last executing test programs: 2m45.501867826s ago: executing program 0 (id=216): r0 = fsopen(&(0x7f0000000280)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000200)='source', &(0x7f0000000000)='\\\\\xe9\x838\x9d<\f\x91\a\xd4$\xae\x01\x91&6n \xf2<\xd6\xcf\x15\xd3\xd7\x1d\xa7=\xef\xca\n@\x06\xa3\xfe%\x11\xc9\xc5\xc4\x96\xb7b\xa0\xbbL}\xcc\'(;\xdc\x8b\x18rBl{\x82\\\xbeA\x17\n\f\xcd=\'\x11\x1b\b>Z\x8e\xb1\xc3j$v\xef,\x06/\x00\x00\x00\x00\x00\xc7\x0f\xaa\x01\x00\x00\x00;\xd5\xcd4g+\xbd\xd1\xe0R\x9d\x18\x19a:\xa2\xdf\xbe\x8b\x89\x81\x00\x00', 0x0) r1 = syz_clone(0x2000400, 0x0, 0xfffffebf, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) readv(r3, &(0x7f0000001340)=[{&(0x7f0000000580)=""/148, 0x94}], 0x1) fcntl$lock(r0, 0x26, &(0x7f00000000c0)={0x1, 0x1, 0xcea, 0xbc89, r2}) readv(r3, &(0x7f0000001240)=[{&(0x7f0000000040)=""/73, 0x49}], 0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r5 = openat$cgroup_procs(r4, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r5, &(0x7f00000005c0)=r1, 0x12) close(r3) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) select(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)={0x0, 0xea60}) syz_clone3(&(0x7f00000008c0)={0x400, 0x0, 0x0, 0x0, {0x17}, 0x0, 0x0, 0x0, 0x0}, 0x58) r7 = openat$cgroup_ro(r6, &(0x7f0000000280)='cgroup.kill\x00', 0x275a, 0x0) r8 = fsopen(&(0x7f0000000180)='cgroup2\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r8, 0x3, &(0x7f0000000000)='source', &(0x7f00000001c0)='[\x8b\xa4[\x13\x9b\x04\x00#\x9b\x94\xb6@\x874L\xf5U\xd7\xcb+3,\x999\xa9\":|\x98\xc5\x93\xba\x8d\xff\x14\x8ag+\xcd\xb1\x96d&\x8dn\x00\xdb\xd2\r!A\x1dZ\x16\xa3\x84\xa1\f\\%$\xd3\x9f\xf4a\xdb\x10\xd1&\x95\xba\x9d\x01O\xc8\t\xd2\xceZ\x8a\x7f\xbc\x92\xfb}\x91\x8d\xbav5{\xe4M;\xa2:\xe0\xfc\xa2G\xd3b2m\xe3i\xfc\x01\xc2\xa1|\x90\xd5\x8d;U\xe2', 0x0) eventfd2(0x98, 0x801) syz_emit_ethernet(0x3b6, &(0x7f00000003c0)={@local, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0x380, 0x3a, 0xff, @local, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [{0x19, 0xa, "a78ce54006598080a8030037004023493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34066d42ca0a5c15b37adac15084dbaf736b41e5af2502"}, {0x0, 0x1, "000000050000000026000400"}, {0x1f, 0x18, "fe906d26efe39393fe08f73eabc5977b1190a3a6ad8338f1511cdd10c35d8f6de79fc7fd175f75649fa368a32c829af02d7f44d92324a7051e460a13ddde25a5b85b9d930914625d8a049b4cf0d129806a610ad8477a2499a9a0527f75b655a6653d0363a979acf93f88eea07d68423e90280409de1657275f716a2bf2915d1783e8eb477b0d1170f0ecbdef4c23e1b76e9ab3d2fbe4b34438d2a77577edd0ebed9682b851b380ae0cab282af9d7ebe668177704c5fd4698c934de4731f3f61effc978"}, {0x0, 0x1d, "06aa85616177c41bc943afcb84619755403946b0730a18d5c38cf7dcad830f2dc8674b87ba8b58f81ece27975cc39e595e9af90b4fe92a38d25551c2d9ebfc5dfc5a2a501b7e483de3f808895c5f4a1a2367bc591dd8b094822ff0dea07c9a1f643c822a18b79f7c5eba31fb68b2d734a6671e27182aee96f24a4a5cf390dab23b500b0c0272479611e4f7f4299ec4d926d443367b105185e6ecd9602ba95392343e9bbd047ef6bc1ba42399907ccd0a562db212baa39eb8164e240069f656d3a05fecf894222a141123f5ac010000000000000090aa235a670670ffc5dc49dfb58d00000000000000"}, {0x0, 0xb, "17dcea46805d4809c20547406b18901b0aeff04c0300f3c75dc2d227a83b89483b1084743475671545e65eb2e9ac946a3f0e2bc4619f91394c02bcfbbb7d71138537d68e2d2c6393a9f3becd1a9f51a948b5b303f4f019"}, {0x21, 0x7, "b8a3e100908f61640000000200fe80ffff00000000000000ff0bc0fe00000000008879e66485201a0015ca83747357a027450004000000"}, {0x0, 0x14, "5e14f0e74d2d42cfb3f27fafb60845f90b6dfc2e37bc87c6905bbc94d33e1ea71a28105f543e868a8a53b360a9d33e2b1e26eb1d18065daa7628cf9ef083611c9f6ae2e1eb3d8bf9c6ab2642c4808288e62afbf0630af1f98aea6fb3beb5fdc5fdaabc2c676d8800871a6aa54155dea2d995cb22c9924e0ad38c6967052cc7596d779b8353aac33a57d79b05613a12328f6101000000634a287570af5e4e12e213408c"}, {0x0, 0x5, "d5170000dce9674a36da018dff16e7a94fe18e88605abbbe1a02a326a63ce65f81ed0000000000"}]}}}}}}, 0x0) write$cgroup_int(r7, &(0x7f0000000040)=0x1, 0x12) 2m42.166037881s ago: executing program 0 (id=228): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0x955, 0x7214, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0xe10858595ca4ddb4, 0x0, {0x9, 0x21, 0x2, 0x0, 0x1, {0x22, 0x5}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) (async) unshare(0x22020600) (async) r1 = socket(0x2000000015, 0x80005, 0x0) bind$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e21, 0x0, @ipv4={'\x00', '\xff\xff', @multicast2}, 0x40}, 0x1c) lseek(0xffffffffffffffff, 0x4000008, 0x2) syz_usb_control_io(r0, &(0x7f0000000280)={0x2c, &(0x7f00000000c0)={0x0, 0xd, 0x7, {0x7, 0xf, "9a768d208f"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) 2m40.750642015s ago: executing program 1 (id=231): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, 0x0, 0x4004040) r1 = socket$kcm(0x2, 0xa, 0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000600), 0x80002, 0x0) ioctl$SNDCTL_DSP_SETTRIGGER(r4, 0x40045010, &(0x7f0000000100)=0x6) syz_usb_connect$hid(0x5, 0x3f, &(0x7f00000020c0)=ANY=[@ANYBLOB="1201010200000010f3044d0740000102030109022d00010103f8"], &(0x7f00000002c0)={0x0, 0x0, 0x5, 0x0, 0x1, [{0x0, 0x0}]}) ioctl$sock_FIOGETOWN(r3, 0x8903, 0x0) r5 = add_key(&(0x7f0000000000)='big_key\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)="ae", 0x1, 0xffffffffffffffff) keyctl$read(0x2, r5, &(0x7f00000000c0)=""/4096, 0x1000) keyctl$read(0xb, r5, &(0x7f00000010c0)=""/4096, 0x1000) ioctl$SIOCSIFHWADDR(r1, 0x8914, 0x0) write$tun(0xffffffffffffffff, 0x0, 0x4d) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0xfff, 0x4, &(0x7f0000000300)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='fdinfo/4\x00') read$FUSE(r6, &(0x7f0000006140)={0x2020}, 0x2020) sysfs$1(0x1, 0x0) membarrier(0x40, 0x0) bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) dup2(r7, 0xffffffffffffffff) chdir(&(0x7f0000000140)='./bus\x00') 2m40.277756493s ago: executing program 0 (id=232): mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000002, 0x8031, 0xffffffffffffffff, 0x3650b000) mremap(&(0x7f00005ab000/0x1000)=nil, 0x1000, 0x1000, 0x7, &(0x7f0000ffe000/0x1000)=nil) r0 = socket(0x1d, 0x2, 0x6) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000800)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000380)=ANY=[@ANYBLOB="020101090800000000170006ffffff00030006001000000002000000e0000009f9ff0f0005000000030005007217440502000000e0000001"], 0x40}}, 0x0) sendmsg$key(r1, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYRES16=r0], 0x50}}, 0x800) bind$can_j1939(r0, &(0x7f0000000380)={0x1d, 0x0, 0x2, {0x1, 0x0, 0x3}, 0xfd}, 0x18) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000002c0)=@abs={0x0, 0x0, 0x1001}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) r4 = syz_open_dev$vim2m(&(0x7f0000000140), 0x200000001003, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r4, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1}) ioctl$vim2m_VIDIOC_STREAMON(r4, 0x40045612, &(0x7f0000000080)=0x2) r5 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r4, &(0x7f0000000240)={0x10000008}) ioctl$vim2m_VIDIOC_QBUF(r4, 0xc058560f, &(0x7f00000002c0)=@multiplanar_mmap={0x0, 0x2, 0x4, 0x0, 0xffffffff, {0x0}, {0x0, 0x0, 0x0, 0x3, 0x0, 0x0, "fafc00"}, 0x9, 0x1, {0x0}}) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) syz_usb_connect(0x0, 0x5f, &(0x7f0000000040)=ANY=[@ANYRESOCT=r6], 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) add_key$user(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe) r7 = socket$can_j1939(0x1d, 0x2, 0x7) bind$can_j1939(r7, &(0x7f0000000080)={0x1d, 0x0, 0x0, {0x0, 0x0, 0x4}, 0xfe}, 0x18) syz_open_dev$tty20(0xc, 0x4, 0x1) pselect6(0x40, &(0x7f0000000080)={0x1000000000000e, 0x9, 0x200000000009, 0x10000000, 0x6, 0x8, 0xc2db, 0x7ff}, 0x0, 0x0, 0x0, 0x0) sendmmsg$sock(r0, &(0x7f0000000280)=[{{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000100)="1f", 0x1}], 0x1}}], 0x206c, 0x0) 2m36.994779098s ago: executing program 0 (id=241): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x1b) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = fsopen(&(0x7f0000000080)='debugfs\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000ac0)='gid', &(0x7f0000000440)='0\x00#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xea\\Eb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D-\x98\x9f\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xb8\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6\xd7\x80Y\xc2\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\xa7\xfa\xdb\x1ce\xc1\x03\x86J\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\x81\x14l7u\x95\x96t\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xe39\xc6b\x905\xf8\xc9@h\x01\xf5\xcb\x88\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?\x839\x85N\x1c\xc1\xcb\xfc\x85\xd2\n\x02\"\xf2\x81g\x90\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9a\x84\'\xa3\xf1\xd9<\xb9k', 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r5 = dup(r4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r5, 0x2000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x600000000000000, 0x0, 0x0, 0x2) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'bridge_slave_0\x00', 0x401}) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x40400, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)={0x24, 0x2, 0x6, 0x5, 0x0, 0x0, {0x5}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}]}, 0x24}, 0x1, 0x0, 0x0, 0x880}, 0x80) r9 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r9, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000600)=[@text16={0x10, &(0x7f0000000080)="360f231b66b80500000066b94d2800000f01d9e32f66b80500000066b9050000000f01c1366566f20f2b5b00ea00908a00baf80c66b8baf0488066efbafc0cb80008ef0f015f023e0fc77e170f07", 0x4e}], 0x1, 0x74, 0x0, 0x0) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="1800000076000d0b00bbf6000300000000000036"], 0x18}}, 0x0) eventfd2(0x9, 0x80001) r11 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000044082, 0x0) fallocate(r11, 0x11, 0x0, 0x100000000007c000) 2m36.98811604s ago: executing program 1 (id=242): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) openat$audio(0xffffff9c, 0x0, 0x402, 0x0) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_open_dev$radio(&(0x7f0000000240), 0x2, 0x2) sched_getattr(0x0, &(0x7f00000004c0)={0x38}, 0x38, 0x0) membarrier(0x10, 0x0) poll(0x0, 0x0, 0x1) prctl$PR_MCE_KILL(0x21, 0x1, 0x0) prctl$PR_MCE_KILL_GET(0x22) r2 = socket(0x10, 0x80002, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000017dcb4401e040c4098af0000000109021200"], 0x0) add_key$user(&(0x7f00000003c0), &(0x7f00000001c0)={'syz', 0x2}, 0x0, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="1400000010e7010000000000000000000000000a20000000000a03000000000000000000070000000c00044000000000000000021c000000090a010400000000000000000700000008000a4000000003"], 0x64}, 0x1, 0x0, 0x0, 0x4004001}, 0x0) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff0000000000010902240001"], 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000200), 0x0}, 0x0) r4 = syz_open_dev$hiddev(0x0, 0x0, 0x0) ioctl$HIDIOCGREPORTINFO(r4, 0xc00c4809, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@newlink={0x3c, 0x10, 0x40d, 0x70bd25, 0x25ffdbfc, {0x0, 0x0, 0x0, 0x0, 0x10}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_HELLO_TIME={0x8, 0x2, 0x6}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) sendmmsg$alg(r2, &(0x7f00000000c0), 0x492492492492627, 0x0) recvfrom$inet(r2, &(0x7f0000000380)=""/42, 0x2a, 0x121, &(0x7f0000000280)={0x2, 0x4e20, @remote}, 0x10) socket(0x28, 0x5, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000a80)={0xffffffffffffffff}) sendmmsg(r5, &(0x7f0000008dc0)=[{{0x0, 0x0, &(0x7f0000001e80)=[{&(0x7f0000001d40)="cf", 0x1}], 0x1}}], 0x1, 0x4009811) 2m33.080627955s ago: executing program 1 (id=249): socket$inet6_tcp(0xa, 0x1, 0x0) (async) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x5, @mcast2, 0x2}, 0x1c) sendmsg$IPSET_CMD_GET_BYNAME(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0xe, 0x6, 0x301, 0x0, 0x0, {0x1, 0x0, 0xa}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x8800) (async) sendmsg$IPSET_CMD_GET_BYNAME(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0xe, 0x6, 0x301, 0x0, 0x0, {0x1, 0x0, 0xa}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x8800) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x4e20, 0x400, @private1={0xfc, 0x1, '\x00', 0x1}, 0x10}, 0x1c) (async) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x4e20, 0x400, @private1={0xfc, 0x1, '\x00', 0x1}, 0x10}, 0x1c) openat$vcsu(0xffffffffffffff9c, &(0x7f0000000180), 0x145341, 0x0) (async) r1 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000180), 0x145341, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f00000001c0)={0x1, 0x40}, 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000980)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000940)={&(0x7f0000000240)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWOBJ={0x1c, 0x12, 0xa, 0x101, 0x0, 0x0, {0x2}, @NFT_OBJECT_CT_EXPECT=@NFTA_OBJ_TYPE={0x8}}, @NFT_MSG_NEWRULE={0x48, 0x6, 0xa, 0x801, 0x0, 0x0, {0x3, 0x0, 0x5}, [@NFTA_RULE_COMPAT={0x1c, 0x5, 0x0, 0x1, [@NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0x201}, @NFTA_RULE_COMPAT_PROTO_IPV6={0x8}, @NFTA_RULE_COMPAT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x3}]}, @NFTA_RULE_ID={0x8, 0x9, 0x1, 0x0, 0x3}, @NFTA_RULE_ID={0x8, 0x9, 0x1, 0x0, 0x1}, @NFTA_RULE_ID={0x8, 0x9, 0x1, 0x0, 0x2}]}, @NFT_MSG_NEWSETELEM={0x1c, 0xc, 0xa, 0x401, 0x0, 0x0, {0x2, 0x0, 0x8}, [@NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x1}]}, @NFT_MSG_NEWCHAIN={0x8c, 0x3, 0xa, 0xa00, 0x0, 0x0, {0x5, 0x0, 0x3}, [@NFTA_CHAIN_HOOK={0x54, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x71bc59f3}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x6}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x694ca038d4ec01de}, @NFTA_HOOK_DEV={0x14, 0x3, 'sit0\x00'}, @NFTA_HOOK_DEV={0x14, 0x3, 'dummy0\x00'}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x16715be1}]}, @NFTA_CHAIN_POLICY={0x8}, @NFTA_CHAIN_COUNTERS={0x1c, 0x8, 0x0, 0x1, [@NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x1}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x7}]}]}, @NFT_MSG_NEWCHAIN={0x24, 0x3, 0xa, 0x201, 0x0, 0x0, {0x2}, [@NFTA_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x1}, @NFTA_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x1}]}, @NFT_MSG_DELTABLE={0x150, 0x2, 0xa, 0x0, 0x0, 0x0, {0x1, 0x0, 0x7}, [@NFTA_TABLE_USERDATA={0x19, 0x6, "34e60d188304cf370ce4fbdb065a0dd271a2cee983"}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}, @NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}, @NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_TABLE_USERDATA={0x81, 0x6, "c72890864ba9b9fd66056e6d381bd17c76aac155316884eacba962dad43ea2fae8a9df143125086daa61ed589d1ef853c01f01bb15f32727238a593aee4eeaa1691e7fed2b7e6459003a5d0b36678d50d9e652d39d4b4bbaafac235bc9cbe30dbed589deb86fd0255f363480da85cda3045d1291fa50ac4a3504d2bc13"}, @NFTA_TABLE_FLAGS={0x8}, @NFTA_TABLE_USERDATA={0x54, 0x6, "b30150af348795821fde40d55b4bc5972d6d394efc6a2d80ce49c2fa036f50c6acdcdb5322f1d0ee0c0a832b7f2259a13cc0ad843edbe36a851abeac1dbc25ddc02d38b3b09ea9122035aa536935e25f"}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_DELCHAIN={0x368, 0x5, 0xa, 0x201, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x3}, @NFTA_CHAIN_TYPE={0xb, 0x7, 'filter\x00'}, @NFTA_CHAIN_USERDATA={0xda, 0xc, "9d7ed6a7b87ce612d7314a3b17e069c8697ab8241492d20bbd8c51cc19792bed7866af8813c282e89b284d3f85c9f678240a7b99eaa5beb0be4133673325ae57cb8e262704c9c528fc40315e60aaeee175b595821af6d6545807d867b4e5eacc969a2bcc690e5beb160cf3709740bd88411209ef4c281ff68fe2b936b8c1d6601eb14371863d35c272c7038bb0a57c0752abeacee4a9727f578c608afd22eb3aaef93e181d776ff84784d6b1b8b6063bfc3e202fdd1f4369570890cdbfb5784911f0e745f7bd62d10dc6545fbd15bbcb18ae0fce35ab"}, @NFTA_CHAIN_USERDATA={0xfd, 0xc, "b11d9030227c3044168a05a24db97091c91af200626ea71981c4edfe01385ecdca59550dcfc367505ef07939bb2b36320d213a94404dbf2b76a07e57bc34f25fa89d1eeb7219949d0837eb9a9a9482928876bcb1ea2a42a1bfa94eabb3d521fceb39bfdb97183e71794ebc9abc96b68586b617ea5e96600bcff9717bc40759efe6f5989b731b9af0882ef225d57d82290a1653518166d42f44e3998d10f59d50ac71e391aebc6bdca5c53eeee3a2d83873d7ca8746d4cdcac02c83ad1331220a9dd0fa6cacab242cf0dfda0da76546dcd0bf368569a9ea3c79403adb5543ab3a976f760c219d56635dfac937fb0deee050afc9f55c26ec17b4"}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x5}, @NFTA_CHAIN_TYPE={0xb, 0x7, 'filter\x00'}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x4}, @NFTA_CHAIN_USERDATA={0xe2, 0xc, "7a3a3eda8b15f56fb33553f65c170fefd2266bd74d85d5302865a3100b75b8159f96bb4dcccd5750652b7f58ae532ef56546139553f1882054793840eed05b55d75a01a70d81f20a95d92894eeb5325ccc53a8ebc421752a63725fb4a625ecf6e849c9edaa5495c1054edcf2e2d0a2c6ff1f3a59ae5f125498302cc393ec7f77a197fb54f78eb900097997b22c7ec1db507a67462495ed0d48a6119b56847f224bd6fde6cba258ae6dd99790e929c3de7291ccf97f46b0012ec61a024437e1e50e1a2cc79d56d1b13613f897655747cfc5daebf81fb0881511ea7f825489"}, @NFTA_CHAIN_USERDATA={0x55, 0xc, "ce7a38cdac2a4d774331c27c84b07a451c3fa818fb52f5b752a6f4daf422d085a0ec2a93058acdaa975dd8be33f145168753169e9054975fb420a0bd91dce3205f75bc751f2205e2193b0c755cab7719e5"}]}, @NFT_MSG_DELTABLE={0xf0, 0x2, 0xa, 0x5, 0x0, 0x0, {0x5, 0x0, 0xa}, [@NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x1}, @NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_TABLE_USERDATA={0xbf, 0x6, "0240d2f03892b4d0502edfe1172d1b57eb273e94e38031c57c71398dd7b85ec8d7779ad12ce8363964ae2e8613f934207211a979e443ab394100d83297fc4c65a006002c054bba205f57f14116d8d05cb4fdb500ef0e79a8900164edcb386178c2911ab9cb9c1e4f49f46a0d5f673824421beed737866557dc31f3683d6d16865cdbb05f4481ed9045c0426c4dc86a38878137144f06986c56d0245762e487228175b1c8ebcc44eb31cfc4fa0b3bb7c5e2070b099515d07ecb0886"}, @NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x3}]}], {0x14}}, 0x700}, 0x1, 0x0, 0x0, 0x8000}, 0x4000000) (async) sendmsg$NFT_BATCH(r2, &(0x7f0000000980)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000940)={&(0x7f0000000240)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWOBJ={0x1c, 0x12, 0xa, 0x101, 0x0, 0x0, {0x2}, @NFT_OBJECT_CT_EXPECT=@NFTA_OBJ_TYPE={0x8}}, @NFT_MSG_NEWRULE={0x48, 0x6, 0xa, 0x801, 0x0, 0x0, {0x3, 0x0, 0x5}, [@NFTA_RULE_COMPAT={0x1c, 0x5, 0x0, 0x1, [@NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0x201}, @NFTA_RULE_COMPAT_PROTO_IPV6={0x8}, @NFTA_RULE_COMPAT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x3}]}, @NFTA_RULE_ID={0x8, 0x9, 0x1, 0x0, 0x3}, @NFTA_RULE_ID={0x8, 0x9, 0x1, 0x0, 0x1}, @NFTA_RULE_ID={0x8, 0x9, 0x1, 0x0, 0x2}]}, @NFT_MSG_NEWSETELEM={0x1c, 0xc, 0xa, 0x401, 0x0, 0x0, {0x2, 0x0, 0x8}, [@NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x1}]}, @NFT_MSG_NEWCHAIN={0x8c, 0x3, 0xa, 0xa00, 0x0, 0x0, {0x5, 0x0, 0x3}, [@NFTA_CHAIN_HOOK={0x54, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x71bc59f3}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x6}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x694ca038d4ec01de}, @NFTA_HOOK_DEV={0x14, 0x3, 'sit0\x00'}, @NFTA_HOOK_DEV={0x14, 0x3, 'dummy0\x00'}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x16715be1}]}, @NFTA_CHAIN_POLICY={0x8}, @NFTA_CHAIN_COUNTERS={0x1c, 0x8, 0x0, 0x1, [@NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x1}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x7}]}]}, @NFT_MSG_NEWCHAIN={0x24, 0x3, 0xa, 0x201, 0x0, 0x0, {0x2}, [@NFTA_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x1}, @NFTA_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x1}]}, @NFT_MSG_DELTABLE={0x150, 0x2, 0xa, 0x0, 0x0, 0x0, {0x1, 0x0, 0x7}, [@NFTA_TABLE_USERDATA={0x19, 0x6, "34e60d188304cf370ce4fbdb065a0dd271a2cee983"}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}, @NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}, @NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_TABLE_USERDATA={0x81, 0x6, "c72890864ba9b9fd66056e6d381bd17c76aac155316884eacba962dad43ea2fae8a9df143125086daa61ed589d1ef853c01f01bb15f32727238a593aee4eeaa1691e7fed2b7e6459003a5d0b36678d50d9e652d39d4b4bbaafac235bc9cbe30dbed589deb86fd0255f363480da85cda3045d1291fa50ac4a3504d2bc13"}, @NFTA_TABLE_FLAGS={0x8}, @NFTA_TABLE_USERDATA={0x54, 0x6, "b30150af348795821fde40d55b4bc5972d6d394efc6a2d80ce49c2fa036f50c6acdcdb5322f1d0ee0c0a832b7f2259a13cc0ad843edbe36a851abeac1dbc25ddc02d38b3b09ea9122035aa536935e25f"}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_DELCHAIN={0x368, 0x5, 0xa, 0x201, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x3}, @NFTA_CHAIN_TYPE={0xb, 0x7, 'filter\x00'}, @NFTA_CHAIN_USERDATA={0xda, 