5e291f84d9d98d7843931c71b7486b2437e2b8122ecf019d273849b6b0be7c4b320bf878c722ab38d72096daff5c85a2fa3c851b542542e07998d1fbcf2c07715b29a55139575c4c2fdfb8bcb5cb70540a8fc425067277a2e2b1536c07e9497c7a6590a8e0907e856074db060354a3fc124d50eaac22a0cdacad4739ba17068313f590be946fa43ff1f3cdaab774d083e00239751ac1a3626a64bc99125edff681bbc52514c2cc6445eca4a6868233d2ec21d90baf90e93277e862645f1e15f2e6dae1c4daf04baacd46f7c361f72ca365147a35950eeda021f2d35dfed40bc8c3ab73e002816a741cb6f1c6b09f24cd3b35b2a1b0a8d32b6cb9dfcbf0ed929b82461a5152241930184bfb2557c3a2fb208dabf30cc618bee02daf87272fac966b07fe3acfa246b813eca5c2cef9d8015a01079aeae6eede5cd1cc52e76ffc2093b8adbce5701910c7597ae3101553556ce124c459d9ac712a28d23916e767b5739867cc9a2813a395a61dd1d6a5b6aa1cde12a49626bfb0fbbc0813a8e3aa386c579354affaa5e84977dc9ebf78ca985754138c3b127378548a0df0d9244aa28fc1e95491a60cb9b78990caf11a736c1fb3e1f549168285cb8605827332f2e8d43364a5d5661d322be92c888c4870bfc8870233d7e46249ce7a3d49428a7fcc2146e14f4794d7cfc895d598a9aaa536cffe05ac9da3eb63b080fca5ca3e1f4b7d4ded439b84a7744aa87f72a236d211932fed5c11dc0b747bab66a80a100cefb738ca83c2b29f8b5186bf1c9073a334ee09cead03a32e8db8c43e7602ab4366ec8769e167a89ef8d6eaf314125d01a2fbed712d3496f1f0063d8ba0efcac0b18e8c75feadd751e004369a8981820bafa83baa969b9bb53aebef5cde8042e0e8a61556e9c7415f96e18296f7703e969474f172e789f2db1f811b639bcac6fa15b20ca55cd3876ea3581d46b3cc5988453253f6ffd71948ef7b0ae5a8b44a96edc1a05cc295c79bf2faa69c18e7173f0526351e10d87633c9ef6322d69f82cb94b5593596937c24543d9c24e4be230e6fce6acbfc00faf73234853ef7e779a136e295132a6f5a183140553783280e10fb6d46498cd474c72f5cbd0cce80c829c8ec74e4b84c5d76d8bb637ed8af36b37204316e5f92b062b18e24e4bdf0ac3c76d061f9c12e6e174b34aa8aef0537787eac9f292a8a4ac40ba2b6a6f3f1a4f883f9164ec3415dd71a3bf152e36482c5e13f2a7f72b4b696321db3bdb1a93e2866a7a6766a38d253d92781a22bd868543af9bda031c0a61fbc78ade58e677c6f2a4d12be5867930392690c0e73b12e2"}) fcntl$setlease(r5, 0x400, 0x0) openat$vcsu(0xffffffffffffff9c, &(0x7f00000000c0), 0x8000, 0x0) 17:27:51 executing program 5: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000380)) r4 = perf_event_open$cgroup(&(0x7f0000000200)={0x0, 0x80, 0xfb, 0x2, 0x7, 0x1, 0x0, 0x7, 0x100, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_config_ext={0x7, 0x3}, 0x1400, 0x6, 0x7, 0x0, 0x2, 0x9, 0x3, 0x0, 0x9911, 0x0, 0x80000000}, 0xffffffffffffffff, 0xd, r0, 0x3) perf_event_open(&(0x7f00000000c0)={0x3, 0x80, 0x48, 0x7, 0xf8, 0x2, 0x0, 0x9, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x8, 0x0, @perf_bp={&(0x7f0000000040), 0xa}, 0x10, 0x2, 0xff, 0x0, 0x0, 0x3ff, 0x7, 0x0, 0x3ff, 0x0, 0x8000}, r3, 0xffffffffffffffff, r4, 0x1) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) sendmmsg(r1, &(0x7f0000000280)=[{{0x0, 0x7, 0x0, 0x7, 0x0, 0x0, 0xf4010000}}], 0x400000000000085, 0x0) 17:27:51 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x4, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) [ 1400.114582][ T9994] ubi0: detaching mtd0 [ 1400.141513][ T9994] ubi0: mtd0 is detached [ 1400.272147][ T9994] ubi0: attaching mtd0 [ 1400.379304][ T9994] ubi0: scanning is finished [ 1400.731097][ T9994] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1400.752000][ T9994] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1400.772198][ T9994] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1400.782076][ T9994] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1400.808779][ T9994] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1400.821529][ T9994] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1400.834588][ T9994] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 1204783369 [ 1400.854011][ T9994] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1400.878903][T10006] ubi0: background thread "ubi_bgt0d" started, PID 10006 [ 1401.114946][T24088] pegasus 4-1:0.0: can't reset MAC [ 1401.120228][T24088] pegasus: probe of 4-1:0.0 failed with error -5 [ 1401.165865][T24088] usb 4-1: USB disconnect, device number 8 [ 1401.844520][T24088] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 1402.084517][T24088] usb 4-1: Using ep0 maxpacket: 8 [ 1402.364482][T24088] usb 4-1: New USB device found, idVendor=08d1, idProduct=0003, bcdDevice=3a.3d [ 1402.373554][T24088] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1402.387157][T24088] usb 4-1: Product: syz [ 1402.391350][T24088] usb 4-1: Manufacturer: syz [ 1402.398973][T24088] usb 4-1: SerialNumber: syz [ 1402.415372][T24088] usb 4-1: config 0 descriptor?? [ 1402.455103][T24088] hub 4-1:0.0: bad descriptor, ignoring hub [ 1402.461042][T24088] hub: probe of 4-1:0.0 failed with error -5 17:27:53 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), 0x0, 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:27:53 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:27:53 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x4, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) 17:27:53 executing program 5: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000380)) r4 = perf_event_open$cgroup(&(0x7f0000000200)={0x0, 0x80, 0xfb, 0x2, 0x7, 0x1, 0x0, 0x7, 0x100, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_config_ext={0x7, 0x3}, 0x1400, 0x6, 0x7, 0x0, 0x2, 0x9, 0x3, 0x0, 0x9911, 0x0, 0x80000000}, 0xffffffffffffffff, 0xd, r0, 0x3) perf_event_open(&(0x7f00000000c0)={0x3, 0x80, 0x48, 0x7, 0xf8, 0x2, 0x0, 0x9, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x8, 0x0, @perf_bp={&(0x7f0000000040), 0xa}, 0x10, 0x2, 0xff, 0x0, 0x0, 0x3ff, 0x7, 0x0, 0x3ff, 0x0, 0x8000}, r3, 0xffffffffffffffff, r4, 0x1) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) sendmmsg(r1, &(0x7f0000000280)=[{{0x0, 0x7, 0x0, 0x8, 0x0, 0x0, 0xf4010000}}], 0x400000000000085, 0x0) 17:27:53 executing program 3: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x98, 0x91, 0xc3, 0x8, 0x8d1, 0x3, 0x3a3d, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x9, 0xb1, 0x16}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000300)={0x24, &(0x7f0000000080)={0x40, 0x11, 0xfb, {0xfb, 0x11, "97ca3c85c0f6f4fc64061292c269af4dbf3bbf6d6881cfefe236987251f5a186e4ce9741bd1b527e58936dae355f110cc8708d2f4d1aed0b99d048e32fb76af1512367bb97d16084fbb542774a02cfc66757407781b376ba9f83560c8a2771d68027aea0ffa394a8a85972672c4b0f8d6527f7bd02c86b570977255c42d79b058a1493a833ffd072c3429dabafcc745884a63a3dcdfb0fa70bb6dd7a76d4ae95b4aac3b914b95fcff4a0fda7bc68428e396e56ac7a6cdb94124f5d61073948fde9b8c1fafb65e6e223ae88d914c5b7e6fbab18c249d6ed488d3ee62ccd7a34f032906fc26d5b5a33b3576cd4f4c4dc1b5ca92701f2db6858b1"}}, &(0x7f00000001c0)={0x0, 0x3, 0xc2, @string={0xc2, 0x3, "075d1bd89196d8af60a37a445b4ffb39825de600f716559dff07acfd508bee144e7fca183de8e2f4d26dda50b08cd02f746ba7b0510db573fdfe35b86f7330f2581b3bb63c3a2c274b6c15eea37fe7daaf64f8d07731d2385fff63d29aeece363ed193da12fc1c914f40d27c467bd8c9a056027af500af05dfb75f64b5df1505cf533f8f086eb7c1c2e1d7a05736bb55e358469267408c39460989b295a86c183d02252eec07a946ed4dc677e3c43dc898ff217c646e3144c37a576f5a9d91d1"}}, &(0x7f0000000000)={0x0, 0x22, 0x20, {[@main=@item_4={0x3, 0x0, 0x8, "e8fa38d3"}, @local=@item_012={0x2, 0x2, 0x1, 'j['}, @main=@item_4={0x3, 0x0, 0xb, "cb66be39"}, @global=@item_4={0x3, 0x1, 0xa, "67f146f9"}, @global=@item_012={0x2, 0x1, 0x9, "5fe1"}, @main=@item_4={0x3, 0x0, 0x8, "d624f1a5"}, @local=@item_4={0x3, 0x2, 0x0, "97bfe86c"}, @global]}}, &(0x7f00000002c0)={0x0, 0x21, 0x9, {0x9, 0x21, 0x6, 0x4, 0x1, {0x22, 0x5a}}}}, &(0x7f0000000580)={0x2c, &(0x7f0000000340)={0x40, 0x5, 0x40, "802ffb7ec0e551a6632485ce59e6d66186d38e11e586e4343850ef93f3e9a5e53fc2c34571472f35563727c734c30675655d577d83fe0d53477a7eec8131776b"}, &(0x7f00000003c0)={0x0, 0xa, 0x1}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x7f}, &(0x7f0000000440)={0x20, 0x1, 0xc1, "12eb3e261297c4ccbf5588a5cd5cb2208487ee2547357cae4efe11ecbd41bfcb29dfab3cdea45a66a66eba1f018dd01d836decaf9e1827cf1c6312c6ec6cd3c9d787e8a15e10e0507a8658679164c09c443d0f6f4c100393af465303bc2e9e6f02cf27f72ff38d930933ba48816d48624e4d51cbc71b9c09b332119cefaea2294e10c823b165cad6bb7c8e4320e8744f06fdd35ba45f098792ba4d52730965a49bf4c6109bdceba970966aac578560f1cfdb763f9a31b3ec500a636a2d25e3f410"}, &(0x7f0000000540)={0x20, 0x3, 0x1, 0x1}}) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000001080)={0x34, &(0x7f0000000dc0)={0x0, 0x0, 0x1, "cf"}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000cc0)={0x2c, &(0x7f0000000a40)={0x0, 0x0, 0x2, ']R'}, 0x0, 0x0, 0x0, 0x0}) 17:27:53 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x4, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) [ 1402.584699][T24088] pegasus: probe of 4-1:0.0 failed with error -71 [ 1402.599298][T10041] ubi0: detaching mtd0 [ 1402.616581][T10041] ubi0: mtd0 is detached [ 1402.645347][T24088] usb 4-1: USB disconnect, device number 9 [ 1402.703948][T10042] ubi0: attaching mtd0 [ 1402.759216][T10054] nfqueue_tg_check: 1 callbacks suppressed [ 1402.759237][T10054] xt_NFQUEUE: number of total queues is 0 17:27:54 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x0, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1402.852637][T10058] xt_NFQUEUE: number of total queues is 0 [ 1402.921740][T10042] ubi0: scanning is finished [ 1403.224599][T13278] usb 4-1: new high-speed USB device number 10 using dummy_hcd 17:27:54 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:27:54 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x0, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1403.455865][T10072] xt_NFQUEUE: number of total queues is 0 [ 1403.473329][T10042] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 1403.514421][T13278] usb 4-1: Using ep0 maxpacket: 8 [ 1403.535406][T10041] ubi0: attaching mtd0 [ 1403.540948][T10041] ubi0: scanning is finished 17:27:54 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x4, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) [ 1403.665340][T10041] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 17:27:54 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x4, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) 17:27:55 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x0, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1403.740335][T10081] xt_NFQUEUE: number of total queues is 0 17:27:55 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1403.844689][T13278] usb 4-1: New USB device found, idVendor=08d1, idProduct=0003, bcdDevice=3a.3d [ 1403.853927][T13278] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1403.880457][T13278] usb 4-1: Product: syz [ 1403.895664][T13278] usb 4-1: Manufacturer: syz [ 1403.897935][T10092] ubi0: attaching mtd0 [ 1403.914743][T13278] usb 4-1: SerialNumber: syz [ 1403.952085][T13278] usb 4-1: config 0 descriptor?? [ 1404.003085][T10092] ubi0: scanning is finished [ 1404.057427][T13278] hub 4-1:0.0: bad descriptor, ignoring hub [ 1404.067716][T13278] hub: probe of 4-1:0.0 failed with error -5 [ 1404.123250][T10103] xt_NFQUEUE: number of total queues is 0 17:27:55 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1404.209312][T10110] xt_NFQUEUE: number of total queues is 0 17:27:55 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x0, 0x0, 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1404.345213][T10092] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1404.353774][T10092] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1404.384398][T10092] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1404.392257][T10092] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1404.421500][T10092] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1404.451143][T10092] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1404.463834][T10119] xt_NFQUEUE: number of total queues is 0 [ 1404.486325][T10092] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 1204783369 [ 1404.535862][T10092] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1404.575353][T10115] ubi0: background thread "ubi_bgt0d" started, PID 10115 17:27:55 executing program 5: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000380)) r4 = perf_event_open$cgroup(&(0x7f0000000200)={0x0, 0x80, 0xfb, 0x2, 0x7, 0x1, 0x0, 0x7, 0x100, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_config_ext={0x7, 0x3}, 0x1400, 0x6, 0x7, 0x0, 0x2, 0x9, 0x3, 0x0, 0x9911, 0x0, 0x80000000}, 0xffffffffffffffff, 0xd, r0, 0x3) perf_event_open(&(0x7f00000000c0)={0x3, 0x80, 0x48, 0x7, 0xf8, 0x2, 0x0, 0x9, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x8, 0x0, @perf_bp={&(0x7f0000000040), 0xa}, 0x10, 0x2, 0xff, 0x0, 0x0, 0x3ff, 0x7, 0x0, 0x3ff, 0x0, 0x8000}, r3, 0xffffffffffffffff, r4, 0x1) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) sendmmsg(r1, &(0x7f0000000280)=[{{0x0, 0x7, 0x0, 0x9, 0x0, 0x0, 0xf4010000}}], 0x400000000000085, 0x0) [ 1404.582565][T10098] ubi0: detaching mtd0 [ 1404.602171][T10098] ubi0: mtd0 is detached [ 1405.344540][T13278] pegasus 4-1:0.0: can't reset MAC [ 1405.349829][T13278] pegasus: probe of 4-1:0.0 failed with error -5 [ 1405.405626][T13278] usb 4-1: USB disconnect, device number 10 [ 1406.104240][ T7421] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 1406.354169][ T7421] usb 4-1: Using ep0 maxpacket: 8 [ 1406.664364][ T7421] usb 4-1: New USB device found, idVendor=08d1, idProduct=0003, bcdDevice=3a.3d [ 1406.673634][ T7421] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1406.687518][ T7421] usb 4-1: Product: syz [ 1406.691702][ T7421] usb 4-1: Manufacturer: syz [ 1406.698127][ T7421] usb 4-1: SerialNumber: syz [ 1406.713747][ T7421] usb 4-1: config 0 descriptor?? 17:27:57 executing program 3: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x98, 0x91, 0xc3, 0x8, 0x8d1, 0x3, 0x3a3d, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x9, 0xb1, 0x16}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_connect$cdc_ncm(0x6, 0x197, &(0x7f0000000080)={{0x12, 0x1, 0x310, 0x2, 0x0, 0x0, 0x20, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x185, 0x2, 0x1, 0x20, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x9, 0x24, 0x6, 0x0, 0x1, 'BMN\x00'}, {0x5, 0x24, 0x0, 0x1}, {0xd, 0x24, 0xf, 0x1, 0x6, 0x9, 0x6, 0x62}, {0x6, 0x24, 0x1a, 0x3, 0x10}, [@dmm={0x7, 0x24, 0x14, 0xffff, 0x7}, @obex={0x5, 0x24, 0x15, 0x32ea}, @network_terminal={0x7, 0x24, 0xa, 0x5, 0x6, 0x10, 0xff}, @country_functional={0x12, 0x24, 0x7, 0xf9, 0x2, [0x7, 0x1, 0x1, 0x0, 0xffff, 0x20]}, @country_functional={0xc, 0x24, 0x7, 0xad, 0x0, [0x1, 0x4, 0x401]}, @mdlm_detail={0xf4, 0x24, 0x13, 0x1f, "1ecb35f6f5a85168a970cb3edc59376eec0ddd31e12bd1448d2a1d6c58cc3654f1981f341a2b919a0fe1d61218b06c3a55838ae635981e5e37a1e60752300e018df0dd86330595ba0abacd4ada85ce520bfd71c979dcb3534d24e0dce2980258f33e87ca379d999a2c3f7f00d71b768fcd54c31e27818650f67e70bdb7c88a1864b0d2e5b9755c2b07e86c34f39679b7117599e81bc6c6e6e1af813cd83ff9af09d687122a3a4fceedcced28ca18e375e7129f4fb96a5f3e46d61677fb89889fc125da284441f169e5283ddbcd110a13c3abc70854bbc7e756d27b3567646799133bb302f1b8b36489ab6441ea10f584"}]}, {{0x9, 0x5, 0x81, 0x3, 0x8, 0x3f, 0x9, 0xff}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x3ff, 0x4, 0x4, 0x6}}, {{0x9, 0x5, 0x3, 0x2, 0x20, 0x0, 0xc0, 0xfc}}}}}}}]}}, &(0x7f00000004c0)={0xa, &(0x7f0000000240)={0xa, 0x6, 0x310, 0x4, 0x1f, 0x54, 0x10}, 0xf, &(0x7f0000000280)={0x5, 0xf, 0xf, 0x2, [@ptm_cap={0x3}, @ext_cap={0x7, 0x10, 0x2, 0xa, 0xd, 0xf, 0x91}]}, 0x6, [{0x4, &(0x7f00000002c0)=@lang_id={0x4, 0x3, 0x446}}, {0x1c, &(0x7f0000000300)=@string={0x1c, 0x3, "4a97cd29b772e7ff6703f1543209debd0037b976eebc7e48a0e1"}}, {0x4, &(0x7f0000000340)=@lang_id={0x4, 0x3, 0x406}}, {0x70, &(0x7f0000000380)=@string={0x70, 0x3, "54ec9eba724bba1ae9f8c2512af4005fb01b2e372112a055155ef028ca0229adb93a87c01e8be760334f407efdc3d0a04254950e897fce7b2ab01274b9e1126777df23a619ce1eda69b0516505153f8a11250eb80b51e3c9d707c780cdd23d8a0f4f4afd246500cb883a1cb36633"}}, {0x55, &(0x7f0000000400)=@string={0x55, 0x3, "ce63c47b2b4160ea0c49fc298ff254a74d569fc312de998ef6ee91ae68fbcc510c98f0de64385950f2f6eacefd948163c3441f9cf1f6eeace33b41b6a77c7acf4daab9e8d425aad3f62b9b0f6b00f2d0eb4a54"}}, {0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x401}}]}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000001080)={0x34, &(0x7f0000000000)={0x0, 0x0, 0x8, "5747264babd42720"}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000cc0)={0x2c, &(0x7f0000000a40)={0x0, 0x0, 0x2, ']R'}, 0x0, 0x0, 0x0, 0x0}) 17:27:57 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x0, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x4, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) 17:27:57 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:27:57 executing program 2: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xfffffff7ffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f0000000040)=0x4) r1 = socket$rds(0x15, 0x5, 0x0) bind$rds(r1, &(0x7f0000000180)={0x2, 0x0, @dev}, 0x10) sendmsg$rds(r1, &(0x7f0000001600)={&(0x7f0000000000)={0x2, 0x0, @remote}, 0x10, 0x0, 0x0, &(0x7f00000001c0)=[@cswp={0x58, 0x114, 0x7, {{}, &(0x7f0000000080), 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}}], 0x58}, 0x0) 17:27:57 executing program 5: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000380)) r4 = perf_event_open$cgroup(&(0x7f0000000200)={0x0, 0x80, 0xfb, 0x2, 0x7, 0x1, 0x0, 0x7, 0x100, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_config_ext={0x7, 0x3}, 0x1400, 0x6, 0x7, 0x0, 0x2, 0x9, 0x3, 0x0, 0x9911, 0x0, 0x80000000}, 0xffffffffffffffff, 0xd, r0, 0x3) perf_event_open(&(0x7f00000000c0)={0x3, 0x80, 0x48, 0x7, 0xf8, 0x2, 0x0, 0x9, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x8, 0x0, @perf_bp={&(0x7f0000000040), 0xa}, 0x10, 0x2, 0xff, 0x0, 0x0, 0x3ff, 0x7, 0x0, 0x3ff, 0x0, 0x8000}, r3, 0xffffffffffffffff, r4, 0x1) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) sendmmsg(r1, &(0x7f0000000280)=[{{0x0, 0x7, 0x0, 0xa, 0x0, 0x0, 0xf4010000}}], 0x400000000000085, 0x0) 17:27:57 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x0, 0x0, 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1406.790464][ T7421] usb 4-1: can't set config #0, error -71 [ 1406.815965][ T7421] usb 4-1: USB disconnect, device number 11 [ 1406.923681][T10164] xt_NFQUEUE: number of total queues is 0 [ 1406.970711][T10162] ubi0: attaching mtd0 17:27:58 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x0, 0x0, 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1407.037538][T10158] xt_NFQUEUE: number of total queues is 0 [ 1407.096942][T10162] ubi0: scanning is finished [ 1407.103583][T10159] atomic_op ffff88807d6ed198 conn xmit_atomic 0000000000000000 [ 1407.176212][T10174] atomic_op ffff88807b82d198 conn xmit_atomic 0000000000000000 17:27:58 executing program 2: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xfffffff7ffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f0000000040)=0x4) r1 = socket$rds(0x15, 0x5, 0x0) bind$rds(r1, &(0x7f0000000180)={0x2, 0x0, @dev}, 0x10) sendmsg$rds(r1, &(0x7f0000001600)={&(0x7f0000000000)={0x2, 0x0, @remote}, 0x10, 0x0, 0x0, &(0x7f00000001c0)=[@cswp={0x58, 0x114, 0x7, {{}, &(0x7f0000000080), 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}}], 0x58}, 0x0) 17:27:58 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x0, &(0x7f00000025c0), 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1407.298372][T10176] xt_NFQUEUE: number of total queues is 0 [ 1407.459938][T10185] atomic_op ffff88807876d998 conn xmit_atomic 0000000000000000 [ 1407.474130][ T7421] usb 4-1: new high-speed USB device number 12 using dummy_hcd 17:27:58 executing program 2: perf_event_open(&(0x7f00000003c0)={0x2, 0x80, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext={0x0, 0x20}, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x200f72}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000000000)=ANY=[@ANYBLOB="0180c2000000aaaaaaaaaa00080045000030000000000001907864010102ac1414aa030090150300183f450000000000000000000000ac14140aac1414bb"], 0x0) 17:27:58 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x0, &(0x7f00000025c0), 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1407.631556][T10162] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1407.642165][T10162] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1407.653876][T10162] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1407.674640][T10162] ubi0: VID header offset: 64 (aligned 64), data offset: 128 17:27:58 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1407.685158][T10162] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1407.704740][T10162] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1407.762910][T10162] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 1204783369 [ 1407.784787][ T7421] usb 4-1: Using ep0 maxpacket: 8 [ 1407.856062][T10162] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1407.858376][T10194] nfqueue_tg_check: 1 callbacks suppressed [ 1407.858440][T10194] xt_NFQUEUE: number of total queues is 0 [ 1407.915611][T10190] ubi0: background thread "ubi_bgt0d" started, PID 10190 [ 1407.931026][T10199] xt_NFQUEUE: number of total queues is 0 [ 1408.114483][ T7421] usb 4-1: New USB device found, idVendor=08d1, idProduct=0003, bcdDevice=3a.3d [ 1408.128157][ T7421] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1408.148201][ T7421] usb 4-1: Product: syz [ 1408.152435][ T7421] usb 4-1: Manufacturer: syz [ 1408.158703][ T7421] usb 4-1: SerialNumber: syz [ 1408.168720][ T7421] usb 4-1: config 0 descriptor?? [ 1408.204982][ T7421] hub 4-1:0.0: bad descriptor, ignoring hub [ 1408.210964][ T7421] hub: probe of 4-1:0.0 failed with error -5 [ 1409.524099][ T7421] pegasus 4-1:0.0: can't reset MAC [ 1409.529407][ T7421] pegasus: probe of 4-1:0.0 failed with error -5 [ 1409.575169][ T7421] usb 4-1: USB disconnect, device number 12 [ 1410.263940][T24097] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 1410.503948][T24097] usb 4-1: Using ep0 maxpacket: 8 17:28:02 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x0, &(0x7f00000025c0), 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:28:02 executing program 2: mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1000009, 0x11, 0xffffffffffffffff, 0xdbc2a000) r0 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000740)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0x1b1c, 0x1b09, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x40, 0x0, 0xff, [{{0x9, 0x4, 0x0, 0x2, 0x2, 0x3, 0x1, 0x2, 0x0, {0x9, 0x21, 0x8001, 0x81, 0x1, {0x22, 0x2fb}}, {{{0x9, 0x5, 0x81, 0x3, 0x20, 0x1}}}}}]}}]}}, &(0x7f0000000c40)={0xa, &(0x7f0000000900)={0xa, 0x6, 0x50, 0x7f, 0x40, 0x7, 0x8, 0x40}, 0x3d, &(0x7f0000000940)={0x5, 0xf, 0x3d, 0x5, [@ssp_cap={0x10, 0x10, 0xa, 0x5, 0x1, 0x6, 0x8800, 0x101, [0xff00cf]}, @generic={0x16, 0x10, 0xf56c3add4a8012d9, "164945007d184fd1b4e1f584463f102af025f3"}, @ptm_cap={0x3}, @ssp_cap={0xc, 0x10, 0xa, 0x9, 0x0, 0x9, 0xf00, 0xd78}, @ptm_cap={0x3}]}, 0x9, [{0x2, &(0x7f0000000980)=@string={0x2}}, {0x4, &(0x7f00000009c0)=@lang_id={0x4}}, {0x4, &(0x7f0000000a00)=@lang_id={0x4, 0x3, 0x340a}}, {0x4, &(0x7f0000000a40)=@lang_id={0x4, 0x3, 0x401}}, {0x66, &(0x7f0000000a80)=@string={0x66, 0x3, "2888f223abca5dd6bbc91709cf4e471f6f6a3e02e48597c50feba2dea8941e5bddc19864772ae6ab72ad3e510e0dc79a7730e9d393d48d04bc961bbfb48a3795eb1af1a43f11692f6eea61e59df4fe63f180d7a94babce83c9ed233ecc7926ef54c5dcba"}}, {0x4, &(0x7f0000000b00)=@lang_id={0x4, 0x3, 0x81a}}, {0x4, &(0x7f0000000b40)=@lang_id={0x4, 0x3, 0x443}}, {0x4, &(0x7f0000000b80)=@lang_id={0x4, 0x3, 0x458}}, {0x60, &(0x7f0000000bc0)=@string={0x60, 0x3, "4396c6349a0d556c429f0712e6740862e347f98e553aa772dd70ee7fd13a2e42ee0fa259484b980d0ebcde376fb71b2460c6fc42c06b8552be202c90d477a3a1bc237bc9fc11b46a6c4fd03fab81cb0f89c787859658bbddf992a2801e05"}}]}) syz_usb_control_io(r0, &(0x7f0000000380)={0x2c, &(0x7f0000000200)={0x40, 0x37, 0xf8, {0xf8, 0x10, "54aaceba24a56da1511f1c8b385cbd4747adef50d890d1a6f2fbac4a27847e577f742279538a3634b19a34eb5985eadd9b270ebc8fa3fb4ea3c063e695833c80e6979a3e64ce1394b0f364c0e45e74ec96a1a9771880e2510c6b42bbbcec2dadad5f97b8d20eb977f35f2c3749f5beccc36065a8c28b3303973713b6e1e69f5e48a5cf5eb99b734c533e3bfb6901e2968c1d59b49aa55f14e5868cc8297e63a5c750a0b2b6629b208e9d1306ef8642e36f54370783ab230431ee99ecc14562360e5e19043654e97e489be4c2531f5b8123c8198b4846bd319b6158292de869d45a3fe24903f78cc44785aed1bb4b56c53342426ce9ee"}}, &(0x7f0000000100)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x1c01}}, &(0x7f00000008c0)={0x0, 0xf, 0x25, {0x5, 0xf, 0x25, 0x1, [@ssp_cap={0x20, 0x10, 0xa, 0x6, 0x5, 0xbf, 0xf008, 0x0, [0xff000f, 0x1fbf, 0xc00f, 0xffff, 0x3ff0]}]}}, &(0x7f0000000300)={0x20, 0x29, 0xf, {0xf, 0x29, 0x8, 0x10, 0x5, 0x5, "6174db08", "00e000"}}, &(0x7f0000000340)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x0, 0x80, 0x40, 0x1, 0x40, 0xffff, 0x3}}}, &(0x7f0000000800)={0x84, &(0x7f00000003c0)={0x0, 0x13, 0x75, "f2ab5f06f782f09780d17bd14a1c9f29d0cba5e47f191c2febed2125c04f89a5aa1f7f8d4ede98f6d6cb45cd8f99ddee5bc8de2a550fc6a85c0d3beaf34490c913546107b8d2374aeae16782d1291e6be17cb85be6c099f27f75e94df18c8aff5f0edcfa5bc810c6542d48cb8416028c8a7081d5b4"}, &(0x7f0000000440)={0x0, 0xa, 0x1, 0x4}, &(0x7f0000000480)={0x0, 0x8, 0x1, 0x9}, &(0x7f0000000140)={0x20, 0x0, 0x4, {0x3}}, &(0x7f0000000500)={0x20, 0x0, 0x8, {0x1, 0x39, [0xf00]}}, &(0x7f00000004c0)={0x40, 0x7, 0x2, 0x100}, &(0x7f0000000580)={0x40, 0x9, 0x1, 0x4}, &(0x7f00000005c0)={0x40, 0xb, 0x2, "0316"}, &(0x7f0000000600)={0x40, 0xf, 0x2, 0xff55}, &(0x7f0000000640)={0x40, 0x13, 0x6, @random="f621b47573ea"}, &(0x7f0000000680)={0x40, 0x17, 0x6, @random="54802ef8cff0"}, &(0x7f00000006c0)={0x40, 0x19, 0x2}, &(0x7f0000000700)={0x40, 0x1a, 0x2, 0xf358}, &(0x7f0000000540)={0x40, 0x1c, 0x1}, &(0x7f0000000780)={0x40, 0x1e, 0x1, 0x7f}, &(0x7f00000007c0)={0x40, 0x21, 0x1, 0x20}}) r1 = socket$kcm(0x29, 0x2, 0x0) setsockopt$kcm_KCM_RECV_DISABLE(r1, 0x119, 0x1, &(0x7f0000000000)=0x2, 0x4) openat(0xffffffffffffffff, &(0x7f0000000d00)='./file0\x00', 0x10000, 0x1) r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/kcm\x00') preadv(r2, &(0x7f0000000180)=[{&(0x7f0000000040)=""/144, 0x90}], 0x1, 0x2, 0x0) 17:28:02 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:28:02 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x0, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x4, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) 17:28:02 executing program 5: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000380)) r4 = perf_event_open$cgroup(&(0x7f0000000200)={0x0, 0x80, 0xfb, 0x2, 0x7, 0x1, 0x0, 0x7, 0x100, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_config_ext={0x7, 0x3}, 0x1400, 0x6, 0x7, 0x0, 0x2, 0x9, 0x3, 0x0, 0x9911, 0x0, 0x80000000}, 0xffffffffffffffff, 0xd, r0, 0x3) perf_event_open(&(0x7f00000000c0)={0x3, 0x80, 0x48, 0x7, 0xf8, 0x2, 0x0, 0x9, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x8, 0x0, @perf_bp={&(0x7f0000000040), 0xa}, 0x10, 0x2, 0xff, 0x0, 0x0, 0x3ff, 0x7, 0x0, 0x3ff, 0x0, 0x8000}, r3, 0xffffffffffffffff, r4, 0x1) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) sendmmsg(r1, &(0x7f0000000280)=[{{0x0, 0x7, 0x0, 0xe, 0x0, 0x0, 0xf4010000}}], 0x400000000000085, 0x0) [ 1410.784362][T24097] usb 4-1: New USB device found, idVendor=08d1, idProduct=0003, bcdDevice=3a.3d [ 1410.793555][T24097] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1410.813983][T24097] usb 4-1: Product: syz [ 1410.818283][T24097] usb 4-1: Manufacturer: syz [ 1410.823000][T24097] usb 4-1: SerialNumber: syz [ 1410.865441][T24097] usb 4-1: config 0 descriptor?? [ 1410.904123][T24097] usb 4-1: can't set config #0, error -71 [ 1410.920135][T24097] usb 4-1: USB disconnect, device number 13 17:28:02 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1410.982894][T10233] ubi0: detaching mtd0 [ 1410.998077][T10230] xt_NFQUEUE: number of total queues is 0 [ 1411.016769][T10233] ubi0: mtd0 is detached 17:28:02 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{0x0, 0x0, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1411.064631][T10231] xt_NFQUEUE: number of total queues is 0 [ 1411.069443][T10233] ubi0: attaching mtd0 [ 1411.083394][T10233] ubi0: scanning is finished 17:28:02 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1411.231159][T10244] xt_NFQUEUE: number of total queues is 0 [ 1411.274359][ T7421] usb 3-1: new low-speed USB device number 39 using dummy_hcd [ 1411.367379][T10233] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1411.390096][T10233] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes 17:28:02 executing program 3: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x98, 0x91, 0xc3, 0x8, 0x8d1, 0x3, 0x3a3d, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x9, 0xb1, 0x16}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000001080)={0x34, &(0x7f0000000dc0)={0x0, 0x0, 0x1, "cf"}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000cc0)={0x2c, &(0x7f0000000a40)={0x0, 0x0, 0x2, ']R'}, 0x0, 0x0, 0x0, 0x0}) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000840)={{0x12, 0x1, 0x0, 0x85, 0x37, 0x4, 0x8, 0x61d, 0xc020, 0x715, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xa3, 0xd9, 0x12}}]}}]}}, 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000001280)={0x84, &(0x7f0000000000)={0x0, 0x0, 0x3, "4e8ef6"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r1, &(0x7f0000000180)={0x14, &(0x7f0000000080)={0x40, 0x21, 0xcc, {0xcc, 0x7, "8c6886ca8b2ab96c086433311a9d29ffa16f67c07c211d688957ea2ec57b74416fe4e638d7128a7eba767d2f2e6ad3f33113aaa56d7ad5726bea9e446acc07f32ff6c67de552da7a108ada1d8c698ad02490ca4d579f52d2a1a8a4e5e341330c44a2e62ac1fbb4c1b1134d8f3d1fbd469bfa2a9225b4c9fd5e1f9a9d815015dc814228f49a03290a1a9341d562e1632fddba588f0fc898e0978b52e418b8ebda356f0b72403a1daeba8d185830e0860841dbfffb6bd10939e42638b4c3933b86da226f702e163b598525"}}, &(0x7f0000000000)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000400)={0x44, &(0x7f00000001c0)={0x0, 0x12, 0xb3, "6b281b97140d520d1cdf265b649c25c22d78e0a0d2a4995a58cf9f697e377eeaf5665ba32465202eb178ff02a3c776fa7f7e422dbc989cc0d59801ef0ec2afccd063ca25a9461ee60c29c5471c818e42be6618f6d280dc80c53486866a55381abb3415a1527b87e80b14384494e2f1b1f3161fca0570b2c4e0b2b5f059e4b427c32087501c1bc236d57c8f90622969f99bfa7b2b9e46417e7d02c2830c2cfcb7e9d1f58dcee307049f425eb5efe7e777d9de43"}, &(0x7f0000000280)={0x0, 0xa, 0x1, 0x7f}, &(0x7f00000002c0)={0x0, 0x8, 0x1, 0xf7}, &(0x7f0000000300)={0x20, 0x80, 0x1c, {0x1f, 0x8, 0x1, 0x2, 0x3, 0x401, 0x1, 0x0, 0x2, 0xfffb, 0x2, 0x8000}}, &(0x7f0000000340)={0x20, 0x85, 0x4, 0x5}, &(0x7f0000000380)={0x20, 0x83, 0x2}, 0xfffffffffffffffe, &(0x7f00000003c0)={0x20, 0x89, 0x2}}) [ 1411.447242][T10233] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1411.526594][T10233] ubi0: VID header offset: 64 (aligned 64), data offset: 128 17:28:02 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{0x0, 0x0, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1411.632004][T10233] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1411.647969][T10257] xt_NFQUEUE: number of total queues is 0 [ 1411.691627][T10255] xt_NFQUEUE: number of total queues is 0 [ 1411.713871][T10233] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1411.721899][T10233] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 1204783369 [ 1411.735023][ T7421] usb 3-1: config 1 interface 0 altsetting 2 endpoint 0x81 has invalid maxpacket 32, setting to 8 [ 1411.746366][ T7421] usb 3-1: config 1 interface 0 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1411.761192][ T7421] usb 3-1: config 1 interface 0 has no altsetting 0 17:28:03 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1411.783933][T10233] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 17:28:03 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x0, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x4, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) 17:28:03 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{0x0, 0x0, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1411.833832][T10250] ubi0: background thread "ubi_bgt0d" started, PID 10250 [ 1411.844196][ T7421] usb 3-1: language id specifier not provided by device, defaulting to English [ 1411.897462][T10269] ubi0: detaching mtd0 [ 1411.905782][T10269] ubi0: mtd0 is detached [ 1411.934910][ T7397] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 1411.985427][ T7421] usb 3-1: New USB device found, idVendor=1b1c, idProduct=1b09, bcdDevice= 0.40 [ 1411.995697][T10269] ubi0: attaching mtd0 [ 1412.003469][ T7421] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1412.059850][ T7421] usb 3-1: Product: 㐊 [ 1412.090257][ T7421] usb 3-1: SerialNumber: Ё [ 1412.098345][T10269] ubi0: scanning is finished [ 1412.130606][ T7421] usb 3-1: rejected 1 configuration due to insufficient available bus power [ 1412.166342][ T7421] usb 3-1: no configuration chosen from 1 choice [ 1412.171766][T10274] xt_NFQUEUE: number of total queues is 0 [ 1412.225791][ T7397] usb 4-1: Using ep0 maxpacket: 8 [ 1412.235892][T10284] xt_NFQUEUE: number of total queues is 0 [ 1412.514314][ T7397] usb 4-1: New USB device found, idVendor=08d1, idProduct=0003, bcdDevice=3a.3d [ 1412.524522][T10269] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1412.532792][T10269] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1412.544135][T10269] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1412.551565][T10269] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1412.562176][T10269] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1412.566686][ T7397] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1412.603154][T10269] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1412.605066][ T7397] usb 4-1: Product: syz [ 1412.634960][ T7397] usb 4-1: Manufacturer: syz [ 1412.635498][T10269] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 1204783369 [ 1412.640426][ T7397] usb 4-1: SerialNumber: syz [ 1412.675356][ T7397] usb 4-1: config 0 descriptor?? [ 1412.692042][T10269] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1412.716015][T10291] ubi0: background thread "ubi_bgt0d" started, PID 10291 [ 1412.728387][ T7397] hub 4-1:0.0: bad descriptor, ignoring hub [ 1412.740743][ T7397] hub: probe of 4-1:0.0 failed with error -5 17:28:05 executing program 2: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000040)) sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f00000000c0)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) setrlimit(0x2, &(0x7f0000000000)={0x8, 0x300000}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sched_setattr(r0, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000180), &(0x7f00000036c0)=0xc) open(&(0x7f0000000380)='./file0\x00', 0x141042, 0x0) r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000009c0), 0x0, 0x0) r4 = ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82) ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, r4) 17:28:05 executing program 5: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000380)) r4 = perf_event_open$cgroup(&(0x7f0000000200)={0x0, 0x80, 0xfb, 0x2, 0x7, 0x1, 0x0, 0x7, 0x100, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_config_ext={0x7, 0x3}, 0x1400, 0x6, 0x7, 0x0, 0x2, 0x9, 0x3, 0x0, 0x9911, 0x0, 0x80000000}, 0xffffffffffffffff, 0xd, r0, 0x3) perf_event_open(&(0x7f00000000c0)={0x3, 0x80, 0x48, 0x7, 0xf8, 0x2, 0x0, 0x9, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x8, 0x0, @perf_bp={&(0x7f0000000040), 0xa}, 0x10, 0x2, 0xff, 0x0, 0x0, 0x3ff, 0x7, 0x0, 0x3ff, 0x0, 0x8000}, r3, 0xffffffffffffffff, r4, 0x1) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) sendmmsg(r1, &(0x7f0000000280)=[{{0x0, 0x7, 0x0, 0x11, 0x0, 0x0, 0xf4010000}}], 0x400000000000085, 0x0) 17:28:05 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:28:05 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext, 0x0, 0x7, 0x200003, 0x0, 0x4, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) 17:28:05 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540), 0x0, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1413.859842][ T7421] usb 3-1: USB disconnect, device number 39 [ 1413.967389][T10309] ubi0: detaching mtd0 [ 1413.995240][T10260] UDC core: couldn't find an available UDC or it's busy: -16 [ 1414.006824][T10309] ubi0: mtd0 is detached [ 1414.029324][T10306] xt_NFQUEUE: number of total queues is 0 17:28:05 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1414.040539][T10308] xt_NFQUEUE: number of total queues is 0 [ 1414.047217][T10260] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 17:28:05 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540), 0x0, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1414.090314][T10309] ubi0: attaching mtd0 [ 1414.097598][T10309] ubi0: scanning is finished [ 1414.113895][ T7397] pegasus 4-1:0.0: can't reset MAC [ 1414.119567][ T7397] pegasus: probe of 4-1:0.0 failed with error -5 [ 1414.174779][ T7397] usb 4-1: USB disconnect, device number 14 [ 1414.181519][T10307] mmap: syz-executor.2 (10307): VmData 37515264 exceed data ulimit 8. Update limits or use boot option ignore_rlimit_data. [ 1414.316434][T10309] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1414.343339][T10309] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1414.383045][T10309] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1414.465760][T10309] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1414.512919][T10333] xt_NFQUEUE: number of total queues is 0 [ 1414.519769][T10331] xt_NFQUEUE: number of total queues is 0 [ 1414.530936][T10309] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1414.568794][T10309] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1414.593104][T10309] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 1204783369 [ 1414.620273][T10309] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1414.656396][T10329] ubi0: background thread "ubi_bgt0d" started, PID 10329 [ 1414.893774][ T7397] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 1415.143685][ T7397] usb 4-1: Using ep0 maxpacket: 8 [ 1415.423757][ T7397] usb 4-1: New USB device found, idVendor=08d1, idProduct=0003, bcdDevice=3a.3d [ 1415.432852][ T7397] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1415.442237][ T7397] usb 4-1: Product: syz [ 1415.447526][ T7397] usb 4-1: Manufacturer: syz [ 1415.452140][ T7397] usb 4-1: SerialNumber: syz [ 1415.466732][ T7397] usb 4-1: config 0 descriptor?? 17:28:06 executing program 3: syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$printer(0xffffffffffffffff, 0x0, &(0x7f0000001080)={0x34, &(0x7f0000000dc0)={0x0, 0x3, 0x1, "cf"}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f0000000cc0)={0x2c, &(0x7f0000000a40)={0x0, 0x0, 0x2, ']R'}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f00000001c0)={0x24, &(0x7f0000000080)={0x20, 0x21, 0xa3, {0xa3, 0x5, "3fa161abdd5ac7dfdbcf8cf641ebacfa8fbdc6bd3fdc95c9334ee213e62770251b2bac3b35ae5122ede257ec7a452dc01eab4548fe5c8918cc58b41ead97f7c017520e6dd0fd96a281d158af3ed323016f393c2ae0cf6acbf93e2c667c411b1350bc8bf751a1ee451a64a63c3d0bb28091f250862841a71288b162633b9a9597aab72e670123f8a1d638184ae7cb2fc45a52627723ae381bd138479e043da91abd"}}, &(0x7f0000000000)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x340a}}, &(0x7f0000000140)={0x0, 0x22, 0x4, {[@local=@item_012={0x0, 0x2, 0x5}, @local=@item_012={0x0, 0x2, 0xe}, @global=@item_012={0x1, 0x1, 0x7, ';'}]}}, &(0x7f0000000180)={0x0, 0x21, 0x9, {0x9, 0x21, 0x3, 0x2, 0x1, {0x22, 0x10f}}}}, &(0x7f00000003c0)={0x2c, &(0x7f0000000200)={0x0, 0x17, 0x2c, "a62cac69b775af16ba1d8b50ed0d23c7995fa1ee0266b6f2fb667002e75314e2cb2bcd3366d34373dc17e30b"}, &(0x7f0000000240)={0x0, 0xa, 0x1, 0x9c}, &(0x7f0000000280)={0x0, 0x8, 0x1, 0x3}, &(0x7f00000002c0)={0x20, 0x1, 0xaa, "824b2326e8d1002273242854872bce76ab0cb86910f463b7d0334957b2e19b9afbefb87f589c68068ccfd72e568a03cadf2120561dfae70c2c278e6b845a8d41c25058697cfac183934de5e8eaa6efcdb166eb4408539e8089e24d518f7bae21764d688241281eebdfb2ebfc8f5d225d4181afe233fc3b6e78e5988e4b5fea7c83a27c106bd55f5795276b6447efcf13780393e2e10d5ae101a82a2ad5ecc9d115641fd5b39292453912"}, &(0x7f0000000380)={0x20, 0x3, 0x1, 0x1}}) [ 1415.509295][ T7397] hub 4-1:0.0: bad descriptor, ignoring hub [ 1415.515595][ T7397] hub: probe of 4-1:0.0 failed with error -5 17:28:06 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:28:06 executing program 2: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x3f, 0x0, 0x0, 0x50d, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000}, 0x0, 0x1, 0xffffffffffffffff, 0x2) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="4000000010000104ff0000000000070000000178", @ANYRES32, @ANYBLOB="0300000000000000140012800b000100626174616476"], 0x40}}, 0x0) r1 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r1, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) ioctl$BTRFS_IOC_SCRUB_CANCEL(r0, 0x941c, 0x0) r2 = openat$incfs(0xffffffffffffffff, &(0x7f0000000180)='.log\x00', 0x101001, 0x0) setsockopt$pppl2tp_PPPOL2TP_SO_DEBUG(r2, 0x111, 0x1, 0x7, 0x4) sendmmsg(r1, &(0x7f000000d180), 0x4000000000000eb, 0x0) getsockname(r1, &(0x7f0000000040)=@vsock, &(0x7f00000000c0)=0x80) 17:28:06 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext, 0x0, 0x7, 0x200003, 0x0, 0x4, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) 17:28:06 executing program 5: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000380)) r4 = perf_event_open$cgroup(&(0x7f0000000200)={0x0, 0x80, 0xfb, 0x2, 0x7, 0x1, 0x0, 0x7, 0x100, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_config_ext={0x7, 0x3}, 0x1400, 0x6, 0x7, 0x0, 0x2, 0x9, 0x3, 0x0, 0x9911, 0x0, 0x80000000}, 0xffffffffffffffff, 0xd, r0, 0x3) perf_event_open(&(0x7f00000000c0)={0x3, 0x80, 0x48, 0x7, 0xf8, 0x2, 0x0, 0x9, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x8, 0x0, @perf_bp={&(0x7f0000000040), 0xa}, 0x10, 0x2, 0xff, 0x0, 0x0, 0x3ff, 0x7, 0x0, 0x3ff, 0x0, 0x8000}, r3, 0xffffffffffffffff, r4, 0x1) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) sendmmsg(r1, &(0x7f0000000280)=[{{0x0, 0x7, 0x0, 0x15, 0x0, 0x0, 0xf4010000}}], 0x400000000000085, 0x0) 17:28:06 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540), 0x0, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1415.633858][ T7397] pegasus: probe of 4-1:0.0 failed with error -71 [ 1415.664351][T10361] ubi0: detaching mtd0 [ 1415.671167][T10363] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'. [ 1415.696670][ T7397] usb 4-1: USB disconnect, device number 15 [ 1415.697304][T10361] ubi0: mtd0 is detached [ 1415.773964][T10364] xt_NFQUEUE: number of total queues is 0 [ 1415.792352][T10363] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.2'. [ 1415.802349][T10368] ubi0: attaching mtd0 [ 1415.815199][T10375] xt_NFQUEUE: number of total queues is 0 17:28:07 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1415.894536][T10363] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 1415.940663][T10368] ubi0: scanning is finished [ 1415.950086][T10363] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'. [ 1415.967959][T10363] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.2'. 17:28:07 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r0 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:28:07 executing program 2: seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0xa202e300, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000140)="be8aeea40598163aa8d3a5788ef0141cb79c418440d8669a8ddd9721e32550bf7233f6d61ac47e22287e6cbee2fd1d991efb423a7d90fa33ca9f5a8e2365c71227c8abdc739b4c99bb65dd844c99a4363fbefcc8511eaee9f62913ba58deb2b167800ccf8d9b6abcdeb6e5a3509ed2407664127bf8f70afa94e1c78b083ea9430511d2c6eff8a5b650d520", 0x8b}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x3a) sendmsg$TIPC_NL_MON_GET(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={0xfffffffffffffffc}}, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000380)) wait4(r1, &(0x7f0000000040), 0x8, &(0x7f0000000200)) [ 1416.092064][T10383] xt_NFQUEUE: number of total queues is 0 [ 1416.277122][T10368] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1416.303225][T10368] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1416.314577][T10368] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 17:28:07 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r0 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1416.342809][T10393] xt_NFQUEUE: number of total queues is 0 17:28:07 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000100), 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r0, 0x0, 0x487, &(0x7f0000000100), &(0x7f00000001c0)=0x30) write$cgroup_int(r2, &(0x7f0000000200), 0x806000) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r1, 0x84, 0x7f, &(0x7f00000002c0)="1a338b6bdd000000", 0x8) socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r3, 0x84, 0x15, &(0x7f0000000040), 0x1) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000700)={{{@in6=@mcast2, @in=@initdev}}, {{@in=@empty}, 0x0, @in=@remote}}, &(0x7f00000005c0)=0xffffffffffffff84) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000380)=ANY=[@ANYBLOB="6c00000066000004282d83f9c2f1ea55973200fcdbbd2168725bf2641f54aa714983579ea3df2500000000baa2f1bc48f477e29a54164f3536847e731ae0177dfa228f3dbde5ad7e4ece37236c59dc3b9e6e71f9a9eb7430d61d65d37856678f3a222995e46ea4684493329790d98336085c3a97b8f7f6ae354ad96870fce819a8461dd7dfe16899d9d6f448560a06554ed498b8eb2deed5c410e7fb967b961cebdc6d9012482af7485bc677adf4cea872d422867b4ca544803e5b4462b938e099ce5ef6870940c894190db5a17acab87eb2307529ae7e74917423a9b11c8e47ebe02af0836f63bebe2c88debb0cc9a94d236ce5e4c84d0fb44c0e6dce84ce47a3fc8a76f1adca0a16cecb877e89f9ff", @ANYBLOB="818db35f2a7a7caa1d489eca27bfc3b288d5ef37b6a16ad79fd6f134559357d9d7e7cc26bd01e7234c094be02991a8a94f26c21e34e810352403ef81bb055b9dc9620dd6aab52edc9c86417c1688e973612b49d9662ae3072331c43bba30b578", @ANYRESHEX], 0x6c}, 0x1, 0x0, 0x0, 0x8001}, 0x44080) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000300)=[@in6={0xa, 0x4e23, 0x0, @empty}], 0x1c) getsockopt$inet_sctp6_SCTP_STATUS(r2, 0x84, 0xe, 0x0, &(0x7f0000000280)) sendto$inet6(r3, &(0x7f0000000000)="ce", 0xbb7, 0x0, &(0x7f0000000240)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={0x0}, 0x10) perf_event_open(&(0x7f0000000080)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x317d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r3, r1, 0x0, 0x32f01) [ 1416.382765][T10368] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1416.413790][T10368] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1416.421230][T10368] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 17:28:07 executing program 3: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x98, 0x91, 0xc3, 0x8, 0x8d1, 0x3, 0x3a3d, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x9, 0xb1, 0x16}}]}}]}}, 0x0) r1 = syz_usb_connect(0x6, 0x818, &(0x7f00000010c0)={{0x12, 0x1, 0x250, 0x9d, 0x77, 0xaf, 0x20, 0x403, 0xdf30, 0xccb1, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x806, 0x3, 0x0, 0xf, 0x80, 0x3, [{{0x9, 0x4, 0xa4, 0x81, 0x5, 0xbf, 0x17, 0x5b, 0x7, [], [{{0x9, 0x5, 0x5, 0x0, 0x40, 0x0, 0x8, 0x68}}, {{0x9, 0x5, 0x8, 0x1, 0x7cf, 0x8, 0x21, 0x6, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x1f, 0x3f}, @uac_iso={0x7, 0x25, 0x1, 0x82, 0x2, 0x2}]}}, {{0x9, 0x5, 0x9, 0x10, 0x0, 0x29, 0x7f, 0xfa}}, {{0x9, 0x5, 0x4, 0x0, 0x3ff, 0x1, 0x2, 0x81, [@generic={0x8, 0xa, "f0c6d808b631"}]}}, {{0x9, 0x5, 0x7, 0x8, 0x200, 0x2, 0x3f, 0x40}}]}}, {{0x9, 0x4, 0x5e, 0x7, 0xe, 0xcf, 0x5c, 0x2d, 0x0, [@cdc_ncm={{0xb, 0x24, 0x6, 0x0, 0x1, "ba057ce1a303"}, {0x5, 0x24, 0x0, 0x9}, {0xd, 0x24, 0xf, 0x1, 0x8, 0x2, 0xee9, 0x6}, {0x6, 0x24, 0x1a, 0x4, 0x2a}, [@dmm={0x7, 0x24, 0x14, 0x8001, 0x2}, @obex={0x5, 0x24, 0x15, 0x1}, @obex={0x5}, @network_terminal={0x7, 0x24, 0xa, 0x7, 0x1, 0x30, 0x7f}]}], [{{0x9, 0x5, 0x5, 0x0, 0x40, 0x20, 0x4, 0x3}}, {{0x9, 0x5, 0x5, 0x0, 0x200, 0x2b, 0x6, 0x1f, [@generic={0xa, 0xd, "6c9f8a74dd2ca5b7"}, @uac_iso={0x7, 0x25, 0x1, 0x0, 0xc1, 0x8}]}}, {{0x9, 0x5, 0x0, 0x3, 0x8, 0x6, 0x40, 0x1}}, {{0x9, 0x5, 0xf, 0x8, 0x200, 0x1, 0x2, 0x6, [@uac_iso={0x7, 0x25, 0x1, 0x2, 0x1}, @uac_iso={0x7, 0x25, 0x1, 0x83, 0x1, 0x1f}]}}, {{0x9, 0x5, 0x5, 0xc, 0x40, 0x9, 0x7f, 0x3, [@generic={0x3, 0x10, 'u'}, @uac_iso={0x7, 0x25, 0x1, 0x0, 0x9, 0x1}]}}, {{0x9, 0x5, 0x9, 0x0, 0x8, 0xb3, 0x2, 0x8, [@generic={0xb8, 0x23, "5c3401783fd5dfa8c8c11c28a80d6916ac6f051a2ea28535bd1e97747693ba5c10aa8ffc92c642763cb993bf92b81741b003757cb75daa82304cd37783160ccd0d11cf3d8ee0e1fa90d139e9387ee4d53b2993a6b31a5c84b5dc944d3ced0b55f8cc45f7c88f5f2a1d9530258e6b30b32cd83c3db5975665af1314745bffc11fdc2be1a336dbf944e7b0f3ca4d508ba6e963abca9d6fa7b7b9b1ea648f9f40a28d9276236606872073b78a8a91570b3322549b3e6785"}]}}, {{0x9, 0x5, 0x9, 0x10, 0x10, 0x1, 0x7f, 0xb8, [@generic={0x89, 0x10, "5a446af4d150f9b3a1c5b5ec654b844d7dbf8b820d8e97f5906e49c3c4d8ae05f2ee197a7c720b76bbfb66395d4aa04ad20a2e57c59463711989bf678f2af10147fc0080c9fae22c8ab78978ac96e93264e8f975ec81e367fc481415acc16f5e5f94ed28de32b1e9e7e0e14319dc56e44af88ca66d2cdbb16087937af342c23d72b2ee26b4881a"}]}}, {{0x9, 0x5, 0x3, 0x10, 0x20, 0xbe, 0xa1, 0xba, [@generic={0x11, 0xf, "4b1006a5283508a09b765d9e79be04"}, @uac_iso={0x7, 0x25, 0x1, 0x2, 0x5, 0x5}]}}, {{0x9, 0x5, 0x8, 0x0, 0x1cf, 0x81, 0x20, 0x0, [@generic={0xd4, 0xa, "2375d8d4c1493ce190971269a3053dc714f79f0d78b84043612df3c1d055bb402460e96d5ddbbd9a348607dd10e02003f984b3b58d1b6605fbe041f49193376b2020f824bebf1d646bb1031d3ee180da7ccef6aa079a28bc17581c5610d51f23f825a40b98b3779536d285280d8e66ebac71cfcac3af80cc4757b61996ac77b355c1a7e56cb091094f54961beacfa6885e5d2bcfb7bdca4849f8eef645e5c58401adcfafb23774a54f3c9a44d4662f0cdefc4eb9280687c23c8065cc4ddde3c15921d6e2b615e99b2b489787b13de8abcc2b"}]}}, {{0x9, 0x5, 0x4, 0x2, 0x8, 0x0, 0x40, 0x9, [@generic={0x65, 0x9, "afd852f95bce6d63ca6e8c57ad292b524e0c12f4bbdd6d8721a27131f1f39a418176f84346e054a76ec3747f4060b618b87d522761ef6378fb28d4e350a7d2e3d9b31617042766d44ed3b8e4043e97c32c83df50e6b945e7c25e8b8d3e62d11e0d43c4"}, @uac_iso={0x7, 0x25, 0x1, 0x1, 0x7, 0x7}]}}, {{0x9, 0x5, 0x3, 0x10, 0xebe93d660e81d3df, 0x70, 0x9, 0x66, [@generic={0x66, 0x23, "cca70828580dfc427554c0f58ed829a9cdbff9ee2fb317ae7f89bafbfe09a234fa1c35bc2f00a20fe66806565cbbb097d57067c74eb293179c7c151e8b59c523efd7d181b304e813c29440d142caef8f1271c91e650be46a63d5f154ddd7a2e762de8fe7"}, @generic={0x15, 0x7, "ea75b045446bd5128bff762df32487c9cc0d11"}]}}, {{0x9, 0x5, 0xa, 0x2, 0x10, 0x8e, 0x4, 0x1, [@generic={0x31, 0x23, "6ffca886d8d25e4236dad24dc5a93c0f312aca879d27a69ad988cfb315d40a2f1ebc83a8c76ecef9e487b04901603a"}, @generic={0x3f, 0x7, "0b9c3e74f65fceb90b8f731117bec355465fd7bb144e03760419dd71f6a784a5c7489933ea9bd4d7c6023f13cb74eaa60174fcbe6a9d0d4875fed360a7"}]}}, {{0x9, 0x5, 0x80, 0xc, 0x8, 0x40, 0xff, 0x7, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0xef, 0x7}, @generic={0x78, 0xd, "6bc2b35b0b8c2fc887b0b413131f99ce18425910b2128c98b23ed2f441dbdea04a5fac3b8d695fbf385394069e8dabf542155fc81e6c1e517d4afa9352e81e0cd574babf1afc5116d6d647b72005cfc25680071f01e182a6c2b5190c4eec13b835ed3a41717ef10f2ccba893179fd99fb72234c653f9"}]}}, {{0x9, 0x5, 0x6, 0x0, 0x10, 0x2, 0x0, 0xfc, [@generic={0xff, 0x31, "b848f5686696392013eed218756a4a52ed9655fbe51b69f4cb7983d1551abf8861cba009d6bcc40eb8c0579088dc9694ee300a0703a8094f7eef2c42f273cc99dafaf187509cb00674510c158986cf72e0c7725a0ae2d26114d35c1fcf5445861a03409d7592cc503556a8f414b4768d0a4dad37071c001b07f1317e740d024f4ce5c7c1e2cbae10963be639ef29fe0adf435a461542e3c61b70cf28046d65dc5d8859b2dbde3df87716a13ad164d49c23f5e8364e00ec3e1c0566e9b9803f6bdaa7c1e4dc1155be5a49a918f89c350e6ddead3e233b646967bf721014692a2bd915e415594d1cc6f6f782492b26ab658ec1058021933a7e3134ada94f"}, @uac_iso={0x7, 0x25, 0x1, 0x1, 0xfa, 0x82d8}]}}]}}, {{0x9, 0x4, 0xb2, 0x4, 0x6, 0xe9, 0x43, 0x43, 0x5, [@hid_hid={0x9, 0x21, 0x0, 0x1, 0x1, {0x22, 0xb7e}}, @hid_hid={0x9, 0x21, 0xbf3, 0x0, 0x1, {0x22, 0xd6c}}], [{{0x9, 0x5, 0x80, 0x4, 0x20, 0x7, 0x1, 0xf7, [@uac_iso={0x7, 0x25, 0x1, 0x3, 0xf8, 0x3}]}}, {{0x9, 0x5, 0x1, 0x0, 0x20, 0x6, 0x4, 0x8, [@uac_iso={0x7, 0x25, 0x1, 0x3, 0x7e, 0x2}, @uac_iso={0x7, 0x25, 0x1, 0x81, 0x1, 0x9}]}}, {{0x9, 0x5, 0xa, 0x0, 0x40, 0x40, 0x9f, 0x2, [@generic={0xa4, 0x21, "d659cd8ae9cb8c9a24a1ba5378aea2141f6dee75ad34c56c6d4340f2159c1444b83a027bc59b1ee55054087c64ca55e7885302ee234b10d96642f967f2907ec659639d786238459adc40be084792f55e3b2c3faafbd09c68da8b88ee81996cd5faaac1a24e18e94cfcccb390a36dadbd7ec14480cd9ba3d160d860cd9f2c2d05bb879f5a1e4c16b70f7794a1147bd6e08d443ad2551268c6f6e419d0c54bb61eb850"}, @uac_iso={0x7, 0x25, 0x1, 0x0, 0x20, 0x7}]}}, {{0x9, 0x5, 0x0, 0x2, 0x200, 0x9, 0x2, 0x4, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x3, 0x6}]}}, {{0x9, 0x5, 0x9, 0xc, 0x3ff, 0xfe, 0x3, 0x80, [@generic={0x9e, 0x21, "c657de5a19b313a02caf52b59471e358e6137f72a8c6a1518b72bde384e47ac47970b067ad2338cac5875c0256bbf136e509c1c22f14e7cb34a1cf34b0eb125f8ec68d343711dc9c9d9dae029bb2cf1db0bd20375111540349ed625fd20dd21aa744d264bbaf42c4e252677d317a5ce0bb32aa3e66c58eaf245b2316afbea25f51cd5bb5faa86721c7192aaa702a10f699164bfe0278b774d507598a"}, @uac_iso={0x7, 0x25, 0x1, 0x0, 0x97, 0x5}]}}, {{0x9, 0x5, 0x8d978e4549995970, 0x10, 0x20, 0x1, 0x6, 0x4}}]}}]}}]}}, &(0x7f0000000a80)={0xa, &(0x7f0000000800)={0xa, 0x6, 0x201, 0x40, 0x5c, 0x40, 0x0, 0x3f}, 0x5, &(0x7f0000000840)={0x5, 0xf, 0x5}, 0x4, [{0x51, &(0x7f0000000880)=@string={0x51, 0x3, "67565721a7161a616e5fb389f5dddcea80ea87762b020c392e8b378f62251633554140fe16ea2c83073103cadb95b74d56677aa5f43c22cf1036ee0fff1645df2fe57eb9d19040cdcc896b330a9de6"}}, {0x4, &(0x7f0000000900)=@lang_id={0x4, 0x3, 0x401}}, {0x43, &(0x7f0000000940)=@string={0x43, 0x3, "7dbfc5dc8e26c6bf89c9b55aa59fc4226e2eecfc0d663774dde2c7a3bc85addf2636a2bbfe4155e8dac0fec2651017b133dd1826be53720aa06662f66b687872a3"}}, {0x4, &(0x7f00000009c0)=@lang_id={0x4, 0x3, 0x816}}]}) syz_usb_control_io$hid(r1, &(0x7f0000000c80)={0x24, &(0x7f0000000b00)={0x0, 0xf, 0xb1, {0xb1, 0x4, "b26c8521f851ee8aa9a55c8790b8168a2655fcee28ba2a0e213032d83cd2ce0c2d12b4289ba9d7b4a63cbaa30fb91279510a3a97e6e45b914f1d7f6e926dddebab20d2bc7290405ea54054c479d85ab5ae66d2ca96e40c69a17ab8f249532cfe7f66263a43a53cec647a042a4cd4f203ceae402821db96fbd14cfa3bef92784eabfcd7b942179e32035e47086b6906c7bd9c2be2191b3fbded38650990be1281c3b805ba989fd750c31265b79a1562"}}, &(0x7f0000000bc0)={0x0, 0x3, 0x5f, @string={0x5f, 0x3, "c0a14811913e388455c7184bfb8698de8a1a889cdede54aa319e0139643fcaf97876e4c430f764ea1328201c7b90327251227740fa6a4c5dcf2f0fa73d1464911d379523600c2fa38a92afbd75739db4f2e47e9c4eea84398c2f2813b5"}}, &(0x7f0000001000)={0x0, 0x22, 0x20, {[@global=@item_012={0x2, 0x1, 0x9, "4d1f"}, @global=@item_4={0x3, 0x1, 0x7, "7cdb7de6"}, @local=@item_012={0x1, 0x2, 0x1, 'S'}, @global=@item_4={0x3, 0x1, 0xa, "2ee780ab"}, @main=@item_012={0x2, 0x0, 0x9, '@Q'}, @main=@item_4={0x3, 0x0, 0x9, "4dc5b2c3"}, @local=@item_012={0x0, 0x2, 0x2}, @global=@item_012={0x2, 0x1, 0x5, "19c2"}, @global=@item_012={0x2, 0x1, 0x1, "54be"}, @main=@item_012={0x1, 0x0, 0x9, '5'}]}}, &(0x7f0000000c40)={0x0, 0x21, 0x9, {0x9, 0x21, 0x4, 0x1, 0x1, {0x22, 0xd30}}}}, &(0x7f0000000fc0)={0x2c, &(0x7f0000000d00)={0x40, 0xf, 0x7d, "3329dad26729f7536145a1ee4f37859cd9525a8727844cd8d774b7556cda96081662e6b21be5bc1e53777496a1009819a72ea061990aae64f3c4463d431af8a6d9ee0bd0ff3eda8eaa4a97514d1fcad738e0ff64218149b555e93c9a566a4a1b7872d0193d791552ad884bf8ea71000c0adb58d66f647b7b684b785226"}, &(0x7f0000000e00)={0x0, 0xa, 0x1, 0xca}, &(0x7f0000000e40)={0x0, 0x8, 0x1, 0x7}, &(0x7f0000000e80)={0x20, 0x1, 0xf8, "9f8b455af71bc2259dc54e8b691d6b78698f4f3f256390a714ff60a8c5945f35a48240e969f9225de4f61a35cf99f31c4525f383344db2567b8187fa6811ca54026f15989b575808d7d4301cd5d4655fa3f92c0f40821761381afac4b2415e36e5a6dee133339b7ac8bd6c8e003a11593e4782f8cff416e3fdcf794c41a9dbc1d29de5949a4f14150d66e3b7db4acc3b242a886b879282a9021b48a9236ef244fe52e4b312399ff53284ee21b1bf7c020b065fd6435a837bb5496b522b2950ce012d7a6a91f4c6699f162b52bdaf4eec6382f12fb3ce5624c2c95a479321c0ef1e829517ff0baea35701b1318cddf52989723a7149a5524e"}, &(0x7f0000000f80)={0x20, 0x3, 0x1, 