0xc, "9d7ed6a7b87ce612d7314a3b17e069c8697ab8241492d20bbd8c51cc19792bed7866af8813c282e89b284d3f85c9f678240a7b99eaa5beb0be4133673325ae57cb8e262704c9c528fc40315e60aaeee175b595821af6d6545807d867b4e5eacc969a2bcc690e5beb160cf3709740bd88411209ef4c281ff68fe2b936b8c1d6601eb14371863d35c272c7038bb0a57c0752abeacee4a9727f578c608afd22eb3aaef93e181d776ff84784d6b1b8b6063bfc3e202fdd1f4369570890cdbfb5784911f0e745f7bd62d10dc6545fbd15bbcb18ae0fce35ab"}, @NFTA_CHAIN_USERDATA={0xfd, 0xc, "b11d9030227c3044168a05a24db97091c91af200626ea71981c4edfe01385ecdca59550dcfc367505ef07939bb2b36320d213a94404dbf2b76a07e57bc34f25fa89d1eeb7219949d0837eb9a9a9482928876bcb1ea2a42a1bfa94eabb3d521fceb39bfdb97183e71794ebc9abc96b68586b617ea5e96600bcff9717bc40759efe6f5989b731b9af0882ef225d57d82290a1653518166d42f44e3998d10f59d50ac71e391aebc6bdca5c53eeee3a2d83873d7ca8746d4cdcac02c83ad1331220a9dd0fa6cacab242cf0dfda0da76546dcd0bf368569a9ea3c79403adb5543ab3a976f760c219d56635dfac937fb0deee050afc9f55c26ec17b4"}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x5}, @NFTA_CHAIN_TYPE={0xb, 0x7, 'filter\x00'}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x4}, @NFTA_CHAIN_USERDATA={0xe2, 0xc, "7a3a3eda8b15f56fb33553f65c170fefd2266bd74d85d5302865a3100b75b8159f96bb4dcccd5750652b7f58ae532ef56546139553f1882054793840eed05b55d75a01a70d81f20a95d92894eeb5325ccc53a8ebc421752a63725fb4a625ecf6e849c9edaa5495c1054edcf2e2d0a2c6ff1f3a59ae5f125498302cc393ec7f77a197fb54f78eb900097997b22c7ec1db507a67462495ed0d48a6119b56847f224bd6fde6cba258ae6dd99790e929c3de7291ccf97f46b0012ec61a024437e1e50e1a2cc79d56d1b13613f897655747cfc5daebf81fb0881511ea7f825489"}, @NFTA_CHAIN_USERDATA={0x55, 0xc, "ce7a38cdac2a4d774331c27c84b07a451c3fa818fb52f5b752a6f4daf422d085a0ec2a93058acdaa975dd8be33f145168753169e9054975fb420a0bd91dce3205f75bc751f2205e2193b0c755cab7719e5"}]}, @NFT_MSG_DELTABLE={0xf0, 0x2, 0xa, 0x5, 0x0, 0x0, {0x5, 0x0, 0xa}, [@NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x1}, @NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_TABLE_USERDATA={0xbf, 0x6, "0240d2f03892b4d0502edfe1172d1b57eb273e94e38031c57c71398dd7b85ec8d7779ad12ce8363964ae2e8613f934207211a979e443ab394100d83297fc4c65a006002c054bba205f57f14116d8d05cb4fdb500ef0e79a8900164edcb386178c2911ab9cb9c1e4f49f46a0d5f673824421beed737866557dc31f3683d6d16865cdbb05f4481ed9045c0426c4dc86a38878137144f06986c56d0245762e487228175b1c8ebcc44eb31cfc4fa0b3bb7c5e2070b099515d07ecb0886"}, @NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x3}]}], {0x14}}, 0x700}, 0x1, 0x0, 0x0, 0x8000}, 0x4000000) r3 = accept4$vsock_stream(r1, &(0x7f00000009c0)={0x28, 0x0, 0x0, @hyper}, 0x10, 0x100800) accept4$vsock_stream(r3, &(0x7f0000000a00), 0x10, 0x80800) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f0000000a40)={0x5d, 0xfffffff8, 0xffffffcd, "6efadc2df304b30ebd6b3f27f63234ffeba5372ac27b2b9077ab6fc68443e7295fa2be06089377063dea6b8a61a42aedeb72bb2721a46f51fcc8e1e33573e1aff6638d1cd1d4eee1b11d17845bf3ceb8b7d45cabf2c9bda7eb9289e6ca"}) r4 = accept4$inet6(r0, &(0x7f0000000ac0)={0xa, 0x0, 0x0, @private2}, &(0x7f0000000b00)=0x1c, 0x80800) setsockopt$inet6_int(r4, 0x29, 0x3, &(0x7f0000000b40)=0x421, 0x4) (async) setsockopt$inet6_int(r4, 0x29, 0x3, &(0x7f0000000b40)=0x421, 0x4) ioctl$VHOST_VDPA_SET_CONFIG_CALL(r1, 0x4004af77, &(0x7f0000000b80)=0x6) io_uring_setup(0x2ac7, &(0x7f0000000bc0)={0x0, 0x8a58, 0x4, 0x2, 0x20, 0x0, r1}) (async) r5 = io_uring_setup(0x2ac7, &(0x7f0000000bc0)={0x0, 0x8a58, 0x4, 0x2, 0x20, 0x0, r1}) io_uring_enter(r5, 0x1037, 0xd11f, 0x36, &(0x7f0000000c40)={[0x85]}, 0x8) r6 = socket$qrtr(0x2a, 0x2, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0xc, 0x110, r6, 0x3d522000) setsockopt$inet6_udp_encap(r1, 0x11, 0x64, &(0x7f0000000c80)=0x1, 0x4) ioctl$VIDIOC_SUBDEV_S_FMT(r1, 0xc0585605, &(0x7f0000000cc0)={0x0, 0x0, {0x8, 0x636, 0x3005, 0x5, 0xa, 0x3, 0x2}}) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(r1, 0xc0189374, &(0x7f0000000d40)={{0x1, 0x1, 0x18, r5, {0x9}}, '\x00'}) ioctl$EVIOCGMASK(r1, 0x80104592, &(0x7f0000000e00)={0x1f, 0x51, &(0x7f0000000d80)="110f42a400ea98d78b8dc2c802ccce9a7188baa76c32458445594f4b2bc6d6cb6e765522b52aab708e03480fb648629059364d8b7a94664f20b57a5a67b178ad92a65263816e867d629aa55796a3057ce0"}) getsockopt$IPT_SO_GET_REVISION_MATCH(r7, 0x0, 0x42, &(0x7f0000000e40)={'NETMAP\x00'}, &(0x7f0000000e80)=0x1e) connect$pppl2tp(r1, &(0x7f0000000ec0)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x2, 0x2, 0x2, 0x0, {0xa, 0x4e22, 0x10000, @private1={0xfc, 0x1, '\x00', 0x1}}}}, 0x32) ioctl$sock_inet6_udp_SIOCINQ(r4, 0x541b, &(0x7f0000000f00)) syz_open_dev$radio(&(0x7f0000000f40), 0x2, 0x2) (async) syz_open_dev$radio(&(0x7f0000000f40), 0x2, 0x2) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r7, 0x6, 0x15, &(0x7f0000000f80)=0xe, 0x4) (async) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r7, 0x6, 0x15, &(0x7f0000000f80)=0xe, 0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000fc0), 0x8000, 0x0) r8 = add_key$keyring(&(0x7f00000010c0), &(0x7f0000001100)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffd) add_key(&(0x7f0000001000)='id_resolver\x00', &(0x7f0000001040)={'syz', 0x1}, &(0x7f0000001080)="bf35b6e1468782e2303007df665b8fcde55a4baee79395b82bd3ed18f7e565af7c260874", 0x24, r8) 2m32.675947627s ago: executing program 1 (id=252): r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$inet6(0xa, 0x80002, 0x0) sendto$inet6(r5, 0x0, 0x0, 0x200c8004, &(0x7f0000000280)={0xa, 0xe20, 0x0, @private0, 0xfffffffb}, 0x1c) sendto$inet6(r5, &(0x7f00000009c0)="c7cfcaaa22e10542fca5c0195350f15147657e0bfc59d383a47190db88690e6fedc3040ab5809ae02a54cd429cc3338c5afa0c9dce3f91950d1f567f358ac21154159130e88cbb6c43197813b2f23f3e442f80877490b393408142ebcfea6821f543e5ee9e27032e2b75d78f1b79f5a6bb6f0645e267770ef7e8f3a92148091217450ce8581e54223eeb6486205a209bf1fe854d211c03f8c3140fc3979d824082990d119473d20e94f253c9621fac339560ae46cb24b88bf2d01559bb658e343257b90f233b81bc5c398be3bbddb23a1e", 0xffd6, 0xc001, 0x0, 0xffffffffffffff0c) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000640)=0x3, 0x4) setsockopt$inet6_udp_int(r5, 0x88, 0x1, &(0x7f0000000080), 0x4) r6 = socket$unix(0x1, 0x1, 0x0) r7 = socket(0x400000000010, 0x3, 0x0) ioctl$KVM_CHECK_EXTENSION(0xffffffffffffffff, 0xae03, 0x5) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r8, {0x0, 0xfff1}, {0xffff, 0xb}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@newtfilter={0x34, 0x2c, 0xd27, 0x70bd24, 0x25dfdbfc, {0x0, 0x0, 0x0, r8, {0xb, 0xa}, {}, {0x7, 0x2}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000002400)=@delchain={0x24, 0x64, 0x1, 0x70bd2c, 0x25dfdbff, {0x0, 0x0, 0x0, r9, {0x0, 0xfff3}, {}, {0xb}}}, 0x24}, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000220edf104c05c10687c20102030109022400010000000009040000024f6996000905c6d6000000000009050202"], 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[], 0x3c}}, 0x10000) sendmsg$nl_route_sched(r0, &(0x7f0000005840)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)=@newqdisc={0x48, 0x24, 0x5820a61ca228651, 0x0, 0x2, {0x0, 0x0, 0x0, r10, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x7fffffff, 0x1}}]}}]}, 0x48}}, 0x0) r11 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000200)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) r12 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x8000, 0x40) ioctl$SIOCSIFHWADDR(r11, 0x8924, &(0x7f00000002c0)={'ip6tnl0\x00', @remote}) mknodat(r12, &(0x7f0000000180)='./file0\x00', 0x8000, 0x4) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000001d00)=@newtfilter={0x6c, 0x28, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r10, {0xc}, {0xfff2}, {0xfff1, 0x3d}}, [@filter_kind_options=@f_bpf={{0x8}, {0x38, 0x2, [@TCA_BPF_ACT={0x34, 0x1, [@m_vlan={0x30, 0x9, 0x0, 0x0, {{0x9}, {0x4}, {0x4}, {0xc}, {0xc}}}]}]}}, @TCA_RATE={0x6, 0x5, {0x0, 0x9}}]}, 0x6c}}, 0x0) 2m30.692702456s ago: executing program 1 (id=258): madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) (async, rerun: 32) r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) (rerun: 32) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffc, 0x6, 0x0, @buffer={0x2, 0x41001, &(0x7f00000000c0)=""/81}, &(0x7f0000000380)="259374c96ee3", 0x0, 0x0, 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000a94000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x8000000000000001) (async, rerun: 64) mbind(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4005, &(0x7f0000000040)=0x81, 0x5, 0x0) (async, rerun: 64) set_mempolicy_home_node(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x0) mlock(&(0x7f0000ffd000/0x3000)=nil, 0x3000) 2m30.417876939s ago: executing program 1 (id=260): r0 = socket$inet6(0xa, 0x800000000000002, 0x0) arch_prctl$ARCH_SHSTK_UNLOCK(0x5004, 0x3) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r0, 0x29, 0x41, &(0x7f0000000440)={'filter\x00'}, 0x28) r1 = add_key(&(0x7f00000000c0)='asymmetric\x00', &(0x7f0000000100)={'syz', 0x2}, &(0x7f0000000140)="c96241c21642d2141815ecb0ac9400ec9a1776842b31003cccad9f97adec0ee7859747e2ed6dc96878665a5c1f0382e1803a86a9f9870a2de9f81799a5e83d15572a009d512d9b53c26f658ace2ee569fb0df6a007690acc282aad30bedfaf9aa60299938238e293237f79b07b113dd6949b39e587677d8eb60c8f0694a7ff5758a75056b779162dd814e095c03e5974599a5671f50e45b522b47d6f56e90665fd9a7fb439fd0dfb2c045781c4306ec79cf2bee3fb77bcf51204c25fffc743777715fc5ecbc92d200aa2be2797bdf2169cf54b813f6c37bc551ac3c0d506c0a3905c55da496685c6236d5b5642cd69a51ec87722c17f753808ee", 0xfa, 0xfffffffffffffffb) bpf$PROG_LOAD(0x5, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r3 = dup(r2) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) r4 = syz_io_uring_setup(0x239, &(0x7f0000000740)={0x0, 0x1c2a, 0x10100, 0x0, 0x0, 0x0, r3}, &(0x7f0000000180)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r5, r6, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd=r2, 0x0, 0x0, 0x0, {}, 0x1}) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="280000003d000d8632cd6bdccc8d0000047c0000040000000c0001"], 0x28}, 0x1, 0x0, 0x0, 0x40004}, 0xc800) io_uring_enter(r4, 0x2ded, 0x4000, 0x0, 0x0, 0x0) r8 = openat$userio(0xffffffffffffff9c, &(0x7f0000000200), 0xa2682, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000005c0)={{0x14}, [@NFT_MSG_NEWRULE={0x70, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x44, 0x4, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @limit={{0xa}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_LIMIT_RATE={0xc, 0x1, 0x1, 0x0, 0x4}, @NFTA_LIMIT_UNIT={0xc}]}}}, {0x14, 0x1, 0x0, 0x1, @range={{0xa}, @val={0x4}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x98}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000003, 0x4008032, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) r10 = accept4$packet(r3, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000280)=0x14, 0x100000) setsockopt$packet_int(r10, 0x107, 0xe, &(0x7f00000002c0)=0x5, 0x4) r11 = io_uring_setup(0x4126, &(0x7f00000007c0)={0x0, 0x80, 0x40, 0x0, 0x274}) r12 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r13 = dup(r12) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r13, 0x2000) io_uring_register$IORING_REGISTER_RING_FDS(r11, 0x13, &(0x7f0000001bc0), 0x2) preadv(r8, &(0x7f0000000140)=[{&(0x7f0000001180)=""/4100, 0x1004}], 0x1, 0x0, 0x0) request_key(&(0x7f0000000000)='syzkaller\x00', &(0x7f0000000040)={'syz', 0x2}, &(0x7f0000000080)='filter\x00', r1) 2m21.186677579s ago: executing program 32 (id=241): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x1b) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = fsopen(&(0x7f0000000080)='debugfs\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000ac0)='gid', &(0x7f0000000440)='0\x00#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xea\\Eb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D-\x98\x9f\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xb8\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6\xd7\x80Y\xc2\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\xa7\xfa\xdb\x1ce\xc1\x03\x86J\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\x81\x14l7u\x95\x96t\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xe39\xc6b\x905\xf8\xc9@h\x01\xf5\xcb\x88\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?\x839\x85N\x1c\xc1\xcb\xfc\x85\xd2\n\x02\"\xf2\x81g\x90\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9a\x84\'\xa3\xf1\xd9<\xb9k', 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r5 = dup(r4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r5, 0x2000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x600000000000000, 0x0, 0x0, 0x2) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'bridge_slave_0\x00', 0x401}) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x40400, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)={0x24, 0x2, 0x6, 0x5, 0x0, 0x0, {0x5}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}]}, 0x24}, 0x1, 0x0, 0x0, 0x880}, 0x80) r9 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r9, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000600)=[@text16={0x10, &(0x7f0000000080)="360f231b66b80500000066b94d2800000f01d9e32f66b80500000066b9050000000f01c1366566f20f2b5b00ea00908a00baf80c66b8baf0488066efbafc0cb80008ef0f015f023e0fc77e170f07", 0x4e}], 0x1, 0x74, 0x0, 0x0) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="1800000076000d0b00bbf6000300000000000036"], 0x18}}, 0x0) eventfd2(0x9, 0x80001) r11 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000044082, 0x0) fallocate(r11, 0x11, 0x0, 0x100000000007c000) 2m15.083943297s ago: executing program 33 (id=260): r0 = socket$inet6(0xa, 0x800000000000002, 0x0) arch_prctl$ARCH_SHSTK_UNLOCK(0x5004, 0x3) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r0, 0x29, 0x41, &(0x7f0000000440)={'filter\x00'}, 0x28) r1 = add_key(&(0x7f00000000c0)='asymmetric\x00', &(0x7f0000000100)={'syz', 0x2}, &(0x7f0000000140)="c96241c21642d2141815ecb0ac9400ec9a1776842b31003cccad9f97adec0ee7859747e2ed6dc96878665a5c1f0382e1803a86a9f9870a2de9f81799a5e83d15572a009d512d9b53c26f658ace2ee569fb0df6a007690acc282aad30bedfaf9aa60299938238e293237f79b07b113dd6949b39e587677d8eb60c8f0694a7ff5758a75056b779162dd814e095c03e5974599a5671f50e45b522b47d6f56e90665fd9a7fb439fd0dfb2c045781c4306ec79cf2bee3fb77bcf51204c25fffc743777715fc5ecbc92d200aa2be2797bdf2169cf54b813f6c37bc551ac3c0d506c0a3905c55da496685c6236d5b5642cd69a51ec87722c17f753808ee", 0xfa, 0xfffffffffffffffb) bpf$PROG_LOAD(0x5, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r3 = dup(r2) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) r4 = syz_io_uring_setup(0x239, &(0x7f0000000740)={0x0, 0x1c2a, 0x10100, 0x0, 0x0, 0x0, r3}, &(0x7f0000000180)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r5, r6, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd=r2, 0x0, 0x0, 0x0, {}, 0x1}) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="280000003d000d8632cd6bdccc8d0000047c0000040000000c0001"], 0x28}, 0x1, 0x0, 0x0, 0x40004}, 0xc800) io_uring_enter(r4, 0x2ded, 0x4000, 0x0, 0x0, 0x0) r8 = openat$userio(0xffffffffffffff9c, &(0x7f0000000200), 0xa2682, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000005c0)={{0x14}, [@NFT_MSG_NEWRULE={0x70, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x44, 0x4, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @limit={{0xa}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_LIMIT_RATE={0xc, 0x1, 0x1, 0x0, 0x4}, @NFTA_LIMIT_UNIT={0xc}]}}}, {0x14, 0x1, 0x0, 0x1, @range={{0xa}, @val={0x4}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x98}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000003, 0x4008032, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) r10 = accept4$packet(r3, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000280)=0x14, 0x100000) setsockopt$packet_int(r10, 0x107, 0xe, &(0x7f00000002c0)=0x5, 0x4) r11 = io_uring_setup(0x4126, &(0x7f00000007c0)={0x0, 0x80, 0x40, 0x0, 0x274}) r12 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r13 = dup(r12) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r13, 0x2000) io_uring_register$IORING_REGISTER_RING_FDS(r11, 0x13, &(0x7f0000001bc0), 0x2) preadv(r8, &(0x7f0000000140)=[{&(0x7f0000001180)=""/4100, 0x1004}], 0x1, 0x0, 0x0) request_key(&(0x7f0000000000)='syzkaller\x00', &(0x7f0000000040)={'syz', 0x2}, &(0x7f0000000080)='filter\x00', r1) 1m55.759824393s ago: executing program 4 (id=323): syz_usb_connect(0x5, 0x2d, &(0x7f00000008c0)=ANY=[@ANYRESOCT=0x0], 0x0) (async) r0 = fsopen(&(0x7f0000000180)='proc\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) (async) r1 = fsmount(r0, 0x0, 0x1) fchdir(r1) (async) ioctl$INCFS_IOC_CREATE_FILE(r1, 0xc058671e, &(0x7f0000000580)={{'\x00', 0x1}, {0x8}, 0xe, 0x0, 0x0, &(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='./bus\x00', &(0x7f0000000380)="821ac44fc48ab185ef1d605189d2c9418ce5f0b2ea83cc9450fbda62843e798a5ab5fc304fe55a867c61b9688f346341640c8bd31944e3398f5585ccff8c4d2c9a8067f7548781e4da8cfb166ddf1208d348e8f63ad6c4a0ba2f0287100e5b6df5ab5b28dd09c2ec23729a4b5f702a28f295c81dced34568c69541d90511b9461ef7c0771a2334f91f8617136eebc3551740532d8e58122b595b3e35fb8da0e41e8ce83d9db56d480051cbb05961d9477dc162707d5ad1a52e93b3a28cf08681b515e579a450c45a100e2616a2753f2d5733699dc39eed4f8a3959d6ad6816b678c3dd1dcf932f7f3d05187411e6b435d579c69e8970679226da842499e97840b4d0ab203cb304bca760550f53fe6ea55e7f0017502d52e3c3b5563c556444424f1a9e664d92ab50e7364672952d470d65fd68c701383bfe15ec51a977fe21c494fbae3e172bf1b4c41785322b00ba3a482430db66f2642621a72176a098c3ba6e55f00d5b3147e44f3716202915c04fcb61c25f145301c062cbcdbbda8d6f84a9f92fc7751c9109a491f5bf528765cadf8045e30d01455369098113cf452e64ed31ef97461ee3c74889d2a891d9e92c29e799c4064f5637f27138096384287d57b1d991", 0x1c4, 0x0, &(0x7f0000000a00)={0x2, 0x1bd, {0x0, 0xc, 0xc0, "9e56083d47606157764437297a1703ffc6ac4900cc507756a4caf797d1ed56ca3fd5af8bce7a67e1d3e0289a8ff675ce2fffee5cf5c4d1efa98ca96cf16e4cc8d1b55c6dc4238b554b40c0ff87f3c5795010f8284bb8c4ed923af156d47a3885da68ab371f9bbde0760e2e5153ee5cb60d95c233b88b802c4c222d0e227cf0c9cc0dfcd57cb82e98f1c011cc140982a6cea7bec03c550c73f4651778534381f9ab4969d94f9f5e07db9027c698df299a9b5ea29f1b04c79212446eda7d221b33", 0xf0, "3eced39034cd490c5956205f2a5df54b9fb4ff4a46779a6a8fe620e0641feef3e24e02add628296e0bbf9df64b11e2b7ec47ded7851076cdc83b79aa8cbd98798dad1b131fcea8640399a9e83507c6af0f4f5c3e20d8719a793048012f176db2709e170da4a4e4fddc23f02c2c8cc5cc7694a95b63a57e884d709ae0c1252891d835d9b627426c035e4e9a8522ee54c23cdd22d90805fa9b041b0f961adb1bc55025807f2162b0312741e00dd30f33427f61b0e378dbb0093ead8e5906d0c8f349f70932521eb5bc8ac034fc001462b6863c894c644fd4a4c5ce74745e92f9cc15641fbc5524c422b8fa3c099abe4e10"}, 0xab, "28693ec5546e3c78aece259b2fc9a6af04186d8f944a7f6cf06a73c5ab5a110263ce3f73e574fd0e1a38e45d89f506dafc237a22de8dceb608c701dbc086b69cbc579ee3835bb5ef0ed50d6b3bf8773b12409ae424cacf889d4577479825e811561443e744c4f60d3e3adef45a4e14da2edc8404e673dfcd9a518242e6b3e0d48b49fd3bea03e0a46b7affd51d9eb6a2be91f427abcdde85620c18ca88acb9568d8a90b9009de6b242c846"}, 0x274}) (async) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) (async) syz_usb_connect(0x5, 0x35, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x54, 0x5e, 0xd, 0x20, 0x499, 0x6bb7, 0x682f, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x23, 0x1, 0x0, 0x0, 0xc0, 0x5, [{{0x9, 0x4, 0x97, 0x0, 0x1, 0xff, 0x70, 0x79, 0x0, [@uac_as={[@format_type_i_discrete={0x8, 0x24, 0x2, 0x1, 0x21, 0x1, 0x26, 0xff}]}], [{{0x9, 0x5, 0x85, 0x3, 0x8, 0x2, 0x5, 0x1}}]}}]}}]}}, 0x0) (async) openat$uinput(0xffffffffffffff9c, &(0x7f0000000080), 0x802, 0x0) (async) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) syz_usb_connect$uac1(0x0, 0xa4, &(0x7f0000000200)=ANY=[@ANYBLOB="2a01000020000040b708000000000000030109029200030172e5000904000000010100000a24010000000201020c0d2407000005000000000000000c240000e9fffff5ffffffff092403f3ff000005024524", @ANYRES8=r2, @ANYBLOB="05", @ANYRES16=r2], 0x0) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x101000, 0x108) getdents64(r3, &(0x7f0000000f80)=""/4096, 0x1000) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2000, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'\x00', 0x2}) (async) r5 = syz_io_uring_setup(0x2515, &(0x7f0000000280)={0x0, 0x100002, 0x10100}, &(0x7f0000000000)=0x0, &(0x7f0000000140)=0x0) (async) r8 = openat$random(0xffffffffffffff9c, &(0x7f0000000100), 0x20000, 0x0) ioctl$RNDCLEARPOOL(r8, 0x5206, &(0x7f00000001c0)=0x6) unshare(0x22020600) syz_io_uring_submit(r6, r7, &(0x7f00000009c0)=@IORING_OP_LINKAT={0x27, 0x10, 0x0, 0xffffffffffffffff, &(0x7f0000000040)='./bus\x00', &(0x7f00000000c0)='./bus\x00', 0xffffffffffffffff, 0x1400}) io_uring_enter(r5, 0x53d1, 0x0, 0x4, 0x0, 0x0) r9 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFADDR(r9, 