0x3f}}) syz_usb_control_io(r0, &(0x7f0000000300)={0x2c, &(0x7f0000000000)={0x40, 0x5, 0x19, {0x19, 0x1, "2ad66c5c8b4680e7ddbb11ec67125e5d9e7e38760a1e9a"}}, &(0x7f0000000080)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x814}}, &(0x7f00000000c0)={0x0, 0xf, 0x19d, {0x5, 0xf, 0x19d, 0x5, [@generic={0x9c, 0x10, 0x1, "ff0e170cb796c3d8d43f875c298a425edb2a57c2acf85bed669b556fe3bd55c7b01ff68c5c55046e1dd5ef831308b1b21aabec089857c505138ddc486b9380e1660720c0d3bb419ff52051e2928b24b37d1e5bb3784851acf4182a0c18673eab71731acd780184214156d31f22d69afddf7c6ed328a45112e8e808f88aa6fedd877acaa66b9406d9ae311a1af312f605b1232477dc4384ecad"}, @wireless={0xb, 0x10, 0x1, 0x8, 0xc6, 0x5, 0x2, 0x0, 0x8}, @ss_container_id={0x14, 0x10, 0x4, 0xfe, "16b4da8ea574f10184afc11c39e5f0cc"}, @generic={0xda, 0x10, 0x4, "a1a4621214ff015e05b17981cb483af1359414d64db4c84c5495f80a270dd5b74b4b19d2b31d74e863d523580d32dfa61737b1da3af57a588ffa45462f3f3a8ed8c68e5439dfc94bfaa1608f34a64a54309ec0124ddfb1015be892059cf7102e8128c52786b2049cf3be4e581113d829e3afa556c5539b39446dc04d780e1332d0e5bab280e7013a6ff2427650943a2395fc6c2e6e7d618ba730283fa2ccc73ca49f13967c35eee1754ceeab39e0b6ea73e8a5593814686b828ea52628718cf91d6ca3d78d16697d41a6cf25ae2b2ce6ca8eb6712447e8"}, @ptm_cap={0x3}]}}, &(0x7f0000000280)={0x20, 0x29, 0xf, {0xf, 0x29, 0x7, 0x1, 0x80, 0xfc, "931c6921", "037daba4"}}, &(0x7f00000002c0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x1, 0x8, 0x6, 0x2, 0x0, 0x1, 0x8}}}, &(0x7f0000000740)={0x84, &(0x7f0000000340)={0x20, 0x14, 0xe, "3e77e45428af9718b7bad05c1e36"}, &(0x7f0000000380)={0x0, 0xa, 0x1, 0x1f}, &(0x7f00000003c0)={0x0, 0x8, 0x1, 0x5e}, &(0x7f0000000400)={0x20, 0x0, 0x4, {0x1, 0x1}}, &(0x7f0000000440)={0x20, 0x0, 0x4, {0x1, 0x40}}, &(0x7f0000000480)={0x40, 0x7, 0x2, 0x2}, &(0x7f00000004c0)={0x40, 0x9, 0x1}, &(0x7f0000000500)={0x40, 0xb, 0x2, "9c67"}, &(0x7f0000000540)={0x40, 0xf, 0x2, 0x401}, &(0x7f0000000580)={0x40, 0x13, 0x6, @multicast}, &(0x7f00000005c0)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x36}}, &(0x7f0000000600)={0x40, 0x19, 0x2, "3aba"}, &(0x7f0000000640)={0x40, 0x1a, 0x2, 0x6}, &(0x7f0000000680)={0x40, 0x1c, 0x1}, &(0x7f00000006c0)={0x40, 0x1e, 0x1, 0x80}, &(0x7f0000000700)={0x40, 0x21, 0x1, 0x99}}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000001980)={0x24, &(0x7f0000000a00)={0x40, 0x23, 0xb, {0xb, 0x7, "fd63774e3d4af8f604"}}, &(0x7f0000001040)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x440a}}, &(0x7f0000001900)={0x0, 0x22, 0xe, {[@local, @global=@item_012={0x0, 0x1, 0x8}, @local=@item_012={0x2, 0x2, 0xb, "5bd6"}, @main=@item_012={0x2, 0x0, 0xc, "88c5"}, @global=@item_012={0x0, 0x1, 0x6}, @local=@item_4={0x3, 0x2, 0xa, "228f7245"}]}}, &(0x7f0000001940)={0x0, 0x21, 0x9, {0x9, 0x21, 0x3ff, 0x0, 0x1, {0x22, 0xcfb}}}}, &(0x7f0000001b80)={0x2c, &(0x7f00000019c0)={0x40, 0x7dcded5bae0685e2, 0x2a, "da719ba1cffee88e9a862799f7fdb226945f765429a5227ff6c1a31a6812ab3f5cfc4a3c04f29df37d5e"}, &(0x7f0000001a00)={0x0, 0xa, 0x1, 0x3}, &(0x7f0000001a40)={0x0, 0x8, 0x1, 0x1f}, &(0x7f0000001a80)={0x20, 0x1, 0xa9, "40e61382d27d2e2a1387d2eb32ef2b402692bf95cb009098de4024fa8c343fec72d7714ed9c114392e7eeb51dbda747634d699827c1cbbbe218c9265b388dcd63d50fc57b37e18710302ae187a88fa11761107104a7c4721197185a4a631273354050c4d03f6aa99248ab642eea90d44b61e5a206f552feee3d0706908addcebe0d5c2e01e1056e5c29fd4d1e08ad8ad1cf0a05203631f5b0c3b624cf8fecc621615987a2e953ada71"}, &(0x7f0000001b40)={0x20, 0x3, 0x1}}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000001080)={0x34, &(0x7f0000000dc0)={0x0, 0x0, 0x1, "cf"}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000cc0)={0x2c, &(0x7f0000000a40)={0x0, 0x0, 0x2, ']R'}, 0x0, 0x0, 0x0, 0x0}) 17:28:07 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5", 0x30, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1416.494158][T10368] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 1204783369 [ 1416.541202][T10368] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 17:28:07 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r0 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1416.584058][T10402] xt_NFQUEUE: number of total queues is 0 [ 1416.605742][T10394] ubi0: background thread "ubi_bgt0d" started, PID 10394 17:28:07 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:28:08 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext, 0x0, 0x7, 0x200003, 0x0, 0x4, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) [ 1416.722145][T10410] xt_NFQUEUE: number of total queues is 0 [ 1416.875171][T10420] ubi0: detaching mtd0 [ 1416.883163][T10420] ubi0: mtd0 is detached [ 1416.955053][T24097] usb 4-1: new high-speed USB device number 16 using dummy_hcd 17:28:08 executing program 5: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000380)) r4 = perf_event_open$cgroup(&(0x7f0000000200)={0x0, 0x80, 0xfb, 0x2, 0x7, 0x1, 0x0, 0x7, 0x100, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_config_ext={0x7, 0x3}, 0x1400, 0x6, 0x7, 0x0, 0x2, 0x9, 0x3, 0x0, 0x9911, 0x0, 0x80000000}, 0xffffffffffffffff, 0xd, r0, 0x3) perf_event_open(&(0x7f00000000c0)={0x3, 0x80, 0x48, 0x7, 0xf8, 0x2, 0x0, 0x9, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x8, 0x0, @perf_bp={&(0x7f0000000040), 0xa}, 0x10, 0x2, 0xff, 0x0, 0x0, 0x3ff, 0x7, 0x0, 0x3ff, 0x0, 0x8000}, r3, 0xffffffffffffffff, r4, 0x1) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) sendmmsg(r1, &(0x7f0000000280)=[{{0x0, 0x7, 0x0, 0x42, 0x0, 0x0, 0xf4010000}}], 0x400000000000085, 0x0) 17:28:08 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5", 0x30, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:28:08 executing program 2: read$FUSE(0xffffffffffffffff, &(0x7f0000000000)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) fchown(0xffffffffffffffff, r0, 0xffffffffffffffff) r2 = fork() r3 = syz_open_procfs(r2, &(0x7f0000002040)='timerslack_ns\x00') r4 = creat(&(0x7f0000002080)='./file0\x00', 0x100) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r3, 0x84, 0x77, &(0x7f00000020c0)={0x0, 0x8000, 0x2, [0x55, 0x5]}, &(0x7f0000002100)=0xc) perf_event_open(&(0x7f0000002140)={0x2, 0x80, 0x80, 0xd7, 0x79, 0x9, 0x0, 0x80, 0x80, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x101, 0x4, @perf_config_ext={0xfffffffeffffffff, 0x9}, 0x970a, 0x400, 0x81, 0x0, 0x0, 0x40, 0x8, 0x0, 0x5f218d6d, 0x0, 0x4}, r2, 0x3, r3, 0x0) rt_sigqueueinfo(r1, 0x1e, &(0x7f00000021c0)={0x24, 0x6, 0x7f}) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = socket$kcm(0x29, 0x0, 0x0) fork() r7 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000002240), 0x200, 0x0) waitid$P_PIDFD(0x3, r7, 0x0, 0x4, 0x0) fcntl$setownex(r6, 0xf, &(0x7f0000002280)={0x1, r2}) ioctl$EXT4_IOC_GROUP_ADD(r5, 0x40286608, &(0x7f00000022c0)={0x1e03, 0x0, 0x1, 0x7, 0x35b6, 0x7fff}) r8 = syz_open_dev$audion(&(0x7f0000002300), 0x4, 0x20402) ioctl$vim2m_VIDIOC_S_FMT(r8, 0xc0d05605, &(0x7f0000002340)={0x1, @pix_mp={0x8000, 0x4, 0x32314d59, 0x0, 0xb, [{0x6, 0x2}, {0x5}, {0x0, 0x9}, {0xfffffff9, 0x7}, {0x10000, 0x80}, {0x40004000, 0x101}, {0x4, 0x101}, {0x8, 0x1000}], 0x2a, 0x0, 0x2, 0x0, 0x2}}) ioctl$vim2m_VIDIOC_S_FMT(r8, 0xc0d05605, &(0x7f0000002440)={0x3, @pix={0xff, 0x9, 0x38414261, 0x8, 0x98, 0x5, 0x0, 0x5, 0x1, 0x3, 0x0, 0x5}}) ioctl$F2FS_IOC_MOVE_RANGE(r3, 0xc020f509, &(0x7f0000002540)={r4, 0x6, 0x6}) ioctl$vim2m_VIDIOC_S_FMT(r9, 0xc0d05605, &(0x7f0000002580)={0x2, @sliced={0x7f, [0x3, 0x1, 0x5, 0x80, 0xffff, 0x2, 0x5, 0x1, 0x0, 0x1, 0x180, 0x9, 0x9, 0x80, 0x1, 0x9, 0xfffe, 0x3ff, 0x91, 0xa2, 0x3, 0x81, 0x20, 0x6, 0x6, 0xe7, 0x9, 0x0, 0x0, 0x9, 0xaf, 0x4, 0x0, 0xfff9, 0x8, 0x56bb, 0x5, 0x6, 0x4, 0x5, 0x6, 0x7, 0x40, 0x8000, 0x0, 0x8001, 0x5]}}) 17:28:08 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x0, 0x200003, 0x0, 0x4, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) [ 1417.244004][T24097] usb 4-1: Using ep0 maxpacket: 8 [ 1417.303799][T10435] ubi0: attaching mtd0 17:28:08 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5", 0x30, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1417.459304][T10435] ubi0: scanning is finished 17:28:08 executing program 2: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5", 0x30, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1417.563736][T24097] usb 4-1: New USB device found, idVendor=08d1, idProduct=0003, bcdDevice=3a.3d [ 1417.589108][T24097] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 17:28:08 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1417.672884][T24097] usb 4-1: Product: syz [ 1417.692474][T24097] usb 4-1: Manufacturer: syz [ 1417.712086][T24097] usb 4-1: SerialNumber: syz [ 1417.748328][T24097] usb 4-1: config 0 descriptor?? [ 1417.765385][T10435] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1417.781280][T10435] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1417.800800][T10435] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1417.818981][T10435] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1417.834443][T24097] hub 4-1:0.0: bad descriptor, ignoring hub [ 1417.840401][T24097] hub: probe of 4-1:0.0 failed with error -5 [ 1417.843829][T10435] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1417.877598][T10435] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1417.909127][T10435] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 1204783369 [ 1417.983559][T10435] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1418.032065][T10459] ubi0: background thread "ubi_bgt0d" started, PID 10459 [ 1418.703807][T24097] pegasus: probe of 4-1:0.0 failed with error -32 17:28:10 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:28:10 executing program 5: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000380)) r4 = perf_event_open$cgroup(&(0x7f0000000200)={0x0, 0x80, 0xfb, 0x2, 0x7, 0x1, 0x0, 0x7, 0x100, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_config_ext={0x7, 0x3}, 0x1400, 0x6, 0x7, 0x0, 0x2, 0x9, 0x3, 0x0, 0x9911, 0x0, 0x80000000}, 0xffffffffffffffff, 0xd, r0, 0x3) perf_event_open(&(0x7f00000000c0)={0x3, 0x80, 0x48, 0x7, 0xf8, 0x2, 0x0, 0x9, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x8, 0x0, @perf_bp={&(0x7f0000000040), 0xa}, 0x10, 0x2, 0xff, 0x0, 0x0, 0x3ff, 0x7, 0x0, 0x3ff, 0x0, 0x8000}, r3, 0xffffffffffffffff, r4, 0x1) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) sendmmsg(r1, &(0x7f0000000280)=[{{0x0, 0x7, 0x0, 0x60, 0x0, 0x0, 0xf4010000}}], 0x400000000000085, 0x0) 17:28:10 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x0, 0x200003, 0x0, 0x4, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) 17:28:10 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80", 0x48, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:28:10 executing program 2: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5", 0x30, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1419.798189][T10483] ubi0: detaching mtd0 [ 1419.816640][T24097] usb 4-1: USB disconnect, device number 16 [ 1419.865021][T10483] ubi0: mtd0 is detached 17:28:11 executing program 2: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5", 0x30, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1419.950851][T10484] nfqueue_tg_check: 6 callbacks suppressed [ 1419.950914][T10484] xt_NFQUEUE: number of total queues is 0 [ 1420.022789][T10490] ubi0: attaching mtd0 17:28:11 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1420.053566][T10502] xt_NFQUEUE: number of total queues is 0 17:28:11 executing program 3: r0 = syz_usb_connect(0x2, 0x101, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x9, 0x90, 0x36, 0x8, 0x5ac, 0x8281, 0x1f73, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xef, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x78, 0x0, 0x5, 0x53, 0xfc, 0xe7, 0x0, [], [{{0x9, 0x5, 0xf, 0x0, 0x200, 0x4, 0x1, 0x4}}, {{0x9, 0x5, 0xa, 0x10, 0x8, 0x2, 0xff, 0xfe, [@generic={0x42, 0x6, "f4a6689c682d426cf5abd95fa43547f2096f077fa199dfa09202c6709ae2d8f73ff8855a1bf4ac220eaed53e92ca446f58924a0fcd02efb5beb226e32117a128"}]}}, {{0x9, 0x5, 0x4, 0xc, 0x8, 0xff, 0x0, 0x3, [@generic={0x16, 0x21, "9947d97093145e3bc3ca28ce07dbbdc804cf7392"}]}}, {{0x9, 0x5, 0x9, 0x0, 0x20, 0x20, 0x9, 0x1f, [@generic={0x58, 0x2, "b0aa8fc9ab7585251ce71b1c825ecea812e8056af73140d19f8fc11aa4d1d79eadffd7240c3e2aa6ce461c5cebacdf9230b88624710272690ceb5541247ef074d60410ca56e4bd4ef66fa6c4de8c24ad64c153b16dc6"}]}}, {{0x9, 0x5, 0xa, 0x4, 0x40, 0x7f, 0x5, 0x7e}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000840)={{0x12, 0x1, 0x0, 0x85, 0x37, 0x4, 0x8, 0x61d, 0xc020, 0x715, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xa3, 0xd9, 0x12}}]}}]}}, 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000001280)={0x84, &(0x7f0000000000)={0x0, 0x0, 0x3, "4e8ef6"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r1, &(0x7f0000000340)={0x2c, &(0x7f00000001c0)={0x40, 0x30, 0xd9, {0xd9, 0x5, "e7cd7beb4ea06b63586a08c96d7c7b5978e5dc1a2e1e7eece5bccb14b47dd07d4b6fa466c9761fc99311a0c5bc25daf96e1cc402fbd0adeb628f896a894fb600f6c19648843e00af6080d4a3b05c12870e3e440dbc12519e22acab3d2155fac6b9b55c0af28aff26b613318d138901e3ff8f43656a8f497f5230292ad65aa4a8ec43e8dc59059fee8b704b175d8debd41091ae9d58b887369d26e037d8e5651b3535ef2dea1c4a3eb36473b436eaefcf74e69c65e377e3a4d552b11467467785ef6e9fb290d23a707b95dbccbdf39a1b5f1bb53ead6999"}}, &(0x7f0000000000)={0x0, 0x3, 0x2e, @string={0x2e, 0x3, "dbab64ec13c8a1f46b157bce1449fe20ec535e8b60e179e240955b42ffd3826eebe4d2d269e1ee87525d176a"}}, &(0x7f0000000040)={0x0, 0xf, 0xf, {0x5, 0xf, 0xf, 0x1, [@ss_cap={0xa, 0x10, 0x3, 0x0, 0x4, 0x7f, 0x8, 0x7fff}]}}, &(0x7f00000002c0)={0x20, 0x29, 0xf, {0xf, 0x29, 0x1, 0x0, 0x6, 0x3, "790ae87b", "767baf3e"}}, &(0x7f0000000300)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0xb6, 0x3, 0x40, 0x8, 0x66, 0x7, 0xc}}}, &(0x7f00000007c0)={0x84, &(0x7f0000000380)={0x0, 0x0, 0x3b, "5ff3b4473b06ff5e871e0372c11bdad584c0d1b26f5027b1981b09c900a73d7b9707c56c4f2f8751b42e4a6b58d7bb72e2cc1486ab451ee120f335"}, &(0x7f0000000400)={0x0, 0xa, 0x1, 0x8}, &(0x7f0000000440)={0x0, 0x8, 0x1, 0x5}, &(0x7f0000000480)={0x20, 0x0, 0x4, {0x2, 0x2}}, &(0x7f00000004c0)={0x20, 0x0, 0x8, {0x0, 0x18, [0xff0f]}}, &(0x7f0000000500)={0x40, 0x7, 0x2, 0x6}, &(0x7f0000000540)={0x40, 0x9, 0x1, 0x26}, &(0x7f0000000580)={0x40, 0xb, 0x2, '`q'}, &(0x7f00000005c0)={0x40, 0xf, 0x2, 0x5000}, &(0x7f0000000600)={0x40, 0x13, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}, &(0x7f0000000640)={0x40, 0x17, 0x6, @remote}, &(0x7f0000000680)={0x40, 0x19, 0x2, 'Q#'}, &(0x7f00000006c0)={0x40, 0x1a, 0x2, 0x3}, &(0x7f0000000700)={0x40, 0x1c, 0x1}, &(0x7f0000000740)={0x40, 0x1e, 0x1, 0xb}, &(0x7f0000000780)={0x40, 0x21, 0x1}}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000001080)={0x34, &(0x7f0000000dc0)={0x0, 0x0, 0x1, "cf"}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000cc0)={0x2c, &(0x7f0000000a40)={0x0, 0x0, 0x2, ']R'}, 0x0, 0x0, 0x0, 0x0}) [ 1420.128424][T10490] ubi0: scanning is finished 17:28:11 executing program 2: perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2}}, 0x2e) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) r2 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r2, r3, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x3a}}, @in6=@loopback, 0x4e22, 0x1, 0x4e20, 0x3, 0xa, 0x0, 0x80, 0x84, 0x0, r3}, {0x5, 0x6, 0x1, 0x9, 0x7, 0x6, 0x13, 0x200}, {0x6, 0x40, 0x0, 0x3}, 0x7f, 0x6e6bb5, 0x2, 0x0, 0x1, 0x3}, {{@in6=@private2, 0x4d4, 0x33}, 0x2, @in6=@remote, 0x3503, 0x4, 0x3, 0x6, 0x3ff, 0x0, 0x5}}, 0xe8) sendmmsg(r0, &(0x7f0000000280)=[{{0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0xf4010000}}], 0x400000000000085, 0x0) [ 1420.269699][T10507] xt_NFQUEUE: number of total queues is 0 17:28:11 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1420.362618][T10512] xt_NFQUEUE: number of total queues is 0 [ 1420.454773][T10490] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1420.478491][T10490] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1420.506144][T10490] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1420.523394][ T5] usb 4-1: new full-speed USB device number 17 using dummy_hcd [ 1420.540550][T10490] ubi0: VID header offset: 64 (aligned 64), data offset: 128 17:28:11 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1420.569214][T10490] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1420.581180][T10523] xt_NFQUEUE: number of total queues is 0 17:28:11 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80", 0x48, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1420.616020][T10490] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 17:28:11 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1420.683299][T10490] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 1204783369 [ 1420.691704][T10528] xt_NFQUEUE: number of total queues is 0 [ 1420.734206][T10490] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1420.753532][T10521] ubi0: background thread "ubi_bgt0d" started, PID 10521 [ 1420.855107][T10534] xt_NFQUEUE: number of total queues is 0 [ 1420.903722][ T5] usb 4-1: config 0 has an invalid interface number: 120 but max is 0 [ 1420.957681][ T5] usb 4-1: config 0 contains an unexpected descriptor of type 0x2, skipping [ 1420.983842][ T5] usb 4-1: config 0 has no interface number 0 [ 1420.990027][ T5] usb 4-1: config 0 interface 120 altsetting 0 endpoint 0xF has invalid maxpacket 512, setting to 64 17:28:12 executing program 5: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000380)) r4 = perf_event_open$cgroup(&(0x7f0000000200)={0x0, 0x80, 0xfb, 0x2, 0x7, 0x1, 0x0, 0x7, 0x100, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_config_ext={0x7, 0x3}, 0x1400, 0x6, 0x7, 0x0, 0x2, 0x9, 0x3, 0x0, 0x9911, 0x0, 0x80000000}, 0xffffffffffffffff, 0xd, r0, 0x3) perf_event_open(&(0x7f00000000c0)={0x3, 0x80, 0x48, 0x7, 0xf8, 0x2, 0x0, 0x9, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x8, 0x0, @perf_bp={&(0x7f0000000040), 0xa}, 0x10, 0x2, 0xff, 0x0, 0x0, 0x3ff, 0x7, 0x0, 0x3ff, 0x0, 0x8000}, r3, 0xffffffffffffffff, r4, 0x1) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) sendmmsg(r1, &(0x7f0000000280)=[{{0x0, 0x7, 0x0, 0x84, 0x0, 0x0, 0xf4010000}}], 0x400000000000085, 0x0) 17:28:12 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x0, 0x200003, 0x0, 0x4, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) 17:28:12 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket(0x10, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:28:12 executing program 2: r0 = creat(&(0x7f0000002440)='./file0\x00', 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x0) getdents(r1, 0x0, 0x27c6) getdents64(r1, 0x0, 0x0) utimensat(r1, &(0x7f0000000100)='./file0\x00', 0x0, 0x0) fanotify_mark(r0, 0x0, 0x4001000, r1, &(0x7f0000000000)='./file0\x00') r2 = creat(&(0x7f0000002440)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f0000000240), 0xfb3f) r3 = perf_event_open(&(0x7f0000001340)={0x3, 0x80, 0x80, 0x0, 0x0, 0x0, 0x0, 0x51c1, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xfffff7ffffffffff, 0xffffffffffffffff, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r4 = syz_open_dev$mouse(&(0x7f0000000040), 0x7a11, 0x8000) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r4, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x30, 0x0, 0x8, 0x3, 0x0, 0x0, {0x3, 0x0, 0x2}, [@CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x600}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x892f}, @CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x30}, 0x1, 0x0, 0x0, 0x840}, 0x0) setsockopt$IPT_SO_SET_ADD_COUNTERS(0xffffffffffffffff, 0x0, 0x41, 0x0, 0x0) fallocate(r3, 0x8, 0x2000, 0x7ffb) 17:28:12 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80", 0x48, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1421.003057][ T5] usb 4-1: config 0 interface 120 altsetting 0 has a duplicate endpoint with address 0xA, skipping [ 1421.173739][ T5] usb 4-1: New USB device found, idVendor=05ac, idProduct=8281, bcdDevice=1f.73 [ 1421.180017][T10552] ubi0: detaching mtd0 [ 1421.213493][ T5] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 17:28:12 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728", 0x54, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1421.229247][T10546] xt_NFQUEUE: number of total queues is 0 [ 1421.237919][ T26] audit: type=1804 audit(1638034092.461:364): pid=10554 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir075826408/syzkaller.gwvnpm/180/file0" dev="sda1" ino=15201 res=1 errno=0 [ 1421.263581][ T5] usb 4-1: Product: syz [ 1421.269231][ T5] usb 4-1: Manufacturer: syz [ 1421.295011][ T5] usb 4-1: SerialNumber: syz [ 1421.328896][T10552] ubi0: mtd0 is detached [ 1421.345774][T10550] xt_NFQUEUE: number of total queues is 0 [ 1421.371850][ T5] usb 4-1: config 0 descriptor?? [ 1421.378354][T10556] ubi0: attaching mtd0 [ 1421.444778][ T26] audit: type=1804 audit(1638034092.471:365): pid=10549 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir075826408/syzkaller.gwvnpm/180/file0" dev="sda1" ino=15201 res=1 errno=0 [ 1421.474220][ T5] hub 4-1:0.120: bad descriptor, ignoring hub [ 1421.480335][ T5] hub: probe of 4-1:0.120 failed with error -5 [ 1421.481627][T10556] ubi0: scanning is finished [ 1421.547931][ T26] audit: type=1804 audit(1638034092.511:366): pid=10549 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir075826408/syzkaller.gwvnpm/180/file0" dev="sda1" ino=15201 res=1 errno=0 [ 1421.599673][ T26] audit: type=1804 audit(1638034092.551:367): pid=10554 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir075826408/syzkaller.gwvnpm/180/file0" dev="sda1" ino=15201 res=1 errno=0 [ 1421.670628][T10567] xt_NFQUEUE: number of total queues is 0 [ 1421.871545][T10556] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1421.885452][T10556] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1421.894740][T10556] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1421.902732][T10556] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1421.910934][T10556] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1421.918731][T10556] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1421.936641][T10556] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 1204783369 [ 1421.947825][T10556] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1421.959774][T10573] ubi0: background thread "ubi_bgt0d" started, PID 10573 [ 1422.059132][T10577] UDC core: couldn't find an available UDC or it's busy: -16 [ 1422.085739][T10577] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 1422.634863][ T1228] ieee802154 phy0 wpan0: encryption failed: -22 [ 1422.641174][ T1228] ieee802154 phy1 wpan1: encryption failed: -22 17:28:14 executing program 3: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x98, 0x91, 0xc3, 0x8, 0x8d1, 0x3, 0x3a3d, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x9, 0xb1, 0x16}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000001c0)={0x2c, &(0x7f0000000080)={0x20, 0x22, 0x6b, {0x6b, 0xc, "814b991479d087826549671356b64aa3b3e9b8d01c134357e3428a8dbb85fb29b8990e833a151316a5531f82b38163a8dfef1d59b5cfdd6df3d8739e23f6af17e8f262ee10898cc1781bd0971a0955f06fff88326dbfba26132e4cbadc14827ea1cdaafd606c6cc153"}}, &(0x7f0000000000)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x100c}}, &(0x7f0000000100)={0x0, 0xf, 0x2c, {0x5, 0xf, 0x2c, 0x4, [@ss_cap={0xa, 0x10, 0x3, 0x0, 0xa, 0x81, 0x5, 0x6}, @wireless={0xb, 0x10, 0x1, 0xc, 0x14, 0x8, 0x4, 0xcf, 0xd1}, @wireless={0xb, 0x10, 0x1, 0x0, 0x0, 0x3f, 0x9, 0xffe1}, @ext_cap={0x7, 0x10, 0x2, 0x12, 0x6, 0x7, 0x7}]}}, &(0x7f0000000140)={0x20, 0x29, 0xf, {0xf, 0x29, 0x1, 0x4, 0x0, 0x2, "7bec2036", "d6c6328b"}}, &(0x7f0000000180)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0xfa, 0x14, 0x6, 0xff, 0xca, 0x2831, 0x6}}}, &(0x7f0000000640)={0x84, &(0x7f0000000200)={0x40, 0x15, 0x73, "9c931d51da50d414d1074826a238bb0eb687e64f2ea6683cab5cf841429566ac90c170962c9bf280df159a9a2798bf78d863552f15acd9005a29b17ff343c22dfae4efd215a54ac9dcd8deb862b6911a7c2e85d2d03522d8bd3f7f7dec1b1249c68babd87cb0759ada5b5809c5504d96264419"}, &(0x7f0000000280)={0x0, 0xa, 0x1, 0xff}, &(0x7f00000002c0)={0x0, 0x8, 0x1, 0x3f}, &(0x7f0000000300)={0x20, 0x0, 0x4, {0x0, 0x5}}, &(0x7f0000000340)={0x20, 0x0, 0x8, {0x20, 0x20, [0xf]}}, &(0x7f0000000380)={0x40, 0x7, 0x2, 0x7}, &(0x7f00000003c0)={0x40, 0x9, 0x1, 0x3}, &(0x7f0000000400)={0x40, 0xb, 0x2, "a12d"}, &(0x7f0000000440)={0x40, 0xf, 0x2, 0x2}, &(0x7f0000000480)={0x40, 0x13, 0x6, @local}, &(0x7f00000004c0)={0x40, 0x17, 0x6, @random="9bcc16709de8"}, &(0x7f0000000500)={0x40, 0x19, 0x2, "c642"}, &(0x7f0000000540)={0x40, 0x1a, 0x2, 0x1}, &(0x7f0000000580)={0x40, 0x1c, 0x1, 0x3}, &(0x7f00000005c0)={0x40, 0x1e, 0x1, 0x7f}, &(0x7f0000000600)={0x40, 0x21, 0x1, 0xf8}}) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000001080)={0x34, &(0x7f0000000dc0)={0x0, 0x0, 0x1, "cf"}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000cc0)={0x2c, &(0x7f0000000a40)={0x0, 0x0, 0x2, ']R'}, 0x0, 0x0, 0x0, 0x0}) 17:28:14 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket(0x10, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:28:14 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728", 0x54, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:28:14 executing program 2: r0 = perf_event_open(&(0x7f00000012c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[], 0x48}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYRES32, @ANYBLOB], 0x44}}, 0x0) recvmsg$unix(0xffffffffffffffff, 0x0, 0x0) r1 = perf_event_open(&(0x7f0000000680)={0x3, 0x80, 0x1, 0x7f, 0x0, 0xbb, 0x0, 0x5, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x5, 0x7e5}, 0x206c, 0x4, 0x0, 0x2, 0x20, 0x2, 0x44, 0x0, 0x10000, 0x0, 0x7f}, 0x0, 0xb, r0, 0x9) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x81, 0x0, 0x0, 0x2, 0x0, 0x0, 0x408, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000000c0), 0x8}, 0x48221, 0x0, 0xffffff21, 0x4, 0x0, 0xff, 0x0, 0x0, 0x9, 0x0, 0x8}, 0x0, 0x4, r1, 0x1) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(0xffffffffffffffff, 0xc0189379, &(0x7f00000002c0)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32, @ANYBLOB="00000032ceb1c394c4717a9672000000945a4050bc1458b52400000000291e05141ddc22567dd50141ab9df528f1ee7fa07d7d9972b2ca95db10695b05e356d3b6f61523d81775aabce28de7b14a7829e929375b16c22d04c17f8174531d0893abce5a13bd016f3fe6f8f695fc7b4a33cae27e7072b015c2bea0ed392a14ee425293a6a10b8125b6f9e63563ab8c0ed5810b52b28b40905b54292eb09e7e8bb0c38ba1dabd00"/175]) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="4000000010000104ff0000000000070000000178", @ANYRES32, @ANYBLOB="0300000000000000140012800b000100626174616476"], 0x40}}, 0x0) flistxattr(0xffffffffffffffff, &(0x7f0000000780)=""/135, 0x87) ioctl$FS_IOC_GETFLAGS(0xffffffffffffffff, 0x80086601, &(0x7f0000000840)) r3 = socket(0x0, 0x80002, 0x0) sendmmsg$alg(r3, &(0x7f0000000180)=[{0x2, 0x1000000000000, 0x0}], 0x1, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000700), 0x614800, 0x0) 17:28:14 executing program 5: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000380)) r4 = perf_event_open$cgroup(&(0x7f0000000200)={0x0, 0x80, 0xfb, 0x2, 0x7, 0x1, 0x0, 0x7, 0x100, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_config_ext={0x7, 0x3}, 0x1400, 0x6, 0x7, 0x0, 0x2, 0x9, 0x3, 0x0, 0x9911, 0x0, 0x80000000}, 0xffffffffffffffff, 0xd, r0, 0x3) perf_event_open(&(0x7f00000000c0)={0x3, 0x80, 0x48, 0x7, 0xf8, 0x2, 0x0, 0x9, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x8, 0x0, @perf_bp={&(0x7f0000000040), 0xa}, 0x10, 0x2, 0xff, 0x0, 0x0, 0x3ff, 0x7, 0x0, 0x3ff, 0x0, 0x8000}, r3, 0xffffffffffffffff, r4, 0x1) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) sendmmsg(r1, &(0x7f0000000280)=[{{0x0, 0x7, 0x0, 0x1f4, 0x0, 0x0, 0xf4010000}}], 0x400000000000085, 0x0) 17:28:14 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x0, 0x0, 0x4, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) [ 1423.263543][ T5] usb 4-1: USB disconnect, device number 17 [ 1423.282178][T10591] ubi0: detaching mtd0 [ 1423.332729][T10591] ubi0: mtd0 is detached [ 1423.358570][T10591] ubi0: attaching mtd0 [ 1423.366231][T10591] ubi0: scanning is finished [ 1423.393956][T10601] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'. [ 1423.492228][T10591] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1423.507854][T10591] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1423.517508][T10601] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.2'. [ 1423.543022][T10591] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1423.578357][T10591] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1423.629656][T10591] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1423.699305][T10591] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1423.708920][ T7421] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 1423.792258][T10591] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 1204783369 [ 1423.893387][T10591] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1423.973540][ T7421] usb 4-1: Using ep0 maxpacket: 8 [ 1423.998961][T10613] ubi0: background thread "ubi_bgt0d" started, PID 10613 17:28:15 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728", 0x54, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:28:15 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket(0x10, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:28:15 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x0, 0x0, 0x4, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) [ 1424.203598][T10614] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'. [ 1424.216118][T10614] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.2'. 17:28:15 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245", 0x5a, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1424.277817][T10623] ubi0: detaching mtd0 [ 1424.291027][T10623] ubi0: mtd0 is detached [ 1424.293339][ T7421] usb 4-1: New USB device found, idVendor=08d1, idProduct=0003, bcdDevice=3a.3d [ 1424.355885][ T7421] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 17:28:15 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r0 = socket(0x10, 0x0, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1424.433064][ T7421] usb 4-1: Product: syz [ 1424.437330][ T7421] usb 4-1: Manufacturer: syz [ 1424.441937][ T7421] usb 4-1: SerialNumber: syz [ 1424.444339][T10623] ubi0: attaching mtd0 17:28:15 executing program 2: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket(0x10, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1424.485848][ T7421] usb 4-1: config 0 descriptor?? [ 1424.559707][T10623] ubi0: scanning is finished [ 1424.574663][ T7421] hub 4-1:0.0: bad descriptor, ignoring hub [ 1424.580607][ T7421] hub: probe of 4-1:0.0 failed with error -5 [ 1424.880675][T10623] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1424.897420][T10623] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1424.930291][T10623] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1424.946074][T10623] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1424.962807][T10623] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1424.974054][T10623] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1424.992877][T10623] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 1204783369 [ 1425.015047][T10623] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1425.036354][T10650] ubi0: background thread "ubi_bgt0d" started, PID 10650 [ 1425.703325][ T7421] pegasus: probe of 4-1:0.0 failed with error -121 17:28:18 executing program 3: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x98, 0x91, 0xc3, 0x8, 0x8d1, 0x3, 0x3a3d, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x9, 0xb1, 0x16}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000001080)={0x34, &(0x7f0000000dc0)={0x0, 0x0, 0x1, "cf"}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000cc0)={0x2c, &(0x7f0000000a40)={0x40, 0x0, 0x2, ']R'}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, &(0x7f0000000280)={0x2c, &(0x7f0000000080)={0x20, 0xd, 0x73, {0x73, 0x9, "dec004c409a431e54b9f0ae4c348ca3b821008c8b4ec76c1700fe796b5e85f122419761cb84c36aff2088dff0c5d9bce136d18070ec711e4b572f70e1459480439e042142e7d369b9205cc91024bf691b104739ddf203829ab40d08a903a889c91bc83e7866aec5ba4ea47de35fda51b52"}}, &(0x7f0000000100)={0x0, 0x3, 0xdb, @string={0xdb, 0x3, "39e2ef868cf837116fdd4782af4554f50c25d1c6ca6fbbb3d48dcd95fce3146ef1984c9cda297c2e9a4168a32a3f7dd273a9661dba208d7096464ebf65de56617c527afce4cd77e9cce0ac01b6cffa57d56af5ff88d9c272601188b947779d6b5fe6b284993ada28f27ba5300c43c3ba10c1acbd4b60a6323c0929947f3a10386800915c201bc83b3cf366fa95f09163dfe85815cf5bf536cbd67a1a5554e8ac57408d10c567b8bec57abbd61bb6099959f4397a2706d1acff256ac3999d8a0389d5ee70ef8ac0fbfd52513900b139427e97a7d5b4b506b0ed"}}, &(0x7f0000000000)={0x0, 0xf, 0x12, {0x5, 0xf, 0x12, 0x2, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x8, 0x20, 0x80, 0x8}, @ptm_cap={0x3}]}}, &(0x7f0000000200)={0x20, 0x29, 0xf, {0xf, 0x29, 0x6d, 0x3, 0x7f, 0x18, "f65fb05c", "30cdebde"}}, &(0x7f0000000240)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x13, 0x10, 0x7, 0x2, 0x73, 0x8, 0x5}}}, &(0x7f0000000700)={0x84, &(0x7f00000002c0)={0x20, 0x15, 0x71, "483c473fc15511a39b20730651afef5a04126bc7b8689f90c24e02b21cfa1666c676225acca80b65b4b781e1f35d8c16dee008283463711afefee2b15eca25ebf0724630c6f1d1e81d6287d608bee5d8929bb6d65a977aeb452960225b77821b8b1a921a8c248afc63cbb3de90b0567e1c"}, &(0x7f0000000340)={0x0, 0xa, 0x1, 0xff}, &(0x7f0000000380)={0x0, 0x8, 0x1, 0x97}, &(0x7f00000003c0)={0x20, 0x0, 0x4, {0x3, 0x2}}, &(0x7f0000000400)={0x20, 0x0, 0x4, {0x20, 0x20}}, &(0x7f0000000440)={0x40, 0x7, 0x2, 0x700}, &(0x7f0000000480)={0x40, 0x9, 0x1, 0x6}, &(0x7f00000004c0)={0x40, 0xb, 0x2, 'th'}, &(0x7f0000000500)={0x40, 0xf, 0x2}, &(0x7f0000000540)={0x40, 0x13, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xb}}, &(0x7f0000000580)={0x40, 0x17, 0x6}, &(0x7f00000005c0)={0x40, 0x19, 0x2, "cb5f"}, &(0x7f00000007c0)={0x40, 0x1a, 0x2, 0x1}, &(0x7f0000000640)={0x40, 0x1c, 0x1, 0x1}, &(0x7f0000000680)={0x40, 0x1e, 0x1, 0x7}, &(0x7f00000006c0)={0x40, 0x21, 0x1, 0x7}}) 17:28:18 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245", 0x5a, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:28:18 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r0 = socket(0x10, 0x0, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:28:18 executing program 2: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728", 0x54, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:28:18 executing program 5: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000380)) r4 = perf_event_open$cgroup(&(0x7f0000000200)={0x0, 0x80, 0xfb, 0x2, 0x7, 0x1, 0x0, 0x7, 0x100, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_config_ext={0x7, 0x3}, 0x1400, 0x6, 0x7, 0x0, 0x2, 0x9, 0x3, 0x0, 0x9911, 0x0, 0x80000000}, 0xffffffffffffffff, 0xd, r0, 0x3) perf_event_open(&(0x7f00000000c0)={0x3, 0x80, 0x48, 0x7, 0xf8, 0x2, 0x0, 0x9, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x8, 0x0, @perf_bp={&(0x7f0000000040), 0xa}, 0x10, 0x2, 0xff, 0x0, 0x0, 0x3ff, 0x7, 0x0, 0x3ff, 0x0, 0x8000}, r3, 0xffffffffffffffff, r4, 0x1) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) sendmmsg(r1, &(0x7f0000000280)=[{{0x0, 0x7, 0x0, 0x300, 0x0, 0x0, 0xf4010000}}], 0x400000000000085, 0x0) 17:28:18 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x0, 0x0, 0x4, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) [ 1427.043290][ T5] usb 4-1: USB disconnect, device number 18 [ 1427.058368][T10664] ubi0: detaching mtd0 [ 1427.109754][T10664] ubi0: mtd0 is detached [ 1427.142113][T10663] nfqueue_tg_check: 6 callbacks suppressed [ 1427.142153][T10663] xt_NFQUEUE: number of total queues is 0 17:28:18 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r0 = socket(0x10, 0x0, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:28:18 executing program 2: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r0 = socket(0x10, 0x0, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1427.248753][T10684] xt_NFQUEUE: number of total queues is 0 [ 1427.277346][T10683] xt_NFQUEUE: number of total queues is 0 17:28:18 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x0, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) 17:28:18 executing program 2: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r0 = socket(0x10, 0x0, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1427.400642][T10691] xt_NFQUEUE: number of total queues is 0 [ 1427.489830][T10694] xt_NFQUEUE: number of total queues is 0 17:28:18 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1427.553947][ T7761] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 1427.597019][T10699] ubi0: attaching mtd0 [ 1427.749734][T10699] ubi0: scanning is finished [ 1427.767340][T10701] xt_NFQUEUE: number of total queues is 0 17:28:19 executing program 2: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r0 = socket(0x10, 0x0, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1427.813055][ T7761] usb 4-1: Using ep0 maxpacket: 8 [ 1427.937519][T10709] xt_NFQUEUE: number of total queues is 0 [ 1427.979075][T10699] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1428.006219][T10699] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1428.049597][T10699] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1428.059752][T10699] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1428.078582][T10699] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1428.098038][T10699] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1428.112476][T10699] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 1204783369 [ 1428.124484][ T7761] usb 4-1: New USB device found, idVendor=08d1, idProduct=0003, bcdDevice=3a.3d [ 1428.130865][T10716] xt_NFQUEUE: number of total queues is 0 [ 1428.140466][ T7761] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1428.175877][ T7761] usb 4-1: Product: syz [ 1428.183501][T10699] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1428.186565][ T7761] usb 4-1: Manufacturer: syz [ 1428.203533][T10713] ubi0: background thread "ubi_bgt0d" started, PID 10713 [ 1428.228018][ T7761] usb 4-1: SerialNumber: syz [ 1428.252622][ T7761] usb 4-1: config 0 descriptor?? [ 1428.303901][ T7761] hub 4-1:0.0: bad descriptor, ignoring hub [ 1428.309857][ T7761] hub: probe of 4-1:0.0 failed with error -5 [ 1429.842952][ T7761] pegasus 4-1:0.0: can't reset MAC [ 1429.848376][ T7761] pegasus: probe of 4-1:0.0 failed with error -5 [ 1429.883713][ T7761] usb 4-1: USB disconnect, device number 19 [ 1430.592868][ T7421] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 1430.832756][ T7421] usb 4-1: Using ep0 maxpacket: 8 17:28:22 executing program 3: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x98, 0x91, 0xc3, 0x8, 0x8d1, 0x3, 0x3a3d, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x9, 0xb1, 0x16}}]}}]}}, 0x0) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x113c, &(0x7f00000010c0)={[{}, {0x69, 0x4e00, "5a6ddd382b542f46a9f037fa9c827f4930c2a73daa448bdb48f6e009223f8d915db585db00b12e245de0b09b4f59dc2a6cc3df97d8228c39db10fe86bb73d12b3673aababdcd3251b79aa1fcc2b130b1607ec2a7fa9a14a73b980275c1c88eb38b452099cc2bc58d8b"}, {0xc0, 0x4e00, "ebcea7cbec4ae51701463c903ccc9ed26f2b3393532a7de67caec2e6139a72e1e433d2c095e5b02b099fb2f921458667665955371fbb9de3ac4765134b7403e27f0d8c8a62442dad6914a8c3a03742c9110ff78f96d48c4571099a56fcc58e952e3266367b5eaa7309ae1635bc246846871cfa6823f312095a133540894da99e39005fb16556196ee92a7ff1a6fcc14ae9cde764e9ce7e117b9f171aa1be6c746546dc3868c3ba0ba757e627dcb8be28efe70fc5398f49a7fcdd849cb9a7fb21"}, {0x1000, 0x4e00, "d9f34141ab18642ed82da7bd50a9aa7d4f4949fa628574759f8bfa5cfaf343585040707373bbea7b12dfd5ecd80ea84d71a08bb572e989606239a46a8a9ab591bbdff47a01677a6675362b42430fa1de2c33e2ca2aed3f36a9adab3bca8083cdf6587e439cc417429f93cf30fdfab7edf2b7982780660263362ce5676ee689c2d0d753abd52ffe396cef10af3fb6c10fbde2097fb1825796728c095cd713076e974b9262fae51eacc5f53ccce45aaf3002d12bd14c931c69766782aa64bbcb123c909b4306bce46ad6d455fbdc2c6ac865518dd9bf7ddd6a4b1f8c9a5a1a3bc775569b190e7083d1165de601af173be3ef5d02fc218e475297da233569a4eb360f0aa48492e674d7e74a508b5ef52bf31535c249b77a089e97ea8c0fdcce6bdc70be17fe4d078d5e4973193b45e54544dfb99bde50ace63eaa5988c524d3ab2bcdbad04d5daf93ceeb3e829b4b93bcf51f4d3caaffdd682b959a940bf2de5ffbbb56a0a6aac2c662c2e389bc39513cf79e218ff1ed5681e474f04b6ad1fabc691ea31716ea28619d78de687e69e4a85250846398cb6ffb29fef97b9e6f2a8568dbaa2dee96b2c99427ae58a72e463f3b01ea7510497793e093d890aeaec98e81f097b6dbfd5532cf6398ac0811cb14204a5b4c3827b203497d224858de5c3af752c796ba872992852deb56cf636b2a33560c2b285e80791e2812237496dd49a11a6abcac702b3d5d8754fe8b7cf1c0e69f32feb68eecfaaa177197f92a97f68ba47a8cdcb7a1a488903ee64d59c69c5341598d960fc8a7a478eb3185b0aa2b227c487c56e9f804cc66871147ee13babbf0074a1af5598d186ba5e67ebd9aa396e9618ee8c2630c41583c57e4b59d5cae440551032c1f3866edbd3f84af7daa8d380f9403acd8d194c44add237879482d09a9588a007389c3d61c49f2181f76643245ff650045d671602a3cbead1109b19cbd7458dcd5e97342d2e92328b2143594802e12d460b9337462088ea865b7803989bf3741ffb969fc49ff1bef9b8de5f89d07226726ec6f398dd2880f9f6bf7da5b46473ddebf041237482de26bdac27ee96e250d7c2c3f1364df08cf450e4b72453c083f8d94b3c509fe62474704fc763a7604737256d17e6c6c7426955f5bdd32544b5a940bf0a71dd84068958d12aadd729c06929abd015eede09ceb8e1b7f7f449ee4304a9ba68abc7bebda4ac9c5958bdc006a317462bb304474e88eb9cbacaa4563cb02a32ce44c34b3217acc6d5c039f0bb97d82d907f88469f5c18946d4ede4af93167ced4c0f01f723a515e8daf7b63a9342740258b89485d51495b16feffe4268716b0bf5352f9d0d0cc4083c641f1aa238ab56cb8e237465aab25624721c6856442d24c0ccda8865cfd52351a0a95fa29c314864c7690097edde6a5b35d2926350ea69b42c41b3940747a2074addfa0673e7b36adf777422a7dcacf4f9b79da15dbf17a3138dd25dc7ffe32920395d725cf84c72120f2d5c684e58c3729eb776bcd4f4c7c54bd0608cb22373ecdb75ec1a39dcfdec3cac92c9e41ed505d11c80b0c3cf25d283bee68ca8863b2bb5c9218ed2efa516386dacc0e9fcc44c1ac8fb1448e5f9b55bdb6a743333578861e7085393e11232a5fa4f74bc25fbf31268b25df66d0b8ca82f95173ed1c32ad6ddb35f7d03ff94fe15b1df951d33f4ed10c7abad1ae8d7752e296bfdf63f57b1624eaac9a862d9ebccf9bc51ca5a3f903e53092568954f3ea01ff2e3c2ea271ef43aea097702e44554d093d87e7cdba01de866734e9157e08876fb1f246ac0351768d5b015a573da53bc46a405165f26b2e379b5b99d8e072a88573c5cdb06ce1856d4d2212031bbf389de0088a260623917dc58414b8e01abbb4160ec5fe5dac4a3e6f562c650d4ea3c58660e6abb29ba34f12d70252bcfa8875547ce8dfb134d49bfc327ae2da1c9cd31ffeec2446b435ed554dbed075d8071a9372372c9bf8d1fcc93b5526ddbf03bc6516588a3e3f6f2f9fbb0ba539a3b88611e9a9897f9a5026f5f545aec2993bdb097bd16620f07274f0607c07a80d85f7ba42aa80ff457413c0e684b2d4b5dbce237aaa085ba7d65f2d6aef4978d0c47c629aecdf94a49bcd5e32c601ab83362a839b7afcfd7b20bb7d7568703db69f9e67bb2753216345f5d68cc0625ddb59c0bac8f1368039e88d4e0a64ad410e760814fe069367ac9eb8ecf8048c0036dd43bad60cef76f245d84f992eefbb921c25e0251294bc005d64824bd08b48e989999acbc2231773e148e4faa8e070369f283fa6d5847b52f2d1ba4974f9c9ff15063023cc74598b4ab08d7673a3cffff90cc15280efba1de9f5621c6eefd35b9e8c001fa9610813549f3c05b7a9d3e3b7dedeac5516418cf112cd5f89df7002c046d80f49f69b47a55c53e8427deab0f206636d2e9cc2b3196f93eac1df9e82c9848786976c2d8f06c8922071da609b5d1f0168e33016cc3d0f9d4e9e09a92dd8103ec24a1df61fca7b243eeb908494d4aa07afde286ac8b1288bbd7ea85198d488f03aea76342dde00c7751a37b5406219a01ebe6c5cb5249527d438036a10aa3b14ba920fa75cdd211f765cf86612260b7fd9888edeba90e66fbfb7633508ab49bdd7e2dc968a96c4997b614e83c0494b9bd167d5849e013c5a3f51e685bc0af968811cd7efa99a9e2d5412557c727498cbfdd42955dee897e2af898f62f89dd9155b7897134b9baf8976d54efa8f0fb49ad61e071d5241b3f5587ab4e887b93e3fb54807b1e4dc03e9cfb246c9f87824c3b0defb3b7fd3a19ededb2c8a778411f54f816550f8a07ead52cb37a7959d5cf6cea323550f7bdff3e7575f997447c23559e3216f85fbccba98f3d7ad61b3fa09e84bc9b85646c06079edae29c07fde15d915ff28ed4da188f7b526a5e7808edbaacbe9bba841aee75c27eeed911e95844a271a1423145200172da0d42e9d1cd6019a36b4432a3b63e587f87b9c3cb996fad68609ff760e6bc83ff519c4a70304d53b143fec807d4169ddbf19ed9104048d17f80f6d2b5f46beeca2f4fbb42ff77f2474748e52878631d0229c59b63f6ed8ed5b1baba72821118f35217f2e7dfe27e0349760b02dfb5a021e388418aa805cf9358b0eab36beae38faeb87afe8d51549c36aa4c6965d6ec98c35eefeb84880353876763061181282ab2c83844564863f4b833aee028b1c329e934621ad7ca03fbb36b99ea7e5bb912b334143266e8a6034ae6098b92c446863da7db88bf943dee7115db2aab8b2e7d86f2bc6d34b4475d8b2324ce18c5ad743a96f6c18056306f968c270d3cf6936987a4aa01ffe778a3dd64132a1909e10d6debc3edbdf101f90568ebe5e7a4f761c8d504634597513315ebb17f1cbda60818dee4d974dff4b6f421ded47f26b9192ff8bf74122c2e964bd340243237ec256b39f26c8da897edbd151bf61fde32a4634b2553618f767bc05bc8206e7d874c44ddcc8dc55e0f476cf3e3549995c9885ee71cfa48be8227dd39c3b05761084bea6f6811879e1fd396cf532f3ea6fc445feba77caa61cb99b076f0e130091a1e593ba5c99a0dd2d42972eea6779505b3d2d92fabc739ab74d1d887d93f0506089b2fc8f82eba68212198a747288de8b325c52928c3cd83f0a66e4ff518993df725fe33dcc12dcb9c6c152a0fa4447827ee946cc62e6b8966bf8d49274cb16b8c00cc20cd569e198e9c3c21ded4a8465ce3882a648b42ae9c7e69d4f2ec857fdafdcfd3e5c1d6f744c1e9c5ca0f970f116691e7d293209d9071783bcd4941a4a8f241e118b9b49dd0d97c186025a512f967540ac0cda74b0231efb9d135775dba5e2716bfc30ef7d61bb7bcaeddf17cd9e88e4efcdb180f534634fab86b3771bb2737f85c43193e031eafeeb81c462b389ba5b167887ae6671b7cf8cc925ca82509fb4f9e6a39367d536be872f348fd6c364c2385ac18111c4b3474cd5c17b7e83b1464d7b096cc0324bb8cf3c32394b5c0162d554982569fcc6d010c1d1525ac1115b0adb1c7210b580974617640c3f0bf5d438925252284cf1bf553c0686e625c50ae439131673dd25878c88205c41fc014fe86b6fda16474a5c8b3a31b2e8304bf10eaf8c9301fb259947f7e1b0205ccba3d079a08338267e6b8de8fbc0c49a85d526828c490341d988677c3dcab2c4c9d42e1ff31587b34eca7316907b27fe42b41c8b1cea0516a1dd4a0762cd82690628a5c5615420dc2cc37d86c83fa94b8cd68c2dcd0cf0474240879de2450a1b3e6ac0a8971b08ad65ed320ef086b96718e123f0f1f67a37c377317aac5010c702f4eb02ee0b4f7d81b8c57f07a94414a03d9e8e3bc607d0f2e890e6325a015d0570eac9633bda93ce86ce354cc6f7e242827b5f46955ed6f209c40b319598498b9925b0f7c60d18148eba56a905f1d2b6527dd97f7f94bf6bec16de9c61b403b8bfb767c3ca539165931b8cd890d5f4e890c2c411f1fc3fc1cecf0408cce54492ee7d4b77cb9d68e024eac18bb1227040096ff3565a5a09792f65c2308e3fbdd142480d4b12b4fc267c0d2292e69abf86c6b997f19bff4b855cb7bdab06496070f8fcc0a606b1ebb3e10c125f507d6f663484c324d5904f6879746707c9561259f9ffce37961407caff152bb83cd43e294ff65be26418a06eebef9c50102d2eb7c4edfe65b2299933508a88f08805f3386ee12be25b7d0af94ca69496c547dcf9800b401f20fa6b109e6f445d4e0c74dc8b452c6d536dc582ba0882a7f040a24d68fb030dbd0716a67ed2f9d5c3e637fe757fc9446f9b33d6abbdeed67fd96694fead3f6a81445806b8b1d85a0af5754a063ac0c4940caf5a24cf5db623ece767cde56ae98beec30fe280a056639e06af9dc989cd88712e00363c4eddbacd285488abc2457ea74bb8de5b6c4926a404b8c58b6b23ceffda83a2f42d8ed4e2ac0f6f32196217e349980086f960934685518f988953b801e784fbe8edc28fbd490336be25566d0c0eaae6627027cc63dbf7808c8c073ad7ed90327b42f66af19e02475ff9717a17676ae2027007880e6fe2d4500ae86ad8cb767d57ed5672e10c1bee245270033799de66c36ed44010c4b375bdc84d0f684caba83c519967593aef9d33dc3765f0c3a2c4b8f919516769837159fd0987e4ca8dd7e98f49e68af92ce9785dd493dd2cfc9c1ab5982a847994238cd8f562623740a79ef4326b67faf634cfadfcaf37db36186a0c14be163f69e32d3bf04852d0ccd3edc245febd19afc54eb15fcaa085acba8cd554cf8d737ac2522b41ea3e1327dfbcf7ddfd2a6cb4702d5f258750556daf3fdcbe64d9db3cc233440b6e47b50867149fb655d7d973dedb0044f110e20c6fcd64aee5000d42732a048fa066853e00b8a2fe678a352e4f9dc7aebc270e699d651e39812a8864bbef518570b5acb422afad7640e88f68efa4f601aa468cbc828fb74dc3e2473090a159380042901342ddcb382a626abeb333e55e6117333bc0d3e48e7d95828ad5f9164050066fbf8251191936801f3e617fbfbf2311282b0860ea074fe9c3581e056ab9419ed6699330b17ad0078e099f739c09ffcd82d5bffbfc324ed034863b512cf16a64ca853eab020c5550639864e62ae8f75ef94fafcdc3863c36bb9f2f8e8320eafe77216aa963552e2622722801bcbc863234cbe9b80702c3727462ff40f1e33226aa7a3cfcf600ab4c4199123d1ccffa21579799176b03546c87673d589898b62f112838be9b2f6c1d6485fe357f832"}]}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000e80)={0x2c, &(0x7f0000000bc0)={0x0, 0x1, 0xd1, {0xd1, 0x22, "6dcefee51434ac4525905481bc7c338dc267201e7141a5e869b721b0bb6a3f62cb358a477b671d781a51827fb0d7e2aff21fe2c002dc1740efaa16b6099b76de8ca16af35f12e1b09cdcce7b768591fff4a9a6aa3fbab7e174e6e19356ce75858704da88d67be5ef09a6000666bcc30fe3cc57f5020300dd7560b112e770fa0288b78ca51de6f47bc3295dfc433686765d8834ec2c9b4211e48467c32c5a3ae4b143845d20e8789f6f3c42451613a0e66544d4c1b3660aaab18181868990a47dfb685250233bf88f9522d0e697282d"}}, &(0x7f0000000d00)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xc0c}}, &(0x7f0000000d40)={0x0, 0xf, 0x4e, {0x5, 0xf, 0x4e, 0x5, [@ptm_cap={0x3}, @ssp_cap={0x14, 0x10, 0xa, 0x0, 0x2, 0x1, 0xf00, 0x401, [0xc0, 0x3f27]}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x0, 0x4, 0x1, 0x6}, @ss_container_id={0x14, 0x10, 0x4, 0xfa, "2dcd9f94a31afa85c8dbaf5ed3eeba8b"}, @ssp_cap={0x14, 0x10, 0xa, 0x7f, 0x2, 0x7, 0x0, 0x3346, [0xff00, 0x0]}]}}, &(0x7f0000000e00)={0x20, 0x29, 0xf, {0xf, 0x29, 0x3, 0x80, 0x3f, 0xff, "d378e046", "8b6a74e7"}}, &(0x7f0000000e40)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x2, 0x60, 0x81, 0xfc, 0x3, 0x31}}}, &(0x7f0000002440)={0x84, &(0x7f0000000ec0)={0x20, 0xe, 0xd, "1044e256007bcac53b0e86cadc"}, &(0x7f0000000f00)={0x0, 0xa, 0x1, 0x7}, &(0x7f0000000f40)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000f80)={0x20, 0x0, 0x4}, &(0x7f0000000fc0)={0x20, 0x0, 0x4, {0x301, 0x20}}, &(0x7f0000001000)={0x40, 0x7, 0x2, 0x6}, &(0x7f0000001040)={0x40, 0x9, 0x1, 0x3}, &(0x7f0000002200)={0x40, 0xb, 0x2, "b221"}, &(0x7f0000002240)={0x40, 0xf, 0x2, 0x3}, &(0x7f0000002280)={0x40, 0x13, 0x6}, &(0x7f00000022c0)={0x40, 0x17, 0x6, @random="bfee0c699661"}, &(0x7f0000002300)={0x40, 0x19, 0x2, "b8fe"}, &(0x7f0000002340)={0x40, 0x1a, 0x2, 0xffff}, &(0x7f0000002380)={0x40, 0x1c, 0x1, 0xf8}, &(0x7f00000023c0)={0x40, 0x1e, 0x1, 0xbc}, &(0x7f0000002400)={0x40, 0x21, 0x1}}) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000001080)={0x34, &(0x7f0000000dc0)={0x0, 0x0, 0x1, "cf"}, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_usb_connect$cdc_ecm(0x6, 0x59, &(0x7f0000000080)={{0x12, 0x1, 0x250, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x47, 0x1, 0x1, 0x7, 0x80, 0x5, [{{0x9, 0x4, 0x0, 0x4, 0x2, 0x2, 0x6, 0x0, 0x2, {{0x8, 0x24, 0x6, 0x0, 0x0, '\\/Y'}, {0x5, 0x24, 0x0, 0x7}, {0xd, 0x24, 0xf, 0x1, 0x80000000, 0x7, 0x6, 0xe7}}, {[{{0x9, 0x5, 0x81, 0x3, 0x9f8d511b6fe0fe21, 0x0, 0x7, 0x3}}], {{0x9, 0x5, 0x82, 0x2, 0x40, 0x2, 0x3, 0x44}}, {{0x9, 0x5, 0x3, 0x2, 0x8, 0x17, 0x3, 0xff}}}}}]}}]}}, &(0x7f00000002c0)={0xa, &(0x7f0000000000)={0xa, 0x6, 0x310, 0x6, 0x80, 0x0, 0x8, 0x4}, 0x5, &(0x7f0000000100)={0x5, 0xf, 0x5}, 0x5, [{0x4, &(0x7f0000000140)=@lang_id={0x4, 0x3, 0x827}}, {0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x1809}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x400a}}, {0x71, &(0x7f0000000200)=@string={0x71, 0x3, "d911b0d6cb2d43911a416daa624c65e3d6522cafe3b855b5d69b07e0c4ca5fea863493bcbdba51e036abcef9826e8198759b13a23ff10814afef40f20b327f8d038d6e3f459d13a8948ccf769fc2adae0bfb12dd2c4b1ead26618965a18fa01adf9cef58e3b461a1f4757086f58a7f"}}, {0x4, &(0x7f0000000280)=@lang_id={0x4, 0x3, 0x41e}}]}) syz_usb_control_io(r1, &(0x7f0000000680)={0x2c, &(0x7f0000000340)={0x20, 0x0, 0xb8, {0xb8, 0x2f, "9b70f4298847e026104bb1a253a438b3f3f8c9662e5a885b080eeb01b083a3f53f6437e479cb621b2a5783a0ee69002f91e0495dad057f8a951ed99e05750fae382ed4544a21112c3f5ece53213265793d47d71aa7236a4b5d4718e440d9b01a567a159b99b0ae6ec919332d857103942af34941a6f9eb805e5829b6dd64566f47a631b1ae13724b42c1a9e0948d189906c0d2bdb391f9351c06d367518733180df51c028a4c60d9bf6061da727940e616872100429e"}}, &(0x7f0000000400)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xeae70115ed6480aa}}, &(0x7f0000000440)={0x0, 0xf, 0x1a7, {0x5, 0xf, 0x1a7, 0x5, [@ssp_cap={0x20, 0x10, 0xa, 0x7f, 0x5, 0x1000, 0x0, 0x7, [0x30, 0xc0c0, 0x3f, 0xf, 0xffc03f]}, @ssp_cap={0x18, 0x10, 0xa, 0x4, 0x3, 0x7, 0x6477402b8fe9beff, 0xc4ac, [0xffffff, 0xffc000, 0x0]}, @generic={0xec, 0x10, 0x3, "18a367d1355cc95447dbabbb30280febba30280e61d64c0d31239a925d84f557cfa9404e690fd53bd10f2f2aef40114a93e501dab4cd3b956a6a65cd95b2550c12fc3e4cb1ed260fb9199feccca21a4bd41bb070fcc44326a687b520f4b2356da56accda5cf444ac73986aea4deec937619f5e39fe4bbc2d4fd4bf65afcd27677157137b6c83b4d67d63fe662ea1803d714736050925bc74099077570f2801ae219ba46fb786863b19277b8dbe9dccff2599ae1871277c36a99bed857078d658e9212c8b5f1bc668d346db1976a577a819b9a043118aee5f4ab44a0287f04a0fbca20b6b43bce94ff2"}, @wireless={0xb, 0x10, 0x1, 0x4, 0x4, 0x7, 0x3f, 0xe7, 0x6}, @generic={0x73, 0x10, 0xd, "3d9b7a86bcf039babe2c3b75518241d1d3c132d93f78e1d580ad3863f76e36886c72c75ab86efd305e21cdb27b6e1b84bc48aa4eeebcc16b0865e51bac81bcadcae016e3c145bf9c0ec8267a218afdf6fcc62563e48118b60e9c05d4d83a8c3170aa20ac7dc95ad57a40d2b20db483ed"}]}}, &(0x7f0000000600)={0x20, 0x29, 0xf, {0xf, 0x29, 0x0, 0x8, 0x6, 0x94, "2e1bec3a", "dac84117"}}, &(0x7f0000000640)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x20, 0x60, 0x4, 0x2, 0xcd, 0x4, 0xff}}}, &(0x7f0000000b00)={0x84, &(0x7f00000006c0)={0x20, 0x11, 0x9, "806172ebea4bd24dd3"}, &(0x7f0000000700)={0x0, 0xa, 0x1, 0x1}, &(0x7f0000000740)={0x0, 0x8, 0x1, 0xd7}, &(0x7f0000000780)={0x20, 0x0, 0x4, {0x3, 0x2}}, &(0x7f00000007c0)={0x20, 0x0, 0x4, {0x1c00, 0x20}}, &(0x7f0000000800)={0x40, 0x7, 0x2, 0x6}, &(0x7f0000000840)={0x40, 0x9, 0x1, 0x2}, &(0x7f0000000880)={0x40, 0xb, 0x2, 'Z%'}, &(0x7f00000008c0)={0x40, 0xf, 0x2, 0x5}, &(0x7f0000000900)={0x40, 0x13, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x24}}, &(0x7f0000000940)={0x40, 0x17, 0x6, @local}, &(0x7f0000000980)={0x40, 0x19, 0x2, "cae7"}, &(0x7f00000009c0)={0x40, 0x1a, 0x2, 0x8b}, &(0x7f0000000a00)={0x40, 0x1c, 0x1, 0x9}, &(0x7f0000000a80)={0x40, 0x1e, 0x1, 0x2}, &(0x7f0000000ac0)={0x40, 0x21, 0x1, 0x8}}) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000cc0)={0x2c, &(0x7f0000000a40)={0x0, 0x0, 0x2, ']R'}, 0x0, 0x0, 0x0, 0x0}) [ 1431.112998][ T7421] usb 4-1: New USB device found, idVendor=08d1, idProduct=0003, bcdDevice=3a.3d [ 1431.122099][ T7421] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1431.130562][ T7421] usb 4-1: Product: syz [ 1431.135264][ T7421] usb 4-1: Manufacturer: syz [ 1431.139876][ T7421] usb 4-1: SerialNumber: syz [ 1431.152232][ T7421] usb 4-1: config 0 descriptor?? 