0x8916, &(0x7f0000000980)={'bond_slave_1\x00', {0x2, 0x4e20, @multicast2}}) ioctl$TUNSETOFFLOAD(r1, 0x400454c9, 0xad356f19b320d40b) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r10, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r11, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r10, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x10, 0x2a43, &(0x7f0000006680)) 1m55.277696052s ago: executing program 4 (id=326): socket$alg(0x26, 0x5, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x6a855000) r0 = syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) ioctl$VIDIOC_S_PARM(r0, 0xc0cc5616, &(0x7f0000000080)={0x3, @output={0x1000, 0x1, {0x6, 0x80000000}, 0x3eb, 0x9}}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x482, 0x0) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000000)={0xfffffffc, 0x0, 0x0, 0xfffffffc, 0xff, "db8f2d2b3b7596160c6981acf8805944823a7f"}) write$binfmt_aout(r1, &(0x7f0000000400)=ANY=[], 0xff2e) ioctl$TCSETS(r1, 0x40045431, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x83, "00000000000000000000ffff00"}) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r1, 0x0) read$usbmon(r3, &(0x7f0000000340)=""/126, 0x7e) r4 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r4, &(0x7f0000000140), 0x10) sendmsg$can_bcm(r4, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="050000000300000000000000", @ANYRES64=0x0, @ANYBLOB="0000000001"], 0x48}}, 0x0) read(r4, &(0x7f0000001480)=""/4096, 0x1000) 1m53.259145595s ago: executing program 4 (id=334): socket$vsock_stream(0x28, 0x1, 0x0) syz_usb_connect(0x6, 0x7a, &(0x7f0000000080)=ANY=[], 0x0) syz_open_dev$sndpcmc(0x0, 0x2, 0x200080) ioctl$EVIOCGREP(0xffffffffffffffff, 0x80084503, &(0x7f0000000140)=""/202) unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x50) openat$adsp1(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) fcntl$getflags(0xffffffffffffffff, 0x3) r0 = syz_open_dev$sndmidi(&(0x7f0000000100), 0x2, 0x141121) ioctl$IOCTL_VMCI_VERSION2(0xffffffffffffffff, 0x7a7, &(0x7f0000000080)=0x80000) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) syz_io_uring_setup(0x71cd, &(0x7f0000000300)={0x0, 0x1fffff, 0x10100, 0x3}, 0x0, 0x0) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/resume', 0x149282, 0x10) write$cgroup_int(r2, &(0x7f0000000040)=0x902, 0x12) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000001540)={&(0x7f0000000500)=@allocspi={0x14c, 0x16, 0x401, 0x70bd29, 0x25dfdbff, {{{@in=@dev={0xac, 0x14, 0x14, 0x1d}, @in=@rand_addr=0x64010102, 0x104, 0x7, 0x0, 0x0, 0x0, 0xa0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x32}, @in=@local, {0x5f1, 0x1, 0x0, 0x9, 0x8000004, 0x0, 0x0, 0x2}, {0x0, 0x0, 0x5, 0x2}, {0x800, 0x0, 0x96}, 0x70bd2b, 0x1, 0x2, 0x2}, 0x20000008, 0xdfffffff}, [@replay_thresh={0x8, 0xb, 0x5}, @algo_aead={0x4c, 0x12, {{'aegis256\x00'}, 0x0, 0x200}}]}, 0x14c}, 0x1, 0x0, 0x0, 0x800}, 0x0) io_uring_register$IORING_REGISTER_PERSONALITY(r2, 0x9, 0x0, 0x0) modify_ldt$write(0x1, &(0x7f0000000000)={0xfff}, 0x10) modify_ldt$write(0x1, &(0x7f0000000000)={0x80, 0x0, 0x400}, 0x10) 1m49.137976525s ago: executing program 4 (id=346): r0 = socket$kcm(0x2, 0x5, 0x106) (async) fsopen(&(0x7f0000000300)='btrfs\x00', 0x0) (async) syz_io_uring_setup(0x239, &(0x7f0000000100)={0x0, 0x730a, 0x10100, 0x0, 0x2}, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20008000}, 0x0) (async) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) (async) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="000002f0d31209000000bc2e79e995"], 0x0) (async) write$binfmt_script(r3, &(0x7f0000000100), 0x208e24b) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r3, 0x0) (async, rerun: 32) preadv(r3, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x3e, 0x0, 0x0) (async, rerun: 32) syz_emit_ethernet(0x4a, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff86dd600a847500140600fe8000"/34, @ANYRES32=0x41424344], 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000180)="66b9800000c00f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f326635004000000f300f20e06635800000000f22e0f30fa6c8", 0x50}], 0x1, 0x0, 0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_XEN_HVM_CONFIG(r2, 0x4038ae7a, &(0x7f0000000140)={0x100, 0x640, &(0x7f0000000240), 0x0}) (async) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f00000004c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={0x0}, 0x10) ioctl$KVM_RUN(r4, 0xae80, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 1m48.589906569s ago: executing program 4 (id=348): capset(&(0x7f0000000080)={0x19980330}, &(0x7f0000000040)={0x0, 0x6, 0x0, 0xfffffffc}) r0 = syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000440)='ns/ipc\x00') setns(r0, 0x8000000) sendmsg(0xffffffffffffffff, 0x0, 0x0) r1 = syz_usb_connect$hid(0x6, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io(r1, &(0x7f0000000080)={0x2c, &(0x7f0000000100)=ANY=[@ANYBLOB="000002"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_connect$printer(0x6, 0x0, 0x0, &(0x7f0000001780)={0xa, &(0x7f00000000c0)={0xa, 0x6, 0x41, 0x9, 0x2, 0x1, 0x10, 0x6d}, 0xf4, &(0x7f00000003c0)=ANY=[@ANYRES32=r0, @ANYRESHEX=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES16=r1, @ANYRES32=r0, @ANYRES32=0x0, @ANYRESHEX=r0]}) syz_usb_ep_write(r1, 0x81, 0x9c, &(0x7f00000002c0)="b9425b44651dd23241963599000000110000004a16941ff5f4b4fffffff1ffdf4cd9f5d3969890522c770d0000000000003a5bd5531d459dffff03000000000091ff000000e8f5b3371da3635b8b4fa637135800001f65e4b436aa9e50bc0f19b7d3372ff9eb1ce036d2574258d6bd8fd0d40ecede1fb5e9428f54d5d1f0ccc9c62e05ea01313ffb4f1aa36289752cf246a5d2da34a5aa97dc14a469c3dd3e26b41c356484e46fd66e3f2c7807e8773eed7b94fa099ab84feadec2ea95f65bba0000ae5b0900f98a979a88c517a2dc360a00237723e2f467af706ea17226296b3a10a351cb47aba2c6b836c906") r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000840)=@raw={'raw\x00', 0x3c1, 0x3, 0x3e8, 0x1c0, 0x111, 0x4b4, 0x0, 0xd4feffff, 0x318, 0x20a, 0x278, 0x318, 0x278, 0x3, 0x0, {[{{@ipv6={@empty, @empty, [], [], 'ipvlan0\x00', 'team_slave_0\x00', {}, {}, 0x6}, 0x0, 0x198, 0x1c0, 0x0, {}, [@common=@inet=@tcp={{0x30}, {[], [], 0x0, 0x0, 0x2, 0x4}}, @common=@unspec=@string={{0xc0}, {0x0, 0x0, 'bm\x00', "6d93eb04697dfa39de04767f46614613a407abbf4ed2e83a63b484dbb3bf6b2a850e79009e2905d2f98ba19f91f3c9faee6d3686e9bee067f4e77d9ad66238750c4100d7ee97ec7646259d90edece6e9787a97bc956c01754c34c5c9518c46178ed5f9194454980e579c80eca35a58dc47d1d5e4ff6e216c724e88c702448587", 0x28}}]}, @common=@inet=@TCPMSS={0x28}}, {{@ipv6={@loopback, @private1, [], [], 'veth1_to_hsr\x00', 'pim6reg1\x00'}, 0x0, 0xf0, 0x158, 0x0, {}, [@common=@unspec=@nfacct={{0x48}, {'syz1\x00'}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'pptp\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x448) r4 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00'}) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000009c0)=ANY=[@ANYBLOB="340000001300011d0091000045cb28ad000082", @ANYRES32=r3, @ANYBLOB="042000000000000014001a80100005800c0001800800010000000000"], 0x34}}, 0x0) r6 = epoll_create1(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r7, &(0x7f0000000240)={0x20000006}) epoll_ctl$EPOLL_CTL_ADD(r7, 0x1, r2, &(0x7f0000000040)={0x20000000}) r8 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000000)={0x1ffffffffffffea6, &(0x7f0000000140)=[{0x6, 0x1, 0x0, 0x2}, {0x7d, 0x2, 0x4, 0x6}, {0xfff9, 0x1, 0x1, 0xff}, {0x9, 0x10, 0xd, 0x3}]}) socket$inet6_sctp(0xa, 0x1, 0x84) close_range(r8, 0xffffffffffffffff, 0x0) r9 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r9, 0x0, 0x0) syz_usb_control_io$hid(r9, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="00220f000000540b4550182183"], 0x0}, 0x0) r10 = syz_open_dev$hiddev(&(0x7f0000000080), 0x0, 0x0) ioctl$HIDIOCGUSAGE(r10, 0xc018480b, &(0x7f00000000c0)={0x1, 0xffffffff, 0xe, 0x7, 0x21185045, 0x6}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) 1m36.434249446s ago: executing program 4 (id=370): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x40400c1) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x10002, 0x0) syz_usb_connect(0x5, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="1201100160bb41082e0c00073b04000000010902240001a20000000904610102030840040905850340"], 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x40000000c6302, 0x0) r3 = dup(r2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000007, 0x38011, r3, 0x0) sendfile(r3, r3, 0x0, 0xffffffff) 1m21.121834174s ago: executing program 34 (id=370): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x40400c1) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x10002, 0x0) syz_usb_connect(0x5, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="1201100160bb41082e0c00073b04000000010902240001a20000000904610102030840040905850340"], 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x40000000c6302, 0x0) r3 = dup(r2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000007, 0x38011, r3, 0x0) sendfile(r3, r3, 0x0, 0xffffffff) 1m5.817514172s ago: executing program 7 (id=420): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) socket$packet(0x11, 0x3, 0x300) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x2c040, 0x0) syz_mount_image$fuse(&(0x7f0000002040), &(0x7f0000002080)='./file0\x00', 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB="2c88ab2280b14729c5a4c22c726f6f746d6f64653d30303030303030303030303030303030303034303030302c907365725f69643d", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) unshare(0x20040600) pselect6(0x40, &(0x7f0000000300)={0x0, 0x7e8d, 0x0, 0x1, 0x0, 0x0, 0x800000}, &(0x7f0000000000)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000000}, 0x0, 0x0, 0x0) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) syz_io_uring_setup(0xbc6, &(0x7f0000001480)={0x0, 0x1061, 0x80, 0x4, 0x1ab}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000300)=@IORING_OP_OPENAT={0x12, 0x6, 0x0, 0xffffffffffffff9c, 0x0, &(0x7f00000002c0)='./file0\x00', 0x22, 0xa580, 0x31713}) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r6 = dup(r5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r6, 0x2000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) write$binfmt_aout(r6, 0x0, 0xffffffdb) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x9) r7 = socket$inet_udp(0x2, 0x2, 0x0) r8 = fsopen(&(0x7f00000003c0)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r8, 0x6, 0x0, 0x0, 0x0) r9 = fsmount(r8, 0x0, 0x0) mprotect(&(0x7f000085d000/0x2000)=nil, 0x2000, 0x2000000) openat$cgroup_pressure(r2, &(0x7f0000000280)='cpu.pressure\x00', 0x2, 0x0) write$cgroup_pressure(r9, &(0x7f0000000040)={'some', 0x20, 0x7, 0x20, 0x2000000000000009}, 0x2f) close(r7) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r10 = socket$nl_route(0x10, 0x3, 0x0) mount$fuse(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000240), 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r6, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="2c616c6c6f775f6f749d7f2c4d6d61785f726561643d3078303030303030303030303030303733362c616c6c6f775f6f746865722c626c6b73697a653d3078303030303030303030303030303030302c64656661756c745f7065726d697373696f6e732c616c6c6f775f6f746865722c7365636c6162656c2c61707072616973652c61707072616973655f747970653d696d617369672c666f776e65723c", @ANYRESDEC=0x0, @ANYBLOB=',audit,permit_directio,context=root,fsname={!,obj_user=,\x00']) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00'}) r11 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000000)={'bridge0\x00'}) 57.676969348s ago: executing program 3 (id=477): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) socket$xdp(0x2c, 0x3, 0x0) syz_mount_image$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000900), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(r1, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000000580)=ANY=[@ANYBLOB="45870e58e7a18dec1e258da64a96f079d5feeef812faaec6762b4a3777624ec9be1fb282a0a757acf81c7517384902b6158da5cd1ed0c8eacb438e7d5185e7f82b28c042beb2604c5894b87fc94cb06e48fb38bb36ad9b38dd6e53feff7fbc45cc48e115c84777e369630e51fb44c77a197810193522916ff501d84adfe443bc3252745213fb9b0650e313e51c608c4d645f6bdfac58e04b55190f7ae78e0e6bf8a143c9b0520e48119d00062150f0e6315aa911ec3ae267110d569c537bc21a15eaec5de400644f73c27d8824512ba81c5feaa0418d888bbd83e7eabaeb345d620232740482524e0fa5b50e86ffeab0ef86f39fe572ba9b0734613442471b893fc3", @ANYRES16=r2, @ANYBLOB="01002cbd7000fbdbdf25130000000e0001006e657464657673696d0000000f0002006e657464657673696d300000080003000000000008000b0006000000060011000a000000"], 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x10) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000480)='./file0\x00', 0x89901) move_mount(r3, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x81800) move_mount(r4, 0x0, 0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x254) socket$xdp(0x2c, 0x3, 0x0) r5 = socket$netlink(0x10, 0x3, 0x400000000000004) writev(r5, &(0x7f0000000100)=[{&(0x7f0000000340)="480069658ff0ffdf1400190d7ebdeb75fd0d8c020000ddffffff0080ffe0090f000060000000a2bc5603ca00000f7f89000000200000004a2471083ec6991778581acb6c0101ff74ae92ea5e", 0x4c}], 0x1) syz_genetlink_get_family_id$batadv(&(0x7f0000000040), r5) pwrite64(r0, &(0x7f0000000300)="fec96b1890e924f0e68a5720c990384ffbdf05ecba334fb8", 0x18, 0x8) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r8 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000180)="420fc7bc4898580000640f01c50f01c566baf80cb864c95782ef66bafc0cec67670f1b0166b8fb008ec046d9c3c442b90a2c81c442812852fcc744240012000000c74424020b000000ff1c24", 0x4c}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_REGS(r8, 0x4090ae82, &(0x7f00000004c0)={[0x583a, 0x401, 0x9, 0xe55, 0x6, 0xfffffffffffffffe, 0x101, 0x4f, 0xf, 0x33b, 0xfffffffffffffffe, 0x100000000, 0x1, 0xb, 0x5, 0x6a], 0x1, 0x1000d6}) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000000)=0x0) move_pages(r9, 0x1, &(0x7f0000000040)=[&(0x7f00006d9000/0x1000)=nil], &(0x7f0000000080)=[0x101, 0x8], &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0], 0x4) r10 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r10, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="fc0000001900674c0000000000000000e0000001000000000000000000000000e000000200000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000000000000000400000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000044000500000000000000000000000000000000000000000033"], 0xfc}}, 0x0) r11 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r11, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000200)=ANY=[@ANYBLOB="ec000000210001002dbd7000fedbdf25fe880000000000000000000000000101ac1414bb0000000000000000000000004e240002000700010a0080a000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="af6b6e00010000009c0011001901010000000000000000000000000020010000000000000000000000000001ac14143e0000000000c8b10000000000ac1414bb00000000000000000000000032fcff00073500000a00020000000000000000000000020000000000ac1e01010000000000000000000000000a010102000000000000000000000000fe80000000000000000000000000002f33"], 0xec}}, 0x20000000) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) 57.170478293s ago: executing program 3 (id=481): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0) (async) r2 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) (async) syz_emit_vhci(&(0x7f0000000600)=ANY=[@ANYBLOB="f6fa0301fa1b04ee1a292f8eb4d679e381357ac9fa4c43697d93f9adff1ec9274c8bcee1c7b3dbb7357ab13399f6a6a1281bb9fa6f632900ca1b5f97816f51cf464bb8027bbfcd0dfc63f46cacabc5df6477ce1ae2bc06c367f9883d8d9455e863f59e19575d7a1ee766bb609e2e077abf6805c0ed9eff5d928ac59c2ead0bb32adab00216db954367291f7a79755593ab775b38e48525925e95eac9ce2ffc93d201d103fe2ebb431905f1440064dd71c9cfe14ea754b718776a4c16823aa9fd7c9de9e250fc558857b1a5597deba57b19235e72e5e07adc522a8197a1550cc49cfac91038d259f09ba9372381dbe9b2575b6c4f9a581e75be020d9cec3e373d998153aeca62adc454b43590dca37a86ad"], 0x7) flock(r2, 0x2) r3 = open(&(0x7f0000000300)='.\x00', 0x100000, 0x0) flock(r3, 0x1) (async, rerun: 64) flock(r3, 0x1) (async, rerun: 64) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000400), r0) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$WG_CMD_SET_DEVICE(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000480)=ANY=[@ANYBLOB="1c020000", @ANYRES16=r4, @ANYBLOB="01000000000000000000010000001400020077673100000000000000000000000000f4010880700000804800098028a25880060001000a00000014000200fe8000000000000000000000000000aa05000300000000001c000080060001000200000008000200e0000001050003000000000024000100000000000000000000000000000000000000000000000000000000000000000080010080200004000a004e2000000005200100000000000000000000000000000800000006000500b01f00000800030006000000060005000500000008000a000100000024000100dbffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff200004000a004e200000040100000000000000000000ffffac14142a06000000240001000000000000000000000000000000000000000000000000000000000000000000d400", @ANYRES16=r1], 0x21c}}, 0x0) (async) sendmsg$DEVLINK_CMD_RATE_GET(r0, &(0x7f00000003c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x68, 0x0, 0x228, 0x70bd29, 0x25dfdbfb, {}, [@handle=@pci={{0x8}, {0x11}}, @handle=@pci={{0x8}, {0x11}}, @handle=@pci={{0x8}, {0x11}}]}, 0x68}, 0x1, 0x0, 0x0, 0x4040000}, 0x4800) (async) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000000c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0xee01}}, './file0\x00'}) (async, rerun: 32) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) (async, rerun: 32) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) (async) waitid$P_PIDFD(0x3, 0xffffffffffffffff, 0x0, 0x8, 0x0) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e) (async) sendmmsg$unix(r7, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x2, 0x0, 0x8, 0x0) (async) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x2, &(0x7f0000000000)=0x9, 0x8, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, 0x0) (async, rerun: 32) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async, rerun: 32) read$FUSE(0xffffffffffffffff, 0x0, 0x0) (async) syz_open_procfs$pagemap(0x0, 0x0) (async, rerun: 64) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) (async, rerun: 64) r9 = syz_io_uring_setup(0x82e, &(0x7f0000000300)={0x0, 0x0, 0x10100}, &(0x7f0000000100)=0x0, &(0x7f0000000080)=0x0) io_uring_register$IORING_REGISTER_PBUF_RING(r9, 0x16, &(0x7f0000000380)={&(0x7f0000001000)={[{0x0}, {0x0}, {0x0}, {0x0}]}, 0x4}, 0x1) syz_io_uring_submit(r10, r11, &(0x7f0000000000)=@IORING_OP_RECVMSG={0xa, 0x20, 0x2, r8, 0x0, &(0x7f00000000c0)={0x0, 0x0, 0x0}}) 56.935737219s ago: executing program 3 (id=483): r0 = socket$nl_route(0x10, 0x3, 0x0) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) fspick(0xffffffffffffffff, 0x0, 0x0) (async) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000240)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffc}, 0x0) (async, rerun: 64) r3 = socket$netlink(0x10, 0x3, 0xa) (rerun: 64) r4 = dup(r3) (async) r5 = open(&(0x7f0000000040)='./file1\x00', 0x1850c2, 0x14c) ftruncate(r5, 0x200004) (async) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) (async, rerun: 64) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0) (rerun: 64) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r7, 0xae60) ioctl$KVM_CAP_X2APIC_API(r7, 0x4068aea3, &(0x7f0000000000)={0x81, 0x0, 0x3}) ioctl$KVM_SIGNAL_MSI(r7, 0x4020aea5, 0x0) (async) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)={0x2c, 0x3e, 0x107, 0xfffffffe, 0x0, {0x1, 0x7c}, [@nested={0x4, 0x142}, @nested={0x10, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}, @nested={0x4, 0x1}]}, @nested={0x4, 0x2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) (async) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r9, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x24, 0x41, 0x107, 0x0, 0x7, {0x1, 0x7c}, [@nested={0x4, 0xfc}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}]}, 0x24}}, 0x4010) (async) sendfile(r4, r5, 0x0, 0x80001d00c0d1) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card3/oss_mixer\x00', 0x262103, 0x0) (async) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=@newlink={0x3c, 0x10, 0x49920d862a92153b, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @vxcan={{0xa}, {0x4, 0x2, 0x0, 0x1, @void}}}, @IFLA_MTU={0x8, 0x3}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) 55.069942839s ago: executing program 3 (id=487): syz_emit_ethernet(0x4a, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa0086dd6000000000140601fe8000"], 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x8, 0xf, &(0x7f0000000200)=ANY=[@ANYBLOB="1800008080b63428e900"/20, @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7020000000000008500000051000000bf0900000000000055"], 