17:28:22 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:28:22 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245", 0x5a, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:28:22 executing program 5: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000380)) r4 = perf_event_open$cgroup(&(0x7f0000000200)={0x0, 0x80, 0xfb, 0x2, 0x7, 0x1, 0x0, 0x7, 0x100, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_config_ext={0x7, 0x3}, 0x1400, 0x6, 0x7, 0x0, 0x2, 0x9, 0x3, 0x0, 0x9911, 0x0, 0x80000000}, 0xffffffffffffffff, 0xd, r0, 0x3) perf_event_open(&(0x7f00000000c0)={0x3, 0x80, 0x48, 0x7, 0xf8, 0x2, 0x0, 0x9, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x8, 0x0, @perf_bp={&(0x7f0000000040), 0xa}, 0x10, 0x2, 0xff, 0x0, 0x0, 0x3ff, 0x7, 0x0, 0x3ff, 0x0, 0x8000}, r3, 0xffffffffffffffff, r4, 0x1) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) sendmmsg(r1, &(0x7f0000000280)=[{{0x0, 0x7, 0x0, 0x3e8, 0x0, 0x0, 0xf4010000}}], 0x400000000000085, 0x0) 17:28:22 executing program 2: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r0 = socket(0x10, 0x0, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:28:22 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x0, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) [ 1431.192974][ T7421] usb 4-1: can't set config #0, error -71 [ 1431.209726][ T7421] usb 4-1: USB disconnect, device number 20 17:28:22 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x0, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) [ 1431.380539][T10744] xt_NFQUEUE: number of total queues is 0 [ 1431.381054][T10750] ubi0: detaching mtd0 17:28:22 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec6", 0x5d, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1431.471913][T10752] xt_NFQUEUE: number of total queues is 0 [ 1431.481991][T10750] ubi0: mtd0 is detached 17:28:22 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec6", 0x5d, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:28:22 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x0, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) [ 1431.717249][T10766] ubi0: attaching mtd0 [ 1431.794348][ T7761] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 1431.810713][T10766] ubi0: scanning is finished [ 1432.062869][ T7761] usb 4-1: Using ep0 maxpacket: 8 17:28:23 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1432.134438][T10766] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1432.145577][T10766] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1432.159376][T10766] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1432.182824][T10766] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1432.191417][T10766] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1432.207057][T10766] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1432.228057][T10766] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 1204783369 [ 1432.251994][T10766] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1432.279125][T10784] ubi0: background thread "ubi_bgt0d" started, PID 10784 [ 1432.288135][T10775] ubi0: detaching mtd0 [ 1432.310035][T10775] ubi0: mtd0 is detached 17:28:23 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1432.333725][T10776] ubi0: attaching mtd0 [ 1432.352462][T10788] nfqueue_tg_check: 1 callbacks suppressed [ 1432.352542][T10788] xt_NFQUEUE: number of total queues is 0 [ 1432.413067][ T7761] usb 4-1: New USB device found, idVendor=08d1, idProduct=0003, bcdDevice=3a.3d [ 1432.431758][ T7761] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1432.442454][T10776] ubi0: scanning is finished [ 1432.461821][ T7761] usb 4-1: Product: syz [ 1432.497745][ T7761] usb 4-1: Manufacturer: syz [ 1432.526914][ T7761] usb 4-1: SerialNumber: syz [ 1432.556591][ T7761] usb 4-1: config 0 descriptor?? [ 1432.674301][ T7761] hub 4-1:0.0: bad descriptor, ignoring hub [ 1432.680249][ T7761] hub: probe of 4-1:0.0 failed with error -5 [ 1432.693839][T10776] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 1434.233061][ T7761] pegasus 4-1:0.0: can't reset MAC [ 1434.242720][ T7761] pegasus: probe of 4-1:0.0 failed with error -5 [ 1434.283268][ T7761] usb 4-1: USB disconnect, device number 21 [ 1434.972587][ T7761] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 1435.232633][ T7761] usb 4-1: Using ep0 maxpacket: 8 17:28:26 executing program 3: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x98, 0x91, 0xc3, 0x8, 0x8d1, 0x3, 0x3a3d, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x9, 0xb1, 0x16}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000001080)={0x34, &(0x7f0000000dc0)=ANY=[@ANYBLOB="2080010000009a"], 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_usb_connect$printer(0x0, 0x2d, &(0x7f0000000000)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x40, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0x8, 0x40, 0x5, [{{0x9, 0x4, 0x0, 0x5, 0x1, 0x7, 0x1, 0x1, 0x5, "", {{{0x9, 0x5, 0x1, 0x2, 0x8, 0x3, 0x2f, 0x1f}}}}}]}}]}}, &(0x7f0000000200)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x200, 0x1, 0x1, 0x7f, 0x8, 0x40}, 0x33, &(0x7f00000000c0)={0x5, 0xf, 0x33, 0x3, [@ext_cap={0x7, 0x10, 0x2, 0x2, 0x9, 0x3, 0x100}, @ssp_cap={0x24, 0x10, 0xa, 0xf7, 0x6, 0xa87, 0x0, 0x8, [0xc00f, 0xf, 0xc0, 0x0, 0xf0, 0xffc0c0]}, @ptm_cap={0x3}]}, 0x2, [{0x4, &(0x7f0000000100)=@lang_id={0x4, 0x3, 0x41b}}, {0x94, &(0x7f0000000140)=ANY=[@ANYBLOB="9403c044bcca8d5c3c43b7ea905a22538b2252375de25e3aec525a603d57fcf46cdb227d620272386c18b329a09d042f17e53c00228e5745123cdaf32c6900b6885d3b641ef30d4d47b11a7f43071161bd85f9c5f01e7d664f20bd580532ddb4e0ea787137b822e004022e7ae0dec55eae4c7fef26a9525272a2b01a23f38fb297cacdfd45bcb9be59871d1bb12a0648a7858ab8"]}]}) syz_usb_control_io(r1, &(0x7f0000000440)={0x2c, &(0x7f0000000240)={0x0, 0x11, 0xdc, {0xdc, 0x8, "ffe539a21d59cbaa319d1cbcc0343dcb62655d862639b351827d9df516ad823f3a18d681abd4fa5d7b29c370aafbc84ff12fa741a47cb87a08714c87bd4da2369a5c891e00cf13dc56ac87ee7ae6101cd11162216f2d3ec0daef3bf7c5619faf99869cbe3819bbffa411226b29ea8e6e9048f049f4ba224e43bdebee5784ef949dbdefef9192eb8824aa6f9b13decc677cf2b7323279ec0e991f8f88f825c8336478fd0061da51279d9602f4dc72c824d9570d5c0977cafd666714613fc128a641f310518b269a6e701f0d7d1600490594cc138fc425e56c02db"}}, &(0x7f0000000340)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x449}}, &(0x7f0000000380)={0x0, 0xf, 0x5, {0x5, 0xf, 0x5}}, &(0x7f00000003c0)={0x20, 0x29, 0xf, {0xf, 0x29, 0xdc, 0x10, 0x66, 0x1f, "80cbaba5", "5490ccdd"}}, &(0x7f0000000400)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x1f, 0x80, 0x1, 0x80, 0x4, 0x6, 0x7}}}, &(0x7f0000000940)={0x84, &(0x7f0000000480)={0x40, 0x15, 0xd4, "06a3750dc36703a01841add1bdaa026c5c1fce974d9fc8fbdae54bc467a2b5fa7ab78e802d3ec9eece5c0367f58599988128c8ec40039af2821bdb25531d79c68e77054fef5fb607b0de6b076087b2808bea7a5ee1e549d196bd234648672fcd9cae3a56a8cf1b95eaee2071d358931b1f9c634b874cba37c239983c5580159bc5469ad2ed50f18966989da386e12d466ab2c97d9763dcfa2ffb7802bc3e00e5c6b864c3e99c1ac17da9e8e69a6c224cee63b77035ff020a56c83759169c9ee10d27a44f6972da3a23c1d186fd31fac640d20787"}, &(0x7f0000000580)={0x0, 0xa, 0x1}, &(0x7f00000005c0)={0x0, 0x8, 0x1, 0xe3}, &(0x7f0000000600)={0x20, 0x0, 0x4, {0x3, 0x3}}, &(0x7f0000000640)={0x20, 0x0, 0x8, {0x0, 0x80, [0xf0f0]}}, &(0x7f0000000680)={0x40, 0x7, 0x2, 0x1}, &(0x7f00000006c0)={0x40, 0x9, 0x1}, &(0x7f0000000700)={0x40, 0xb, 0x2, "b708"}, &(0x7f0000000740)={0x40, 0xf, 0x2, 0x23f}, &(0x7f0000000780)={0x40, 0x13, 0x6, @remote}, &(0x7f00000007c0)={0x40, 0x17, 0x6}, &(0x7f0000000800)={0x40, 0x19, 0x2, "0e22"}, &(0x7f0000000840)={0x40, 0x1a, 0x2, 0x4}, &(0x7f0000000880)={0x40, 0x1c, 0x1, 0x1f}, &(0x7f00000008c0)={0x40, 0x1e, 0x1, 0x6}, &(0x7f0000000900)={0x40, 0x21, 0x1, 0xcb}}) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000cc0)={0x2c, &(0x7f0000000a40)={0x0, 0x0, 0x2, ']R'}, 0x0, 0x0, 0x0, 0x0}) 17:28:26 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x0, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) 17:28:26 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) 17:28:26 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:28:26 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec6", 0x5d, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:28:26 executing program 5: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000380)) r4 = perf_event_open$cgroup(&(0x7f0000000200)={0x0, 0x80, 0xfb, 0x2, 0x7, 0x1, 0x0, 0x7, 0x100, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_config_ext={0x7, 0x3}, 0x1400, 0x6, 0x7, 0x0, 0x2, 0x9, 0x3, 0x0, 0x9911, 0x0, 0x80000000}, 0xffffffffffffffff, 0xd, r0, 0x3) perf_event_open(&(0x7f00000000c0)={0x3, 0x80, 0x48, 0x7, 0xf8, 0x2, 0x0, 0x9, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x8, 0x0, @perf_bp={&(0x7f0000000040), 0xa}, 0x10, 0x2, 0xff, 0x0, 0x0, 0x3ff, 0x7, 0x0, 0x3ff, 0x0, 0x8000}, r3, 0xffffffffffffffff, r4, 0x1) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) sendmmsg(r1, &(0x7f0000000280)=[{{0x0, 0x7, 0x0, 0x700, 0x0, 0x0, 0xf4010000}}], 0x400000000000085, 0x0) [ 1435.552586][ T7761] usb 4-1: New USB device found, idVendor=08d1, idProduct=0003, bcdDevice=3a.3d [ 1435.561746][ T7761] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1435.629378][ T7761] usb 4-1: Product: syz [ 1435.651093][ T7761] usb 4-1: Manufacturer: syz [ 1435.697869][ T7761] usb 4-1: config 0 descriptor?? [ 1435.744776][T10820] xt_NFQUEUE: number of total queues is 0 [ 1435.752695][ T7761] usb 4-1: can't set config #0, error -71 [ 1435.769482][ T7761] usb 4-1: USB disconnect, device number 22 [ 1435.789516][T10829] xt_NFQUEUE: number of total queues is 0 17:28:27 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:28:27 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) 17:28:27 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x0, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) 17:28:27 executing program 0: syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1436.183341][ T7761] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 1436.241685][T10849] ubi0: attaching mtd0 [ 1436.337748][T10849] ubi0: scanning is finished 17:28:27 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x0, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000}) 17:28:27 executing program 0: syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1436.437512][T10853] xt_NFQUEUE: number of total queues is 0 [ 1436.442509][ T7761] usb 4-1: Using ep0 maxpacket: 8 [ 1436.670963][T10861] xt_NFQUEUE: number of total queues is 0 [ 1436.684977][T10849] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1436.705624][T10849] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1436.731201][T10849] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1436.743423][ T7761] usb 4-1: New USB device found, idVendor=08d1, idProduct=0003, bcdDevice=3a.3d [ 1436.753979][T10849] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1436.768498][ T7761] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1436.781903][T10849] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1436.792119][T10849] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1436.799376][ T7761] usb 4-1: Product: syz [ 1436.801428][T10849] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 1204783369 [ 1436.821354][ T7761] usb 4-1: Manufacturer: syz [ 1436.826077][T10849] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1436.845586][T10866] ubi0: background thread "ubi_bgt0d" started, PID 10866 [ 1436.853816][T10862] ubi0: detaching mtd0 [ 1436.866414][T10862] ubi0: mtd0 is detached [ 1436.871485][T10868] ubi0: attaching mtd0 [ 1436.906168][ T7761] usb 4-1: SerialNumber: syz [ 1436.931633][ T7761] usb 4-1: config 0 descriptor?? [ 1437.013860][ T7761] hub 4-1:0.0: bad descriptor, ignoring hub [ 1437.028103][T10868] ubi0: scanning is finished [ 1437.042421][ T7761] hub: probe of 4-1:0.0 failed with error -5 [ 1437.172877][T10868] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1437.181187][T10868] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1437.188756][T10868] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1437.198536][T10868] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1437.207057][T10868] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1437.220669][T10868] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1437.239260][T10868] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 1204783369 [ 1437.258127][T10868] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1437.278324][T10875] ubi0: background thread "ubi_bgt0d" started, PID 10875 [ 1438.083556][T10835] UDC core: couldn't find an available UDC or it's busy: -16 [ 1438.091001][T10835] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 1438.342608][ T7761] pegasus: probe of 4-1:0.0 failed with error -71 [ 1438.377912][ T7761] usb 4-1: USB disconnect, device number 23 [ 1439.102518][T13278] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 1439.342275][T13278] usb 4-1: Using ep0 maxpacket: 8 17:28:30 executing program 0: syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:28:30 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684", 0x5e, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:28:30 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) 17:28:30 executing program 5: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000380)) r4 = perf_event_open$cgroup(&(0x7f0000000200)={0x0, 0x80, 0xfb, 0x2, 0x7, 0x1, 0x0, 0x7, 0x100, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_config_ext={0x7, 0x3}, 0x1400, 0x6, 0x7, 0x0, 0x2, 0x9, 0x3, 0x0, 0x9911, 0x0, 0x80000000}, 0xffffffffffffffff, 0xd, r0, 0x3) perf_event_open(&(0x7f00000000c0)={0x3, 0x80, 0x48, 0x7, 0xf8, 0x2, 0x0, 0x9, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x8, 0x0, @perf_bp={&(0x7f0000000040), 0xa}, 0x10, 0x2, 0xff, 0x0, 0x0, 0x3ff, 0x7, 0x0, 0x3ff, 0x0, 0x8000}, r3, 0xffffffffffffffff, r4, 0x1) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) sendmmsg(r1, &(0x7f0000000280)=[{{0x0, 0x7, 0x0, 0x900, 0x0, 0x0, 0xf4010000}}], 0x400000000000085, 0x0) 17:28:30 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x0, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000}) [ 1439.727987][T10895] ubi0: detaching mtd0 [ 1439.732329][T13278] usb 4-1: New USB device found, idVendor=08d1, idProduct=0003, bcdDevice=3a.3d [ 1439.732369][T13278] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1439.732397][T13278] usb 4-1: Product: syz [ 1439.756869][T13278] usb 4-1: config 0 descriptor?? [ 1439.785517][T13278] usb 4-1: can't set config #0, error -71 17:28:31 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684", 0x5e, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1439.863295][T13278] usb 4-1: USB disconnect, device number 24 [ 1439.887772][T10903] xt_NFQUEUE: number of total queues is 0 17:28:31 executing program 0: syz_mount_image$befs(0x0, 0x0, 0x0, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1439.935499][T10910] xt_NFQUEUE: number of total queues is 0 [ 1439.959307][T10895] ubi0: mtd0 is detached [ 1439.970531][T10901] ubi0: attaching mtd0 [ 1440.053270][T10901] ubi0: scanning is finished 17:28:31 executing program 3: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120100000800000000000400000000000000090212000100000000090400000009b11600"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000840)={{0x12, 0x1, 0x0, 0x85, 0x37, 0x4, 0x8, 0x61d, 0xc020, 0x715, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xa3, 0xd9, 0x12}}]}}]}}, 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000001280)={0x84, &(0x7f0000000000)={0x0, 0x0, 0x3, "4e8ef6"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r1, &(0x7f0000000200)={0x2c, &(0x7f0000000080)={0x0, 0x8, 0xb6, {0xb6, 0x33, "a8ce954943f85f914505c028fc1b5dabf49428c02546c5202e13e9434cde4aee6f629fcce51d6a0712376d6d1c5c2918b799bc40e4e143b592e0355bffbaf2765819ed3f2dad33e139d25c361f4a5fab37500592eade993e6fb176ebc8ef66c1d00f161cd2f4450191bcfc23da764e58f719693b9a1ee92a0df61a0f7ca0cd872b90186dd45ffebff460604636fa00d57d64f6e280e3885725d3ca13a6ac9fa6dc973d9d4daa81230804328f9b7290def27bacbb"}}, &(0x7f0000000000)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xc09}}, &(0x7f0000000140)={0x0, 0xf, 0x19, {0x5, 0xf, 0x19, 0x1, [@ss_container_id={0x14, 0x10, 0x4, 0x0, "b9e236a00b84a8787fc9d2dbfe74ff7c"}]}}, &(0x7f0000000180)={0x20, 0x29, 0xf, {0xf, 0x29, 0x8, 0x4, 0x76, 0x7, "3d164823", "4ed07062"}}, &(0x7f00000001c0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x2, 0x4, 0x0, 0x3c, 0x9, 0xedb7, 0x400}}}, &(0x7f0000000680)={0x84, &(0x7f0000000240)={0x40, 0x14, 0x7a, "d8593770a01775d549e279215f7b38b901955d5f9226a4c1e9e3d30e34c82f73010ca0c608c6147adad9cc1c19c7502521320b454ffdb7da309dbe118720796524b0bf94c9911ed8d2995e4609ff467c00ba06053a94d77565a668c803f981cacc8578bc12b53bd0c455e640b7d3cc4067e11654a24957a52b0a"}, &(0x7f00000002c0)={0x0, 0xa, 0x1, 0x6}, &(0x7f0000000300)={0x0, 0x8, 0x1, 0xfc}, &(0x7f0000000340)={0x20, 0x0, 0x4, {0x2, 0x3}}, &(0x7f0000000380)={0x20, 0x0, 0x8, {0x2, 0x8, [0xf]}}, &(0x7f00000003c0)={0x40, 0x7, 0x2, 0x80}, &(0x7f0000000400)={0x40, 0x9, 0x1, 0x2}, &(0x7f0000000440)={0x40, 0xb, 0x2, "b2b2"}, &(0x7f0000000480)={0x40, 0xf, 0x2, 0x1}, &(0x7f00000004c0)={0x40, 0x13, 0x6, @local}, &(0x7f0000000500)={0x40, 0x17, 0x6, @remote}, &(0x7f0000000540)={0x40, 0x19, 0x2, "67b2"}, &(0x7f0000000580)={0x40, 0x1a, 0x2, 0x1}, &(0x7f00000005c0)={0x40, 0x1c, 0x1, 0x3}, &(0x7f0000000600)={0x40, 0x1e, 0x1, 0x6}, &(0x7f0000000640)={0x40, 0x21, 0x1, 0x8}}) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000001080)={0x34, &(0x7f0000000dc0)={0x0, 0x0, 0x1, "cf"}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000cc0)={0x2c, &(0x7f0000000a40)={0x0, 0x0, 0x2, ']R'}, 0x0, 0x0, 0x0, 0x0}) 17:28:31 executing program 0: syz_mount_image$befs(0x0, 0x0, 0x0, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:28:31 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684", 0x5e, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1440.237043][T10920] xt_NFQUEUE: number of total queues is 0 [ 1440.264101][T10921] xt_NFQUEUE: number of total queues is 0 [ 1440.417806][T10901] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1440.439430][T10901] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1440.456101][T10932] xt_NFQUEUE: number of total queues is 0 17:28:31 executing program 0: syz_mount_image$befs(0x0, 0x0, 0x0, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1440.460475][T10901] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1440.474967][T10901] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1440.495355][T10901] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1440.522365][ T7761] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 1440.525371][T10901] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1440.554511][T10901] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 1204783369 17:28:31 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1440.574594][T10901] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 17:28:31 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1440.644569][T10936] ubi0: background thread "ubi_bgt0d" started, PID 10936 [ 1440.651784][T10904] ubi: mtd0 is already attached to ubi0 [ 1440.669558][T10941] xt_NFQUEUE: number of total queues is 0 17:28:31 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x0, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000}) 17:28:31 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x4, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) [ 1440.722211][ T7761] usb 4-1: device descriptor read/64, error 18 [ 1440.840747][T10948] xt_NFQUEUE: number of total queues is 0 [ 1440.904820][T10955] ubi0: detaching mtd0 [ 1440.912191][T10950] xt_NFQUEUE: number of total queues is 0 [ 1440.931122][T10955] ubi0: mtd0 is detached [ 1440.992928][ T7761] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 1441.073006][T10960] ubi0: attaching mtd0 17:28:32 executing program 5: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000380)) r4 = perf_event_open$cgroup(&(0x7f0000000200)={0x0, 0x80, 0xfb, 0x2, 0x7, 0x1, 0x0, 0x7, 0x100, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_config_ext={0x7, 0x3}, 0x1400, 0x6, 0x7, 0x0, 0x2, 0x9, 0x3, 0x0, 0x9911, 0x0, 0x80000000}, 0xffffffffffffffff, 0xd, r0, 0x3) perf_event_open(&(0x7f00000000c0)={0x3, 0x80, 0x48, 0x7, 0xf8, 0x2, 0x0, 0x9, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x8, 0x0, @perf_bp={&(0x7f0000000040), 0xa}, 0x10, 0x2, 0xff, 0x0, 0x0, 0x3ff, 0x7, 0x0, 0x3ff, 0x0, 0x8000}, r3, 0xffffffffffffffff, r4, 0x1) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) sendmmsg(r1, &(0x7f0000000280)=[{{0x0, 0x7, 0x0, 0xa00, 0x0, 0x0, 0xf4010000}}], 0x400000000000085, 0x0) 17:28:32 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:28:32 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1441.204159][ T7761] usb 4-1: device descriptor read/64, error 18 [ 1441.246479][T10960] ubi0: scanning is finished 17:28:32 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1441.322759][ T7761] usb usb4-port1: attempt power cycle [ 1441.348514][T10966] xt_NFQUEUE: number of total queues is 0 [ 1441.579584][T10977] xt_NFQUEUE: number of total queues is 0 [ 1441.636317][T10960] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1441.664998][T10960] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1441.698259][T10960] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1441.722254][T10960] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1441.729769][T10960] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1441.736863][ T7761] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 1441.741006][T10960] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1441.756535][T10960] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 1204783369 [ 1441.767613][T10960] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1441.779072][T10981] ubi0: background thread "ubi_bgt0d" started, PID 10981 [ 1441.786877][T10957] ubi: mtd0 is already attached to ubi0 [ 1441.872887][ T7761] usb 4-1: Invalid ep0 maxpacket: 0 [ 1442.022152][ T7761] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 1442.112775][ T7761] usb 4-1: Invalid ep0 maxpacket: 0 [ 1442.118157][ T7761] usb usb4-port1: unable to enumerate USB device 17:28:34 executing program 3: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x98, 0x91, 0xc3, 0x8, 0x8d1, 0x3, 0x3a3d, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x9, 0xb1, 0x16}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000001c0)={0x2c, &(0x7f0000000080)={0x40, 0x62, 0x52, {0x52, 0x2, "591f1d84eb9851ab7bbe73861cb1b7c4d3b094aac31ed12cae5ecc104e1d4d68f14491df9b56e48432b53462a8718e0a8238f3bea5b7b7c94e1b37b4e91d172f1ef12d94b54a87ac7e96d9b626cb406a"}}, &(0x7f0000000000)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x44c}}, &(0x7f0000000100)={0x0, 0xf, 0x5, {0x5, 0xf, 0x5}}, &(0x7f0000000140)={0x20, 0x29, 0xf, {0xf, 0x29, 0x5, 0x8, 0x20, 0x7f, "2ff0a847", "71c18031"}}, &(0x7f0000000180)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x0, 0x2, 0xf8, 0xff, 0x68, 0x0, 0x7ff}}}, &(0x7f0000000680)={0x84, &(0x7f0000000200)={0x40, 0x1, 0x85, "a2c6587c225b34136dde2bba6bc3f5247cc131802318a8e08b92e98f2dd82003e6f2f5502082a80e5bf71190edc0bcacbc7f0a8123d1ce8c87443e6742c2bb3f12ce4a3a098f4d99384d82ce1e8f095df7454c563c4ebdd08496e6752117d38fa51aba682118dffcaa7a90c0762d099593918415b1f472a3199e753a4c81710dbce0e22f22"}, &(0x7f00000002c0)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000000300)={0x0, 0x8, 0x1, 0x6}, &(0x7f0000000340)={0x20, 0x0, 0x4, {0x2, 0x3}}, &(0x7f0000000380)={0x20, 0x0, 0x4, {0x12e0, 0x20}}, &(0x7f00000003c0)={0x40, 0x7, 0x2, 0x4200}, &(0x7f0000000400)={0x40, 0x9, 0x1, 0x81}, &(0x7f0000000440)={0x40, 0xb, 0x2, "98f0"}, &(0x7f0000000480)={0x40, 0xf, 0x2, 0x5251}, &(0x7f00000004c0)={0x40, 0x13, 0x6, @link_local}, &(0x7f0000000500)={0x40, 0x17, 0x6, @broadcast}, &(0x7f0000000540)={0x40, 0x19, 0x2, "f422"}, &(0x7f0000000580)={0x40, 0x1a, 0x2, 0x1f}, &(0x7f00000005c0)={0x40, 0x1c, 0x1, 0x6}, &(0x7f0000000600)={0x40, 0x1e, 0x1, 0x6}, &(0x7f0000000640)={0x40, 0x21, 0x1, 0x8}}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000001080)={0x34, &(0x7f0000000dc0)={0x0, 0x0, 0x1, "cf"}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000cc0)={0x2c, &(0x7f0000000a40)={0x0, 0x0, 0x2, ']R'}, 0x0, 0x0, 0x0, 0x0}) 17:28:34 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:28:34 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x0, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:28:34 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x0, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) readahead(0xffffffffffffffff, 0xfffffffffffffff7, 0x0) 17:28:34 executing program 5: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000380)) r4 = perf_event_open$cgroup(&(0x7f0000000200)={0x0, 0x80, 0xfb, 0x2, 0x7, 0x1, 0x0, 0x7, 0x100, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_config_ext={0x7, 0x3}, 0x1400, 0x6, 0x7, 0x0, 0x2, 0x9, 0x3, 0x0, 0x9911, 0x0, 0x80000000}, 0xffffffffffffffff, 0xd, r0, 0x3) perf_event_open(&(0x7f00000000c0)={0x3, 0x80, 0x48, 0x7, 0xf8, 0x2, 0x0, 0x9, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x8, 0x0, @perf_bp={&(0x7f0000000040), 0xa}, 0x10, 0x2, 0xff, 0x0, 0x0, 0x3ff, 0x7, 0x0, 0x3ff, 0x0, 0x8000}, r3, 0xffffffffffffffff, r4, 0x1) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) sendmmsg(r1, &(0x7f0000000280)=[{{0x0, 0x7, 0x0, 0xbb8, 0x0, 0x0, 0xf4010000}}], 0x400000000000085, 0x0) 17:28:34 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x4, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) [ 1443.271922][T10994] ubi0: detaching mtd0 17:28:34 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, 0x0) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1443.315678][T10994] ubi0: mtd0 is detached [ 1443.450195][T10995] ubi0: attaching mtd0 17:28:34 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x0, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) readahead(0xffffffffffffffff, 0xfffffffffffffff7, 0x0) [ 1443.577447][T10995] ubi0: scanning is finished 17:28:34 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, 0x0) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1443.692450][T24097] usb 4-1: new high-speed USB device number 29 using dummy_hcd 17:28:35 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, 0x0) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1443.932414][T24097] usb 4-1: Using ep0 maxpacket: 8 [ 1443.980895][T10995] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1443.991903][T10995] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1444.006802][T10995] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 17:28:35 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1444.027394][T10995] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1444.047829][T10995] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1444.069372][T10995] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 17:28:35 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x0, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1444.106987][T10995] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 1204783369 [ 1444.134267][T10995] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1444.156512][T11029] ubi0: background thread "ubi_bgt0d" started, PID 11029 [ 1444.166365][T11017] ubi0: detaching mtd0 [ 1444.179097][T11017] ubi0: mtd0 is detached [ 1444.212578][T24097] usb 4-1: New USB device found, idVendor=08d1, idProduct=0003, bcdDevice=3a.3d [ 1444.227328][T24097] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1444.286894][T24097] usb 4-1: Product: syz [ 1444.316499][T24097] usb 4-1: Manufacturer: syz [ 1444.365019][T24097] usb 4-1: SerialNumber: syz [ 1444.428986][T24097] usb 4-1: config 0 descriptor?? [ 1444.473468][T24097] hub 4-1:0.0: bad descriptor, ignoring hub [ 1444.479423][T24097] hub: probe of 4-1:0.0 failed with error -5 [ 1445.342094][T24097] pegasus: probe of 4-1:0.0 failed with error -32 17:28:37 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:28:37 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x4, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) 17:28:37 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x0, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) readahead(0xffffffffffffffff, 0xfffffffffffffff7, 0x0) 17:28:37 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x0, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:28:37 executing program 5: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000380)) r4 = perf_event_open$cgroup(&(0x7f0000000200)={0x0, 0x80, 0xfb, 0x2, 0x7, 0x1, 0x0, 0x7, 0x100, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_config_ext={0x7, 0x3}, 0x1400, 0x6, 0x7, 0x0, 0x2, 0x9, 0x3, 0x0, 0x9911, 0x0, 0x80000000}, 0xffffffffffffffff, 0xd, r0, 0x3) perf_event_open(&(0x7f00000000c0)={0x3, 0x80, 0x48, 0x7, 0xf8, 0x2, 0x0, 0x9, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x8, 0x0, @perf_bp={&(0x7f0000000040), 0xa}, 0x10, 0x2, 0xff, 0x0, 0x0, 0x3ff, 0x7, 0x0, 0x3ff, 0x0, 0x8000}, r3, 0xffffffffffffffff, r4, 0x1) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) sendmmsg(r1, &(0x7f0000000280)=[{{0x0, 0x7, 0x0, 0xe00, 0x0, 0x0, 0xf4010000}}], 0x400000000000085, 0x0) [ 1446.462127][T13281] usb 4-1: USB disconnect, device number 29 [ 1446.589671][T11057] nfqueue_tg_check: 5 callbacks suppressed [ 1446.589738][T11057] xt_NFQUEUE: number of total queues is 0 [ 1446.592663][T11059] ubi0: attaching mtd0 17:28:37 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:28:37 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:28:38 