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6, @void, @value}, 0x94) openat$vimc2(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) syz_usb_connect(0x3, 0x2d, &(0x7f0000000200)=ANY=[@ANYBLOB="1201500242864220f30c75930a000102030109021b"], 0x0) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) cachestat(r1, &(0x7f0000000080)={0x4, 0xffffff8000000000}, &(0x7f00000000c0), 0x0) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0xffc9, 0x0, 0x0, 0xb, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "f4bd000000801900", [0x0, 0x2000000000001]}}) 53.706557988s ago: executing program 3 (id=495): madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000600)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(camellia)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5910fae9d6dcd3292ea54c7b6ef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x0) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f00000004c0), r1) sendmsg$ETHTOOL_MSG_PRIVFLAGS_SET(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000c80)={0x700, r2, 0x800, 0x70bd26, 0x25dfdbfe, {}, [@ETHTOOL_A_PRIVFLAGS_FLAGS={0x6ec, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_VALUE={0xe1, 0x4, "b363761a7cfacd7c6e293935680191f0660619778aaa810d4213b87560321a18f220aa66e8b7fd7fd2d67ed439c76419631c931047456837ff2397d2e17ffff4f3037602269f7c9354d092a8933fa13f3c620361f6d75dee6b1f18f77a01d33faf2de1a6b043f8134d5649d3095ca72cacb5d5bab7b3e7d6d90bccaa39e59e3f8f7580e34312e73dc4146ab8d9ad7796ec5fc249ac711eb1397c10de64f1f8c92d924d894ed658a27291726ba16393195c243b76a47645b1582b18bbde7cc7f4c327243bed5db534d6abaeaa2725e7f35e413e28fa733011947878ee85"}, @ETHTOOL_A_BITSET_VALUE={0x5fd, 0x4, "db54bf0f98d4c0d991aeefa6106ce7785699dc706f57172e3569db5cc9eef052b079ff3955552dd59fa072c1676923a6fac5bf7b2a8cbc38f669ef736bf66aaef7e65ae34aae1b7bf90793212bb55ae5ae22ffcc0cb359af5c51eda5b67abb27a39a7c9d3c562c8b730a10c3a58ea9e7b07287e4b0a6260e7cd924ccc8a88fe0356d325c21709e0f195e4e35d07483cc736ff83f0871573b65eb93ecdf93388851349a7d11b76040e4279f05a44e2e32c08e9f5b8ac0b53f4bf9ef1b35adc0dca3c9e4f2c91ba1bf94d32c714595595f80e5be1177cf929beca031253f838fb7bd0d61b4ed24b38636cf1113eeb75ef51ef93424d35727d6fc899e776f01da2a7d51da315a66d9c57be37b6b92409b363e356e5ae687afcad4133fbd372a4dfdacdcd08a4f42e270b3df54a27c536c2a85812f2a18a57ce35f6a6a4e01e3ef5f2630fbb804decbd2fc16555438ccbeab39079fec143594150a322507b657d4345e1044d58dd697d066095b8c43d694c4d6cd23e476e894ba3fd651bb7dc38b5fc654ca9db0f0ac345631aedc63ea2d5e75fff380bb45360387d46b248a96391078694b6d3376fdce42158a678b2d68e4dfd82b15ad53a76bfce7ab64e0257226b5144cbcef35d4f7b75b073b9bc48b02aefc8400dc613d9f2f5e3ba5937d7c7858145a4e4373af1b65ae539733c302203be0dabcef0c390d99e885c0ea96e0ea4d7d84b7a7284928481d8caa9efb585e27a38b934302fa913c221bc0d7496d9320f2bcf1d59f741b93a6c4fb57aab87a5f5d38980c88fd15f945edd7c1d40687ce3dd3fa5f68ed654d0b7e8c25a8f41e8a5395ee15d8ee9a3b8f51199694819a00f91638c1d50f26c4fad835749dd02bce3b81b42da505cd394166247a3429443dd606783aa4be335ab198b924a169862586d0f42a6c28a29d46a519d3ce992445cfe33e2ed6c0300a1af596dae57ce733773658218c265a1f30ba40e147550b7f5b76686cdadf1b750caa51f3890c23993cf9fd62154450d1dc28cfe42aa5c170e158a6707a7157fe7d930b1a164af0e7505462bf9aaf1406f99a322b6b4c5355d55eec74504d1d3438ee2a0f18c9a178ecd90f785c6894213738c1585fd8fb280b9654aee5c28f656993615631a8ee78df0434c1683a61bbc4cc037fe6627588c11125bdbf0e33e50b58db8e20ca24810261a751863eeaefec82ee8e00d271706585ef55ee9e697db7fbe35931cbc0cf6e53fdc0709fe33904b70f60c19b7c089ec5d1f70f16b9ac8de4e278e75eaec66d011e1db7871d9ec5ff9a9c140090b6203ed5d3f53f25b9f29adde69179d22be5bcf773c3eccb632f22aceeaf1adbf8774dc32fb95c8c647abdfe17750b2bd9a240ec5000941ef2c7c828147fe9d37863daaaee0e499a817fb88cb911891bc1636114eba77ef92b69a21ea15326c25a33be87d9bd68f2299060266094502c2c81ea0b401cbb4904e09dce4f823e7eb6c5a8c8454c5420f02873d486e46287f7ad0b72b6ec85f2eda00e26ded2a90103d32d47a87083a00f0e5cffc782079d55637e0132f7cda81c6acc42726f0b18a205ba09d09aae86077c9720eae65ef915fbf8c8f24f80db8b9977d32cc7c5ebb38c5f299c348b338afe000eba183cfbda4037d159f4250ffe9964a6b77e6f2ceb9a6760860b1cd5281d51254290338be34b0f54aec18f7ab40a0c3171672c79cc421d7dcc83e9b0c53b65974abfdae9167a2c7a69358696ceca9e373240ba4901df1a7a900e33efcf8a80edc97e050e594857041716b1e7e127988c5a5235ceeba4a190eaacd8881321007d041e3b593a908bdf1400178723e4d0426eb5a0cf88a2e957e51f373156af3191585ca5d7bbafc30bde899c25fc18f757ff2ca6d26850537ced2843837081ac293c28c390525735ece258858a9aaa41886b13d65c72b44ff3527f1501e10a94db5a3c1084047c143265382fd0be3f3df080c3e28605ab50a6adb5dee6441efacd04d5b63ecab7c12191d79647f757017ff41c8ec4bcec66f59168270a1b5775f3c781a3f02f4d42b9e6c5f50cc2ab0be0251502a3f0693b64424c2a0d31b0ed66633c28fbe71f3fddee6c6623b57d4bc659e53be288dc4b23897fef3223b3ad161e91ee81b603fe3831182bd2b4"}]}]}, 0x700}, 0x1, 0x0, 0x0, 0x10}, 0x40000) r3 = syz_usb_connect(0x2, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="31010000dccd5e08cb060700000000952301090224000100007e000904340102d469e7000905", @ANYRES64], 0x0) syz_usb_control_io$uac1(r3, 0x0, 0x0) munmap(&(0x7f0000eaa000/0x1000)=nil, 0x1000) madvise(&(0x7f0000e3a000/0x2000)=nil, 0x2000, 0x17) mremap(&(0x7f0000ed7000/0x1000)=nil, 0x1000, 0x1000, 0x7, &(0x7f0000d03000/0x1000)=nil) 51.141989828s ago: executing program 3 (id=500): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r1 = dup(r0) mmap(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1000001, 0x38011, r1, 0x2c9ab000) r2 = socket$inet6_sctp(0xa, 0x801, 0x84) sendto$inet(r1, &(0x7f00000000c0)="4c5eb492e98c746589b0023e07fc5e99519f406369dd248d4e5b00879046e9f8ca75966d800eafecf8b9e044ba7733fc15322f8d823bf5155028f7e017791273a5c137707e41c5a1c9dee98570214c444968b161c3f78e81cc6cf5309e8c6ba2e4b2de78193a5f947e4959b18c2380f3984e7372c0d9a1", 0x77, 0x8000, 0x0, 0x0) getsockopt$bt_hci(r2, 0x84, 0x84, &(0x7f00000020c0)=""/4055, &(0x7f0000000000)=0xfd7) 50.636897615s ago: executing program 35 (id=420): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) socket$packet(0x11, 0x3, 0x300) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x2c040, 0x0) syz_mount_image$fuse(&(0x7f0000002040), &(0x7f0000002080)='./file0\x00', 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB="2c88ab2280b14729c5a4c22c726f6f746d6f64653d30303030303030303030303030303030303034303030302c907365725f69643d", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) unshare(0x20040600) pselect6(0x40, &(0x7f0000000300)={0x0, 0x7e8d, 0x0, 0x1, 0x0, 0x0, 0x800000}, &(0x7f0000000000)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000000}, 0x0, 0x0, 0x0) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) syz_io_uring_setup(0xbc6, &(0x7f0000001480)={0x0, 0x1061, 0x80, 0x4, 0x1ab}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000300)=@IORING_OP_OPENAT={0x12, 0x6, 0x0, 0xffffffffffffff9c, 0x0, &(0x7f00000002c0)='./file0\x00', 0x22, 0xa580, 0x31713}) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r6 = dup(r5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r6, 0x2000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) write$binfmt_aout(r6, 0x0, 0xffffffdb) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x9) r7 = socket$inet_udp(0x2, 0x2, 0x0) r8 = fsopen(&(0x7f00000003c0)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r8, 0x6, 0x0, 0x0, 0x0) r9 = fsmount(r8, 0x0, 0x0) mprotect(&(0x7f000085d000/0x2000)=nil, 0x2000, 0x2000000) openat$cgroup_pressure(r2, &(0x7f0000000280)='cpu.pressure\x00', 0x2, 0x0) write$cgroup_pressure(r9, &(0x7f0000000040)={'some', 0x20, 0x7, 0x20, 0x2000000000000009}, 0x2f) close(r7) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r10 = socket$nl_route(0x10, 0x3, 0x0) mount$fuse(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000240), 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r6, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="2c616c6c6f775f6f749d7f2c4d6d61785f726561643d3078303030303030303030303030303733362c616c6c6f775f6f746865722c626c6b73697a653d3078303030303030303030303030303030302c64656661756c745f7065726d697373696f6e732c616c6c6f775f6f746865722c7365636c6162656c2c61707072616973652c61707072616973655f747970653d696d617369672c666f776e65723c", @ANYRESDEC=0x0, @ANYBLOB=',audit,permit_directio,context=root,fsname={!,obj_user=,\x00']) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00'}) r11 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000000)={'bridge0\x00'}) 49.429759672s ago: executing program 2 (id=506): bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b7000000ff000003bfa30000000000000703000000feffff620af0fff8ffffff71a4f0ff0000000015"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r0 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_user\x00', 0x275a, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="280000000206010200000000000000000100000005fa030000000000090002007379"], 0x28}}, 0x0) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0xb, 0x1d, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d9600010000000000000000000000000000000000000000000000000000000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "f4bd0007003219002bfd000000000000000000af1e4ccfb7b3cad800000800", [0x0, 0x2000000000001]}}) 49.046092417s ago: executing program 2 (id=507): syz_emit_ethernet(0x4a, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa0086dd6000000000140601fe8000"], 0x0) r0 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) syz_usb_connect(0x3, 0x2d, &(0x7f0000000200)=ANY=[@ANYBLOB="1201500242864220f30c75930a000102030109021b"], 0x0) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x600, 0x0, 0x0, 0xb, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "f4bd000000801900", [0x0, 0x2000000000001]}}) 47.213928875s ago: executing program 2 (id=510): r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000), 0x381280, 0x0) io_setup(0x6, &(0x7f0000000180)=0x0) r2 = socket$igmp6(0xa, 0x3, 0x2) io_submit(r1, 0x3, &(0x7f0000000340)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0xe1d7, r0, &(0x7f0000000040)="66b8d72e0031c67b869197ce66a5d6215e4cb67953660f5437840a115e66d3ffad99c36c748e978bea34e92de04932622604453a430bd108d12d3c1905b35c7972114808d61c23261d0aa97504cf6225126b2a734989d9924c49bf96daf7b661783041e21aaaa021ea4bc111bcd6f099bd8cb9d9ca7db43b8b0e7458d4575c6664f29dd0a4a47726c4cc97a3c706bd2b206c19982c25b3d710ed34224b57cc60174888e2012a89994a148c2208332dca85fa2c5ac2d98790f44a8d3705a6c0f8", 0xc0, 0x4, 0x0, 0x1, r0}, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x5, 0x200, r2, &(0x7f00000001c0)="dc7b5d3c04bf11dee545db1b8b410fe2c15535e3923c9792fffcbc57caa9a394c25bd36f22eab63c399ecadec37449d68a358ba3bde6a76ec073cae87307a6e634030c9382dc35e1ac376cffed1a472cca31a406a25fa971782cbb12eb9c9e1e06da4e4ba641c257ae6a8324cea8ee06300e0305e0fae32546a0ddbc11a6c7d2df28d7c990b9b737812d1e3ca0e623c0999fe2c83389f3db2f777fcbb15b61b9312f38659644f0e4332a579433b9c961402189d14d33942709c1cb11eb7ef80f4f1c4bb566bb94fd7565daa2e71166a471d9fd78887d0c6392bb5a9c576fa52508118be061f3b2", 0xe7, 0x5, 0x0, 0x3, r0}, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x9, r2, &(0x7f00000002c0)="ca97a2651341d6d0c0df0e81d15ba8c426f953ff08f436a7b56afa21882c62f4a049392d7c716c22fc0a95fb60ce6023fe39e536ac65307c8ca9ea0d07a4", 0x3e, 0x0, 0x0, 0x2, r0}]) openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000), 0x381280, 0x0) (async) io_setup(0x6, &(0x7f0000000180)) (async) socket$igmp6(0xa, 0x3, 0x2) (async) io_submit(r1, 0x3, &(0x7f0000000340)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0xe1d7, r0, &(0x7f0000000040)="66b8d72e0031c67b869197ce66a5d6215e4cb67953660f5437840a115e66d3ffad99c36c748e978bea34e92de04932622604453a430bd108d12d3c1905b35c7972114808d61c23261d0aa97504cf6225126b2a734989d9924c49bf96daf7b661783041e21aaaa021ea4bc111bcd6f099bd8cb9d9ca7db43b8b0e7458d4575c6664f29dd0a4a47726c4cc97a3c706bd2b206c19982c25b3d710ed34224b57cc60174888e2012a89994a148c2208332dca85fa2c5ac2d98790f44a8d3705a6c0f8", 0xc0, 0x4, 0x0, 0x1, r0}, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x5, 0x200, r2, &(0x7f00000001c0)="dc7b5d3c04bf11dee545db1b8b410fe2c15535e3923c9792fffcbc57caa9a394c25bd36f22eab63c399ecadec37449d68a358ba3bde6a76ec073cae87307a6e634030c9382dc35e1ac376cffed1a472cca31a406a25fa971782cbb12eb9c9e1e06da4e4ba641c257ae6a8324cea8ee06300e0305e0fae32546a0ddbc11a6c7d2df28d7c990b9b737812d1e3ca0e623c0999fe2c83389f3db2f777fcbb15b61b9312f38659644f0e4332a579433b9c961402189d14d33942709c1cb11eb7ef80f4f1c4bb566bb94fd7565daa2e71166a471d9fd78887d0c6392bb5a9c576fa52508118be061f3b2", 0xe7, 0x5, 0x0, 0x3, r0}, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x9, r2, &(0x7f00000002c0)="ca97a2651341d6d0c0df0e81d15ba8c426f953ff08f436a7b56afa21882c62f4a049392d7c716c22fc0a95fb60ce6023fe39e536ac65307c8ca9ea0d07a4", 0x3e, 0x0, 0x0, 0x2, r0}]) (async) 46.701600236s ago: executing program 2 (id=511): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_PAUSE_GET(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x58, r1, 0x100, 0x70bd25, 0x25dfdbfc, {}, [@HEADER={0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip_vti0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6_vti0\x00'}]}, @HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wlan1\x00'}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x20000040}, 0x4020000) r2 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_HMAC_IDENT(r2, 0x84, 0x16, &(0x7f0000000180)={0x2, [0x200, 0x0]}, 0x8) mremap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000, 0x4, &(0x7f0000ffb000/0x3000)=nil) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r0, &(0x7f00000003c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x90}, 0xc, &(0x7f0000000380)={&(0x7f0000000280)={0xe8, r3, 0x200, 0x70bd2a, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r4}, @val={0xc, 0x99, {0x101, 0x16}}}}, [@NL80211_ATTR_REKEY_DATA={0x18, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="fd4e128a525bc06762f03aa70974f10d"}]}, @NL80211_ATTR_REKEY_DATA={0x94, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "9f41f0e24f249dc0"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="4ca5df1bf4845d9cadb08a9d74efa81105ba0335254af902f04cd46d8363b1f9"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="1e02a49266758db0fc92cdfa91b6a736"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="6ef06d164b329100681b5436986bac915b724c92b5b516e2"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="6a858d4e7b4f1e174ca01e17edd03eb9"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="9c654a78ad96dd0f4259b233e97e2847"}]}, @NL80211_ATTR_REKEY_DATA={0x14, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7fff}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xa}]}]}, 0xe8}, 0x1, 0x0, 0x0, 0x20008808}, 0x20000000) syz_genetlink_get_family_id$nl80211(&(0x7f0000000400), r0) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) recvmmsg(r5, &(0x7f00000024c0)=[{{&(0x7f0000000440)=@ethernet={0x0, @remote}, 0x80, &(0x7f0000000900)=[{&(0x7f00000004c0)=""/68, 0x44}, {&(0x7f0000000540)=""/131, 0x83}, {&(0x7f0000000600)=""/53, 0x35}, {&(0x7f0000000640)=""/2, 0x2}, {&(0x7f0000000680)=""/188, 0xbc}, {&(0x7f0000000740)=""/118, 0x76}, {&(0x7f00000007c0)=""/154, 0x9a}, {&(0x7f0000000880)=""/9, 0x9}, {&(0x7f00000008c0)=""/61, 0x3d}], 0x9, &(0x7f00000009c0)=""/120, 0x78}}, {{&(0x7f0000000a40)=@hci, 0x80, &(0x7f0000001d40)=[{&(0x7f0000000ac0)=""/73, 0x49}, {&(0x7f0000000b40)=""/4096, 0x1000}, {&(0x7f0000001b40)=""/146, 0x92}, {&(0x7f0000001c00)=""/226, 0xe2}, {&(0x7f0000001d00)=""/57, 0x39}], 0x5}, 0x6}, {{&(0x7f0000001dc0)=@l2tp={0x2, 0x0, @dev}, 0x80, &(0x7f0000002080)=[{&(0x7f0000001e40)=""/53, 0x35}, {&(0x7f0000001e80)=""/197, 0xc5}, {&(0x7f0000001f80)=""/211, 0xd3}], 0x3, &(0x7f00000020c0)=""/191, 0xbf}, 0x2}, {{&(0x7f0000002180)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @initdev}}}, 0x80, &(0x7f0000002380)=[{&(0x7f0000002200)=""/21, 0x15}, {&(0x7f0000002240)=""/81, 0x51}, {&(0x7f00000022c0)=""/146, 0x92}], 0x3, &(0x7f00000023c0)=""/223, 0xdf}, 0x2}], 0x4, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f00000025c0)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) r7 = openat(r6, &(0x7f0000002600)='./file0\x00', 0x408040, 0x4) mlock(&(0x7f0000ffb000/0x3000)=nil, 0x3000) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r6, 0xc0502100, &(0x7f0000002640)={0x0, 0x0}) move_pages(r8, 0x2, &(0x7f00000026c0)=[&(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil], &(0x7f0000002700)=[0x124d, 0x1, 0x8, 0x0, 0x5, 0x2, 0x3, 0xc255, 0x89d], &(0x7f0000002740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x2) ioctl$UFFDIO_ZEROPAGE(r6, 0xc020aa04, &(0x7f0000002780)={{&(0x7f0000c00000/0x400000)=nil, 0x400000}, 0x1}) ioctl$F2FS_IOC_GET_COMPRESS_OPTION(r6, 0x8002f515, &(0x7f00000027c0)) ioctl$AUTOFS_DEV_IOCTL_VERSION(r6, 0xc0189371, &(0x7f0000002800)={{0x1, 0x1, 0x18, r6}, './file0\x00'}) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r7, 0x84, 0x1, &(0x7f0000002840)={0x0, 0x3, 0x7, 0x3871, 0xe93, 0x7626}, &(0x7f0000002880)=0x14) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r9, 0x84, 0x76, &(0x7f00000028c0)={r10, 0x40}, &(0x7f0000002900)=0x8) ioctl$KVM_GET_DEVICE_ATTR_vm(r7, 0x4018aee2, &(0x7f0000002980)=@attr_other={0x0, 0xd3a5, 0x81, &(0x7f0000002940)=0x7}) sendmsg$key(r9, &(0x7f0000002a80)={0x0, 0x0, &(0x7f0000002a40)={&(0x7f00000029c0)={0x2, 0x14, 0x7, 0x8, 0xc, 0x0, 0x70bd29, 0x25dfdbfc, [@sadb_x_policy={0x8, 0x12, 0x0, 0x0, 0x0, 0x0, 0x7, {0x6, 0x6c, 0x8, 0xf0, 0x0, 0x2, 0x0, @in6=@rand_addr=' \x01\x00', @in=@rand_addr=0x64010102}}, @sadb_x_nat_t_type={0x1, 0x14, 0x8}, @sadb_x_nat_t_port={0x1, 0x15, 0x4e20}]}, 0x60}}, 0x0) sendfile(r7, r6, &(0x7f0000002ac0)=0xfffffffffffffe75, 0x10001) getsockopt$inet_sctp6_SCTP_RECVNXTINFO(r7, 0x84, 0x21, &(0x7f0000002b00), &(0x7f0000002b40)=0x4) sendmsg$DEVLINK_CMD_SB_PORT_POOL_SET(r7, &(0x7f0000002d80)={&(0x7f0000002b80)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000002d40)={&(0x7f0000002bc0)={0x144, 0x0, 0x200, 0x70bd2c, 0x25dfdbfc, {}, [{{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0x3}, {0x6, 0x11, 0x2}, {0x8, 0x15, 0x1}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x1}}, {0x8, 0xb, 0x8000}, {0x6, 0x11, 0x4}, {0x8, 0x15, 0x7}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}, {0x8, 0xb, 0x7}, {0x6, 0x11, 0x80}, {0x8, 0x15, 0x4}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x2}}, {0x8, 0xb, 0x6}, {0x6, 0x11, 0xcf80}, {0x8, 0x15, 0x4}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x1}}, {0x8, 0xb, 0x8}, {0x6, 0x11, 0x4}, {0x8, 0x15, 0xac7}}]}, 0x144}, 0x1, 0x0, 0x0, 0x16000000}, 0x4000040) r11 = openat$uhid(0xffffffffffffff9c, &(0x7f0000002dc0), 0x2, 0x0) write$UHID_CREATE2(r11, &(0x7f0000002e00)={0xb, {'syz0\x00', 'syz1\x00', 'syz0\x00', 0x7b, 0x80, 0x1, 0x7fff, 0x0, 0x0, "242956a29aa0bcf31b91370a569b8c65200c8c6a909732f4dc619748dca6c921d04a8d3e25a2afb60cf36ee7016640c29aa66ea0faa1bbd265a2be4f90de249074f8f1f886dbffd74d03f228880e41d5aa0205494d8fc42f4d97f1c7ccc10f58ce75d728cc21c24da2173fb2dcc4b1e2379e46c1877186edcc1210"}}, 0x193) mbind(&(0x7f0000dd6000/0x4000)=nil, 0x4000, 0x1, &(0x7f0000002fc0)=0xffffffff, 0x8000000000000001, 0x5) 45.670008411s ago: executing program 2 (id=514): r0 = syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f000010"], 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x60042, 0x0) syz_usb_disconnect(r0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='net/ip6_tables_matches\x00') prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x7, 0x5, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x6a855000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) r1 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000180)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x2000000000c0, 0x2000000000f0, 0x200000000120], 0x1985ee, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff1f00000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff00"/144]}, 0x108) socket$inet6_udp(0xa, 0x2, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) io_uring_setup(0x137a, &(0x7f0000000080)={0x0, 0xfffffffc, 0x0, 0x0, 0x11d}) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x1, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) futex(&(0x7f000000cffc)=0x4, 0x80000000000b, 0x4, 0x0, &(0x7f0000048000), 0x0) futex(&(0x7f0000000000)=0x1, 0xd, 0x2, 0x0, 0x0, 0x0) futex(&(0x7f000000cffc), 0xc, 0x1, 0x0, &(0x7f0000048000)=0x1, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'adiantum(xchacha20-simd,anubis-generic,nhpoly1305-sse2)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f0000000300)="c99b57381801238c09d0ff0f1d0dbd301e5a47b2f3caa73dcd2a6a370554375a", 0x20) r6 = accept4(r5, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r6) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket(0x9, 0x1, 0x0) socket$unix(0x1, 0x5, 0x0) 41.402292042s ago: executing program 2 (id=519): syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x8, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="85000000080000006a0a00fe000000002e40000000000000950000000000000018100000", @ANYRES32, @ANYBLOB="1000000000000025050000000000000000000000000000009500000000000000"], &(0x7f0000000140)='GPL\x00', 0x2, 0x8, &(0x7f0000000080)=""/177, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x8, 0x0, 0x3b, 0x10, 0x0, 0x1e, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x49) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r1 = dup(r0) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r2, 0x3ba0, &(0x7f0000000200)={0x48, 0x11}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000007, 0x38011, r1, 0x0) r3 = getpgrp(0xffffffffffffffff) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r1, 0xc4c85512, &(0x7f0000000b80)={{0x3, 0x0, 0x8, 0x0, 'syz1\x00'}, 0x0, 0x0, 0x0, r3, 0x0, 0x0, 'syz0\x00', 0x0}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r4) r6 = syz_open_dev$cec(&(0x7f0000000000), 0x0, 0x0) ioctl$CEC_ADAP_S_LOG_ADDRS(r6, 0xc05c6104, &(0x7f00000000c0)={"0e00", 0x0, 0x5, 0x2, 0x0, 0x3, "f759ca14860e4041836dd400", '\x00\x00\a\x00', "0300", "e859ad13", ["d5c2a7cdaeea2c6f8e00b600", "808e8889dc7fb3eacf821b00", "2971088d5453005a4e5200", "ff812500004000"]}) ioctl$IOC_WATCH_QUEUE_SET_FILTER(r1, 0x5761, &(0x7f0000000740)={0x1, 0x0, [{0x3, 0x6, 0x10000, [0x10, 0xfffffff3, 0x9, 0x8, 0x7fff, 0x6, 0x5, 0xfffffffb]}]}) r7 = openat$kvm(0xffffff9c, &(0x7f0000000040), 0x480, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r9, 0xc008ae88, &(0x7f0000000c80)=ANY=[@ANYBLOB="010000000000003103010040"]) r10 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$AUTOFS_IOC_EXPIRE_MULTI(r7, 0x40049366, &(0x7f0000000700)=0x2) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=@gettaction={0x48, 0x32, 0x10, 0x70bd2a, 0x25cfdbfd, {}, [@action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x1}}, @action_gd=@TCA_ACT_TAB={0x28, 0x1, [{0xc, 0x5, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x4000009}}, {0xc, 0x2, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x81f7}}, {0xc, 0x8, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x4}}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000000}, 0x800) r11 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000000)={'bond0\x00', 0x0}) pipe(&(0x7f0000000200)) sendmsg$nl_route(r11, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000001c0)=ANY=[@ANYBLOB="5c00000010000304000000000000000000000400", @ANYRES32=r12, @ANYBLOB="60bc010004a701003c00128009000100626f6e64000000002c"], 0x5c}, 0x1, 0x0, 0x0, 0x11}, 0x4000044) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r10, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYRESDEC=r5], 0x30}, 0x1, 0x0, 0x0, 0x2004c8c4}, 0xc000) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f00000001c0)=@nat={'nat\x00', 0x1b, 0x5, 0x4c8, 0x0, 0x2d0, 0xffffffff, 0x0, 0xf0, 0x3f8, 0x3f8, 0xffffffff, 0x3f8, 0x3f8, 0x5, &(0x7f0000000140), {[{{@uncond, 0x0, 0xa8, 0xf0}, @unspec=@DNAT1={0x48, 'DNAT\x00', 0x1, {0x0, @ipv6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @ipv6=@dev={0xfe, 0x80, '\x00', 0x3a}, @icmp_id=0x65, @gre_key=0xa0}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @unspec=@DNAT1={0x48, 'DNAT\x00', 0x1, {0xe, @ipv6=@remote, @ipv6=@private0={0xfc, 0x0, '\x00', 0x1}, @gre_key=0x4, @icmp_id=0x65}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @REDIRECT={0x48, 'REDIRECT\x00', 0x0, {0x8, @ipv6=@private0={0xfc, 0x0, '\x00', 0x1}, @ipv4=@rand_addr=0x64010101, @port=0x4e24, @gre_key=0x9}}}, {{@uncond, 0x0, 0x100, 0x128, 0x0, {}, [@common=@hl={{0x28}, {0x470effb075d91a5d, 0xc2}}, @common=@ah={{0x30}, {[0x4d2, 0x4d2], 0x6, 0x80, 0x1}}]}, @common=@unspec=@AUDIT={0x28, 'AUDIT\x00', 0x0, {0x1}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x528) 35.987236023s ago: executing program 36 (id=500): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r1 = dup(r0) mmap(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1000001, 0x38011, r1, 0x2c9ab000) r2 = socket$inet6_sctp(0xa, 0x801, 0x84) sendto$inet(r1, &(0x7f00000000c0)="4c5eb492e98c746589b0023e07fc5e99519f406369dd248d4e5b00879046e9f8ca75966d800eafecf8b9e044ba7733fc15322f8d823bf5155028f7e017791273a5c137707e41c5a1c9dee98570214c444968b161c3f78e81cc6cf5309e8c6ba2e4b2de78193a5f947e4959b18c2380f3984e7372c0d9a1", 0x77, 0x8000, 0x0, 0x0) getsockopt$bt_hci(r2, 0x84, 0x84, &(0x7f00000020c0)=""/4055, &(0x7f0000000000)=0xfd7) 26.165690856s ago: executing program 37 (id=519): syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x8, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="85000000080000006a0a00fe000000002e40000000000000950000000000000018100000", @ANYRES32, @ANYBLOB="1000000000000025050000000000000000000000000000009500000000000000"], &(0x7f0000000140)='GPL\x00', 0x2, 0x8, &(0x7f0000000080)=""/177, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x8, 0x0, 0x3b, 0x10, 0x0, 0x1e, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x49) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r1 = dup(r0) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r2, 0x3ba0, &(0x7f0000000200)={0x48, 0x11}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000007, 0x38011, r1, 0x0) r3 = getpgrp(0xffffffffffffffff) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r1, 0xc4c85512, &(0x7f0000000b80)={{0x3, 0x0, 0x8, 0x0, 'syz1\x00'}, 0x0, 0x0, 0x0, r3, 0x0, 0x0, 'syz0\x00', 0x0}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r4) r6 = syz_open_dev$cec(&(0x7f0000000000), 0x0, 0x0) ioctl$CEC_ADAP_S_LOG_ADDRS(r6, 0xc05c6104, &(0x7f00000000c0)={"0e00", 0x0, 0x5, 0x2, 0x0, 0x3, "f759ca14860e4041836dd400", '\x00\x00\a\x00', "0300", "e859ad13", ["d5c2a7cdaeea2c6f8e00b600", "808e8889dc7fb3eacf821b00", "2971088d5453005a4e5200", "ff812500004000"]}) ioctl$IOC_WATCH_QUEUE_SET_FILTER(r1, 0x5761, &(0x7f0000000740)={0x1, 0x0, [{0x3, 0x6, 0x10000, [0x10, 0xfffffff3, 0x9, 0x8, 0x7fff, 0x6, 0x5, 0xfffffffb]}]}) r7 = openat$kvm(0xffffff9c, &(0x7f0000000040), 0x480, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r9, 0xc008ae88, &(0x7f0000000c80)=ANY=[@ANYBLOB="010000000000003103010040"]) r10 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$AUTOFS_IOC_EXPIRE_MULTI(r7, 0x40049366, &(0x7f0000000700)=0x2) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=@gettaction={0x48, 0x32, 0x10, 0x70bd2a, 0x25cfdbfd, {}, [@action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x1}}, @action_gd=@TCA_ACT_TAB={0x28, 0x1, [{0xc, 0x5, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x4000009}}, {0xc, 0x2, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x81f7}}, {0xc, 0x8, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x4}}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000000}, 0x800) r11 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000000)={'bond0\x00', 0x0}) pipe(&(0x7f0000000200)) sendmsg$nl_route(r11, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000001c0)=ANY=[@ANYBLOB="5c00000010000304000000000000000000000400", @ANYRES32=r12, @ANYBLOB="60bc010004a701003c00128009000100626f6e64000000002c"], 0x5c}, 0x1, 0x0, 0x0, 0x11}, 0x4000044) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r10, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYRESDEC=r5], 0x30}, 0x1, 0x0, 0x0, 0x2004c8c4}, 0xc000) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f00000001c0)=@nat={'nat\x00', 0x1b, 0x5, 0x4c8, 0x0, 0x2d0, 0xffffffff, 0x0, 0xf0, 0x3f8, 0x3f8, 0xffffffff, 0x3f8, 0x3f8, 0x5, &(0x7f0000000140), {[{{@uncond, 0x0, 0xa8, 0xf0}, @unspec=@DNAT1={0x48, 'DNAT\x00', 0x1, {0x0, @ipv6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @ipv6=@dev={0xfe, 0x80, '\x00', 0x3a}, @icmp_id=0x65, @gre_key=0xa0}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @unspec=@DNAT1={0x48, 'DNAT\x00', 0x1, {0xe, @ipv6=@remote, @ipv6=@private0={0xfc, 0x0, '\x00', 0x1}, @gre_key=0x4, @icmp_id=0x65}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @REDIRECT={0x48, 'REDIRECT\x00', 0x0, {0x8, @ipv6=@private0={0xfc, 0x0, '\x00', 0x1}, @ipv4=@rand_addr=0x64010101, @port=0x4e24, @gre_key=0x9}}}, {{@uncond, 0x0, 0x100, 0x128, 0x0, {}, [@common=@hl={{0x28}, {0x470effb075d91a5d, 0xc2}}, @common=@ah={{0x30}, {[0x4d2, 0x4d2], 0x6, 0x80, 0x1}}]}, @common=@unspec=@AUDIT={0x28, 'AUDIT\x00', 0x0, {0x1}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x528) 16.841757659s ago: executing program 8 (id=573): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1b96, 0x9, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x40, 0x0, [{{0x9, 0x4, 0x0, 0xfd, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x7}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x7}}}}}]}}]}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYRES8=r1], 0x7c}}, 0x4000) sendmsg$NFT_BATCH(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)={{0x14}, [@NFT_MSG_NEWRULE={0x60, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2, 0x0, 0xfffe}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x34, 0x4, 0x0, 0x1, [{0x30, 0x1, 0x0, 0x1, @match={{0xa}, @val={0x20, 0x2, 0x0, 0x1, [@NFTA_MATCH_INFO={0x5, 0x3, "fc"}, @NFTA_MATCH_NAME={0xb, 0x1, 'socket\x00'}, @NFTA_MATCH_REV={0x8, 0x2, 0x1, 0x0, 0x2}]}}}]}]}], {0x14}}, 0x88}, 0x1, 0x0, 0x0, 0x24044800}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000000c0)={0xfffffffffffffeff, &(0x7f0000000100)={0x20, 0x22, 0x7, {0x7, 0xd, "3918682e04"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) 15.304371729s ago: executing program 6 (id=578): madvise(&(0x7f0000bdc000/0x4000)=nil, 0x4000, 0x15) set_mempolicy(0x2, &(0x7f0000000000)=0x76, 0x105) r0 = socket(0x10, 0x803, 0x0) write(r0, &(0x7f0000000900)="2600000022004701050007008980e8ff02006d20002b1f00c0e9f7094a51f10101033500b088", 0x26) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000400)=ANY=[@ANYBLOB="48000000100039042cbd7000eaffffff000003e4", @ANYRES32=0x0, @ANYBLOB="830004002a600000280012800b000100697036746e6c00001800028014000300ff"], 0x48}, 0x1, 0x0, 0x0, 0x8000}, 0x4040) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000280)=ANY=[@ANYBLOB="02000000000000000d00000004000000040000007f00000008000000620000000900000000000000000000000000000008000080080000000400000000800000090000009000"/88]) recvfrom$inet6(r0, 0x0, 0x61, 0x40000000, &(0x7f0000000480)={0xa, 0x0, 0x7, @remote}, 0x1c) syz_clone(0x642c7080, 0x0, 0x0, 0x0, 0x0, 0x0) 14.97012046s ago: executing program 8 (id=579): r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000407e0509200000000000010902240001000020000904000002030003000921feff0a0122160009058103ff03000000ed45f7b55b4e6d78852b770e0cb179a13e196eba3a9bfb360066cbcfc15c990987ab43b0c4f4cd035ec64a80f55a49bb01d7b05bb6454a2c8f719f7e6b8da92c3f95"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000740)={0x2c, &(0x7f0000000140)={0x40, 0x10, 0x9, {0x9, 0x4ffd271b2776e994, "747f980aa6d04e"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) 14.834820525s ago: executing program 5 (id=581): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r0) r1 = syz_open_dev$sndctrl(&(0x7f0000000440), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, &(0x7f0000000040)) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000140)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) syz_usb_connect(0x2, 0x60f, &(0x7f0000000540)={{0x12, 0x1, 0x200, 0xf9, 0xd3, 0xa6, 0x10, 0x1046, 0x9967, 0x1697, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5fd, 0x1, 0x8, 0xbe, 0x0, 0x8, [{{0x9, 0x4, 0x71, 0x0, 0xa, 0x49, 0x89, 0x97, 0x9, [@cdc_ecm={{0x9, 0x24, 0x6, 0x0, 0x0, "bdf3b25b"}, {0x5, 0x24, 0x0, 0x7}, {0xd, 0x24, 0xf, 0x1, 0x6, 0x2, 0x3, 0x4b}, [@network_terminal={0x7, 0x24, 0xa, 0x1, 0x2, 0x1, 0x9}]}], [{{0x9, 0x5, 0x5, 0x1, 0x10, 0x2, 0xae, 0x1}}, {{0x9, 0x5, 0x6, 0x10, 0x3ff, 0x9, 0x9, 0x1, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x9, 0x8001}, @generic={0xfd, 0x23, "0b1e836c9ee49c0f2f3daf58b2b58f59553b53d83f68e2e890eef368529ede182ff617830effc82a7acfba3c07153d6cc421e0b3af5088c5c1a90fe005fa5aaf39b6999c1a09ee2d436c7660c9cf90ff491df523fd7ef52d11f1f6e43ad31c583d362bd6634363175d523e837273227bc7b41d5ef4ec6494f51bd8479672d5936d3cb57306102ea575b4c975a6ba18c9b91b556d4067d194282fddb162b5317c583a999f8e8d1ad9440e1831a5a5257d68d967f295b8e8205b23bfbece2bd5b34e4850629612ea482aea048dc50c59577d400dba24f433b634790be1805321c7670dfc6577cb5dc63398dd3dd3257fc982808eb5473b6df56bcbd5"}]}}, {{0x9, 0x5, 0x6, 0x10, 0x20, 0x8, 0xfe, 0xfd}}, {{0x9, 0x5, 0x6, 0x0, 0x40, 0x3, 0x9, 0x5, [@generic={0xd4, 0x21, "b7186182a103788634747aa73babe954a11f8de43fdcf64f13a885ed653fad5551f4aa358b5c13b799d1f1b2940ce013ec7bf79588b4354ea9da462da8cdb3941656ee42a304e976e88f41a591caa52fd890f52e716bd0f6470131fbd808a655fb7fcbe7a93385eb27c65d8af5e3360b629d01c23e9d6ceb61c718e29d6eea810a380f67c28093f43b7767b118a5deab3e0ed27191585bab98eb76153bb2be5ee4795128fb1471f268c9ed2972debf1653ad92794dfd76224b49422aea2bc9a65565ebb77a8b2dad094d85371b9600fda1ff"}]}}, {{0x9, 0x5, 0xf, 0x10, 0x20, 0x9, 0x10, 0xc, [@uac_iso={0x7, 0x25, 0x1, 0x81, 0x84, 0x4}, @generic={0x23, 0xc, "d073476adf179d106d45c750bfbdbb7623f05d6062edf745951ca3ef0608078304"}]}}, {{0x9, 0x5, 0x7, 0x10, 0x40, 0xff, 0x3d, 0x1, [@generic={0xba, 0x11, "06673bd98634d2eaa56728046c1050ef5f3f447e071fca0fcb31c729a8e8a5bc8b9ce6da1b4536b95a0075c8424ea42b303fefad6df37e5b8b2e769df1e828dcfba6347d2641b1e365dfcd0eceb2a81a1b8bef7c33059e911be2166ade32d09a8152a2bc717808df0fd1879715b0d8641b6ef843fb4cfa8b682054f32042c236a5923e56beccccd5fe1704d19015a7005782340182cd2e7be5e25ef4c412fb75dc9ab19dd78436e6af8533ae3a6ca2c48ad071a1660925e2"}]}}, {{0x9, 0x5, 0x0, 0x4, 0x20, 0x1, 0xfd, 0x3f}}, {{0x9, 0x5, 0x8, 0x10, 0x200, 0x2, 0x9, 0x1, [@generic={0xb6, 0x0, "11a0df53b251907aa5c1b629815d771715963d549eed9ad0fbc9ff9b28457ec379d95850977df9c6973dcb420e35c3721c94d1d4fef384c3c4e2c0fe8f18ed86812acd6dc54c6456b637e055d1afc355cfe4a4f223314577b3d1863b4e670191a5905a906589ad1f0e79cb1ead3d72f8ddc9bb018a597a4e335b624de9b3482f98aa734f4b71e994cd9f3e665672b0697b8cbd3b094093e6fb1e5776f954505d8eff24e8ba5ac7f08516b033acfb55f983aeccae"}]}}, {{0x9, 0x5, 0xf, 0x0, 0x200, 0xe, 0xc2, 0x1, [@generic={0x16, 0x6, "be67f83b9262de2dbb2cfc8a7d47a5d327d963c5"}, @generic={0xc4, 0x10, "dd479fed91a109cbeb9e4c93be103113d18ccd227dc95f63b7210e251b03104d361ce5a787e2c0640f5b2c5af78df3a2d77fce8a62d83176c52db39bd398c65f51f14d90c1dbee201cbf05794c86e320f0593dc8c374b413bf983035a89fd29828a1dd477dd51cd4a5be43e437a2396442c29db7027810ea37611bf7763fa4f255c8d4cb93767fc19c08f9fbf137c66dcc8ee791c387a5315774a61984c9972b46b1051e346441621296a7482b867498848d39398c6433832e2981778a77cb3ff964"}]}}, {{0x9, 0x5, 0x5, 0x3, 0x200, 0x9, 0x3, 0x7, [@generic={0x55, 0xa, "061fa4c54db6ca38ab04ec0a33218f43fbfdb32b0a37073e78df580380c163f62a06d513d068e7159d52bdf7ff7ac04f39fae8314124cafd3c7cf59fa0392fdfd5dcf67e31343d0ea183ecf5e100b7f442b1bd"}, @generic={0xce, 0xb, "45532a85f4d3f95194f7a5cd841c5c2812d0e7b2ba15a9705624e7921c5d4a3fc5ec1d9f8e9c48108ec5b49febe3863819785adfca5fa5f4ed326be313e1d1d172342e415dc5fd813b89c390b2b37470063c30200ae30156e99c566edcf7ef75fb8b508d8d76a9b00e265b25e26b65e81f4e632606d6cef8ba1146b688cb7a71fd276a0ac988a18ef5d81488b9e6003896dab9c582d3bf2e3cedd08ee954942148c9c053a447b0fab580a69763ae9422e17b52e4ca0d79cf0e41da730642ec98d2065178053d4f4e10ba0a5b"}]}}]}}]}}]}}, &(0x7f00000004c0)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x200, 0xe7, 0x1, 0x5, 0x68, 0x9}, 0x5, &(0x7f0000000300)={0x5, 0xf, 0x5}, 0x2, [{0x54, &(0x7f0000000340)=@string={0x54, 0x3, "56b2a9aaf8c45fba323f8d5029c29ad0591bad5d17b78271aea0ae537df018879f4bb7b33c42c33326da6e7b539779ebc10c65a77345e7c2c407e6978650953f8652416659fc8d973e0b6fc5744ab4fdccc0"}}, {0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x40b}}]}) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) futex(&(0x7f000000cffc), 0x9, 0x0, 0x0, 0x0, 0x4) futex(&(0x7f000000cffc)=0x400, 0xa, 0x2, 0x0, 0x0, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_io_uring_setup(0x893, &(0x7f00000003c0)={0x0, 0xaee1, 0x0, 0x0, 0x1a3}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r6, r7, &(0x7f00000002c0)=@IORING_OP_RECVMSG={0xa, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000001400)={0x0, 0x0, 0x0}, 0x0, 0x40010041}) io_uring_enter(r5, 0x5361, 0xfffffffd, 0x2, 0x0, 0x0) r8 = syz_open_dev$sndpcmp(&(0x7f0000000200), 0x0, 0xa2c65) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000500)={0x0, 0xfffffffffffffd83, 0xfa00, {0x0, 0x0}}, 0xfdbc) ioctl$SNDRV_PCM_IOCTL_SW_PARAMS(r8, 0xc0884113, &(0x7f0000000240)={0x1, 0x0, 0x200, 0x10001, 0xffffffffffffffff, 0x8, 0x4, 0x200, 0x4, 0x2c, 0x7fffffff, 0x1}) ioctl$SNDCTL_DSP_GETOPTR(r2, 0x800c5012, &(0x7f0000000000)) 14.181793762s ago: executing program 6 (id=582): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000240)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_CHANNELS_GET(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="8f8f0200000000000000040000001800018014000200776c616e3000000000020000f5527030"], 0x2c}}, 0x2000c090) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) r6 = openat$zero(0xffffffffffffff9c, &(0x7f0000000180), 0x14f502, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r6, 0x40605346, &(0x7f0000000440)={0x4, 0x2, {0x2, 0x0, 0x4, 0x2, 0x4}, 0x6}) ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000140)={@empty, 0x39, r5}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) r7 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, &(0x7f0000000340)={[{0x10122e, 0x3, 0x0, 0x0, 0x0, 0x4a, 0x80, 0x0, 0x5, 0xff, 0x55}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x9}]}) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x51857000) r9 = syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') writev(r9, &(0x7f0000000100)=[{&(0x7f00000004c0)='4', 0x1}], 0x9) r10 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r10, 0x3b81, &(0x7f0000000140)={0x7f, 0x0, 0x0}) r12 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r12, 0x3b81, &(0x7f0000000200)={0x15, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r10, 0x3b85, &(0x7f00000000c0)={0xfffffffffffffeb5, 0x2, r13, 0x0, &(0x7f000025a000/0x4000)=nil, 0x4000, 0xffffffffffffffff}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r10, 0x3ba0, &(0x7f00000001c0)={0x48, 0x5, r11, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r12, 0x3ba0, &(0x7f00000002c0)={0x48, 0x7, r14, 0x0, 0x10000, 0x0, 0x4, 0x36f273, 0x22272d}) 13.056591998s ago: executing program 8 (id=584): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0xda) ptrace(0x10, 0x0) (async) msgget(0x1, 0x2b0) (async) msgrcv(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) msgrcv(0x0, 0x0, 0x0, 0x2, 0x2000) (async) msgsnd(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="a902"], 0x8, 0x800) (async) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000300), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x5, &(0x7f0000002140)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}) (async) r1 = socket$unix(0x1, 0x2, 0x0) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r2, &(0x7f0000000340)={0xa, 0x4e22, 0x0, @remote, 0x7}, 0x1c) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)={0x28, r4, 0x7, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}]}]}, 0x28}}, 0x0) (async) open(&(0x7f0000000000)='./file0/file0\x00', 0x22182, 0x5) (async) connect$unix(r1, &(0x7f00000008c0)=@file={0x1, './file0\x00'}, 0x6e) 12.465945723s ago: executing program 8 (id=585): openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) fspick(0xffffffffffffffff, 0x0, 0x0) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffc}, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) r2 = socket$netlink(0x10, 0x3, 0xa) r3 = dup(r2) r4 = open(&(0x7f0000000040)='./file1\x00', 0x1850c2, 0x14c) ftruncate(r4, 0x200004) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x21, &(0x7f00000005c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r5}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x6}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='syzkaller\x00', 0x8, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r6, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) write$apparmor_exec(r4, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000"], 0x8) sendfile(r3, r4, 0x0, 0x80001d00c0d1) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000180)={0x2, &(0x7f0000000140)=[{0x7, 0x6, 0xfc, 0x1}, {0x0, 0xfb, 0x8, 0x3}]}, 0x10) r7 = socket$unix(0x1, 0x1, 