executing program 3: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x98, 0x91, 0xc3, 0x8, 0x8d1, 0x3, 0x3a3d, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x9, 0xb1, 0x16}}]}}]}}, 0x0) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000840)={{0x12, 0x1, 0x0, 0x85, 0x37, 0x4, 0x8, 0x61d, 0xc020, 0x715, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xa3, 0xd9, 0x12}}]}}]}}, 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000001280)={0x84, &(0x7f0000000000)={0x0, 0x0, 0x3, "4e8ef6"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$printer(r1, &(0x7f0000000000)={0x14, &(0x7f0000000080)={0x40, 0x23, 0xde, {0xde, 0x6, "0ca21b7f42c2477ef2b599702f1b6a571063c0feb652e08bc1e086999160129570faf1daeeda5e6415f1e13940ed86749cb0ac6c5c565bbe1b958face29c790c65bfe9e8ced16b598abcf0823ea00b35ec8307625219b7bf0d5c1065d1c717f67da4ebca554af36a552c82f3a128356fd6face4fc7b29e7377ec768e00cb09d287b5f17002a594c585e36626abc223462eacd751e121ac4dddb803a6ea4951423e339ad7412b3d37d3373ab35ecb1cf399a1236db592a6b1d624a61c2356d6b57eaaab678ea87d3b110307b5a89e736a2330f6cfb5a92021c72c8024"}}, &(0x7f0000000180)={0x0, 0x3, 0xf7, @string={0xf7, 0x3, "15ebd0fdeafe3d53cbaa0ed71c5d2ab5996f19355779609a65ddffed1b360bda2f4df3b087f250bc3c295c80f9e4d7612951421280816dc4933b983e84a599799deca555ac6f4acbc7acdbe32b102c458d440b3197d39d7d2fdf4e65cc6bd4280297bee70be446cde5d5f2e6759e8e1acb99070c2261dac8291926e8b938a823bd895b8e7c1a71d0ea74506b467661ba5f3672465dd07e7220d9ef517924e40f6713eb0befebc82d106ed4a04af73733740b09262a6958d50f322e1cb48c9e5f6b6dd82bebe05409abaeb142f64a018f2bfb11165f3e11f21a4dd53827a8a1e2c4eacc7f55d2359ad66100330a340b77915a8ce22e"}}}, &(0x7f0000000540)={0x34, &(0x7f0000000280)={0x20, 0x0, 0xcd, "5eaa12d4ed030b085d7e10cdb548dc2642edd6760930ec3857462fca2b02510e2bef8d3f5c245eb261e7b178dc918c48de0a71ea45c8dd29b910e92881bd19241be12867024a1dbb88ca2e7ea3e12993ea33e020148314ccd310d277a4f4ba500919838c3c20869c45130c7f075292875dfa3bccab30354bdcc953a0538f629948425311480ce3bc40ae6e07db51578406b17ddbe75bab39254da5c2e56f545919dcd8edc095bcd36f4166ae065ebcbd50711a575df61c5cdada9284f415c59171cf28ea782266cec0f2e3aaee"}, &(0x7f0000000380)={0x0, 0xa, 0x1, 0x8}, &(0x7f00000003c0)={0x0, 0x8, 0x1, 0x2}, &(0x7f0000000400)=ANY=[@ANYBLOB="20007f000000007dc9933e750eeefd6e977e9b9013b17f1ec94a21106461cc3cddbbc168025c3177f3704f8cd462b2a2994fea3fd5d819cd5970b9360829a7fb5413209ee34988bb48a1ed828f840e0aca10aa534c79c6aee1a04fa86d3281c542be07cfc5400965ec81009841f07c7edb03acd49420da44bc"], &(0x7f00000004c0)={0x20, 0x1, 0x1, 0x1}, &(0x7f0000000500)={0x20, 0x0, 0x1, 0x3f}}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000001080)={0x34, &(0x7f0000000dc0)={0x0, 0x0, 0x1, "cf"}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, &(0x7f0000000600)={0x14, &(0x7f0000000580)={0x20, 0x4, 0x2c, {0x2c, 0x24, "0756df132ed582775d5d4bc164e7cbfbd8cde7ec8be6f88912ed1db9d3a3fe326731c2aa2075a0b66bbc"}}, &(0x7f00000005c0)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000740)={0x1c, &(0x7f0000000640)={0x20, 0xa, 0x5e, "ba7a25ac7ceb34aea3c50fa87129902469fc3c6c4c1e2eec7a2b07d10d36abc25d3c0c557bd8256b7dc5f0bba727dcee3cae2d883cb317645f682253a7e5ae9c1fa16be7f65a8fe405acc374102fcc7228879bd0c98082bbbe2e3e40f8bb"}, &(0x7f00000006c0)={0x0, 0xa, 0x1, 0x9a}, &(0x7f0000000700)={0x0, 0x8, 0x1, 0x7}}) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000cc0)={0x2c, &(0x7f0000000a40)={0x0, 0x0, 0x2, ']R'}, 0x0, 0x0, 0x0, 0x0}) [ 1446.718025][T11074] xt_NFQUEUE: number of total queues is 0 [ 1446.780506][T11059] ubi0: scanning is finished 17:28:38 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x4, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(0xffffffffffffffff, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) 17:28:38 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(0x0, &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1446.927628][T11078] xt_NFQUEUE: number of total queues is 0 17:28:38 executing program 5: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000380)) r4 = perf_event_open$cgroup(&(0x7f0000000200)={0x0, 0x80, 0xfb, 0x2, 0x7, 0x1, 0x0, 0x7, 0x100, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_config_ext={0x7, 0x3}, 0x1400, 0x6, 0x7, 0x0, 0x2, 0x9, 0x3, 0x0, 0x9911, 0x0, 0x80000000}, 0xffffffffffffffff, 0xd, r0, 0x3) perf_event_open(&(0x7f00000000c0)={0x3, 0x80, 0x48, 0x7, 0xf8, 0x2, 0x0, 0x9, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x8, 0x0, @perf_bp={&(0x7f0000000040), 0xa}, 0x10, 0x2, 0xff, 0x0, 0x0, 0x3ff, 0x7, 0x0, 0x3ff, 0x0, 0x8000}, r3, 0xffffffffffffffff, r4, 0x1) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) sendmmsg(r1, &(0x7f0000000280)=[{{0x0, 0x7, 0x0, 0x1100, 0x0, 0x0, 0xf4010000}}], 0x400000000000085, 0x0) [ 1447.092785][T11059] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1447.112297][T11059] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1447.129450][T11087] xt_NFQUEUE: number of total queues is 0 [ 1447.158038][T11059] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1447.201968][ T7761] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 1447.207422][T11059] ubi0: VID header offset: 64 (aligned 64), data offset: 128 17:28:38 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1447.271708][T11059] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1447.346161][T11059] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1447.370325][T11098] xt_NFQUEUE: number of total queues is 0 17:28:38 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(0x0, &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1447.400549][T11059] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 1204783369 [ 1447.421952][T11059] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1447.443396][T11089] ubi0: background thread "ubi_bgt0d" started, PID 11089 [ 1447.450592][T11090] ubi0: detaching mtd0 [ 1447.460802][T11090] ubi0: mtd0 is detached [ 1447.461967][ T7761] usb 4-1: Using ep0 maxpacket: 8 [ 1447.480147][T11096] ubi0: attaching mtd0 17:28:38 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:28:38 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x0, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) [ 1447.563409][T11104] xt_NFQUEUE: number of total queues is 0 [ 1447.637416][T11096] ubi0: scanning is finished 17:28:39 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(0x0, &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1447.749389][T11110] xt_NFQUEUE: number of total queues is 0 [ 1447.762147][ T7761] usb 4-1: New USB device found, idVendor=08d1, idProduct=0003, bcdDevice=3a.3d [ 1447.779880][ T7761] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1447.837897][ T7761] usb 4-1: Product: syz [ 1447.859367][ T7761] usb 4-1: Manufacturer: syz [ 1447.884183][ T7761] usb 4-1: SerialNumber: syz [ 1447.919101][ T7761] usb 4-1: config 0 descriptor?? [ 1447.952628][T11096] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 1447.986948][ T7761] hub 4-1:0.0: bad descriptor, ignoring hub 17:28:39 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1448.005307][T11115] ubi0: attaching mtd0 [ 1448.011514][T11115] ubi0: scanning is finished [ 1448.032552][ T7761] hub: probe of 4-1:0.0 failed with error -5 17:28:39 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), 0x0, 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1448.159637][T11128] xt_NFQUEUE: number of total queues is 0 [ 1448.185378][T11081] UDC core: couldn't find an available UDC or it's busy: -16 [ 1448.198081][T11115] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) 17:28:39 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x4, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(0xffffffffffffffff, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) [ 1448.227978][T11081] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 1448.256666][T11115] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1448.303377][T11115] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1448.345878][T11115] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1448.404427][T11115] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1448.476046][T11115] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1448.538386][T11138] xt_NFQUEUE: number of total queues is 0 [ 1448.548406][T11115] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 1204783369 [ 1448.625258][T11115] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1448.709106][T11133] ubi0: background thread "ubi_bgt0d" started, PID 11133 [ 1448.716995][T11140] ubi0: detaching mtd0 [ 1448.726324][T11140] ubi0: mtd0 is detached [ 1448.770844][T11142] xt_NFQUEUE: number of total queues is 0 [ 1449.657278][ T7761] pegasus 4-1:0.0: can't reset MAC [ 1449.662590][ T7761] pegasus: probe of 4-1:0.0 failed with error -5 [ 1449.693395][ T7761] usb 4-1: USB disconnect, device number 30 [ 1450.401640][T24088] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 1450.641705][T24088] usb 4-1: Using ep0 maxpacket: 8 17:28:42 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), 0x0, 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:28:42 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:28:42 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x0, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) 17:28:42 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x4, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(0xffffffffffffffff, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) [ 1450.921906][T24088] usb 4-1: New USB device found, idVendor=08d1, idProduct=0003, bcdDevice=3a.3d [ 1450.931009][T24088] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 17:28:42 executing program 5: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000380)) r4 = perf_event_open$cgroup(&(0x7f0000000200)={0x0, 0x80, 0xfb, 0x2, 0x7, 0x1, 0x0, 0x7, 0x100, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_config_ext={0x7, 0x3}, 0x1400, 0x6, 0x7, 0x0, 0x2, 0x9, 0x3, 0x0, 0x9911, 0x0, 0x80000000}, 0xffffffffffffffff, 0xd, r0, 0x3) perf_event_open(&(0x7f00000000c0)={0x3, 0x80, 0x48, 0x7, 0xf8, 0x2, 0x0, 0x9, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x8, 0x0, @perf_bp={&(0x7f0000000040), 0xa}, 0x10, 0x2, 0xff, 0x0, 0x0, 0x3ff, 0x7, 0x0, 0x3ff, 0x0, 0x8000}, r3, 0xffffffffffffffff, r4, 0x1) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) sendmmsg(r1, &(0x7f0000000280)=[{{0x0, 0x7, 0x0, 0x1500, 0x0, 0x0, 0xf4010000}}], 0x400000000000085, 0x0) [ 1450.987569][T24088] usb 4-1: Product: syz [ 1451.003726][T24088] usb 4-1: Manufacturer: syz [ 1451.030510][T24088] usb 4-1: SerialNumber: syz [ 1451.071037][T24088] usb 4-1: config 0 descriptor?? [ 1451.112593][T24088] usb 4-1: can't set config #0, error -71 [ 1451.160615][T24088] usb 4-1: USB disconnect, device number 31 [ 1451.209577][T11170] ubi0: attaching mtd0 17:28:42 executing program 3: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x98, 0x91, 0xc3, 0x8, 0x8d1, 0x3, 0x3a3d, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x9, 0xb1, 0x16}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_connect$hid(0x6, 0x36, &(0x7f0000000880)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x20, 0x44f, 0xb323, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0xca, 0x80, 0x1, [{{0x9, 0x4, 0x0, 0x52, 0x2, 0x3, 0x1, 0x3, 0x1, {0x9, 0x21, 0x0, 0x1, 0x1, {0x22, 0xb54}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x1a, 0x5}}}}}]}}]}}, &(0x7f0000001780)={0xa, &(0x7f0000001400)={0xa, 0x6, 0x250, 0x2, 0x3, 0x2, 0x0, 0x80}, 0x1c, &(0x7f0000001440)={0x5, 0xf, 0x1c, 0x2, [@ss_container_id={0x14, 0x10, 0x4, 0x0, "fc03b93a6ed5ee4f1b91525f71f9b47c"}, @ptm_cap={0x3}]}, 0x6, [{0x55, &(0x7f0000001480)=@string={0x55, 0x3, "c51d2b8cfcee1bd8eb60bea3a3f799610c211a62271390562d773967b96d01c7843d70ee8aeaaa00a580f432a46424a3cdefe4cdaf3aab1ea5a660ddc8a4999a63c35095c4771daacb88a06760452ac95a25cc"}}, {0x4, &(0x7f0000001500)=@lang_id={0x4, 0x3, 0x1453}}, {0x4, &(0x7f0000001540)=@lang_id={0x4, 0x3, 0x807}}, {0xe8, &(0x7f0000001580)=@string={0xe8, 0x3, "662d08a42026338c5e705ba5dbfaf51b2e60fdc99f42dc4008c9e59f7af1dd50c730891e623048be378eb33ea9d368daf7f6028d87341293cc83171b4b083e2b1725997d77c907aa07bf9ba8bb7b659052fea92ab3683d21d3d71c6922888d353835b658981ad0e459a4506faff2b3affbb713a8b35f89fa87170f3a163d9c83a55c11bf6e0e6a66af7a94fe79b5a76ef617b7f777cc0364c01a2f731499af8e1ac93dd7222827ad825f655dc1712ac347663545ede202fe3cafc34ecb98990ef305f829d281f98fafc2d654dd3a74b14591d8783ba072d58e5a057907abd51e6896a4e62367"}}, {0x90, &(0x7f0000001680)=@string={0x90, 0x3, "4a045e7ae74911688529bbc099cc34aef72c26f68214d69099f383ff098676d4c20196da3df646d7ae285da234e884575246d774c406ddb5a40be492880aa0a79d99dad76cb61a6dc968e796290f00e237e92ba219bc3e8cb880b005f20ece64fb9478736ff2afd207d189ae15a25be5d03adaac79359da5e09bb6bca3f407fe20941629989b7712315655a54baa"}}, {0x4, &(0x7f0000001740)=@lang_id={0x4, 0x3, 0x419}}]}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_connect$printer(0x0, 0x2d, &(0x7f0000000fc0)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x40, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0x6, 0x10, 0x1, [{{0x9, 0x4, 0x0, 0x4, 0x2, 0x7, 0x1, 0x2, 0x1, "", {{{0x9, 0x5, 0x1, 0x2, 0x10, 0xfb, 0x5, 0x6}}}}}]}}]}}, &(0x7f0000001200)={0xa, &(0x7f0000001000)={0xa, 0x6, 0x250, 0x9, 0x7, 0x6, 0x20, 0x8}, 0xf, &(0x7f0000001040)={0x5, 0xf, 0xf, 0x1, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x1, 0x8, 0x7f, 0x6}]}, 0x4, [{0x4, &(0x7f0000001080)=@lang_id={0x4, 0x3, 0xc1a}}, {0x4, &(0x7f00000010c0)=@lang_id={0x4, 0x3, 0x408}}, {0x2d, &(0x7f0000001100)=@string={0x2d, 0x3, "0fa50e4c1c3d5876b9d0ae8180ee554d2367bde4aee3f2d55c404eef9cd2cecdd312dfcd572e6164b8661e"}}, {0xb3, &(0x7f0000001140)=ANY=[@ANYBLOB="b3033fe35f93911f0409828f6698ce7042cd907ea2aa5be3b74d063a85d41c1bc0cbed463e4973bfaac27fbe693ccd2acaafb56eaa537f2771e033aae76c005f9b6306e88dc2fa23e4d395e5751997144222aa04afd9a12cad60f0fbfc410c73b9df7a78626351b6c463fbfd4c587ef70a6a3db363126a53edb25c262423df85b54a02ac12ed90f86b3b080e6a3806ab37c7ab2b77cdc28dc6211f0394187647b9e3c48809235a091b331e45daf6c400000000"]}]}) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000840)={{0x12, 0x1, 0x0, 0x85, 0x37, 0x4, 0x8, 0x61d, 0xc020, 0x715, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xa3, 0xd9, 0x12}}]}}]}}, 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000001280)={0x84, &(0x7f0000000000)={0x0, 0x0, 0x3, "4e8ef6"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r1, &(0x7f0000000980)={0x2c, &(0x7f0000000840)={0x20, 0x11, 0x3, {0x3, 0x1, 'O'}}, &(0x7f0000001340)=ANY=[@ANYBLOB="00930abe2b380000081400000000000000000000000000cb4eb49b62e9b9a4b5bba8e20927b0711161a835be98fe063d79812e6a5c0bfc2185714984d5106c1fa36f9ce4e1c1e89b149c33f79d215fa63a97f7624e4388a025d72b5437ba807fa02cb4d46db08d07de1f5a5a620474409ff10a4cbfa4bfba7432faa038d5da7fe8cc3dbbce96f38c4dabe8d2cfebfdbefaf3bfce442f06f2b39f456e5e884963d8dfa9a5843c7b015b25e7f6a1fb7acfeaae54a6414550acca98ddb8fa5f"], &(0x7f00000008c0)={0x0, 0xf, 0x2f, {0x5, 0xf, 0x2f, 0x3, [@ptm_cap={0x3}, @ptm_cap={0x3}, @ssp_cap={0x24, 0x10, 0xa, 0xca, 0x6, 0x9, 0xf00, 0x240, [0x3f30, 0x3fcf, 0xc00f, 0xcf, 0xffc011, 0x0]}]}}, &(0x7f0000000900)={0x20, 0x29, 0xf, {0xf, 0x29, 0xfe, 0x3, 0x3, 0x5, "4f01f3aa", "b4654394"}}, &(0x7f0000000940)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x6, 0x4, 0xac, 0x0, 0x5, 0x200, 0x9bba}}}, &(0x7f0000000f00)={0x84, &(0x7f0000000a80)={0x20, 0xd, 0xca, "e1d33ad6ec87745fc004665d8f31e12f534e2f42dcf466bf59d8d07157fb744e8579a4dfff0eb0ab0d2d92c5362d6a9809cbc397a95057ed98785b6401b04c3830869ab32de6e86bd1782acabd9a12fa4dc9178634698b2588924c5a223c0b2188d9b5d4cc92711318e5acbfa3984997bdce0dc2207ccffd200deaddbaa67b4d775b0c556395f15bf91ab4e0c62204712d4f89bb4af8ab1bc6cad4e7af3b9f31719079f03977de6c164967bab158044c091258b74e2bb8a5ff71b8cceb7f317643ec2fe9f5333bb98cbb"}, &(0x7f00000009c0)={0x0, 0xa, 0x1, 0x5}, &(0x7f0000000a00)={0x0, 0x8, 0x1, 0x7f}, &(0x7f0000000b80)={0x20, 0x0, 0x4, {0x3, 0x2}}, &(0x7f0000000bc0)={0x20, 0x0, 0x4, {0x1000, 0x20}}, &(0x7f0000000c00)={0x40, 0x7, 0x2, 0x6}, &(0x7f0000000c40)={0x40, 0x9, 0x1, 0x3f}, &(0x7f0000000c80)={0x40, 0xb, 0x2, "c740"}, &(0x7f0000000d00)={0x40, 0xf, 0x2, 0x9}, &(0x7f0000000d40)={0x40, 0x13, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x24}}, &(0x7f0000000d80)={0x40, 0x17, 0x6, @remote}, &(0x7f0000000dc0)={0x40, 0x19, 0x2, "5387"}, &(0x7f0000000e00)={0x40, 0x1a, 0x2, 0x8}, &(0x7f0000000e40)={0x40, 0x1c, 0x1, 0x81}, &(0x7f0000000e80)={0x40, 0x1e, 0x1, 0x7}, &(0x7f0000000ec0)={0x40, 0x21, 0x1, 0x5}}) syz_usb_control_io(r0, 0x0, 0x0) r2 = syz_usb_connect$printer(0x5, 0x2d, &(0x7f0000000080)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x0, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0xef, 0x80, 0x6, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x7, 0x1, 0x2, 0x5, "", {{{0x9, 0x5, 0x1, 0x2, 0x3ff, 0x1, 0x7, 0x2}}}}}]}}]}}, &(0x7f00000003c0)={0xa, &(0x7f00000000c0)={0xa, 0x6, 0x201, 0xd0, 0x1f, 0x4, 0x40, 0x5}, 0x185, &(0x7f0000000100)={0x5, 0xf, 0x185, 0x6, [@ext_cap={0x7, 0x10, 0x2, 0x0, 0x2, 0x9, 0x3ff}, @generic={0xcf, 0x10, 0x1, "4dba0b90e58f11f38be619b6625e89180ae46ee8d17e2ee860a50db9a360336e0d04735a0bb0ca2955364334475ee7459ff80d06438bdb1376dd1a71922352bf8d1f62651f9fa6283a61dbeca7836645cf9b4368eb735b1744e4697a15945a6a1b2713e26c363e1add300c8d448e1cd43461129604dfd04c806f0e24b3838a5fd9c7eacfc387087bd676544f9a9abadd9fb851767abdbc0e79e3f3a1026c965bf41dac3d302534a3eff75327831f63439e517045cf0ab4a37e0ad3d9f03c17ab3e942535707bfc7ae788f2c0"}, @ss_container_id={0x14, 0x10, 0x4, 0x82, "914416b9c736d57a04d98e85178ca505"}, @generic={0x84, 0x10, 0xa, "ccbe5b24b0274733cd178ae66ca514de73980332cc5e7960baa565c7744afb51f5a4892758af137b8c1e93b726ec0e20e7551739eac0f7e9abae5061b4e07f4e6f1d3a8caf0e221529927789ea19f6fa07e60bdf0361d370e0bf39512aa15f957b4628ef2ce5a15a645779a2d3a7ff9c6709c9bda785535ba63735e14eb9324454"}, @ext_cap={0x7, 0x10, 0x2, 0xa, 0x5, 0x1, 0x80}, @wireless={0xb, 0x10, 0x1, 0x4, 0x10, 0x3f, 0x2, 0x8, 0x4}]}, 0x3, [{0x4, &(0x7f00000002c0)=@lang_id={0x4, 0x3, 0xc09}}, {0x4, &(0x7f0000000300)=@lang_id={0x4, 0x3, 0x446}}, {0x6c, &(0x7f0000000340)=@string={0x6c, 0x3, "cdcd8f97a6185006fe8083ad86927900f070d956ce44454f2013c48e6b0cadb6d2f78e2bd109f3205caa8ca0ee10890fb40904866d3a933131dad10b09993820a11abe6740b241192207678aaa595be39417dffa91b499ffe0bc1d2207a64f28780741818a518e4d8440"}}]}) syz_usb_control_io$printer(r2, 0x0, &(0x7f0000000000)={0x34, &(0x7f0000000440)={0x0, 0xf, 0x20, "d0e43d09c82317491e4fef27f7c718e8c9fe4ea4a8d2ecc6d56c513033b79c7b"}, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = syz_usb_connect$cdc_ecm(0x4, 0x7b, &(0x7f0000000480)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x69, 0x1, 0x1, 0x5, 0x20, 0xa2, [{{0x9, 0x4, 0x0, 0x20, 0x3, 0x2, 0x6, 0x0, 0x3, {{0x9, 0x24, 0x6, 0x0, 0x0, 'lHwG'}, {0x5, 0x24, 0x0, 0x1}, {0xd, 0x24, 0xf, 0x1, 0x1, 0x3ff, 0x1, 0xfa}, [@mbim_extended={0x8, 0x24, 0x1c, 0x0, 0x6, 0x6}, @obex={0x5, 0x24, 0x15, 0x3}, @dmm={0x7, 0x24, 0x14, 0x401, 0xb}, @acm={0x4, 0x24, 0x2, 0x9}, @acm={0x4, 0x24, 0x2, 0x2}, @call_mgmt={0x5, 0x24, 0x1, 0x1, 0x6}]}, {[{{0x9, 0x5, 0x81, 0x3, 0x40, 0x0, 0x0, 0x80}}], {{0x9, 0x5, 0x82, 0x2, 0x3ff, 0x1, 0x6, 0x4}}, {{0x9, 0x5, 0x3, 0x2, 0x3ff, 0x40, 0xb5, 0x6}}}}}]}}]}}, &(0x7f0000000580)={0xa, &(0x7f0000000400)={0xa, 0x6, 0x110, 0xb5, 0x0, 0x3f, 0x40, 0x8}, 0x1f, &(0x7f0000000500)={0x5, 0xf, 0x1f, 0x3, [@ptm_cap={0x3}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x1, "c4cc6d07d9b9af56ebe1b285295dcab7"}]}, 0x1, [{0x4, &(0x7f0000000540)=@lang_id={0x4, 0x3, 0x455}}]}) syz_usb_control_io$cdc_ecm(r3, &(0x7f00000006c0)={0x14, &(0x7f00000005c0)={0x20, 0x10, 0xa6, {0xa6, 0x21, "bd1337c20eeabfc00f467c80e95b3bb3d89228adabce351f9fe1584eb90f34ce49f98ee916e2b609436f34275d095b8087516f473aa14cebf4eebea45c34475e2a21e2d970bda004b06a020dfd9a5a4a7973c59d82cd3f1b3f59c54094dfa9818030c31397398b49c10393f3c060281a6f5ac450142eef2c9d1d09045ce2173306d2e9026c62f9f4f0fd5e040d9a80400df1ddaca920cd924b6951631fe9d6ec857fb2cf"}}, &(0x7f0000000680)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000800)={0x1c, &(0x7f0000000700)={0x20, 0x12, 0x79, "1f90a8160439352602118587ae4cd86a7766756cf44ab63842b52eeadd3bd7f3e1d24f4ec94b935d26773865786e4e151910eedc2b62f4d19f39f161fbce9d70d838651917fcc3ef8b03c1122129391f871e80096db12d89c1a5cc1beb7f88852c208b0d396468e233435656ad6ce7902ea447f6f9cf7f79ff"}, &(0x7f0000000780)={0x0, 0xa, 0x1, 0x7}, &(0x7f00000007c0)={0x0, 0x8, 0x1}}) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000cc0)={0x2c, &(0x7f0000000a40)={0x0, 0x0, 0x2, ']R'}, 0x0, 0x0, 0x0, 0x0}) [ 1451.310068][T11170] ubi0: scanning is finished 17:28:42 executing program 5: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000380)) r4 = perf_event_open$cgroup(&(0x7f0000000200)={0x0, 0x80, 0xfb, 0x2, 0x7, 0x1, 0x0, 0x7, 0x100, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_config_ext={0x7, 0x3}, 0x1400, 0x6, 0x7, 0x0, 0x2, 0x9, 0x3, 0x0, 0x9911, 0x0, 0x80000000}, 0xffffffffffffffff, 0xd, r0, 0x3) perf_event_open(&(0x7f00000000c0)={0x3, 0x80, 0x48, 0x7, 0xf8, 0x2, 0x0, 0x9, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x8, 0x0, @perf_bp={&(0x7f0000000040), 0xa}, 0x10, 0x2, 0xff, 0x0, 0x0, 0x3ff, 0x7, 0x0, 0x3ff, 0x0, 0x8000}, r3, 0xffffffffffffffff, r4, 0x1) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) sendmmsg(r1, &(0x7f0000000280)=[{{0x0, 0x7, 0x0, 0x1f00, 0x0, 0x0, 0xf4010000}}], 0x400000000000085, 0x0) [ 1451.609754][T11170] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1451.632377][T11170] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1451.641351][T11170] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1451.651316][T11170] ubi0: VID header offset: 64 (aligned 64), data offset: 128 17:28:42 executing program 5: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000380)) r4 = perf_event_open$cgroup(&(0x7f0000000200)={0x0, 0x80, 0xfb, 0x2, 0x7, 0x1, 0x0, 0x7, 0x100, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_config_ext={0x7, 0x3}, 0x1400, 0x6, 0x7, 0x0, 0x2, 0x9, 0x3, 0x0, 0x9911, 0x0, 0x80000000}, 0xffffffffffffffff, 0xd, r0, 0x3) perf_event_open(&(0x7f00000000c0)={0x3, 0x80, 0x48, 0x7, 0xf8, 0x2, 0x0, 0x9, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x8, 0x0, @perf_bp={&(0x7f0000000040), 0xa}, 0x10, 0x2, 0xff, 0x0, 0x0, 0x3ff, 0x7, 0x0, 0x3ff, 0x0, 0x8000}, r3, 0xffffffffffffffff, r4, 0x1) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) sendmmsg(r1, &(0x7f0000000280)=[{{0x0, 0x7, 0x0, 0x3f00, 0x0, 0x0, 0xf4010000}}], 0x400000000000085, 0x0) [ 1451.659478][T11170] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1451.701358][T11170] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1451.713680][T11170] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 1204783369 17:28:43 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x4, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, 0x0, 0x0) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) [ 1451.761652][T11170] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1451.776021][T11192] ubi0: background thread "ubi_bgt0d" started, PID 11192 [ 1451.783873][T11171] ubi: mtd0 is already attached to ubi0 [ 1451.795970][T24088] usb 4-1: new high-speed USB device number 32 using dummy_hcd 17:28:43 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x0, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) 17:28:43 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), 0x0, 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:28:43 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1451.978461][T11199] ubi0: detaching mtd0 [ 1452.007136][T11199] ubi0: mtd0 is detached [ 1452.051614][T24088] usb 4-1: Using ep0 maxpacket: 8 [ 1452.110201][T11201] ubi0: attaching mtd0 [ 1452.225000][T11206] nfqueue_tg_check: 2 callbacks suppressed [ 1452.225038][T11206] xt_NFQUEUE: number of total queues is 0 17:28:43 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x0, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1452.304440][T11201] ubi0: scanning is finished 17:28:43 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x4, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, 0x0, 0x0) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) [ 1452.331964][T24088] usb 4-1: New USB device found, idVendor=08d1, idProduct=0003, bcdDevice=3a.3d [ 1452.341037][T24088] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1452.350672][T11214] xt_NFQUEUE: number of total queues is 0 [ 1452.367426][T24088] usb 4-1: Product: syz [ 1452.376972][T24088] usb 4-1: Manufacturer: syz [ 1452.387651][T24088] usb 4-1: SerialNumber: syz [ 1452.404401][T24088] usb 4-1: config 0 descriptor?? [ 1452.458361][T24088] hub 4-1:0.0: bad descriptor, ignoring hub [ 1452.468648][T24088] hub: probe of 4-1:0.0 failed with error -5 17:28:43 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x0, 0x0, 0x0, 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1452.567389][T11220] xt_NFQUEUE: number of total queues is 0 [ 1452.662586][T11201] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1452.677067][T11201] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1452.701771][T11201] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1452.709322][T11201] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1452.775154][T11201] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1452.816144][T11201] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1452.827102][T11201] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 1204783369 [ 1452.837304][T11201] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1452.854362][T11226] ubi0: background thread "ubi_bgt0d" started, PID 11226 [ 1452.854388][T11223] ubi0: detaching mtd0 [ 1452.903346][T11223] ubi0: mtd0 is detached 17:28:44 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x0, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) 17:28:44 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1452.986499][T11234] xt_NFQUEUE: number of total queues is 0 [ 1453.099145][T11186] UDC core: couldn't find an available UDC or it's busy: -16 [ 1453.131537][T11186] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 1453.145807][T11239] ubi0: attaching mtd0 [ 1453.209592][T11186] UDC core: couldn't find an available UDC or it's busy: -16 [ 1453.216827][T11239] ubi0: scanning is finished [ 1453.237537][T11186] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 1453.473102][T11186] UDC core: couldn't find an available UDC or it's busy: -16 [ 1453.481318][T11239] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1453.489957][T11239] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1453.492065][T11186] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 1453.506593][T11239] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1453.516289][T11239] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1453.525637][T11239] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1453.541655][T11239] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1453.550437][T11239] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 1204783369 [ 1453.576517][T11239] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1453.588600][T11247] ubi0: background thread "ubi_bgt0d" started, PID 11247 [ 1453.811755][T24088] pegasus: probe of 4-1:0.0 failed with error -71 [ 1453.852265][T24088] usb 4-1: USB disconnect, device number 32 17:28:45 executing program 3: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x98, 0x91, 0xc3, 0x8, 0x8d1, 0x3, 0x3a3d, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x9, 0xb1, 0x16}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000000)={0x34, &(0x7f0000000dc0)={0x60, 0x0, 0x1, "cf"}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000cc0)={0x2c, &(0x7f0000000a40)={0x0, 0x0, 0x2, ']R'}, 0x0, 0x0, 0x0, 0x0}) 17:28:45 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:28:45 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x4, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, 