0x0) bind$unix(r7, &(0x7f0000000dc0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) execve(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) syz_emit_ethernet(0x79, &(0x7f0000000000)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xbb7fd210a0b1dc43}, @empty, @void, {@ipv4={0x88fb, @udp={{0x5, 0x4, 0x0, 0x1, 0x6b, 0x0, 0x0, 0x0, 0x11, 0x0, @empty=0x18, @multicast1}, {0x0, 0x4ea0, 0x57, 0x0, @gue={{0x2, 0x1, 0x3, 0x8}, "cfe7e212d8e29be775eb84c2b695b842f054fade05e35be8fb4baf9b80a2f9b5dc095b933ef4b41bfbd7c3c22f04cebfe7dda5d76d59af07ef391ac18cd91befc40ba5d2b304e2"}}}}}}, 0x0) 11.136455792s ago: executing program 5 (id=586): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000f549b06200"/28], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x18, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000030000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000001b5109185000000a0000000bf91000000000000b7020000000000008500000085000000b70000008000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000080)={0x6, &(0x7f0000000040)=[{0x4, 0xc1, 0xff, 0xfffffffb}, {0x9b6, 0xff, 0x1, 0x401}, {0x1, 0x10, 0xd5, 0x80}, {0x1, 0x7, 0x8, 0x174}, {0x1ff, 0x81, 0x9, 0x4}, {0x7, 0x1, 0x0, 0x4}]}) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_INITMSG(r2, 0x84, 0x2, &(0x7f00000000c0)={0xfffc}, 0x8) sendto$inet6(r2, &(0x7f00000004c0)='W', 0x1, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback, 0x8}, 0x1c) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, 0x0, &(0x7f0000000100)) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004000000007c", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100000914bf20c80a01c3d5820102031d0902120001000000000904"], 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0xc, &(0x7f0000000780)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000001001600850000008200000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000005c0)={r4, 0x18000000000002a0, 0x78, 0x0, &(0x7f00000004c0)="b9ff03076044238cb89e14f0655847e0ffff00004000632f77fb0806143b0feafa8d0cac14140c07029f89052f87e577ca6a114b0000000000003901050b038da1880b25181aa59d943be3f4aed50ea5a6b8686731cb89ef77123c899b699eeaa8eaa0053461119663906400f30c0600000000000059b6d3", 0x0, 0x2, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x299}, 0x28) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) 10.225514404s ago: executing program 6 (id=587): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, 0x0, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prctl$PR_SET_TSC(0x1a, 0x1) ioctl$TCSETA(0xffffffffffffffff, 0x402c542d, &(0x7f0000000800)={0x0, 0x0, 0x6, 0x0, 0x0, "dac7a15f305b57a3"}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x80001, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_PIT(r3, 0x8048ae66, &(0x7f0000000340)={[{0x122e, 0x3, 0x0, 0x0, 0x0, 0x4, 0xc, 0x0, 0x5, 0xff, 0x1f}, {0xf, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfd, 0x0, 0x9}, {0x0, 0x0, 0x3c, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}]}) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_open_dev$sndctrl(&(0x7f00000000c0), 0x0, 0x0) ioctl$KVM_SET_CLOCK(r3, 0x4030ae7b, &(0x7f0000000040)={0x3, 0xa, 0x7, 0x100000000, 0xc}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, 0x0}], 0x1, 0x1, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x10b200, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) lseek(r7, 0x8, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000600)=[@text64={0x40, &(0x7f00000006c0)="f3440fc7b729000000f20f5f0d00000080460f5ba4b07a000000470f38c9403736460fc7b10f240000660f3881078fa9189021da820001c0fef3440f0966b881000f00d8", 0x44}], 0xaaaabbc, 0x74, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000240)) ioctl$KVM_RUN(r8, 0xae80, 0x0) 9.669832155s ago: executing program 9 (id=588): r0 = userfaultfd(0x801) (async) r1 = syz_open_dev$usbfs(&(0x7f0000000040), 0x200, 0xac01) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$USBDEVFS_SUBMITURB(r2, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x0, 0x41, &(0x7f0000000240)={0x20, 0xc, 0x0, 0x1ff}, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) (async) r3 = socket$l2tp6(0xa, 0x2, 0x73) setsockopt$inet6_int(r3, 0x29, 0x10, &(0x7f00000000c0)=0x4, 0x4) (async) sendmmsg$inet6(r3, &(0x7f0000000200)=[{{&(0x7f0000000000)={0xa, 0x4e20, 0x40100008, @remote, 0x8}, 0x1c, 0x0}}], 0x1, 0x20004004) (async) ioctl$UFFDIO_WRITEPROTECT(r0, 0xc018aa06, 0x0) (async) r4 = fsopen(&(0x7f0000000180)='proc\x00', 0x1) r5 = socket$nl_generic(0x10, 0x3, 0x10) (async) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e00000008000000000018000380140003801000018004000300080001"], 0x44}}, 0x0) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000001180)=ANY=[@ANYBLOB='8\f\x00\x00', @ANYRES16=r6, @ANYBLOB="0700000000000000000005000000180001801400020073797a5f74756e0000000000000000000c0003800400038004000100"], 0x38}}, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) (async) r7 = fsmount(r4, 0x0, 0x1) (async) r8 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x1f7ff6, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r8, 0xc0145608, &(0x7f0000000040)={0x8, 0x1, 0x1}) (async) ioctl$vim2m_VIDIOC_QBUF(r8, 0xc058560f, &(0x7f00000000c0)=@multiplanar_mmap={0x6, 0x1, 0x4, 0x800, 0x7, {}, {0x2, 0xa, 0x7f, 0x5, 0x4, 0x2, "b3848769"}, 0x5, 0x1, {0x0}, 0x1}) (async) fchdir(r7) (async) getdents64(0xffffffffffffffff, &(0x7f0000000500)=""/45, 0x2d) (async) syz_io_uring_setup(0x48ba, &(0x7f0000000000)={0x0, 0xe3ee, 0x1000, 0xeffffffb, 0x333}, &(0x7f0000000080), &(0x7f0000ff4000)) (async) syz_io_uring_setup(0x88f, &(0x7f0000000480)={0x0, 0xcb52, 0x1000, 0x1, 0xffdffffd}, &(0x7f00000000c0)=0x0, &(0x7f0000000280)=0x0) (async) r11 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TUNSETIFF(r11, 0x400454ca, &(0x7f0000001440)={'\x00', 0x2}) (async) ioctl$TUNSETLINK(r2, 0x400454cd, 0x325) syz_memcpy_off$IO_URING_METADATA_GENERIC(r9, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r9, r10, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x81}}) 9.416997523s ago: executing program 9 (id=589): syz_emit_ethernet(0x4a, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa0086dd6000000000140601fe8000"], 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x8, 0xf, &(0x7f0000000200)=ANY=[@ANYBLOB="1800008080b63428e900"/20, @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7020000000000008500000051000000bf0900000000000055"], 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6, @void, @value}, 0x94) openat$vimc2(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) syz_usb_connect(0x3, 0x2d, &(0x7f0000000200)=ANY=[@ANYBLOB="1201500242864220f30c75930a000102030109021b"], 0x0) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) cachestat(r1, &(0x7f0000000080)={0x4, 0xffffff8000000000}, &(0x7f00000000c0), 0x0) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x4000000, 0x0, 0x0, 0xb, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "f4bd000000801900", [0x0, 0x2000000000001]}}) 9.308307626s ago: executing program 8 (id=590): fcntl$setpipe(0xffffffffffffffff, 0x407, 0x2) r0 = userfaultfd(0x801) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x218, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) close(0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$dsp1(0xffffffffffffff9c, 0x0, 0x361082, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x100000f, 0x810, r0, 0x57c68000) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r3) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r4, 0x0) syz_emit_ethernet(0x8e, &(0x7f0000000140)={@local, @local, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "000400", 0x58, 0x6, 0xfe, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x2, 0x16, 0xc2, 0x2000, 0x0, 0x7, {[@generic={0x13, 0x3, '8'}, @md5sig={0x13, 0x12, "a1cbd12aa50e39de3b5624a87fb75f32"}, @timestamp={0x8, 0xa, 0x6, 0x5}, @md5sig={0x13, 0x12, "e9803cac6913fbfccc18ce5a512eaf73"}, @md5sig={0x13, 0x12, "f2a3c47d2be4dabe21013d40454c15b5"}]}}}}}}}}, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r5 = memfd_create(&(0x7f0000000d00)='Y\xff\xff\x00\x00\x00\x00\x00K\xb2\x02\x80B\xe9\xe8\xcc\xde\x06\x00l\xa8\x1aJ\xaf\xb2M\xba\xb8_\x05U\xcd<|>\x9e\xec^\x0e\xbe\x18+-\x9b\x893\x02\x00\xa6\x1f+\xb3\xc5\x90z5\xe0\xdfi\xb7\x9f\xb4QW\xc9\xc9\x92\x03\t\x00\x00\x00\x00\x00\xb2\x0f\xee\xbe\f8\xcc\x7f\x00\x00\x00Z\x81\x00\x00\x00\x00\x18I\x13\xf1\xa2x\x04\x81R\xd45R\xae\x05\x00\x00\x00\x00\x00\x00\x00_M^dQ:\xbc\xafq\x88\x19nSF|;]\xe1A\x8c\x8a\x98\xd7|\xdcLF\r\xb1\xfd\xbf!\xc7u\xccP\xdd\x13~\x89\xcf\x85\xca\xa0%\xc6\xc7\x11\x00\x00\x00\x00\x00\x00\x00?M9\\\av~\'\xd9\xb0\xacdya]8\x9d\xb7\v\xf39\xc5{\x9c!\x0f/\xb8o8\xb9\x8d\x19\xe2\xca\x01y\x83\xe7\ng\x87\xd93\xf0y\xd6\xb0\xf2\x9f\xa7\xcf\xad\x86\\\xec\xec\xd6\x9d\bT\xcd\xa2\xea', 0xe) ftruncate(r5, 0x0) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) syz_emit_ethernet(0x3e, &(0x7f0000000000)={@local, @random="10200500c54d", @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x6, 0x0, @private=0xa010102, @local}, {{0x1, 0x0, 0x41424344, 0x41424344, 0x0, 0x6, 0x7, 0x0, 0x0, 0x0, 0x0, {[@exp_smc={0xfe, 0x6}]}}}}}}}, 0x0) bind$inet(r6, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10) connect$inet(r6, &(0x7f00000009c0)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x21}}, 0x10) writev(r6, &(0x7f0000000200)=[{&(0x7f00000000c0)='X', 0x8030000}], 0x1) r7 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$UI_ABS_SETUP(r7, 0x401c5504, &(0x7f0000000140)={0x4, {0x1, 0x1, 0x8, 0x4, 0x5, 0x52}}) shutdown(r6, 0x1) syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f000010"], 0x0) fsopen(&(0x7f0000000000)='cifs\x00', 0x0) 8.94427934s ago: executing program 6 (id=591): rt_sigprocmask(0x0, &(0x7f0000000400)={[0xfffff7feffff7ffc]}, 0x0, 0x8) (async) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) (async) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) r3 = dup(r2) ioctl$KVM_SET_MSRS(r3, 0xc008ae88, &(0x7f00000002c0)=ANY=[@ANYBLOB="820000000000000070000040"]) r4 = gettid() tkill(r4, 0x12) (async) io_setup(0x2, &(0x7f00000001c0)=0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) io_pgetevents(r5, 0x3, 0x3, &(0x7f0000000200)=[{}, {}, {}], &(0x7f0000000140)={r6, r7+60000000}, &(0x7f0000000040)={&(0x7f0000000080)={[0x1]}, 0x8}) 7.787898281s ago: executing program 0 (id=552): mremap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f000052a000/0x2000)=nil) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xffffffff}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_ifreq(r0, 0x8993, &(0x7f00000000c0)={'batadv_slave_1\x00', @ifru_map={0x2, 0xd, 0x401, 0x8, 0x7a, 0xe3}}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x10) prctl$PR_SET_MM(0x37, 0x0, &(0x7f0000001000/0x1000)=nil) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r3, 0x4601, &(0x7f0000000100)={0x400, 0x300, 0x0, 0x384, 0x1000, 0x0, 0xd968d5b908ac0cdc, 0x1, {}, {0x3}, {0xf4f2, 0x1000}, {0x0, 0x0, 0xffe}, 0x0, 0x100, 0x0, 0xd613, 0x0, 0x0, 0x0, 0x0, 0x32, 0x1, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1}) r4 = syz_genetlink_get_family_id$fou(&(0x7f0000000600), 0xffffffffffffffff) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014"], 0x7c}}, 0x10) sendmsg$NFT_BATCH(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000a00000a90000000060a0b0400000000000000000200000064000480600001800a000100696e6e65720000005000028008000240000000840800034000000007080004400000000f08000140000000002c0005800c0001007061796c6f6164000700028008000340000000b90800024000000004080004400000004b0900010073797a30000000000900020073797a32"], 0xb8}}, 0x0) sendmsg$FOU_CMD_GET(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000240)=ANY=[@ANYBLOB="40000000cca7a637fc9299e54169361687ac4e792f47a5466af2692cf1fc948b6aff9a91da5165e0a4f4452a99a8527b9959f06909ac5d2b50d8dd58f7f077dd1bdb1bfad5", @ANYRES16=r4, @ANYBLOB="010029bd7000fcdbdf2503000000060001004e220000050002000a00000014000700fc00000000000000000000000000000208000b00", @ANYRES32=0x0, @ANYBLOB], 0x40}, 0x1, 0x0, 0x0, 0x20002801}, 0x800) r6 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000640)={'wlan0\x00'}) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000034276d20402003c68e010000000109021200010000000009040001"], 0x0) 7.689651349s ago: executing program 5 (id=592): ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000000)=0x0) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f0000000200)={0x0, &(0x7f0000000140)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_SETCRTC(r1, 0xc06864a2, &(0x7f00000002c0)={0x0, 0x0, r2, 0x0, 0x80, 0x5, 0x9, 0x0, {0x9, 0xd6, 0x1c, 0x7, 0xfe, 0x401, 0x7, 0xa, 0x0, 0x52, 0x8000, 0x7e9, 0x401, 0x5, "cb630dab3a0338057401a192419598961f50dc45c87d55b42a28b8f01c0e0e7a"}}) r3 = socket$kcm(0x10, 0x2, 0x4) close(r3) socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000011c0)=[{&(0x7f0000000780)="5c00000013006bcc9e3be35c6e17aa31076b876c1d0000007ea60864160af36514001ac00800020004000c00060003000364bc24eab556a705251e618294ff0051f60a84c9f4d4938037e786a6d0001000000e4509c5bbcd72c6c953", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) sched_setattr(r0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x8, 0x0, 0xb49, 0x2, 0x8, 0x0, 0x5f}, 0x0) ioprio_set$uid(0x3, 0x0, 0x2004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000940)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f00000001c0)=@abs={0x0, 0x0, 0x4e23}, 0x34) sendmmsg$unix(r7, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='net/ip6_tables_targets\x00') syz_io_uring_setup(0x1249, &(0x7f00000000c0)={0x0, 0x216d, 0x80, 0x0, 0x44, 0x0, r8}, &(0x7f0000000180)=0x0, &(0x7f0000000040)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r9, 0x4, 0x0, 0x0, 0x4) ptrace(0x10, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x4000002, 0x50032, 0xffffffffffffffff, 0x0) syz_clone(0x100, 0x0, 0x0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000fc0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r10, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001400)=[{&(0x7f0000000080)="3bfdd75fa5717852d59a9367444a2130e72cd4dabc8854532cca0c32a5b9f844a4610c7525650ce3d3b76b15026d93e6dee896115e9364066aa3d14e33ef732b4681335c576902153114bdb9c74b538a71115fb1d1a63d1b04129661b29aab89d0be999a6b7c9bea755adedbf305a79f70b71d3d4c98577b49db4963ce89b0def5e840f459659cb6f86d56b069a5de11d601d348ff88ca6e5e2cfe40176880b33e9e8dbc32ba2e6a99b1b50276dc4f06166000d7069a3cc76f", 0xb9}, {&(0x7f0000000180)="892950e2405ee8629d9384a91c16d1706a3e61f305119f95cac0f1927f4c205b971eb41147cb1f86883d6910e68ac3996551800b3ec64b77f8444b18345a2c8b178eeeba0cde7319a5a46bfe7f5770e019efd9d52069edcced33a758c4e657f3a792dc193a1911b4e82ea800ad7afe03c851a8", 0x73}, {&(0x7f0000000200)="a68cde0d56b170df7710b54f17d9a39c4f98f3547190", 0x16}, {&(0x7f0000001080)="45e04400f2b383517a08c397dd0a76e67ecfc8e74573c24dedd3a48fb62418c1412fdcd15e888cb0f5d02e77bfecefda6b064c0bb2b66a9a522e63873dde02330510255eec7dfa1af708cdab59fb71eca786a359a2c3b0cbad35144ec5b069c53f90e43339845dc7fd140c55b0149ab38eb27c140f374bcc2c95b0b121d1a9302f3a01b888243b3fc0d46f0de0", 0x8d}, {&(0x7f0000000300)="87fb74cf4d67adbbd062637f514c1f5eb18d7b442e6457a356c6cb1f71a43dfae773c8489cce5145f92615d4bdb13ef54d6ae90ec7733180fcf5adf3e13fdb05b57b748bd14eda042a97fdd84498304a504a0a159b972e8200c2d0f536a3465ec498ed12b924bd134057df36129d3ebe3dd3ce9f0671e5278143e4afa3d43f444681de1b5f9725fca34fa357fe2154981666fb9dc202fc17a0199eb1c25bdd1005e590e84783ee9894c888998dc25a83c14aeee31d114acfa0bcd235d571cd765f4b9259ba43e6fc30291d8a642146c4771898030b736aeee6b247abb0784b154e104e7dcda401f9b1736fea30a41a4153fe6a9a525bd0a3487571f914f05b590e242341ade289d8f5b842c6be4a93c2755dfd47174def782a2f8f61c068b5a012f02c0801601e860def788121e8808c01fed4c920a3698d0d684920918c95b17f76bbcb4f265c931d8f79560ff8114b70f4dd6791e2ed70cfeb89905791b88be26efe1c5c66b7b50b3d2be0dbc066dfc31618f9507f6f340b85a2f76a6dcac9d6ccc289ace5e5fecd25afe22ffa451f5e365ab33cc985f2e9d7f7fb1be4794740a94215d7db14b0ffcec19e5e3c5ae0d8578ef3b65d2a7a77a11e390a6c3a6b391061c886b961e3c2f42d62047bfe1356a44b840d3d956105f4c0fa95db08c4933f00de77cdc057c28b41fecfc8398c442be1ad065954f6c9dfeb2fd7207e8548a00a1d50bdf522d2abfdafd71723616a34830fbfa8fc81e0c2639cc12f363a4919b7a00ac8189dad3e7e54122a2ef430f623658d5e281c9a19442995bb9b0e3f7d13e3016b6f9523be196bf23bbcc5ec802f43ef8b651d688d9d5a44f35c9847e4c32bce3e9ebed2326adadc76f06a195db32c80b3090d7cd65c9d8518ba4e528c5eb5c7a1c5695b21595fa8a8621734bfda8afddd65e1f37a1990220a00fa9bd2c22b0117ceb08ae6af3c944c2eca924abfddad065d1472d0c3f742a49b1e78c669471873706ad157d831d7482b773f07b0673a6ce1e227a7a4d13744bf459434c0ab1c323a38b1a84cbf1ce9741f2b8fdcc2e073e56171603d035aacd83e71d5132831f4f1e8bf517979f132a33fd03783272e9b8c96dfa4e1d320a58d82acfc8d3d53a5a52daafe4dc8be08f4ad53e11cc21374b6ff4ff5ea2ecc5d3f7c057f74f0098e57d990090475cdaffdef0da917653ed10fb70b94b72e5b4d95cbea0fc1dd2579635ad6ab545ba4d7b6d2f5442bdb78beb6c8ed62942a439117025b4566b48d9f3a17fdf4577e8606a4bc4c26557e58312fd2d1a541ebec3e5ae28eef8b2ab0597083716dd12889335570ee7839530eee879d9b137606cd4dd7103991671b4464bb68529eb19fb7a8845e3491bfbac688a87cf0744f429ea112014402915c4c1f6bae08d689d3cb7d641d7befe8fc74a2242310a9a367a39531b4c86da5b39df524e52f33ff9c40b48cb196ffc9ca855b6e698ade8a83e52b9ddc5031ff09e1907e4f8b0d07e64e1fb8e427f8819a7be907aa216bf8e2a4c7cc87ed53bf9490d4cc788b91f3b9f705e984a7e62c7a495e8421b97c39dc954b35468f17c6682334f4e16308448f457faeffff6d1f818522fa441d3a48168bdb12ffebace436a3915b63076cb6a655718647f87eaaf313b5bbd430421eed3a2215e439600a56eac8c65291eb103326a8034662bd337ab51577d9110ec7151be5cc9c54b2a30891acac5ad006ed537dbeb8f16eecbde7cf4e71373faf3c36b772f6d7ea9346875c8cf1049d49d4f8eb01b946c11e8c8e3ab2015f282167acddcc77fff03e1be9134252af0abfe538b4d25fc4ff874b52b9fb0996b5f32b4141dbd30578ff46e13ef6c63fc1620f62cb11a3dce401993976c272a5f62fde3f2a0e654d19e7a39dcdb622b9526d2a15cc18e6f817c916a00775353dd9c8954e66d0445b59bb0f5e6e3b46447232f52a0e398b057d123ef503afcbd48544db6434d2025bfc8dab72262a4fa5426a03061e7f8966e0086ff8ab5a91ab59f19b830394ee8bc76d6fb4816b8f4cde35b7eb9d3811228d51c54828f97fd1e648196c81bc73ed56249a59f318704e84656a6cedd2b8c1e1808d1cc648749abc643131e494c01336d4a14b8609656f2c972dc23c5c2e43fe40119fb88b5ec2aade35c03646e347354c493de8ab3672ccf94af0df333c6678299129d79be0eec281c5b3858ce3995566a390b674635b356692e3e9c53a089638ba0d69e772b7b410a5ae03de12e7de755ee559e1707b7b8003aabc8e2ce03c01e3183ff2d93262f6d5ceaafecdae66bc7cb3952c5a6571d864d502f281db5a228695badca5d022fdb6da56ab15dc377d1c1f8581ff56e28c2b2a84edb629547d28275c2ed571103b4ca7cdeb0776ba9f9dffcd78d21c3d4caa9289ed199672f4e7b912068c49c817114c37d37ea03954bae87d1ddae3da2ad85feb2fbb735b75a51f7bee5c8d88cc7bf64700d1a46ec6b631ae22ac7b06730a86a26bdcb992e1c7b50142de96b14a8468e4514068a30896fc677fddefaebb125c693a8d460469c7fe535f844781940f66d6abd091191c3122d584f5b0f5b0d443713d7d5186124d73de28aca30b719d4a55e09d259bddbf16995aeb1000880890afbd24d4066b0398985a40999de22ce176348e1c1f57eaf75b92a1e4f1482e89a00ac2cc36b20e36af9ec310599c19a5b1d6f8fadba104c58c801c6633315f82ebfa88faddd0b693e2f827f586c1cc5538e93bcf10f81af6dd7ee727df3b5018c0b4e31e40d040a47503b6ace4d29a1162ce487351825255f5584aff7cbd421f85c3d9fbb3784abd9848f16028b68f0d32ed8bb80106e8cc4acb939ff88bd39976d166b2addebf628b3fcd056da2f60e1b90f7a32702954921908ebccb683622a1f574ceba6951bef5e751c338c8279318dc28e36b9fc2bb17c3ad08aceb00fc388e6db112a738f86a4a1eb11526e1b9d73250b326285ed47c4398d93a3933d9a784249b65ad7d78a1f81d96ef36493ed693045a2150a8eb43cecc0c93e7d20b15b39a0646b081c2923b816365b7fbb41683a41732d942c5aa12faf876ec7f036becde8f3295af6dacff38d076d8e06260fee167703bb610745374a2758a6b88e465ca77d1f3105ae8b6b04a1eb509fb178d6249dbbc84d5d1d069278449a89d03e4a9a395d8170c329a296cfc329798cb9b9f1078d098cf3f989fd4ec53e013fbe917df35292d44fb1f3da4da4432a1847d4721514ade8cda5e5c0b51183580fc35266a970ebba74faeda56d4dcb56df51f96ad237452cedbd0cb2bee112713c3d450835811bf3da9745136d428e148fd0932dc77c8d8e61a16c625241fad8425b4ece394eedd5f165bd94923bfa1172be8edc8a4fcaae5f77ee8cc510192b27964da09c3e84efb4bc7154da1a24da8b7e544b42278d2574687ec76143afa6cf193d52a2a7f4c20ee57b6056a1337d5e408117a6cf1ab49c8980f39597f69902085d3e8d374d44e6ab4ed1185a26be2bc7281e9cfbbeb6bed899aa1924d3faa06d95999fbeaf2337494e0c2c39eef5a73fcde84459a9ea48d4e015d9e5bb5839354967ce02f637bc8678d2595b9a918fc36b927d7501f0ac2e3471ce02b5df355689c87f191ef5390900a41deec29984e45a878ece964b0009aad561316fc3b30ce1b49266d32eb17cd30f3e17e1f59014e8c518940dd0a093d1349c1a7c2581963bbe0ba372b6426e81c33c71b2ec8141c5713e52a37fff0a417a5b259e1420d9fb6a731f5baa0cc494221947895aa8fa14745a986a366bff9d0c239a19f85372497565b5b703da16439019df5f3d29f4247fb528854c9648630f03e9dedde5a08a47728ea6a4d42e62eff6fa3bd402325e0f4387b60171c37c180f958ad80955779c899517e7ea76eed00598e01552eaaf08b723daf9d466e8c57af43a15a46528b1119f5074aa3c51f77357ebe158275bc06b89640d7ce3c0a03af01418d7dc6ae8a1be8ab08c1722d66d1e9277480b8b178447667c024f9b78f8a878a2d7cf8e83e5104f6964b2907a989abafc7d7d0df941abf3d7283b6a11d46c2911a42182ec27ab785d92946e1ee8ef44846d561850d2a98c305c382f36d4cfc9b2bfd3b86ef21a0d187adcafbec8268c7d662a34dda1c83c4967097743133bc8c587edf249f5668c34ddb112fa4eb1bea9c8f6a000f1f34428b54688a5e214a7919868b25dbe930e86a243ecf54afe0b518c647d04873d2cf62cb2ab27f00015537a4fd2ea3dc8777abdf3284622347016566da0b9c406ca8c40694e4013a53fbf2e803d51b0bbe5e9df5fc74f66be618856357ccf803c53ed0e3b3fe79f69f0ede9b565d8f7a8ce5aa8cbb4e8fa61be3fd00ffb07e45065498925c14c0b311942d4ed951ad6237aadb5405bc7b2d79e1fd295b7c2ed8efa883e44c86a5053e2f421c6d4dc0c47d3a05d911db37d6efdb8e50fb3f06139ac147bc7162c21aece79eaf72e9779f19eb5395cec3d15a7594ea70a6b373d98651d2215b210f037ea3f8a57ded74474f6fdb64a08b56af52168da70b30aee03472cd8bee5af04cad7303004a4aba464b99", 0xcb3}], 0x5, &(0x7f0000001480)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @private, @multicast1}}}], 0x20}, 0x1) recvmsg$unix(r11, &(0x7f0000001140)={0x0, 0x0, &(0x7f0000001040)=[{&(0x7f00000025c0)=""/4098, 0x1002}], 0x1}, 0x40000100) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8008, &(0x7f0000000000)=0x9, 0x6, 0x4) mlock(&(0x7f0000148000/0x4000)=nil, 0x4000) splice(r4, 0x0, r5, 0x0, 0xf3a, 0x1) syz_open_dev$loop(&(0x7f0000000080), 0x69d, 0x80002) 7.497490257s ago: executing program 6 (id=593): unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000002200)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000002240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) r4 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x200000, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r4, 0x3ba0, &(0x7f0000002280)={0x48, 0x2, r5}) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r6, 0xaf01, 0x0) r7 = eventfd(0x401) ioctl$VHOST_SET_VRING_KICK(r6, 0x4008af20, 0x0) write$eventfd(r7, &(0x7f00000000c0)=0xfffffffffffffffe, 0x8) read$eventfd(r7, &(0x7f00000012c0), 0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r3, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r8 = syz_open_procfs(0x0, &(0x7f00000023c0)='attr/exec\x00') read$FUSE(r8, &(0x7f00000001c0)={0x2020}, 0x2020) sendmsg$SMC_PNETID_GET(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000900)=0x14) sendmsg$nl_route(r7, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000002400)=ANY=[], 0x3c}, 0x1, 0x0, 0x0, 0x20004004}, 0x885) sendmmsg$inet(r0, &(0x7f0000000640)=[{{&(0x7f0000000040)={0x2, 0x4e1c, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000000)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r9, @empty}}}], 0x20}}], 0x1, 0x80) 6.995577621s ago: executing program 9 (id=594): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = socket$l2tp(0x2, 0x2, 0x73) setsockopt$inet_group_source_req(r3, 0x0, 0x0, &(0x7f0000000480)={0x4, {{0x2, 0x4e20, @remote}}, {{0x2, 0x4e22, @private=0xa010101}}}, 0x108) r4 = openat$zero(0xffffffffffffff9c, &(0x7f00000010c0), 0x280100, 0x0) getdents64(r4, 0x0, 0x0) setsockopt$packet_buf(r4, 0x107, 0x16, &(0x7f0000000200)="a6ee1571c7a2ba8caa11082c9532826a54e578ca8d274e7c7839f090eafaabb55a29f6718bdee0a9a767348eeb47a7274e01bf4bcef5ed63de5d6e41c7492599c2f8a80777d0c834bab02c4fe4a098cefcf6b3e53c83f830a61c810b690b0a6db23cc63c2a9fda48e25e22696827", 0x6e) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, &(0x7f0000000180)="2e470f30b99b080000b800100000ba000000000f30c7442400dd000000c744240207000000ff1c2467460f21d766baf80cb88c106e8fef66bafc0cedb9f30a00000f3266b841000f00d00f01c826400fd398070000000f32", 0x58}], 0x1, 0x43, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r5, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x3, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route_sched(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0x300, 0x0, 0xfffffffe, {0x0, 0x0, 0x0, r6, {0x0, 0x9}, {0xffff, 0x6}, {0xe, 0x7}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x10, 0x3, {0x6, 0x2}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0xc010}, 0x4000) sendmsg$nl_route_sched(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000003e40)=@newtfilter={0x1acc, 0x28, 0xd27, 0x1004001, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0x2, 0x9}, {}, {0xc, 0xb}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x1a9c, 0x2, [@TCA_CGROUP_POLICE={0x408, 0x2, [@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x10001, 0xffff967f, 0x101, 0x80000000, 0x8, 0xfff, 0x7, 0x10, 0x5, 0xffffffff, 0x3, 0x80000000, 0x2, 0x6, 0x7, 0x3680, 0xfffffffd, 0x4, 0x2, 0x8, 0x4, 0x9, 0x1, 0x2, 0x5, 0xcad0, 0x3, 0x5, 0x4, 0x7, 0x5, 0x1, 0x10001, 0x80000000, 0x8, 0xf3, 0x5, 0x89, 0xfd, 0x7ff, 0x4, 0x200, 0x4, 0x88, 0x413, 0x0, 0x6, 0x5, 0x5, 0x7ff, 0xa, 0x80000000, 0x6, 0x80000000, 0x3, 0x10001, 0x3cd491e8, 0x0, 0xd, 0x3, 0x5, 0x7, 0x9, 0x100, 0x8, 0xfa2, 0x8, 0x3, 0x4, 0x0, 0x6, 0x93, 0x6, 0xfffffffb, 0x2, 0x2, 0x0, 0x7, 0x5, 0x2, 0x10001, 0x6, 0x2, 0xc20, 0xfffffffb, 0x5, 0x8, 0x5, 0x80, 0x8, 0x6, 0x4, 0x7d, 0x4, 0x1, 0x5a58, 0x4, 0x315e, 0xfffff5bf, 0x9, 0x4, 0x6, 0x7fffffff, 0x7f, 0x800, 0x87, 0x4, 0x6, 0x6, 0x8, 0x2, 0xf78c, 0x6, 0x897, 0x7, 0xffffffff, 0x0, 0x80000001, 0x6, 0x4, 0x3, 0xcbed, 0xffff, 0xfffffffb, 0x4, 0xf, 0x777, 0x40, 0x20000000, 0x5a9, 0x80000001, 0x101, 0x2, 0xcc, 0x0, 0x9b8, 0x5, 0x1ff, 0x9, 0x0, 0xffff0001, 0x3, 0x901, 0x9, 0x9, 0x1, 0x2, 0xffff, 0x8, 0x1ff, 0x80000000, 0x8, 0xc39c, 0x3, 0x7, 0x7, 0x2, 0x0, 0x7, 0x10, 0x4, 0x5, 0xad3, 0x1, 0x2, 0x87, 0x12, 0x7, 0x541, 0x40, 0x7, 0x546, 0x80000001, 0x1, 0x5, 0x0, 0x2, 0x5, 0x0, 0x8000, 0x8001, 0xf, 0x4, 0xf, 0x8, 0x5, 0x5, 0xffff, 0x6, 0x200, 0x2, 0x8, 0x6, 0x5, 0xfffffffa, 0x8000, 0x38, 0x72c, 0x7, 0x4, 0x1, 0x2, 0x9, 0x400, 0x7, 0x5, 0x4, 0xd, 0x2, 0x3, 0xf61, 0x7331, 0x42f, 0xa9b, 0x3ff, 0x1, 0xa, 0xf1, 0x7fffffff, 0x1, 0x1, 0x941, 0x1, 0xe9, 0xf22, 0x80, 0x100, 0xffff, 0x8, 0x7, 0xd11, 0x7ff, 0xf, 0xc, 0x1, 0x5, 0x7, 0x4, 0xff, 0x0, 0x100, 0x9ca6, 0x80000001, 0x600, 0x9, 0xffffffff, 0x9b, 0x7, 0x1000, 0x7f, 0x101, 0x5, 0x7, 0x9, 0x9, 0xf7]}]}, @TCA_CGROUP_EMATCHES={0x14, 0x3, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0xfffc}}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x8001}}]}, @TCA_CGROUP_ACT={0xc28, 0x1, [@m_nat={0x17c, 0x5, 0x0, 0x0, {{0x8}, {0x54, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x95a, 0x7, 0x2, 0x6, 0xb}, @local, @broadcast}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x6, 0x8, 0x6, 0x7fffffff, 0xff}, @private=0xa010100, @broadcast, 0xffffff00}}]}, {0x103, 0x6, "d11b59fa5d12816da5f439e502c269fe19917ad25baf0ea14f4e0d9c370f1a7cd53050321b23c48716c567318e118abb232a6987a45e15c143bfc6e608b5ae0e2e3abffb67e22ccde5eb297868c24fe30d58a92cbea6734d582d9fad1596bdb2b9294a39e27a91720d29d208966b3801468223d45996c5fc2af9cfe9b77b58831fadbfa72b391aecd84e50f15eea7d10d315e5c0c4e94fd2dc107296f1aab5a6f895642b33a7f140c384d4786102efdeb7ca37f5a74315c909ca2ed87267389a81f87d015b6137d91794197c0b451f8419add206126afdfe36110ef1c852ae1f32ac14cc1ac6ca2b32eb0f8d359a08da26fe190253cb80caf2f23631381b4b"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x3, 0x3}}}}, @m_gact={0xb4, 0x18, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x8001, 0x6, 0x20000000, 0x6, 0xd815}}]}, {0x6d, 0x6, "0c28f7eaefbc84b27fa50d993f177ca443ed3d4b7b00608e93248bdb8ebee2ad14e97c4a45f6f2a292dd7217b55ffb446392f7e583236c3032ec2f0cafb854cd436259f2763448b4c069a4fa7e3f804136c7cf32a19199e120892316d78e41dec3039fa4699191bf42"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}, @m_nat={0x54, 0x800, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x3, 0x6, 0x4, 0x1000, 0x2}, @multicast2, @multicast2, 0xff0000ff}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x3, 0x1}}}}, @m_gact={0x4c, 0x2, 0x0, 0x0, {{0x9}, {0x4}, {0x1f, 0x6, "04f3f0ac3a6207329759f03c99999a6870c1c539d97595fe07b3b9"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x6}}}}, @m_police={0x954, 0xb, 0x0, 0x0, {{0xb}, {0x88c, 0x2, 0x0, 0x1, [[@TCA_POLICE_PEAKRATE64={0xc}, @TCA_POLICE_RESULT={0x8, 0x5, 0x8}, @TCA_POLICE_TBF={0x3c, 0x1, {0xc0e42c00, 0x7, 0xffffff81, 0x1, 0x3, {0x3, 0x1, 0x0, 0x9, 0x6, 0x71}, {0x40, 0x2, 0x5, 0xfffd, 0x5, 0x1}, 0xf8c, 0x80000001, 0xa}}, @TCA_POLICE_RESULT={0x8, 0x5, 0x2}, @TCA_POLICE_RESULT={0x8, 0x5, 0x8}], [@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x3, 0x7f, 0x5, 0x5, 0x9, 0xe9b0, 0x100, 0x100, 0x1, 0x7, 0xffff, 0x5, 0x2, 0x7, 0x7, 0x4, 0x9670, 0x10000, 0x8, 0x6, 0x2, 0x5, 0x2, 0x0, 0x2, 0x8, 0x6, 0x10000, 0x5, 0x7b540229, 0x0, 0xa, 0x3, 0xfffffffa, 0xffff9703, 0x3, 0xffffffff, 0x7f, 0x14, 0x51c1, 0x2, 0x6, 0x5b4e4870, 0x7, 0x2, 0x1, 0x1f, 0x81, 0x4, 0x4, 0x8, 0xffffffff, 0x1, 0x101, 0x7, 0x5, 0x100, 0xfffffff4, 0xc04c, 0x1, 0x8, 0x4, 0x9, 0x40, 0x4, 0x7f, 0x5, 0xfc7, 0x0, 0xfffffffe, 0x0, 0x8, 0x0, 0x0, 0xa, 0x6, 0x91, 0x5, 0x0, 0x26a, 0x9, 0x1000, 0x80, 0x0, 0x4, 0x79a, 0x4, 0x4, 0xff, 0x857, 0x7, 0x3, 0x7ff, 0x2, 0x2, 0x3, 0x7, 0x400, 0x7, 0x6, 0x8000000, 0x5, 0x1, 0x8, 0x9, 0x5, 0x2, 0xffff, 0x3, 0x9, 0xbbcc, 0x40, 0x101, 0x7, 0x8, 0x7, 0x2, 0x1, 0x80, 0x6, 0x2, 0x7, 0x8, 0x9, 0x8, 0xfffffff6, 0x1fa40000, 0x9, 0x3, 0x2, 0x40, 0x7, 0x401, 0x9, 0x20, 0xff, 0x4, 0x80, 0x4, 0x9, 0xbd, 0x7, 0x6, 0x7f, 0x6, 0x4, 0xdf6, 0x7, 0x87b, 0x2, 0x0, 0x4, 0x5, 0x80000000, 0x3d, 0xf, 0x2, 0x5e0, 0x6, 0xf, 0x7, 0x10001, 0x5, 0xdab, 0x4, 0x7, 0x2, 0x78, 0x10000, 0xd73c, 0x9, 0x1, 0x1, 0x0, 0x7, 0x9, 0x8, 0x2131, 0x5, 0xbcc4, 0x10001, 0xffffa192, 0xffffb990, 0xe70e, 0x3, 0x400, 0x6, 0x6, 0x0, 0x8, 0xc, 0x0, 0x4, 0x68, 0x401, 0xa0, 0x5, 0x3, 0x0, 0x7, 0x4, 0xec, 0x200, 0x7db5, 0xffff, 0x7, 0x92, 0x9, 0x0, 0xc2f6, 0x800, 0x2, 0x4c, 0x5, 0x200, 0xff0000, 0x9, 0x9, 0xf, 0x1ff, 0xcc3, 0x1000, 0x2, 0x5, 0x7fffffff, 0x6, 0x101, 0x9, 0x1, 0xe9, 0x80000, 0x5, 0x7c20, 0xd, 0x2, 0x8, 0x4, 0x5, 0x0, 0x10, 0x2, 0x4, 0x4, 0x9, 0x1, 0xd, 0x8, 0x9, 0x4, 0xff, 0x2, 0x9b5, 0x99, 0xf, 0x80, 0x9]}, @TCA_POLICE_RATE64={0xc, 0x8, 0xffffffffffff38c3}, @TCA_POLICE_AVRATE={0x8, 0x4, 0x5}, @TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x401}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0xfffffffe, 0x7, 0x4, 0x4, 0x1, 0x3, 0x7f8, 0x1, 0x9, 0xfffffff9, 0x3, 0xba82, 0x800, 0xc0, 0x5, 0x7f, 0x6, 0x9, 0x9, 0x7, 0x7, 0x1, 0x9, 0x4002, 0x4, 0xfffffff8, 0x0, 0xfffffff7, 0x2, 0x80, 0xffff, 0x3, 0x86d, 0x7, 0x1, 0x8, 0xfffffff7, 0xc, 0x6, 0x8, 0x101, 0x1, 0x4, 0x5, 0x0, 0x400, 0x2, 0x8, 0x4, 0x6, 0x8, 0x7, 0x9, 0x10001, 0x0, 0x2, 0x8, 0x7, 0x9, 0x9, 0x3, 0xd1, 0x7, 0x2, 0x5, 0x10001, 0x49c, 0x1, 0xfffffffb, 0x100, 0x0, 0xfffff1b1, 0x3, 0x6, 0x4, 0xfffffffe, 0xc, 0xf86b, 0x2, 0xf85c, 0x80000000, 0x100, 0x2, 0x9, 0xfe, 0xfffffffe, 0x0, 0x1, 0x9, 0xd, 0x10000, 0x1, 0x0, 0xe, 0x0, 0x1, 0x0, 0x3ff, 0x9, 0x2, 0x7, 0xfffffff9, 0x0, 0x0, 0x10000000, 0x7, 0xffff8000, 0x8, 0x7, 0x80000001, 0x800, 0x1014, 0x7, 0x4fda, 0x3, 0x4, 0x10, 0xa, 0x5, 0x3, 0x58, 0x40, 0x10, 0x9, 0x80, 0x40, 0x7, 0x10001, 0x8, 0x17, 0xd, 0x7, 0x200, 0x7, 0x4, 0x3, 0x5ce2, 0x1, 0xc000000, 0x5537d96e, 0x9, 0x1, 0xf, 0x8, 0x80000000, 0xe32, 0x1, 0x4, 0xffff8000, 0xd1, 0x0, 0x9, 0x5, 0x7fff, 0x9, 0x1, 0x2, 0x401, 0x1, 0x3, 0xc5, 0x9, 0xe, 0x6, 0x2, 0xffffff5d, 0xff, 0x5, 0x7, 0xd0, 0x9, 0x4, 0x16f, 0x37, 0xf5f2580, 0x3, 0x8, 0x8, 0x9, 0x0, 0x9b5b, 0x1, 0xffff, 0x9, 0x3, 0x80000001, 0x1ff, 0xfffffffc, 0x5, 0x10, 0x5, 0x4, 0x7ff, 0x6, 0xffffff8f, 0xb, 0x4, 0x1, 0x1, 0x5, 0x4, 0x8, 0x6, 0xff, 0x2, 0xdc, 0x4, 0x7, 0x8, 0x3ff, 0x6, 0x1, 0x1, 0x9, 0x4, 0x6, 0xff, 0x3, 0x6, 0x3, 0x0, 0x1, 0x77d2f22b, 0x5, 0xd, 0x4, 0x401, 0x737, 0x44, 0x7f, 0x7, 0x80000000, 0x9, 0x2, 0x1, 0xf00000, 0x6, 0x5, 0x2, 0xf34, 0x1, 0x6e89, 0x3, 0x6, 0x4, 0x0, 0x5, 0x1, 0x7ff, 0x5, 0x3, 0x301, 0x3, 0x19, 0x4, 0x1]}]]}, {0x9f, 0x6, "f5145294aafbcae94707648f8180b8d4e040854ac822e23a680394ecdbb64d10830e0ea2b15ede5781f6b03a9b782a0644e4ddc1b105098e1915924870b30ca7213da7f6112134aa1ce56be6fe8867daa62acba7b6e64c488ccad87c8e872d4052c29af65cd7f587c3028c85c6ba8ea29f5e05b8c48d1deb2d790146550fe0b1f8b31adc87e7308b459780efda3d2198d8f93c2fe2e61b53d76036"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2, 0x4}}}}]}, @TCA_CGROUP_EMATCHES={0x10, 0x3, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x4}}, @TCA_EMATCH_TREE_LIST={0x4}]}, @TCA_CGROUP_POLICE={0x830, 0x2, [@TCA_POLICE_RESULT={0x8, 0x5, 0x7}, @TCA_POLICE_RATE={0x404, 0x2, [0x1, 0xa23, 0x2, 0x1, 0xfffffff9, 0x8, 0x6, 0xff, 0x0, 0x4dbaff6b, 0xd0, 0xc, 0x4, 0xe4f2, 0x489, 0x3, 0x2, 0x5, 0x6, 0x4, 0x65, 0x6, 0x1, 0xd3d0, 0xc0000, 0x9, 0xb5152000, 0x1, 0x5, 0x270309a0, 0x8, 0x100, 0x2, 0x5, 0xffff8d86, 0x6, 0x7258, 0x0, 0x5, 0x4, 0x2, 0x8, 0x52d, 0x1, 0xff, 0x8, 0x0, 0x1d, 0xffffff19, 0x3, 0x3, 0x5, 0x8, 0x3e, 0x8, 0x60, 0x80, 0x9, 0xcc, 0x2, 0xea2b, 0x1, 0xffffffff, 0xf, 0x546, 0x4, 0x4, 0x5, 0x77, 0xfffffff7, 0x0, 0x2, 0x8, 0x685, 0x0, 0x6, 0x1, 0xfff, 0x101, 0x81, 0x8, 0x7, 0x5, 0x6, 0x3, 0x10000, 0x5b95, 0x5, 0x2, 0x4a0, 0x7, 0x2, 0x80000000, 0xc06, 0x7, 0x5, 0xfffffffb, 0xfffffffe, 0x5, 0x2fa, 0x6, 0x3, 0x7fff, 0x9, 0x4, 0x7fff, 0x401, 0x4, 0x7, 0x80000000, 0x5, 0x0, 0x0, 0x3, 0x8, 0x5, 0x1, 0xa4f, 0x6, 0x1, 0x80000000, 0x7, 0x2, 0x6, 0x4, 0x7, 0x0, 0xf, 0x0, 0x5, 0x8, 0x5, 0xfffffff8, 0x800, 0x10001, 0x3, 0x0, 0x1, 0x1ff, 0x8, 0x1, 0x4, 0x7f, 0x5, 0x8, 0xbe08, 0x8, 0xffe1, 0x3ff, 0x8, 0x7, 0x5, 0x80000000, 0x637, 0xeb, 0x1, 0x6, 0x4, 0xffff7b85, 0x5, 0x434, 0x0, 0x8, 0x4, 0x1, 0x1, 0x3, 0xffff, 0x3, 0x0, 0x1000, 0x6, 0x4, 0x5, 0x4, 0x0, 0x81, 0x1, 0x8, 0x3, 0x0, 0x8, 0x6, 0x8, 0x10000, 0x6, 0x3, 0x6, 0x2, 0x81, 0xb3dd, 0x1, 0xb468, 0x4e, 0x9, 0x8, 0x8000, 0x0, 0x2, 0x4, 0x63, 0xffffff00, 0x9, 0x3, 0x0, 0x5, 0x3, 0x800, 0x8, 0x36ab, 0x200, 0x9, 0x2, 0x1, 0x6, 0x7ff, 0xb0, 0x8, 0x2, 0x6, 0x81, 0x6594, 0x918659e, 0x1, 0x800, 0x5, 0xffff, 0x3, 0x5, 0x1, 0x8, 0x10000, 0x8, 0x96, 0x3, 0x1, 0x80000001, 0x5, 0x0, 0x505, 0xff, 0x6, 0x5, 0x3, 0x3, 0x7, 0x0, 0x5, 0x1, 0x0, 0xc6be, 0x200, 0x7, 0x8, 0x4eaf, 0x80000001]}, @TCA_POLICE_RESULT={0x8, 0x5, 0x7ff}, @TCA_POLICE_RATE64={0xc, 0x8, 0x1}, @TCA_POLICE_RATE={0x404, 0x2, [0x6e062169, 0xe16, 0x8, 0x80000000, 0x40, 0x7fffffff, 0x401, 0x5, 0x10000, 0x0, 0xd57, 0x5, 0x7, 0x1, 0xb958, 0xfff, 0xc2, 0x5, 0xa, 0x0, 0x7ff, 0x101, 0x0, 0x6, 0x1, 0x10001, 0xfffffff1, 0x2, 0x6, 0x19e3000, 0x2, 0x426, 0x6, 0xfff, 0x7, 0x14000, 0xff, 0x1, 0x0, 0x6267, 0x1, 0x2, 0x0, 0x101, 0x0, 0x8001, 0x4b72fe00, 0x3, 0x79ab, 0x9, 0x0, 0x1, 0x4, 0x8, 0x8, 0xffffffff, 0x8, 0x6, 0x71a8, 0x1, 0x3, 0xfffffffc, 0xad570b4c, 0x4, 0x1, 0x3, 0x9, 0x7fffffff, 0x7, 0x0, 0x4, 0x583, 0x7, 0x8, 0x8, 0x40, 0x6, 0x7fffffff, 0x75, 0xa5b, 0x8, 0x0, 0x1, 0x9, 0x0, 0x8000, 0x3, 0x6, 0x9, 0x80000000, 0x6, 0x5, 0x0, 0x6, 0xfffffc5a, 0x986, 0x9, 0xe4, 0x2, 0x4a, 0x2, 0x3, 0x7, 0x7ff, 0x4e8, 0xffff0000, 0x3, 0x6, 0x3, 0x100, 0x0, 0x6, 0x8, 0x6, 0x38, 0x80, 0x3a, 0x1, 0x2f2, 0x7fff, 0x35, 0x9, 0x9, 0x9543, 0x3, 0x0, 0x7fffffff, 0x1, 0xe905, 0x9, 0x80000001, 0xfffffffd, 0x80, 0xfffffeff, 0x2, 0x9, 0x9b, 0x0, 0x3, 0x4, 0x8, 0x34b, 0x2, 0xe9ce, 0x7, 0x4, 0x1, 0x3, 0x88be, 0x1, 0x6, 0x713b9703, 0x400, 0x0, 0x5, 0x8, 0x18040, 0x54, 0x587b, 0x5, 0x1, 0x0, 0x9, 0x7, 0x7, 0x0, 0x9, 0x4, 0x101, 0x2, 0x8, 0x0, 0x2, 0x5, 0x6, 0x2, 0x9, 0x8, 0x9, 0xfffffffe, 0xfffffffd, 0xf, 0x6, 0x7, 0x100, 0x9, 0x2, 0x7, 0x8, 0x7f, 0x800, 0x80000001, 0x6, 0x3cf, 0x10, 0x2, 0xb, 0x79b, 0x1, 0x6, 0x4, 0xf36, 0x9, 0x0, 0x3, 0x0, 0x2, 0x80000001, 0x9, 0x40, 0x2e3468be, 0x5, 0x5, 0x8, 0x1000, 0x6, 0x5, 0x7, 0x2, 0x1, 0x7, 0x6, 0x4817, 0xa01, 0xffffffff, 0x5, 0x6, 0xcd74, 0x5, 0xffffffff, 0x73, 0xc, 0x9, 0x20, 0x7ff, 0x4, 0x800, 0x7, 0x1, 0x5, 0xb, 0x4, 0x7, 0x200, 0x8, 0x8, 0x3, 0x8, 0xffffff9d, 0x9, 0xd, 0x5, 0x0, 0x8, 0x40, 0x6]}, @TCA_POLICE_RESULT={0x8, 0x5, 0x4}]}, @TCA_CGROUP_EMATCHES={0x214, 0x3, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x4}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0xfffc}}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x401}}, @TCA_EMATCH_TREE_LIST={0x4}, @TCA_EMATCH_TREE_LIST={0x4}, @TCA_EMATCH_TREE_LIST={0x1e4, 0x2, 0x0, 0x1, [@TCF_EM_CMP={0x18, 0xc, 0x0, 0x0, {{0x8, 0x1, 0x7fff}, {0x3, 0x3, 0x9, 0x1, 0x0, 0x0, 0x1}}}, @TCF_EM_CONTAINER={0xec, 0x3, 0x0, 0x0, {{0xe0}, "ceaab5f729014fcd59de66cba39718dbfb8954ba823bb2e49aff8366846add96878698498c077f9352898e88ce4f5fc4bbb4c86771607c05c47aa8f0c33086afb482050d1ae38e56728627a56c8e3242597973589a3901b5e54725d7687ca586c598cc95aa24b652a76b9a88d01f02f84e5a9117599cdd601822791611e6cc977ded7d80f874e6f74f0a2c7c52af11f27bb203673bb08fbfc99b3397d8e480902842c8548b14a5fbb82dc4d19f5847332cd2b9ce10c2d4bf9989c5bf624882c0b10d8881a7267d14b1ea400e72daaef9e95d7405ea16fdd70cb0975564f0a3"}}, @TCF_EM_CMP={0x18, 0x3, 0x0, 0x0, {{0x9, 0x1, 0xea1}, {0x0, 0xfffffff2, 0x9, 0xa, 0x4, 0x1}}}, @TCF_EM_CONTAINER={0xc4, 0x2, 0x0, 0x0, {{0x4, 0x0, 0x7}, "6a7b62f6eca853213b6e3614e2583ee44e384af68a4851dc5161b1f973ba99f8dc62eacedeffacbfeabce8eb67e79b1e5a9fefbbb6f02c449aeb9a95219797dd0c678ba2fb781f8fa5eef20c21afdb6c48c661e9a101b5e3ae8848478307193e31b18fe1fd6c51293476deff84b62ac3b9828aa946e47dae9b08b905e7f6df9c61cef27827f6d858a116dd547710f908aa3dbc54d6bf3d06dcab037b2c8605dc1b0dda9eec5151d553f9cf9ad0f01cb896d2d411905279"}}]}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0xa}}]}]}}]}, 0x1acc}, 0x1, 0x0, 0x0, 0x8810}, 0x404c0c0) ioctl$KVM_RUN(r2, 0xae80, 0x0) r7 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r7, &(0x7f0000514ff4)={0x10, 0x0, 0x1, 0x7fffc}, 0xc) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f0000003e00)={0x0, 0x0, &(0x7f0000003dc0)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000090000000a20000000000a05140000000000000000010000000900010073797a300000000058000000160a09000900000000000000010000000900010073797a30000000000900020073797a32000000002c00038018000380140001006d6163736563300000000000000000000800024000000000080001400000000014000000110001"], 0xa0}}, 0x0) sendmsg$NFT_BATCH(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000680)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a14000000020a05000000000000000000000000801400000011000100ffff406de46ef5a22832edc3a46fc5ffff000000000000000ab89c"], 0x3c}, 0x1, 0x1200}, 0x0) r9 = syz_io_uring_setup(0x49a, &(0x7f0000000400)={0x0, 0x79af, 0x0, 0x7ffc, 0x40024e}, &(0x7f00000000c0)=0x0, &(0x7f0000000040)=0x0) r12 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_CPUID(r4, 0x4008ae8a, &(0x7f00000005c0)=ANY=[@ANYBLOB="0100000000000000010000404000000000feffff070000000800000000000000da93cfd74346ce6b1c4713d136f55b9b9ba6334b9221afeab20253f882367216302b9378054176deceef2c4283976b9f022ac5fe8d94562ec096b9f332b57b1d0a83c7662e8fd4608bb70f12b45ee0d00b150d2f7e5af19e25cd3a2e6fc5ec8e9021aaa529b6bc3be6467da560ec3eb2d78f2f9930f3c9069ed3051a"]) ioctl$TIOCGDEV(r12, 0x80045432, &(0x7f0000000040)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r10, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) syz_io_uring_submit(r10, r11, &(0x7f00000002c0)=@IORING_OP_TIMEOUT={0xb, 0x11, 0x0, 0x0, 0x0, &(0x7f0000000100), 0x1, 0x40, 0x1}) io_uring_enter(r9, 0x627, 0xc104effd, 0x43, 0x0, 0x0) 5.429825341s ago: executing program 9 (id=595): r0 = socket(0x10, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f00000000c0)={'ip6tnl0\x00', &(0x7f0000000140)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x0, 0x0, 0x32, @ipv4={'\x00', '\xff\xff', @remote}, @local, 0x80, 0x40, 0x0, 0xffffffff}}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) getsockopt(r1, 0x28, 0x1, 0x0, &(0x7f0000000000)) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000380)={0x2, 0x4e22, @empty}, 0x10) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r3, 0x29, 0x1a, &(0x7f0000000100)=0x401, 0x4) r4 = socket$rds(0x15, 0x5, 0x0) bind$rds(r4, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10) sendmsg$rds(r4, &(0x7f0000000100)={&(0x7f0000000040)={0x2, 0x0, @local}, 0x10, 0x0, 0x0, &(0x7f00000016c0)=[@rdma_args={0x48, 0x114, 0x1, {{0x0, 0x2}, {&(0x7f0000000580)=""/154, 0x9a}, &(0x7f00000011c0)=[{&(0x7f0000001140)=""/102, 0x66}], 0x1, 0x60, 0xffffffff00000005}}], 0x48, 0x80}, 0x0) bind$inet6(r3, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty, 0xffffffff}, 0x1c) sched_getparam(0x0, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r5, &(0x7f0000000380)={0x2, 0x4e22, @multicast2}, 0x10) socket(0x2, 0x80805, 0x0) r6 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r0, 0x84, 0x70, &(0x7f00000001c0)={r7, @in={{0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}}, [0x170, 0xac, 0x400000000000, 0x6, 0x1, 0x1, 0x800, 0xf9, 0x7, 0x146664ed, 0x10, 0xffffffffffffffff, 0x9, 0xffffffffffffffed, 0x3]}, &(0x7f0000000000)=0x100) 5.204104638s ago: executing program 9 (id=596): socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$MRT_FLUSH(0xffffffffffffffff, 0x0, 0xd1, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000c80)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x27}}, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$inet6_udp_int(r2, 0x11, 0x65, &(0x7f0000000200), 0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, 0x0, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000000500)={'filter\x00', 0xb001, 0x4, 0x3bc, 0x1c4, 0x1c4, 0x0, 0x2b0, 0x2b0, 0x2b0, 0x7fffffe, 0x0, {[{{@uncond, 0xbc, 0x10c}, @unspec=@AUDIT={0x0, 'AUDIT\x00', 0x0, {0x1}}}, {{@uncond, 0xbc, 0xe4, 0x0, {0x0, 0x1e03}}, @unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x46e, 0xfffc}}}, {{@arp={@broadcast, @empty, 0xffffffff, 0xff000000, 0x9, 0xb, {@mac=@multicast, {[0x0, 0xff, 0x0, 0xff, 0xff]}}, {@mac, {[0x0, 0xff, 0x0, 0x0, 0x0, 0xff]}}, 0x200, 0x9, 0x2, 0x9289, 0x401, 0x218, 'veth1_vlan\x00', 'veth0_macvtap\x00', {0xff}, {}, 0x0, 0x80}, 0xbc, 0xec}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x0, 0x0, 0xffffffff}}}], {{'\x00', 0xbc, 0xe0}, {0x24}}}}, 0x1bf) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) r3 = socket$kcm(0x10, 0x400000002, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfb, {0x0, 0x0, 0x0, r7, {0x0, 0x1}, {0xffff, 0xffff}, {0xffff, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x4000) sendmsg$nl_route_sched(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@newtfilter={0x34, 0x2c, 0xd27, 0x30bd29, 0x25dfdbfc, {0x0, 0x0, 0x0, r7, {0x0, 0xf}, {}, {0x7, 0x9}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x24000014}, 0x20084084) sendmsg$inet(r3, &(0x7f0000000100)={0x0, 0x2, &(0x7f0000000080)=[{&(0x7f0000000140)="600000002e000d190a762d7f089e", 0xfca2}, {&(0x7f0000000280)="68cabf2dfb58fc0a1d6b689866f05d490d010088a8ffff0200258f2e4409b8f9e6aaeb88bea123dc2c6726e89b1ae2f6e8bcb5ee52dcd7298d39093c510293bca0b646a3ce904f6e6b788b3204c233e60ddc", 0x52}], 0x2}, 0x0) r8 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x20000000, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) r9 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r10 = syz_open_procfs(0x0, &(0x7f0000000080)='comm\x00') preadv(r10, &(0x7f00000002c0)=[{&(0x7f0000000540)=""/30, 0x1e}], 0x1, 0x10000000, 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x8, 0x1c, &(0x7f0000000000)=ANY=[@ANYBLOB="1808000000000000000000000000000018110000", @ANYRES32=r9, @ANYBLOB="0000000000000000b7020000140000f83c030000000000008500000005000000bf0900000000000055090100000000009500000000000000b7020000000000007baaf8ff00000000b509080089ffffff7baaf0ff00000000bf8700000000000007070000f8ffffffbfa43452ccd790dccf420000f0ffffffb70200000800000018280000031b4432b6", @ANYRES32=r8, @ANYBLOB="0000000000000000b7050000080000004600000076000000bf98000000000000b5080000000000008500000007000000b7000000000000009500000000000000"], &(0x7f0000000980)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x69) 4.154831587s ago: executing program 5 (id=597): r0 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffd) keyctl$restrict_keyring(0x1d, r0, &(0x7f0000000080)='id_legacy\x00', &(0x7f00000000c0)='$!