0x0, 0x0) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) 17:28:45 executing program 5: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000380)) r4 = perf_event_open$cgroup(&(0x7f0000000200)={0x0, 0x80, 0xfb, 0x2, 0x7, 0x1, 0x0, 0x7, 0x100, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_config_ext={0x7, 0x3}, 0x1400, 0x6, 0x7, 0x0, 0x2, 0x9, 0x3, 0x0, 0x9911, 0x0, 0x80000000}, 0xffffffffffffffff, 0xd, r0, 0x3) perf_event_open(&(0x7f00000000c0)={0x3, 0x80, 0x48, 0x7, 0xf8, 0x2, 0x0, 0x9, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x8, 0x0, @perf_bp={&(0x7f0000000040), 0xa}, 0x10, 0x2, 0xff, 0x0, 0x0, 0x3ff, 0x7, 0x0, 0x3ff, 0x0, 0x8000}, r3, 0xffffffffffffffff, r4, 0x1) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) sendmmsg(r1, &(0x7f0000000280)=[{{0x0, 0x7, 0x0, 0x4000, 0x0, 0x0, 0xf4010000}}], 0x400000000000085, 0x0) 17:28:45 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x0, 0x0, 0x0, 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:28:45 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x0, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) [ 1454.456089][T11268] ubi0: detaching mtd0 17:28:45 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1454.508932][T11267] xt_NFQUEUE: number of total queues is 0 [ 1454.528495][T11268] ubi0: mtd0 is detached 17:28:45 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x0, 0x0, 0x0, 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1454.572417][T11266] xt_NFQUEUE: number of total queues is 0 [ 1454.599230][T11273] ubi0: attaching mtd0 [ 1454.693230][T11273] ubi0: scanning is finished 17:28:45 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x4, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x0, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) [ 1454.861474][T24088] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 1454.937732][T11288] xt_NFQUEUE: number of total queues is 0 [ 1454.941851][T11273] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1454.984079][T11287] xt_NFQUEUE: number of total queues is 0 [ 1454.995269][T11273] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes 17:28:46 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x0, 0x0, &(0x7f00000025c0), 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1455.038213][T11273] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1455.069806][T11273] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1455.090717][T11273] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1455.101632][T24088] usb 4-1: Using ep0 maxpacket: 8 [ 1455.112998][T11273] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1455.151804][T11273] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 1204783369 [ 1455.174644][T11273] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1455.195036][T11293] ubi0: background thread "ubi_bgt0d" started, PID 11293 [ 1455.195212][T11294] ubi0: detaching mtd0 [ 1455.249190][T11294] ubi0: mtd0 is detached 17:28:46 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x0, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) 17:28:46 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x0, 0x0, &(0x7f00000025c0), 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1455.306205][T11303] xt_NFQUEUE: number of total queues is 0 [ 1455.382845][T24088] usb 4-1: New USB device found, idVendor=08d1, idProduct=0003, bcdDevice=3a.3d [ 1455.403449][T24088] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1455.428505][T24088] usb 4-1: Product: syz [ 1455.440333][T24088] usb 4-1: Manufacturer: syz [ 1455.451915][T24088] usb 4-1: SerialNumber: syz [ 1455.468301][T24088] usb 4-1: config 0 descriptor?? [ 1455.540812][T24088] hub 4-1:0.0: bad descriptor, ignoring hub [ 1455.547441][T24088] hub: probe of 4-1:0.0 failed with error -5 [ 1455.567014][T11311] ubi0: attaching mtd0 [ 1455.585634][T11312] xt_NFQUEUE: number of total queues is 0 [ 1455.645996][T11311] ubi0: scanning is finished [ 1455.858381][T11311] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1455.874053][T11311] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1455.891175][T11311] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1455.899009][T11311] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1455.907690][T11311] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1455.917378][T11311] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1455.929835][T11311] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 1204783369 [ 1455.943730][T11311] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1455.956621][T11320] ubi0: background thread "ubi_bgt0d" started, PID 11320 [ 1456.871620][T24088] pegasus 4-1:0.0: can't reset MAC [ 1456.876900][T24088] pegasus: probe of 4-1:0.0 failed with error -5 [ 1456.922346][T24088] usb 4-1: USB disconnect, device number 33 [ 1457.621314][T13278] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 1457.891226][T13278] usb 4-1: Using ep0 maxpacket: 8 17:28:49 executing program 3: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x98, 0x91, 0xc3, 0x8, 0x8d1, 0x3, 0x3a3d, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x9, 0xb1, 0x16}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000001080)={0x34, &(0x7f0000000dc0)=ANY=[@ANYBLOB="0bdc"], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000cc0)={0x2c, &(0x7f0000000a40)={0x0, 0x0, 0x2, ']R'}, 0x0, 0x0, 0x0, 0x0}) 17:28:49 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:28:49 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x4, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x0, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) 17:28:49 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x0, 0x0, &(0x7f00000025c0), 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:28:49 executing program 5: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000380)) r4 = perf_event_open$cgroup(&(0x7f0000000200)={0x0, 0x80, 0xfb, 0x2, 0x7, 0x1, 0x0, 0x7, 0x100, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_config_ext={0x7, 0x3}, 0x1400, 0x6, 0x7, 0x0, 0x2, 0x9, 0x3, 0x0, 0x9911, 0x0, 0x80000000}, 0xffffffffffffffff, 0xd, r0, 0x3) perf_event_open(&(0x7f00000000c0)={0x3, 0x80, 0x48, 0x7, 0xf8, 0x2, 0x0, 0x9, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x8, 0x0, @perf_bp={&(0x7f0000000040), 0xa}, 0x10, 0x2, 0xff, 0x0, 0x0, 0x3ff, 0x7, 0x0, 0x3ff, 0x0, 0x8000}, r3, 0xffffffffffffffff, r4, 0x1) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) sendmmsg(r1, &(0x7f0000000280)=[{{0x0, 0x7, 0x0, 0x4200, 0x0, 0x0, 0xf4010000}}], 0x400000000000085, 0x0) 17:28:49 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x0, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) [ 1458.241395][T13278] usb 4-1: New USB device found, idVendor=08d1, idProduct=0003, bcdDevice=3a.3d [ 1458.266641][T13278] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1458.273973][T11340] ubi0: detaching mtd0 [ 1458.306092][T11340] ubi0: mtd0 is detached [ 1458.312976][T13278] usb 4-1: Product: syz [ 1458.374757][T13278] usb 4-1: config 0 descriptor?? [ 1458.431752][T13278] usb 4-1: can't set config #0, error -71 17:28:49 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x4, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x0, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) 17:28:49 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x0, 0x1, &(0x7f00000025c0)=[{0x0, 0x0, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:28:49 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x0, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) [ 1458.494788][T11348] xt_NFQUEUE: number of total queues is 0 [ 1458.509745][T13278] usb 4-1: USB disconnect, device number 34 [ 1458.513891][T11354] xt_NFQUEUE: number of total queues is 0 17:28:49 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1458.736994][T11363] ubi0: attaching mtd0 [ 1458.802237][T11365] xt_NFQUEUE: number of total queues is 0 17:28:50 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x0, 0x1, &(0x7f00000025c0)=[{0x0, 0x0, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1458.851994][T11363] ubi0: scanning is finished [ 1458.921601][T13278] usb 4-1: new high-speed USB device number 35 using dummy_hcd 17:28:50 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1459.000484][T11375] xt_NFQUEUE: number of total queues is 0 [ 1459.074776][T11378] xt_NFQUEUE: number of total queues is 0 [ 1459.171261][T13278] usb 4-1: Using ep0 maxpacket: 8 [ 1459.219329][T11382] xt_NFQUEUE: number of total queues is 0 [ 1459.240059][T11363] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1459.251766][T11363] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1459.270550][T11363] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1459.280618][T11363] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1459.300243][T11363] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1459.317262][T11363] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1459.336774][T11363] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 1204783369 [ 1459.358648][T11363] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1459.384552][T11387] ubi0: background thread "ubi_bgt0d" started, PID 11387 [ 1459.398252][T11367] ubi0: detaching mtd0 [ 1459.422348][T11367] ubi0: mtd0 is detached [ 1459.448633][T11370] ubi0: attaching mtd0 [ 1459.501733][T13278] usb 4-1: New USB device found, idVendor=08d1, idProduct=0003, bcdDevice=3a.3d [ 1459.510816][T13278] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1459.541770][T11370] ubi0: scanning is finished [ 1459.571141][T13278] usb 4-1: Product: syz [ 1459.575387][T13278] usb 4-1: Manufacturer: syz [ 1459.580082][T13278] usb 4-1: SerialNumber: syz [ 1459.611913][T13278] usb 4-1: config 0 descriptor?? [ 1459.630072][T11370] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 1459.662015][T13278] hub 4-1:0.0: bad descriptor, ignoring hub [ 1459.667967][T13278] hub: probe of 4-1:0.0 failed with error -5 [ 1460.521360][T13278] pegasus: probe of 4-1:0.0 failed with error -121 17:28:52 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x0, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:28:53 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x0, 0x1, &(0x7f00000025c0)=[{0x0, 0x0, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:28:53 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x4, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(0xffffffffffffffff, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) 17:28:53 executing program 5: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000380)) r4 = perf_event_open$cgroup(&(0x7f0000000200)={0x0, 0x80, 0xfb, 0x2, 0x7, 0x1, 0x0, 0x7, 0x100, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_config_ext={0x7, 0x3}, 0x1400, 0x6, 0x7, 0x0, 0x2, 0x9, 0x3, 0x0, 0x9911, 0x0, 0x80000000}, 0xffffffffffffffff, 0xd, r0, 0x3) perf_event_open(&(0x7f00000000c0)={0x3, 0x80, 0x48, 0x7, 0xf8, 0x2, 0x0, 0x9, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x8, 0x0, @perf_bp={&(0x7f0000000040), 0xa}, 0x10, 0x2, 0xff, 0x0, 0x0, 0x3ff, 0x7, 0x0, 0x3ff, 0x0, 0x8000}, r3, 0xffffffffffffffff, r4, 0x1) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) sendmmsg(r1, &(0x7f0000000280)=[{{0x0, 0x7, 0x0, 0x6000, 0x0, 0x0, 0xf4010000}}], 0x400000000000085, 0x0) 17:28:53 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x0, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) 17:28:53 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x0) getdents(r0, 0x0, 0x27c6) getdents64(r0, 0x0, 0x0) utimensat(r0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0) ioctl$IOCTL_VMCI_DATAGRAM_RECEIVE(r0, 0x7ac, &(0x7f00000005c0)={&(0x7f0000000180)={{@my=0x1, 0x9}, {@local, 0x3}, 0x400, "aa7b69c7423bdd11a094d95316cb00d72bd026a28fdb8d723483882721209dbc50c368b252195136f996e4fbeaf42bb48c92e1ce6a85b5f3a2cc92c1513cfdc17ae3456b262693e99c9dea4939e4a5ef68f79f9f684d505816bd1a7e9e9567e2d4308ef555e45b03654b5d579b3d9114b5d320a016e5c0602c1c528f1e5cb0b815696189ca64cb9040d7bcfb6ef7769109d3d4164192e305aec0913e08ff521eab701fc7ac232768229a58b1ce60e1a90b914c8726cdf0129c7785e9488db63e320895e2c1ff76634a60fee8f3b174bff2a2607207b4e1b8ba0cbe66f5e9530c64a8bb3789e63498a6384c514a394009a5778312a65cf42fb2e6ee58d46bbbbd238455d52163396f671de1aacd9627bc09f33375e5aef189cb26cfe37b44cf307a92d0fd73e9d1155217031b7fbd8613ffa05af05455d78bf9c8312253e27ce718b094db2b05459a99459b774923b568dd3cd4d7a78a364980b5231551cab9e6d8349a2d28dd91a2169c5ef43b7a422a34c729577b0b4885af85fe7ab3c19de2a4afe979a75984d8617a8ac16674b2100248335468d42aff3c993c891a954e51dcb8001e409a8de07ee2c8093e30546b93033efefbe8e485b230a3d698f531ea77ed1a62e71498913e6c6d09cd1b63bb9a6ed0abce4e4e819d023dba069c6a12270943ecdd0bbf709ede0767f95c736ef3830c169ddc46755214e7d4ba2494e3572a91595f6123f2033ea2d942aa13616d1c1454a9febf74ea8ee8a8fdfda0490effccca99d82d1a1c257b54b9b905f894273b379fea0bca7ae2e659d10efa128e9d31152f79f8c76409faf5bc2edd26b7ee38220f72e63a3b6acafeb83c4d5fe446031712859cd7dd5a083ae152a2e4b7ffd62908b650c5259fc47f14d93793ed9d7a7b70cd41421b9481e86ede752974867d54ff5c4c26a4f43cdbfd64362cf347b3597afbbec69c26e2766dbf84b7487b58686b90f2a39e9860669ea512299c22f993e356ec4ad110873f14290ae6bd988d3148a874c4ad90fb8b657ed47825fbf79a0f99df8e595afeabb17c2d74e5fb1f857fc0116d312f1d0f664c7a1ede124ab839c5456910abc5b6349bcda074a3b2b7274f73bf698928eb67f9e9466a02fed6531f620ad5e976dc5972bc93eb6f72d37e7a90e827da8c703e0dc569a0505fc41ed382b103c734309311179f8911afd77224a9aaae5261cf6178eb00aa0cc3598649e24d581d159795e0f9575317bce9c6040e68fead3e847eb0821c7688fc4913dacca3dc29bb443d9bec3633488ecfd148593b0a4db6d4cbeac68eda0861a95945f6e66c406b86feb3cd1368c81e5be3b0453e7cc03c344127a65debe3a88146fc320940fd8c9ce0e0d047f1c579749f2cdc9bcfcf8a3b00b10bae95a712348bcc80d53e38526200178ed6c0584f5f6f3a981b2896e3184000ce0a"}, 0x418, 0x4c}) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_PROTOCOL_FEATURES(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r1, 0x400, 0x70bd2d, 0x25dfdbfb, {}, ["", "", "", "", ""]}, 0x14}}, 0x20044080) r2 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x98, 0x91, 0xc3, 0x8, 0x8d1, 0x3, 0x3a3d, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x9, 0xb1, 0x16}}]}}]}}, 0x0) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r3, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r3, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1000000, 0x11, r3, 0x72457000) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io$printer(r2, 0x0, &(0x7f0000001080)={0x34, &(0x7f0000000dc0)=ANY=[@ANYBLOB="000001ff0f0000"], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r2, 0x0, &(0x7f0000000cc0)={0x2c, &(0x7f0000000a40)={0x0, 0x0, 0x2, ']R'}, 0x0, 0x0, 0x0, 0x0}) [ 1461.861462][T24088] usb 4-1: USB disconnect, device number 35 17:28:53 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x0, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540), 0x0, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1462.038671][T11414] ubi0: attaching mtd0 [ 1462.162412][T11427] xt_NFQUEUE: number of total queues is 0 17:28:53 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x4, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(0xffffffffffffffff, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) 17:28:53 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x0, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1462.249884][T11428] xt_NFQUEUE: number of total queues is 0 [ 1462.256488][T11414] ubi0: scanning is finished [ 1462.369381][T13281] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 1462.528744][T11439] xt_NFQUEUE: number of total queues is 0 [ 1462.661064][T13281] usb 4-1: Using ep0 maxpacket: 8 [ 1462.669929][T11414] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1462.694676][T11414] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes 17:28:54 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x0, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1462.725186][T11414] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1462.741696][T11414] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1462.757604][T11414] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1462.768691][T11414] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1462.778435][T11414] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 1204783369 [ 1462.789640][T11414] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1462.804062][T11447] ubi0: background thread "ubi_bgt0d" started, PID 11447 [ 1462.804089][T11434] ubi0: detaching mtd0 [ 1462.843253][T11434] ubi0: mtd0 is detached [ 1462.849279][T11440] ubi0: attaching mtd0 17:28:54 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x0, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) connect$pppoe(0xffffffffffffffff, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(0xffffffffffffffff, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, 0xffffffffffffffff, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r2, 0xfffffffffffffff7, 0x0) [ 1462.922330][T11440] ubi0: scanning is finished [ 1463.001270][T13281] usb 4-1: New USB device found, idVendor=08d1, idProduct=0003, bcdDevice=3a.3d [ 1463.016566][T13281] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 17:28:54 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x0, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1463.044195][T11454] xt_NFQUEUE: number of total queues is 0 [ 1463.069881][T13281] usb 4-1: Product: syz [ 1463.088419][T13281] usb 4-1: Manufacturer: syz [ 1463.111062][T13281] usb 4-1: SerialNumber: syz [ 1463.149466][T13281] usb 4-1: config 0 descriptor?? [ 1463.181854][T11440] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1463.196072][T11440] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1463.212024][T13281] hub 4-1:0.0: bad descriptor, ignoring hub [ 1463.213977][T11440] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 17:28:54 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x0, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1463.241975][T13281] hub: probe of 4-1:0.0 failed with error -5 [ 1463.264495][T11440] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1463.288776][T11440] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1463.315952][T11440] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 17:28:54 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1463.357854][T11440] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 1204783369 [ 1463.413816][T11440] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1463.445129][T11462] ubi0: background thread "ubi_bgt0d" started, PID 11462 [ 1463.453411][T11457] ubi0: detaching mtd0 [ 1463.464534][T11457] ubi0: mtd0 is detached 17:28:54 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x0, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1463.527040][T11473] xt_NFQUEUE: number of total queues is 0 [ 1463.728530][T11481] xt_NFQUEUE: number of total queues is 0 [ 1463.738714][T11482] xt_NFQUEUE: number of total queues is 0 17:28:55 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x4, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(0xffffffffffffffff, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) 17:28:55 executing program 5: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000380)) r4 = perf_event_open$cgroup(&(0x7f0000000200)={0x0, 0x80, 0xfb, 0x2, 0x7, 0x1, 0x0, 0x7, 0x100, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_config_ext={0x7, 0x3}, 0x1400, 0x6, 0x7, 0x0, 0x2, 0x9, 0x3, 0x0, 0x9911, 0x0, 0x80000000}, 0xffffffffffffffff, 0xd, r0, 0x3) perf_event_open(&(0x7f00000000c0)={0x3, 0x80, 0x48, 0x7, 0xf8, 0x2, 0x0, 0x9, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x8, 0x0, @perf_bp={&(0x7f0000000040), 0xa}, 0x10, 0x2, 0xff, 0x0, 0x0, 0x3ff, 0x7, 0x0, 0x3ff, 0x0, 0x8000}, r3, 0xffffffffffffffff, r4, 0x1) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) sendmmsg(r1, &(0x7f0000000280)=[{{0x0, 0x7, 0x0, 0x8400, 0x0, 0x0, 0xf4010000}}], 0x400000000000085, 0x0) [ 1463.935103][T11489] ubi0: attaching mtd0 [ 1463.984730][T11489] ubi0: scanning is finished [ 1464.111297][T13281] pegasus: probe of 4-1:0.0 failed with error -121 [ 1464.180318][T11489] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1464.189320][T11489] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1464.198977][T11489] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1464.208116][T11489] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1464.216671][T11489] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1464.224791][T11489] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1464.236445][T11489] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 1204783369 [ 1464.248003][T11489] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1464.260134][T11496] ubi0: background thread "ubi_bgt0d" started, PID 11496 17:28:56 executing program 3: getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000000), &(0x7f0000000080)=0xc) r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x98, 0x91, 0xc3, 0x8, 0x8d1, 0x3, 0x3a3d, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x9, 0xb1, 0x16}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000001080)={0x34, &(0x7f0000000dc0)={0x0, 0x0, 0x1, "cf"}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000cc0)={0x2c, &(0x7f0000000a40)={0x0, 0x0, 0x2, ']R'}, 0x0, 0x0, 0x0, 0x0}) 17:28:56 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:28:56 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x0, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) connect$pppoe(0xffffffffffffffff, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(0xffffffffffffffff, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, 0xffffffffffffffff, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r2, 0xfffffffffffffff7, 0x0) 17:28:56 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x0, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540), 0x0, 0x20}], 0x0, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:28:56 executing program 5: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000380)) r4 = perf_event_open$cgroup(&(0x7f0000000200)={0x0, 0x80, 0xfb, 0x2, 0x7, 0x1, 0x0, 0x7, 0x100, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_config_ext={0x7, 0x3}, 0x1400, 0x6, 0x7, 0x0, 0x2, 0x9, 0x3, 0x0, 0x9911, 0x0, 0x80000000}, 0xffffffffffffffff, 0xd, r0, 0x3) perf_event_open(&(0x7f00000000c0)={0x3, 0x80, 0x48, 0x7, 0xf8, 0x2, 0x0, 0x9, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x8, 0x0, @perf_bp={&(0x7f0000000040), 0xa}, 0x10, 0x2, 0xff, 0x0, 0x0, 0x3ff, 0x7, 0x0, 0x3ff, 0x0, 0x8000}, r3, 0xffffffffffffffff, r4, 0x1) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) sendmmsg(r1, &(0x7f0000000280)=[{{0x0, 0x7, 0x0, 0xb80b, 0x0, 0x0, 0xf4010000}}], 0x400000000000085, 0x0) 17:28:56 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x4, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, 0x0, 0x0, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) [ 1465.421013][T11505] ubi0: detaching mtd0 [ 1465.439197][T11505] ubi0: mtd0 is detached [ 1465.468428][T13278] usb 4-1: USB disconnect, device number 36 [ 1465.564230][T11506] ubi0: attaching mtd0 [ 1465.629231][T11519] xt_NFQUEUE: number of total queues is 0 [ 1465.645025][T11515] xt_NFQUEUE: number of total queues is 0 17:28:56 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:28:56 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x4, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, 0x0, 0x0, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) [ 1465.738393][T11506] ubi0: scanning is finished 17:28:57 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1465.897505][T11528] xt_NFQUEUE: number of total queues is 0 [ 1466.030894][T13278] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 1466.079871][T11506] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1466.090423][T11506] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1466.125294][T11506] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1466.150633][T11506] ubi0: VID header offset: 64 (aligned 64), data offset: 128 17:28:57 executing program 5: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000380)) r4 = perf_event_open$cgroup(&(0x7f0000000200)={0x0, 0x80, 0xfb, 0x2, 0x7, 0x1, 0x0, 0x7, 0x100, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_config_ext={0x7, 0x3}, 0x1400, 0x6, 0x7, 0x0, 0x2, 0x9, 0x3, 0x0, 0x9911, 0x0, 0x80000000}, 0xffffffffffffffff, 0xd, r0, 0x3) perf_event_open(&(0x7f00000000c0)={0x3, 0x80, 0x48, 0x7, 0xf8, 0x2, 0x0, 0x9, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x8, 0x0, @perf_bp={&(0x7f0000000040), 0xa}, 0x10, 0x2, 0xff, 0x0, 0x0, 0x3ff, 0x7, 0x0, 0x3ff, 0x0, 0x8000}, r3, 0xffffffffffffffff, r4, 0x1) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) sendmmsg(r1, &(0x7f0000000280)=[{{0x0, 0x7, 0x0, 0xe803, 0x0, 0x0, 0xf4010000}}], 0x400000000000085, 0x0) [ 1466.174635][T11506] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1466.192636][T11506] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 17:28:57 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1466.252478][T11539] xt_NFQUEUE: number of total queues is 0 [ 1466.254971][T11506] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 1204783369 17:28:57 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x0, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540), 0x0, 0x20}], 0x0, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1466.300865][T13278] usb 4-1: Using ep0 maxpacket: 8 [ 1466.342679][T11506] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1466.399627][T11536] ubi0: background thread "ubi_bgt0d" started, PID 11536 [ 1466.399658][T11532] ubi0: detaching mtd0 [ 1466.435784][T11532] ubi0: mtd0 is detached [ 1466.454429][T11534] ubi0: attaching mtd0 [ 1466.634329][T11534] ubi0: scanning is finished [ 1466.646458][T11549] xt_NFQUEUE: number of total queues is 0 [ 1466.666196][T11550] xt_NFQUEUE: number of total queues is 0 [ 1466.681324][T13278] usb 4-1: New USB device found, idVendor=08d1, idProduct=0003, bcdDevice=3a.3d [ 1466.720072][T13278] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1466.746407][T13278] usb 4-1: Product: syz [ 1466.752992][T13278] usb 4-1: Manufacturer: syz [ 1466.758722][T13278] usb 4-1: SerialNumber: syz [ 1466.768562][T13278] usb 4-1: config 0 descriptor?? [ 1466.779326][T11534] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 1466.811682][T13278] hub 4-1:0.0: bad descriptor, ignoring hub [ 1466.817630][T13278] hub: probe of 4-1:0.0 failed with error -5 [ 1468.130775][T13278] pegasus 4-1:0.0: can't reset MAC [ 1468.136047][T13278] pegasus: probe of 4-1:0.0 failed with error -5 [ 1468.181619][T13278] usb 4-1: USB disconnect, device number 37 [ 1468.860719][ T7415] usb 4-1: new high-speed USB device number 38 using dummy_hcd [ 1469.110838][ T7415] usb 4-1: Using ep0 maxpacket: 8 17:29:00 executing program 3: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x98, 0x91, 0xc3, 0x8, 0x8d1, 0x3, 0x3a3d, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x9, 0xb1, 0x16}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000001080)={0x34, &(0x7f0000000dc0)={0x40, 0xffffffffffffffff, 0x1, "8d"}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000cc0)={0x2c, &(0x7f0000000080)=ANY=[@ANYBLOB="0005020000c25d529eca411cb064b5f116727b98af1e6c2d7d4c909bee38bdb540ee4fd3e49158b0710aff0ba1fb1bb69d3779fd6a8df21636ad57828f821975de2ad71ecb30faf6b544f8595021eb9c5ba227b864a96939f64510508b95fe6d131f8d21364bd3d2836d711a99eaaf8589d1e3f5e4fa358c20786d24c22ce56353d063d7c9bcb702284d79173c12b2dc08d7d9ebe2ef39feff5e9882d45e40fea164a62d677ac853ac77e6b1d270ef7404dddf64bffdd5dfb2eb814965c6140fa8c9afaf122290604f219ae3887af306208bba"], 0x0, 0x0, 0x0, 0x0}) 17:29:00 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:29:00 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x0, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) connect$pppoe(0xffffffffffffffff, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(0xffffffffffffffff, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, 0xffffffffffffffff, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r2, 0xfffffffffffffff7, 0x0) 17:29:00 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x0, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540), 0x0, 0x20}], 0x0, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:29:00 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x4, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, 0x0, 0x0, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) 17:29:00 executing program 5: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000380)) r4 = perf_event_open$cgroup(&(0x7f0000000200)={0x0, 0x80, 0xfb, 0x2, 0x7, 0x1, 0x0, 0x7, 0x100, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_config_ext={0x7, 0x3}, 0x1400, 0x6, 0x7, 0x0, 0x2, 0x9, 0x3, 0x0, 0x9911, 0x0, 0x80000000}, 0xffffffffffffffff, 0xd, r0, 0x3) perf_event_open(&(0x7f00000000c0)={0x3, 0x80, 0x48, 0x7, 0xf8, 0x2, 0x0, 0x9, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x8, 0x0, @perf_bp={&(0x7f0000000040), 0xa}, 0x10, 0x2, 0xff, 0x0, 0x0, 0x3ff, 0x7, 0x0, 0x3ff, 0x0, 0x8000}, r3, 0xffffffffffffffff, r4, 0x1) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) sendmmsg(r1, &(0x7f0000000280)=[{{0x0, 0x7, 0x0, 0xf401, 0x0, 0x0, 0xf4010000}}], 0x400000000000085, 0x0) [ 1469.335243][ T7415] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 1469.362496][ T7415] usb 4-1: can't read configurations, error -71 17:29:00 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x0, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540), 0x0, 0x20}], 0x29070e8, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1469.535010][T11584] xt_NFQUEUE: number of total queues is 0 17:29:00 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:29:00 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) 17:29:00 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x4, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) 17:29:01 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1469.764883][T11602] xt_NFQUEUE: number of total queues is 0 [ 1469.830430][T11604] xt_NFQUEUE: number of total queues is 0 [ 1469.858645][T11607] ubi0: attaching mtd0 [ 1469.917973][T11607] ubi0: scanning is finished 17:29:01 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x0, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540), 0x0, 0x20}], 0x29070e8, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1470.061410][ T7415] usb 4-1: new high-speed USB device number 39 using dummy_hcd [ 1470.187910][T11607] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1470.198046][T11623] xt_NFQUEUE: number of total queues is 0 [ 1470.207677][T11607] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1470.225887][T11607] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1470.245005][T11607] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1470.259743][T11607] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1470.281581][T11607] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1470.300253][T11607] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 1204783369 [ 1470.313629][ T7415] usb 4-1: Using ep0 maxpacket: 8 [ 1470.330408][T11607] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1470.355186][T11628] ubi0: background thread "ubi_bgt0d" started, PID 11628 [ 1470.362558][T11616] ubi0: detaching mtd0 [ 1470.390800][T11616] ubi0: mtd0 is detached [ 1470.409168][T11617] ubi0: attaching mtd0 [ 1470.458680][T11617] ubi0: scanning is finished [ 1470.590886][ T7415] usb 4-1: New USB device found, idVendor=08d1, idProduct=0003, bcdDevice=3a.3d [ 1470.606375][ T7415] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1470.615344][T11617] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1470.625633][T11617] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1470.639563][ T7415] usb 4-1: Product: syz [ 1470.646872][T11617] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1470.647726][ T7415] usb 4-1: Manufacturer: syz [ 1470.654748][T11617] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1470.666535][T11617] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1470.673395][T11617] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1470.677040][ T7415] usb 4-1: SerialNumber: syz [ 1470.681448][T11617] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 1204783369 [ 1470.681477][T11617] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1470.681531][T11637] ubi0: background thread "ubi_bgt0d" started, PID 11637 [ 1470.741528][ T7415] usb 4-1: config 0 descriptor?? [ 1470.781516][ T7415] hub 4-1:0.0: bad descriptor, ignoring hub [ 1470.787483][ T7415] hub: probe of 4-1:0.0 failed with error -5 [ 1471.880726][ T7415] pegasus: probe of 4-1:0.0 failed with error -121 [ 1472.200842][T24088] usb 4-1: USB disconnect, device number 39 [ 1472.850497][ T7761] usb 4-1: new high-speed USB device number 40 using dummy_hcd [ 1473.090402][ T7761] usb 4-1: Using ep0 maxpacket: 8 17:29:04 executing program 3: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x98, 0x91, 0xc3, 0x8, 0x8d1, 0x3, 0x3a3d, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x9, 0xb1, 0x16}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000001080)={0x34, &(0x7f0000000dc0)={0x0, 0x0, 0x1, "cf"}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000cc0)={0x2c, &(0x7f0000000a40)={0x20, 0x0, 0x2, ']R'}, 0x0, 0x0, 0x0, 0x0}) 17:29:04 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x0, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540), 0x0, 0x20}], 0x29070e8, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:29:04 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) 17:29:04 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x4, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) 17:29:04 executing program 5: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000380)) r4 = perf_event_open$cgroup(&(0x7f0000000200)={0x0, 0x80, 0xfb, 0x2, 0x7, 0x1, 0x0, 0x7, 0x100, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_config_ext={0x7, 0x3}, 0x1400, 0x6, 0x7, 0x0, 0x2, 0x9, 0x3, 0x0, 0x9911, 0x0, 0x80000000}, 0xffffffffffffffff, 0xd, r0, 0x3) perf_event_open(&(0x7f00000000c0)={0x3, 0x80, 0x48, 0x7, 0xf8, 0x2, 0x0, 0x9, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x8, 0x0, @perf_bp={&(0x7f0000000040), 0xa}, 0x10, 0x2, 0xff, 0x0, 0x0, 0x3ff, 0x7, 0x0, 0x3ff, 0x0, 0x8000}, r3, 0xffffffffffffffff, r4, 0x1) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) sendmmsg(r1, &(0x7f0000000280)=[{{0x0, 0x7, 0x0, 0x20480, 0x0, 0x0, 0xf4010000}}], 0x400000000000085, 0x0) 17:29:04 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1473.397596][T11664] ubi0: detaching mtd0 [ 1473.411778][ T7761] usb 4-1: New USB device found, idVendor=08d1, idProduct=0003, bcdDevice=3a.3d [ 1473.424035][T11664] ubi0: mtd0 is detached [ 1473.464663][ T7761] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1473.481809][T11664] ubi0: attaching mtd0 [ 1473.506553][T11664] ubi0: scanning is finished [ 1473.527421][ T7761] usb 4-1: config 0 descriptor?? [ 1473.544690][T11671] xt_NFQUEUE: number of total queues is 0 [ 1473.571715][T11674] xt_NFQUEUE: number of total queues is 0 [ 1473.620752][ T7761] usb 4-1: can't set config #0, error -71 [ 1473.643101][T11664] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1473.655154][ T7761] usb 4-1: USB disconnect, device number 40 [ 1473.663888][T11664] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1473.682297][T11664] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1473.701225][T11664] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1473.734248][T11664] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1473.763049][T11664] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1473.797176][T11664] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 1204783369 [ 1473.861896][T11664] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1473.926284][T11683] ubi0: background thread "ubi_bgt0d" started, PID 11683 [ 1473.936363][T11667] ubi: mtd0 is already attached to ubi0 17:29:05 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x4, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) [ 1474.071003][ T7761] usb 4-1: new high-speed USB device number 41 using dummy_hcd 17:29:05 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) 17:29:05 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x0, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540), 0x0, 0x20}], 0x29070e8, &(0x7f0000002600)) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:29:05 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1474.185055][T11692] ubi0: detaching mtd0 [ 1474.196373][T11692] ubi0: mtd0 is detached 17:29:05 executing program 5: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000380)) r4 = perf_event_open$cgroup(&(0x7f0000000200)={0x0, 0x80, 0xfb, 0x2, 0x7, 0x1, 0x0, 0x7, 0x100, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_config_ext={0x7, 0x3}, 0x1400, 0x6, 0x7, 0x0, 0x2, 0x9, 0x3, 0x0, 0x9911, 0x0, 0x80000000}, 0xffffffffffffffff, 0xd, r0, 0x3) perf_event_open(&(0x7f00000000c0)={0x3, 0x80, 0x48, 0x7, 0xf8, 0x2, 0x0, 0x9, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x8, 0x0, @perf_bp={&(0x7f0000000040), 0xa}, 0x10, 0x2, 0xff, 0x0, 0x0, 0x3ff, 0x7, 0x0, 0x3ff, 0x0, 0x8000}, r3, 0xffffffffffffffff, r4, 0x1) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) sendmmsg(r1, &(0x7f0000000280)=[{{0x0, 0x7, 0x0, 0x40000, 0x0, 0x0, 0xf4010000}}], 0x400000000000085, 0x0) [ 1474.310777][ T7761] usb 4-1: Using ep0 maxpacket: 8 [ 1474.318859][T11692] ubi0: attaching mtd0 17:29:05 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1474.444894][T11701] xt_NFQUEUE: number of total queues is 0 [ 1474.462279][T11692] ubi0: scanning is finished [ 1474.505252][T11705] xt_NFQUEUE: number of total queues is 0 [ 1474.590556][ T7761] usb 4-1: New USB device found, idVendor=08d1, idProduct=0003, bcdDevice=3a.3d [ 1474.608873][ T7761] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1474.631272][ T7761] usb 4-1: Product: syz [ 1474.638777][ T7761] usb 4-1: Manufacturer: syz [ 1474.652656][ T7761] usb 4-1: SerialNumber: syz [ 1474.669463][ T7761] usb 4-1: config 0 descriptor?? [ 1474.733109][ T7761] hub 4-1:0.0: bad descriptor, ignoring hub [ 1474.739073][ T7761] hub: probe of 4-1:0.0 failed with error -5 [ 1474.814462][T11712] xt_NFQUEUE: number of total queues is 0 [ 1474.839056][T11692] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1474.880096][T11692] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1474.896142][T11692] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1474.926426][T11692] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1474.960517][T11692] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1474.978130][T11692] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1474.994143][T11692] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 1204783369 [ 1475.010604][T11692] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1475.023563][T11718] ubi0: background thread "ubi_bgt0d" started, PID 11718 [ 1475.031549][T11700] ubi0: detaching mtd0 [ 1475.070864][T11700] ubi0: mtd0 is detached [ 1476.070433][ T7761] pegasus 4-1:0.0: can't reset MAC [ 1476.075731][ T7761] pegasus: probe of 4-1:0.0 failed with error -5 [ 1476.121251][ T7761] usb 4-1: USB disconnect, device number 41 [ 1476.800235][T13281] usb 4-1: new high-speed USB device number 42 using dummy_hcd [ 1477.050222][T13281] usb 4-1: Using ep0 maxpacket: 8 [ 1477.350304][T13281] usb 4-1: New USB device found, idVendor=08d1, idProduct=0003, bcdDevice=3a.3d [ 1477.359383][T13281] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1477.368067][T13281] usb 4-1: Product: syz [ 1477.372791][T13281] usb 4-1: Manufacturer: syz [ 1477.377429][T13281] usb 4-1: SerialNumber: syz [ 1477.384441][T13281] usb 4-1: config 0 descriptor?? [ 1477.420997][T13281] hub 4-1:0.0: bad descriptor, ignoring hub [ 1477.426956][T13281] hub: probe of 4-1:0.0 failed with error -5 17:29:08 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x4, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x10, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) 17:29:08 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) 17:29:08 executing program 5: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000380)) r4 = perf_event_open$cgroup(&(0x7f0000000200)={0x0, 0x80, 0xfb, 0x2, 0x7, 0x1, 0x0, 0x7, 0x100, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_config_ext={0x7, 0x3}, 0x1400, 0x6, 0x7, 0x0, 0x2, 0x9, 0x3, 0x0, 0x9911, 0x0, 0x80000000}, 0xffffffffffffffff, 0xd, r0, 0x3) perf_event_open(&(0x7f00000000c0)={0x3, 0x80, 0x48, 0x7, 0xf8, 0x2, 0x0, 0x9, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x8, 0x0, @perf_bp={&(0x7f0000000040), 0xa}, 0x10, 0x2, 0xff, 0x0, 0x0, 0x3ff, 0x7, 0x0, 0x3ff, 0x0, 0x8000}, r3, 0xffffffffffffffff, r4, 0x1) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) sendmmsg(r1, &(0x7f0000000280)=[{{0x0, 0x7, 0x0, 0x150000, 0x0, 0x0, 0xf4010000}}], 0x400000000000085, 0x0) 17:29:08 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x0, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) 17:29:08 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x0, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540), 0x0, 0x20}], 0x29070e8, &(0x7f0000002600)) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1477.550459][T13281] pegasus: probe of 4-1:0.0 failed with error -71 [ 1477.610939][T13281] usb 4-1: USB disconnect, device number 42 [ 1477.725518][T11748] xt_NFQUEUE: number of total queues is 0 [ 1477.755803][T11757] xt_NFQUEUE: number of total queues is 0 17:29:09 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x0, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540), 0x0, 0x20}], 0x29070e8, &(0x7f0000002600)) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1477.798929][T11754] ubi0: attaching mtd0 [ 1477.923908][T11754] ubi0: scanning is finished [ 1478.170728][T11770] xt_NFQUEUE: number of total queues is 0 [ 1478.195991][T11754] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) 17:29:09 executing program 5: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000380)) r4 = perf_event_open$cgroup(&(0x7f0000000200)={0x0, 0x80, 0xfb, 0x2, 0x7, 0x1, 0x0, 0x7, 0x100, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_config_ext={0x7, 0x3}, 0x1400, 0x6, 0x7, 0x0, 0x2, 0x9, 0x3, 0x0, 0x9911, 0x0, 0x80000000}, 0xffffffffffffffff, 0xd, r0, 0x3) perf_event_open(&(0x7f00000000c0)={0x3, 0x80, 0x48, 0x7, 0xf8, 0x2, 0x0, 0x9, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x8, 0x0, @perf_bp={&(0x7f0000000040), 0xa}, 0x10, 0x2, 0xff, 0x0, 0x0, 0x3ff, 0x7, 0x0, 0x3ff, 0x0, 0x8000}, r3, 0xffffffffffffffff, r4, 0x1) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) sendmmsg(r1, &(0x7f0000000280)=[{{0x0, 0x7, 0x0, 0xa2ffff, 0x0, 0x0, 0xf4010000}}], 0x400000000000085, 0x0) [ 1478.222757][T11754] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1478.251839][T11754] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1478.277326][T11754] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1478.321034][T11754] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1478.360184][T11754] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 17:29:09 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, 0x0, &(0x7f0000000200)) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1478.404749][T11754] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 1204783369 [ 1478.448395][T11754] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1478.484803][T11773] ubi0: background thread "ubi_bgt0d" started, PID 11773 [ 1478.493362][T11746] ubi: mtd0 is already attached to ubi0 17:29:09 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x0, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x80012, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) 17:29:09 executing program 3: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x98, 0x91, 0xc3, 0x8, 0x8d1, 0x3, 0x3a3d, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x9, 0xb1, 0x16}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000840)={{0x12, 0x1, 0x0, 0x85, 0x37, 0x4, 0x8, 0x61d, 0xc020, 0x715, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xa3, 0xd9, 0x12}}]}}]}}, 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000001280)={0x84, &(0x7f0000000000)={0x0, 0x0, 0x3, "4e8ef6"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r1, &(0x7f0000000400)={0x2c, &(0x7f0000000080)={0x20, 0x2, 0xc3, {0xc3, 0x3, "774530a1c5ebf1eeb34c1e60fcc31b10dc0c8d37bfa7a2516e211dbe1ab9f7a0a40a6382e5139be907ece6b3509285c20b21fbefe72590d41e58d90dc7198d3dab40d8f3da62a9622ad368138c5b95ee95ac0c129f8f65caa1b380b912d215c395efad6114a26360e1386b8955d53ad25613126e952c97bcf243ec18e86b5671de360302cd2a5af23d980f7952c3e9159cf70c5615bd34c72d5131483fcbb2e94602c342c03e63fdcfd5c0f198d6ff58bf5222b7399da67b20e03f9cddaee55821"}}, &(0x7f0000000000)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x3009}}, &(0x7f0000000180)={0x0, 0xf, 0x1cb, {0x5, 0xf, 0x1cb, 0x6, [@wireless={0xb, 0x10, 0x1, 0x2, 0xda, 0x9, 0x40, 0x9, 0x93}, @ext_cap={0x7, 0x10, 0x2, 0x14, 0x4, 0x6, 0x9}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x1e, 0x82, 0x8}, @generic={0xdc, 0x10, 0x3, "99b346f7da288af9c6c37c2cca733298cc1d5c00abe20c55f9776ec7e7c5d843de409c553b5f9b65699a96475596425a6fae69f8b11b3d8bc7e0ae5d7186dc080fc89488f96ad4b6bd144f8bae78158a6a8150d55954efa4f5e7170db9125db8f0b41b47aa16176d16e2d32b6307a9e90870834f714f2e0b6315cf2ae0b8f5b500b543b1e9aa84e548f17e7c14e210218cb80f49a756d3f947921acba4fff03898dc5f2c161b699289f8f9ddbea910a8cb07bdb1f1bb8456d36a241feac29c89d29b716c568191c14c09a0475897f8bb36fccb79359ff093cd"}, @generic={0xcb, 0x10, 0xb, "9cfb4e0a7ef35e0eeb058b93b9b511d5c1f081fc7959987fb1ffd36d2e7c35ed73465efdd8b50b61f8c98a909b3ebcee581104e0d26f5ce8623747f4ccdc9bc36cac8b257e44fdcc3ea8108cd2b6c6f72b5efd52ff7aac427627ce06fc3893c891cc27126b13dd30d24431428421c50ffcae48d98bef97c2de103e73d408e9a9c35b5e9c73e12d4f35bf0be81bbbbfe2c31d2fd405ac0502c3eee6cbf26d738bbbf13c624364f1a053c3303e821c56973921cd07bfe5563b5b03ec12407acc14d0a5273113ac45d7"}, @ptm_cap={0x3}]}}, &(0x7f0000000380)={0x20, 0x29, 0xf, {0xf, 0x29, 0x20, 0x8, 0x0, 0x8, "05f0bd6e", "2d66df28"}}, &(0x7f00000003c0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x35, 0x0, 0x1f, 0x80, 0xfe, 0xca25, 0x3}}}, &(0x7f00000008c0)={0x84, &(0x7f0000000440)={0x40, 0x15, 0xa6, "8ade84219279067ebc88694fcce22e763ce8ece3ca7f6831cbd179dc522ce724223efdaa1a722a5c5797c93326ac86e9a0184ba44da4df2fb9b21102541356c4c537632e5ce96c80b908471aed44507a87c67aace1f0ec0a559cfa6b50ba7956f389706385b65b3f0bdab2a56cd40705c30740a8c8daa4befda6d0c05f9aff7f19588e706b169f990a447c0d4ddd22f4b3a358a0cf2cd24fb134b61a8b2c1e2cc21a38dc76a2"}, &(0x7f0000000500)={0x0, 0xa, 0x1, 0x2f}, &(0x7f0000000540)={0x0, 0x8, 0x1, 0x8}, &(0x7f0000000580)={0x20, 0x0, 0x4, {0x5, 0x1}}, &(0x7f00000005c0)={0x20, 0x0, 0x4, {0x60, 0xa2da32d23fc61442}}, &(0x7f0000000600)={0x40, 0x7, 0x2, 0x2}, &(0x7f0000000640)={0x40, 0x9, 0x1, 0x5}, &(0x7f0000000680)={0x40, 0xb, 0x2, "dbff"}, &(0x7f00000006c0)={0x40, 0xf, 0x2, 0x9}, &(0x7f0000000700)={0x40, 0x13, 0x6, @broadcast}, &(0x7f0000000740)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x24}}, &(0x7f0000000780)={0x40, 0x19, 0x2, "38a7"}, &(0x7f00000007c0)={0x40, 0x1a, 0x2, 0x7}, &(0x7f0000000800)={0x40, 0x1c, 0x1, 0x7}, &(0x7f0000000840)={0x40, 0x1e, 0x1, 0xff}, &(0x7f0000000880)={0x40, 0x21, 0x1, 0x9}}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000001080)={0x34, &(0x7f0000000dc0)={0x0, 0x0, 0x1, "cf"}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000cc0)={0x2c, &(0x7f0000000a40)={0x0, 0x0, 0x2, ']R'}, 0x0, 0x0, 0x0, 0x0}) 17:29:09 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x20000000) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000280)) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x20006000) writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x4, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7, 0x200003, 0x0, 0x4, 0x0, 0x503}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x5, @random="8e2ef2766aa1", 'bond0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x10, r2, 0x31a6f000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7207, 0x4, 0xc9], 0x3, 0x80000, 0x0, 0xffffffffffffffff}) readahead(r3, 0xfffffffffffffff7, 0x0) 17:29:09 executing program 4: syz_mount_image$befs(&(0x7f0000000000), 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x3f5, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540)="5bf4fc4be34d1dfc141debd2ce54c0b7132809c69dfc66032ed4286ca76a600a3e3213614457866124f7791c77c879f5d1cdf846ff3cce3db484131eae6618cc6ef3378e03e4ef80ffc615500171ea3bea3db728e2796969f245143ec684e7", 0x5f, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, 0x0, &(0x7f0000000200)) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1478.708153][T11784] xt_NFQUEUE: number of total queues is 0 [ 1478.817328][T11791] ubi0: detaching mtd0 17:29:10 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x0, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540), 0x0, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1478.904932][T11791] ubi0: mtd0 is detached [ 1478.916182][T11791] ubi0: attaching mtd0 [ 1478.987527][T11791] ubi0: scanning is finished [ 1478.992368][T13281] usb 4-1: new high-speed USB device number 43 using dummy_hcd [ 1479.086055][T11800] xt_NFQUEUE: number of total queues is 0 [ 1479.141051][T11793] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: __schedule+0x49fc/0x4d90 [ 1479.152556][T11793] CPU: 0 PID: 11793 Comm: syz-executor.2 Not tainted 5.16.0-rc2-next-20211125-syzkaller #0 [ 1479.162647][T11793] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1479.172713][T11793] Call Trace: [ 1479.176002][T11793] [ 1479.178944][T11793] dump_stack_lvl+0xcd/0x134 [ 1479.183561][T11793] panic+0x2b0/0x6dd [ 1479.187508][T11793] ? __warn_printk+0xf3/0xf3 [ 1479.192128][T11793] ? finish_task_switch.isra.0+0x319/0xb80 [ 1479.197964][T11793] ? __schedule+0x49fc/0x4d90 [ 1479.202677][T11793] __stack_chk_fail+0x15/0x20 [ 1479.207377][T11793] __schedule+0x49fc/0x4d90 [ 1479.209997][T11791] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1479.211898][T11793] ? mark_lock+0xef/0x17b0 [ 1479.224061][T11793] ? asm_sysvec_apic_timer_interrupt+0x12/0x20 [ 1479.230246][T11793] ? io_schedule_timeout+0x180/0x180 [ 1479.235548][T11793] ? mark_held_locks+0x9f/0xe0 [ 1479.238965][T11791] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1479.240334][T11793] preempt_schedule_irq+0x4e/0x90 [ 1479.240369][T11793] irqentry_exit+0x31/0x80 [ 1479.240399][T11793] asm_sysvec_apic_timer_interrupt+0x12/0x20 [ 1479.240429][T11793] RIP: 0010:sock_wmalloc+0x0/0x120 [ 1479.251274][T11791] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1479.252715][T11793] Code: e9 a8 fd ff ff 4c 89 e7 e8 bd eb 96 fa e9 96 fe ff ff 4c 89 ef e8 30 ec 96 fa e9 da fe ff ff 66 66 2e 0f 1f 84 00 00 00 00 00 <41> 56 41 55 41 89 cd 41 54 41 89 d4 55 48 89 fd 53 48 89 f3 e8 87 [ 1479.252743][T11793] RSP: 0018:ffffc900142ef928 EFLAGS: 00000202 [ 1479.259557][T11791] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1479.263115][T11793] RAX: 0000000000000007 RBX: 0000000000000000 RCX: 0000000000000cc0 [ 1479.263133][T11793] RDX: 0000000000000000 RSI: 0000000000000016 RDI: ffff88807aac1000 [ 1479.263147][T11793] RBP: ffff88807aac1000 R08: 00000000000005ea R09: 0000000000000001 [ 1479.263164][T11793] R10: ffffffff850c6f6e R11: 0000000000000000 R12: ffff88806e88c000 17:29:10 executing program 0: syz_mount_image$befs(0x0, 0x0, 0xe, 0x0, &(0x7f0000002400), 0x0, &(0x7f0000000040)=ANY=[@ANYRES16]) syz_mount_image$f2fs(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', 0x0, 0x1, &(0x7f00000025c0)=[{&(0x7f0000002540), 0x0, 0x20}], 0x29070e8, &(0x7f0000002600)={[], [{@smackfsfloor={'smackfsfloor', 0x3d, '\x00'}}]}) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x10, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x14, 0x0, 0x701, 0x0, 0xfffffffc, {0xc}}, 0x14}}, 0x4000004) truncate(0x0, 0x80000000000044) syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB='nobarrier,session=0x000000']) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x4000008006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000009c0)) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000840)=0x9) exit(0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x6e8, 0x78fa0100, 0x1d0, 0x4f8, 0x4f8, 0x400, 0x618, 0x618, 0x618, 0x618, 0x618, 0x6, 0x0, {[{{@uncond, 0x11e, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}, {{@ipv6={@private1, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748) [ 1479.263182][T11793] R13: 0000000000000010 R14: 0000000000000010 R15: 0000000000000006 [ 1479.263207][T11793] ? pppoe_sendmsg+0x20e/0x750 [ 1479.278018][T11791] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1479.294912][T11793] ? __sanitizer_cov_trace_cmp8+0x1d/0x70 [ 1479.294953][T11793] pppoe_sendmsg+0x2b9/0x750 [ 1479.294985][T11793] ? lockdep_hardirqs_on+0x79/0x100 [ 1479.295017][T11793] ? pppoe_create+0x310/0x310 [ 1479.310267][T11808] xt_NFQUEUE: number of total queues is 0 [ 1479.316435][T11793] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 1479.316484][T11793] ? pppoe_create+0x310/0x310 [ 1479.394246][T11791] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1479.396541][T11793] sock_sendmsg+0xcf/0x120 [ 1479.396581][T11793] ____sys_sendmsg+0x331/0x810 [ 1479.413715][T11793] ? kernel_sendmsg+0x50/0x50 [ 1479.418417][T11793] ? do_recvmmsg+0x6d0/0x6d0 [ 1479.423041][T11793] ? __lock_acquire+0x162f/0x54a0 [ 1479.428096][T11793] ___sys_sendmsg+0xf3/0x170 [ 1479.432713][T11793] ? sendmsg_copy_msghdr+0x160/0x160 [ 1479.435081][T11791] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 1204783369 [ 1479.438020][T11793] ? irqentry_enter+0x28/0x50 [ 1479.438060][T11793] ? asm_sysvec_apic_timer_interrupt+0x12/0x20 [ 1479.458874][T11793] ? lockdep_hardirqs_on+0x79/0x100 [ 1479.464098][T11793] ? asm_sysvec_apic_timer_interrupt+0x12/0x20 [ 1479.470277][T11793] ? __sys_sendmmsg+0x20a/0x470 [ 1479.475164][T11793] ? lock_is_held_type+0xff/0x140 [ 1479.480224][T11793] __sys_sendmmsg+0x195/0x470 [ 1479.484925][T11793] ? __ia32_sys_sendmsg+0xb0/0xb0 [ 1479.489972][T11793] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 1479.492217][T11791] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1479.495973][T11793] ? find_held_lock+0x2d/0x110 [ 1479.496016][T11793] ? find_held_lock+0x2d/0x110 [ 1479.515382][T11793] ? __context_tracking_exit+0xb8/0xe0 [ 1479.520867][T11793] ? lock_downgrade+0x6e0/0x6e0 [ 1479.525760][T11793] __x64_sys_sendmmsg+0x99/0x100 [ 1479.530810][T11793] ? syscall_enter_from_user_mode+0x21/0x70 [ 1479.536733][T11793] do_syscall_64+0x35/0xb0 [ 1479.541173][T11793] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1479.547082][T11793] RIP: 0033:0x7f6618ed6ae9 [ 1479.551510][T11793] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1479.562588][T11804] ubi0: background thread "ubi_bgt0d" started, PID 11804 [ 1479.571129][T11793] RSP: 002b:00007f661642b188 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1479.571158][T11793] RAX: ffffffffffffffda RBX: 00007f6618fea020 RCX: 00007f6618ed6ae9 [ 1479.571177][T11793] RDX: 04000000000000eb RSI: 000000002000d180 RDI: 0000000000000006 [ 1479.571194][T11793] RBP: 00007f6618f30f6d R08: 0000000000000000 R09: 0000000000000000 [ 1479.571210][T11793] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1479.571226][T11793] R13: 00007ffcf1170e8f R14: 00007f661642b300 R15: 0000000000022000 [ 1479.578542][T11795] ubi: mtd0 is already attached to ubi0 [ 1479.586657][T11793] [ 1479.587012][T11793] Kernel Offset: disabled [ 1479.639947][T11793] Rebooting in 86400 seconds..