-\x00') r1 = add_key$keyring(&(0x7f0000000180), &(0x7f00000001c0)={'syz', 0x3}, 0x0, 0x0, r0) keyctl$search(0xa, r0, &(0x7f0000000100)='rxrpc\x00', &(0x7f0000000140)={'syz', 0x3}, r1) keyctl$clear(0x7, r1) r2 = request_key(&(0x7f0000000200)='big_key\x00', &(0x7f0000000240)={'syz', 0x2}, &(0x7f0000000280)='id_legacy\x00', r1) add_key(&(0x7f00000002c0)='ceph\x00', &(0x7f0000000300)={'syz', 0x1}, &(0x7f0000000340)="6ccd008fba2113a766a5f8b8b782ce6072e4b891d5b8d8ee977c87e800e27046008d1bf0508f958c8172ff8020f463e2b4bf2d6ef75c91d3f061f05068fbe2a1b2a48b564f109d7f96b0549a2e7137549ef57f532a14ad0b300e526bc38482c7f9cc35f6bc0d29976c3a6f9b3b6a8e5d057aae620ba9381293a9988c11a63b37eaeb9da03eeeae8790030e19e27090db", 0x90, r0) r3 = add_key$fscrypt_provisioning(&(0x7f0000000400), &(0x7f0000000440)={'syz', 0x0}, &(0x7f0000000480)={0x1, 0x0, @a}, 0x48, 0x0) r4 = add_key$keyring(&(0x7f0000000500), &(0x7f0000000540)={'syz', 0x2}, 0x0, 0x0, r0) keyctl$KEYCTL_MOVE(0x1e, r3, r4, r1, 0x0) r5 = add_key$keyring(&(0x7f0000000600), &(0x7f0000000640)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffc) keyctl$search(0xa, r4, &(0x7f0000000580)='cifs.idmap\x00', &(0x7f00000005c0)={'syz', 0x3}, r5) keyctl$update(0x2, r5, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000680)) keyctl$assume_authority(0x10, r2) keyctl$KEYCTL_PKEY_VERIFY(0x1c, &(0x7f00000006c0)={r1, 0xc8, 0x7b}, &(0x7f0000000700)={'enc=', 'pkcs1', ' hash=', {'blake2b-512-generic\x00'}}, &(0x7f0000000780)="52d596526f54824a80b978571c8fdf41b05a2b0fc8dc6bd9cd279e0f3c0eaa4983defb4804dcb17f1c9c0cc9c62274a9f51a2b48be271713520610a85049f500e905e76f33f441ea96e55a7ad026658e7aaa89542cc0d7c0563668e9dcf174c7422144211b41a4ca24ed4c0515214c213df46d7e24826acec407dea45bf74fdf64363ec5c1f2f8cae5d0a7a73efd943591be77b1b9bbca649f03d06d8b39a44db15d2edaaa5e5d212b9f696531bc63e470413a0d40e860c5aa498369f70ca9a28a19ff25c84a52aa", &(0x7f0000000880)="a9752482d0e9810c00961d16a3ae72f8e64dfe9a6d79f0b4636fcdf90530af5f5d363150d19dc95acdebccdad17baa2ea3daea8fa12a576d195e1d5a17dceaa9bf32e248266f2ce70cbc72c572a97eb3cf1499674f08a5a83252fa0f0e28c9e331b5e20e73611c99ae28d263bce9690ebe428b591a0bbaae9fc23a") r6 = request_key(&(0x7f0000000900)='user\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='syz', r1) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r0, &(0x7f00000009c0)='id_legacy\x00', &(0x7f0000000a00)=@chain={'key_or_keyring:', r6}) keyctl$negate(0xd, 0x0, 0x800, r2) read$FUSE(0xffffffffffffffff, &(0x7f0000000a40)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) keyctl$chown(0x4, r6, 0x0, r8) r9 = accept4$inet(0xffffffffffffffff, &(0x7f0000002a80)={0x2, 0x0, @multicast2}, &(0x7f0000002ac0)=0x10, 0x80800) connect$inet(r9, &(0x7f0000002b00)={0x2, 0x4e21, @multicast2}, 0x10) add_key$fscrypt_provisioning(&(0x7f0000002b40), &(0x7f0000002b80)={'syz', 0x3}, &(0x7f0000002bc0)={0x0, 0x0, @b}, 0x48, r5) keyctl$set_timeout(0xf, r3, 0x8) keyctl$get_persistent(0x16, r7, r1) sendmsg$NFT_BATCH(r9, &(0x7f0000003400)={&(0x7f0000002c40)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000033c0)={&(0x7f0000002c80)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWFLOWTABLE={0x2a0, 0x16, 0xa, 0x201, 0x0, 0x0, {0x0, 0x0, 0xa}, [@NFTA_FLOWTABLE_HOOK={0xe4, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x7ff}, @NFTA_FLOWTABLE_HOOK_DEVS={0x7c, 0x3, 0x0, 0x1, [{0x14, 0x1, 'veth1_to_bridge\x00'}, {0x14, 0x1, 'bond_slave_1\x00'}, {0x14, 0x1, 'bond0\x00'}, {0x14, 0x1, 'ip6tnl0\x00'}, {0x14, 0x1, 'syz_tun\x00'}, {0x14, 0x1, 'nicvf0\x00'}]}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x13}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0xfffffffa}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8}, @NFTA_FLOWTABLE_HOOK_DEVS={0x2c, 0x3, 0x0, 0x1, [{0x14, 0x1, 'team_slave_1\x00'}, {0x14, 0x1, 'wlan0\x00'}]}]}, @NFTA_FLOWTABLE_HOOK={0x17c, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x8a7}, @NFTA_FLOWTABLE_HOOK_DEVS={0xb8, 0x3, 0x0, 0x1, [{0x14, 0x1, 'nr0\x00'}, {0x14, 0x1, 'ip6gretap0\x00'}, {0x14, 0x1, 'netpci0\x00'}, {0x14, 0x1, 'pim6reg\x00'}, {0x14, 0x1, 'lo\x00'}, {0x14, 0x1, 'nr0\x00'}, {0x14, 0x1, 'pim6reg1\x00'}, {0x14, 0x1, 'syzkaller1\x00'}, {0x14, 0x1, 'veth0\x00'}]}, @NFTA_FLOWTABLE_HOOK_DEVS={0xb8, 0x3, 0x0, 0x1, [{0x14, 0x1, 'geneve1\x00'}, {0x14, 0x1, 'bond0\x00'}, {0x14, 0x1, 'pimreg1\x00'}, {0x14, 0x1, 'veth1_to_bridge\x00'}, {0x14, 0x1, 'veth0\x00'}, {0x14, 0x1, 'veth0_to_hsr\x00'}, {0x14, 0x1, 'batadv_slave_1\x00'}, {0x14, 0x1, 'macvlan0\x00'}, {0x14, 0x1, 'vcan0\x00'}]}]}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x1}]}, @NFT_MSG_NEWTABLE={0x34, 0x0, 0xa, 0xb04, 0x0, 0x0, {0x2, 0x0, 0x6}, [@NFTA_TABLE_FLAGS={0x8}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x150, 0x6, 0xa, 0x3, 0x0, 0x0, {0x5, 0x0, 0x3}, [@NFTA_RULE_HANDLE={0xc, 0x3, 0x1, 0x0, 0x1}, @NFTA_RULE_ID={0x8, 0x9, 0x1, 0x0, 0x2}, @NFTA_RULE_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x2}, @NFTA_RULE_POSITION_ID={0x8, 0xa, 0x1, 0x0, 0x3}, @NFTA_RULE_USERDATA={0xcb, 0x7, 0x1, 0x0, "4b3019235f5e965f486d6922c57980376376d1ba5e3e1b60ae0b20b147c105de85dcebe89e6b37b011808744577367ffa9e8cc00445101e52a72bba9508922d8fa56f68e11ce391ad1885c002cfbe3f5fdf352a350d8fb31a90a986f3dd73635d7b335563f232aefcc46b9a3e5b7a16c357e8c785ba2fbc5799b55a59b4b6802d542e920594f8fc3590d26292427e8716e5ea4af098ce47710188efa6d97e908a2ffa4276c724e6c87c6f14146e7744baf131581523b646c13369bf339e10c01995704a1826fe8"}, @NFTA_RULE_POSITION={0xc, 0x6, 0x1, 0x0, 0x1}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_USERDATA={0x32, 0x7, 0x1, 0x0, "186696ccd2ff932eff385bfa9aaa9a230e97451342adbab0ed5edc5896dad41a4c812a556fe47b4d4b7c54204258"}]}, @NFT_MSG_DELRULE={0x2dc, 0x8, 0xa, 0x101, 0x0, 0x0, {0x3, 0x0, 0x1}, [@NFTA_RULE_COMPAT={0x24, 0x5, 0x0, 0x1, [@NFTA_RULE_COMPAT_PROTO_IPV6={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0x88be}, @NFTA_RULE_COMPAT_PROTO_IPV6={0x8, 0x1, 0x1, 0x0, 0x7b}]}, @NFTA_RULE_USERDATA={0x42, 0x7, 0x1, 0x0, "b492c69804ab9a76d2536ccf5c231425cb95a915f4e007e8799cb5cdac99c3ff07c12e52f41d2e2aae5eaf55c7f91f43a7c0d5582b7e136ffbc8e0f97e93"}, @NFTA_RULE_EXPRESSIONS={0x60, 0x4, 0x0, 0x1, [{0x3c, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x2c, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_SREG={0x8, 0x7, 0x1, 0x0, 0x17}, @NFTA_EXTHDR_OP={0x8, 0x6, 0x1, 0x0, 0x2}, @NFTA_EXTHDR_SREG={0x8, 0x7, 0x1, 0x0, 0xb}, @NFTA_EXTHDR_OFFSET={0x8, 0x3, 0x1, 0x0, 0x4b}, @NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0x14}]}}}, {0x10, 0x1, 0x0, 0x1, @inner={{0xa}, @void}}, {0x10, 0x1, 0x0, 0x1, @limit={{0xa}, @void}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x3}, @NFTA_RULE_POSITION_ID={0x8}, @NFTA_RULE_POSITION={0xc, 0x6, 0x1, 0x0, 0x4}, @NFTA_RULE_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x1}, @NFTA_RULE_EXPRESSIONS={0x1a4, 0x4, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @lookup={{0xb}, @void}}, {0x48, 0x1, 0x0, 0x1, @byteorder={{0xe}, @val={0x34, 0x2, 0x0, 0x1, [@NFTA_BYTEORDER_LEN={0x8, 0x4, 0x1, 0x0, 0x8b}, @NFTA_BYTEORDER_OP={0x8}, @NFTA_BYTEORDER_SIZE={0x8, 0x5, 0x1, 0x0, 0xf7}, @NFTA_BYTEORDER_OP={0x8, 0x3, 0x1, 0x0, 0x67240152684d218f}, @NFTA_BYTEORDER_SIZE={0x8, 0x5, 0x1, 0x0, 0x8d}, @NFTA_BYTEORDER_DREG={0x8, 0x2, 0x1, 0x0, 0x9}]}}}, {0x40, 0x1, 0x0, 0x1, @synproxy={{0xd}, @val={0x2c, 0x2, 0x0, 0x1, [@NFTA_SYNPROXY_WSCALE={0x5, 0x2, 0x7}, @NFTA_SYNPROXY_MSS={0x6, 0x1, 0x1, 0x0, 0x186}, @NFTA_SYNPROXY_FLAGS={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_SYNPROXY_FLAGS={0x8, 0x3, 0x1, 0x0, 0x5}, @NFTA_SYNPROXY_WSCALE={0x5, 0x2, 0x9}]}}}, {0x24, 0x1, 0x0, 0x1, @socket={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_SOCKET_LEVEL={0x8, 0x3, 0xbb}, @NFTA_SOCKET_DREG={0x8, 0x2, 0x1, 0x0, 0xc}]}}}, {0x78, 0x1, 0x0, 0x1, @log={{0x8}, @val={0x6c, 0x2, 0x0, 0x1, [@NFTA_LOG_LEVEL={0x8, 0x5, 0x1, 0x0, 0x6}, @NFTA_LOG_FLAGS={0x8, 0x6, 0x1, 0x0, 0x1}, @NFTA_LOG_PREFIX={0x13, 0x2, 0x1, 0x0, 'key_or_keyring:'}, @NFTA_LOG_SNAPLEN={0x8, 0x3, 0x1, 0x0, 0xdc}, @NFTA_LOG_PREFIX={0x13, 0x2, 0x1, 0x0, 'key_or_keyring:'}, @NFTA_LOG_QTHRESHOLD={0x6, 0x4, 0x1, 0x0, 0xd1a}, @NFTA_LOG_FLAGS={0x8, 0x6, 0x1, 0x0, 0x4}, @NFTA_LOG_QTHRESHOLD={0x6, 0x4, 0x1, 0x0, 0xa}, @NFTA_LOG_QTHRESHOLD={0x6, 0x4, 0x1, 0x0, 0xd}, @NFTA_LOG_SNAPLEN={0x8, 0x3, 0x1, 0x0, 0x2}]}}}, {0xc, 0x1, 0x0, 0x1, @osf={{0x8}, @void}}, {0x60, 0x1, 0x0, 0x1, @objref={{0xb}, @val={0x50, 0x2, 0x0, 0x1, [@NFTA_OBJREF_SET_NAME={0x9, 0x4, 'syz2\x00'}, @NFTA_OBJREF_SET_ID={0x8}, @NFTA_OBJREF_IMM_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_OBJREF_IMM_TYPE={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_OBJREF_SET_SREG={0x8, 0x3, 0x1, 0x0, 0xf}, @NFTA_OBJREF_SET_SREG={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_OBJREF_SET_SREG={0x8, 0x3, 0x1, 0x0, 0x12}, @NFTA_OBJREF_SET_NAME={0x9, 0x4, 'syz1\x00'}]}}}]}, @NFTA_RULE_COMPAT={0x2c, 0x5, 0x0, 0x1, [@NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0x18}, @NFTA_RULE_COMPAT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_RULE_COMPAT_PROTO_IPV6={0x8, 0x1, 0x1, 0x0, 0x2b}, @NFTA_RULE_COMPAT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0x89e2}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0xa}}}, 0x728}, 0x1, 0x0, 0x0, 0x4002044}, 0x20048011) keyctl$KEYCTL_MOVE(0x1e, r3, r1, r0, 0x0) add_key$keyring(&(0x7f0000003440), &(0x7f0000003480)={'syz', 0x2}, 0x0, 0x0, r2) keyctl$get_security(0x11, r6, &(0x7f00000034c0)=""/4096, 0x1000) 3.661841096s ago: executing program 5 (id=598): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x43, &(0x7f0000000140)=0x9, 0x4) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r3, 0x0, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000001301000000000200000000008e51a4b1ce93c7ba8737"], 0x1c}], 0x1, 0x0, 0x0, 0x88}, 0x20024044) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = dup(r5) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) socket$kcm(0x29, 0x5, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r5, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x10, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) r8 = socket$inet(0x2, 0x3, 0x5) sendmsg$inet(r8, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) ioctl$EXT4_IOC_ALLOC_DA_BLKS(0xffffffffffffffff, 0x660c) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x1, 0x0, 0x0, 0x2) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xd) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f00001b4000/0x18000)=nil, &(0x7f00000000c0)=[@text32={0x20, 0x0}], 0x1, 0x38, 0x0, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4048aecb, &(0x7f00000002c0)=ANY=[]) ioctl$KVM_GET_VCPU_EVENTS(r2, 0x4048aecb, &(0x7f0000000140)) socket$inet_sctp(0x2, 0x5, 0x84) 3.341513127s ago: executing program 8 (id=599): r0 = socket(0x80000000000000a, 0x2, 0x0) r1 = socket$inet6(0xa, 0x1, 0x8010000000000084) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r4, 0x84, 0x6, 0x0, &(0x7f00000000c0)) ioctl$FBIOGET_FSCREENINFO(0xffffffffffffffff, 0x4602, &(0x7f0000000100)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_emit_ethernet(0x52, &(0x7f0000000300)={@local, @link_local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x44, 0x0, 0x0, 0x0, 0x21, 0x0, @private, @broadcast}, @redirect={0x5, 0x0, 0x0, @private=0xa010102, {0xa, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @dev={0xac, 0x14, 0x14, 0x1}, {[@rr={0x7, 0x13, 0x0, [@multicast2, @private, @broadcast, @dev={0xac, 0x14, 0x14, 0xc}]}]}}}}}}}, 0x0) r5 = openat$adsp1(0xffffffffffffff9c, &(0x7f00000000c0), 0xa0201, 0x0) ioctl$SNDCTL_DSP_SETFMT(r5, 0xc0045005, &(0x7f0000000640)=0x8000) fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e21, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x37}}}, 0x1c) r6 = socket(0x1d, 0x2, 0x6) setsockopt$inet6_group_source_req(r6, 0x6a, 0x2e, 0x0, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}, 0x20000}}, {{0xa, 0x0, 0x40000, @dev={0xfe, 0x80, '\x00', 0x26}}}}, 0x108) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @loopback}}}, 0x108) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001d40)=[{&(0x7f0000000100)=ANY=[@ANYBLOB="2c00000010008100000000000080000000000000", @ANYRES32=0x0, @ANYBLOB="0a043cbf", @ANYRES32, @ANYBLOB="0a001b"], 0x2c}], 0x1}, 0x0) r8 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@newqdisc={0x54, 0x10, 0x1, 0x0, 0x10000000, {0x0, 0x0, 0x0, 0x0, {0x1}, {}, {0xe}}, [@TCA_INGRESS_BLOCK={0x8}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1a, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x800}, 0x0) 1.923509146s ago: executing program 6 (id=600): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prctl$PR_SET_TSC(0x1a, 0x1) ioctl$TCSETA(0xffffffffffffffff, 0x402c542d, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x80001, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_PIT(r3, 0x8048ae66, &(0x7f0000000340)={[{0x122e, 0x3, 0x0, 0x0, 0x0, 0x4, 0xc, 0x0, 0x5, 0xff, 0x1f}, {0xf, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfd, 0x0, 0x9}, {0x0, 0x0, 0x3c, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}]}) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_open_dev$sndctrl(&(0x7f00000000c0), 0x0, 0x0) ioctl$KVM_SET_CLOCK(r3, 0x4030ae7b, &(0x7f0000000040)={0x3, 0xa, 0x7, 0x100000000, 0xc}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, 0x0}], 0x1, 0x1, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x10b200, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) lseek(r7, 0x8, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000600)=[@text64={0x40, &(0x7f00000006c0)="f3440fc7b729000000f20f5f0d00000080460f5ba4b07a000000470f38c9403736460fc7b10f240000660f3881078fa9189021da820001c0fef3440f0966b881000f00d8", 0x44}], 0xaaaabbc, 0x74, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000240)) ioctl$KVM_RUN(r8, 0xae80, 0x0) 1.744225239s ago: executing program 5 (id=601): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x20, 0x403, 0x6030, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x2}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x2, {[@main=@item_012={0x1, 0x0, 0x0, ')'}]}}, 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000940)={0x84, &(0x7f00000004c0)={0x0, 0x14, 0xd, "5e6424818327b2369deca65eb2"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000680)=@newlink={0x40, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2408}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @lowpan={{0xb}, {0x4}}}, @IFLA_ADDRESS={0xa}]}, 0x40}}, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-des3_ede-asm\x00'}, 0x2e) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r3 = accept4(r2, 0x0, 0x0, 0x80800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa693584", 0x35}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e7", 0x9b}], 0x2}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000200)=""/95, 0x5f}, {&(0x7f0000000280)=""/233, 0xe9}], 0x2}, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000600)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000540)={0x20, 0x1, 0x19, "e2e3f47d3c527f10d0fc6b0785b0dd76f645269fca71f41e12"}, 0x0}) 133.320287ms ago: executing program 9 (id=602): r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) getpeername$packet(0xffffffffffffffff, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)=@ipv4_deladdr={0x48, 0x15, 0x8, 0x70bd25, 0x25dfdbfb, {0x2, 0x18, 0xa0, 0xfe, r1}, [@IFA_ADDRESS={0x8, 0x1, @loopback}, @IFA_LABEL={0x14, 0x3, 'vcan0\x00'}, @IFA_LABEL={0x14, 0x3, 'wg0\x00'}]}, 0x48}, 0x1, 0x0, 0x0, 0x44810}, 0x20044004) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r0, &(0x7f00000001c0)={0x8}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$KVM_GET_SUPPORTED_CPUID(r0, 0xc008ae05, &(0x7f0000000200)=""/23) epoll_create(0xb) execveat(r0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000480)={[&(0x7f0000000280)='vcan0\x00', &(0x7f00000002c0)='vcan0\x00', &(0x7f0000000300)='wg0\x00', &(0x7f0000000340)='\\-\x00', &(0x7f0000000380)='\x00', &(0x7f00000003c0)='vcan0\x00', &(0x7f0000000400)='vcan0\x00', &(0x7f0000000440)='wg0\x00']}, &(0x7f0000000600)={[&(0x7f0000000500)='wg0\x00', &(0x7f0000000540)='.)}[{\x00', &(0x7f0000000580)='^\x00', &(0x7f00000005c0)='.#&]:).\x00']}, 0x1000) r3 = openat2(r0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x80d80, 0x8}, 0x18) ioctl$F2FS_IOC_GET_FEATURES(r2, 0x8004f50c, &(0x7f00000006c0)) membarrier(0x2, 0x0) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000700)={0x0}, &(0x7f0000000740)=0x8) setsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000780)={r4, 0x5, 0x6, [0x26e5, 0xff9a, 0x7ff, 0xffc0, 0x7dbd, 0xcd65]}, 0x14) r5 = accept4$inet(r3, &(0x7f00000007c0)={0x2, 0x0, @loopback}, &(0x7f0000000800)=0x10, 0x80000) getsockopt$inet_sctp_SCTP_CONTEXT(r5, 0x84, 0x11, &(0x7f0000000840)={r4, 0x7}, &(0x7f0000000880)=0x8) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f00000008c0)={0x73622a85, 0x1180}) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000900)={'team0\x00', 0x0}) openat$nci(0xffffffffffffff9c, &(0x7f0000000940), 0x2, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x17, &(0x7f0000000980)=0x40, 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f00000009c0), 0xffffffffffffffff) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000a40), r3) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000b40)={&(0x7f0000000a00), 0xc, &(0x7f0000000b00)={&(0x7f0000000a80)={0x58, r7, 0x200, 0x70bd29, 0x25dfdbfc, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xfc}, @ETHTOOL_A_LINKINFO_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}]}]}, 0x58}}, 0x40) r8 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_DEL_VIF(r8, 0x0, 0xcb, &(0x7f0000000b80)={0x1, 0x8, 0xd, 0x80000001, @vifc_lcl_addr=@dev={0xac, 0x14, 0x14, 0x2b}, @local}, 0x10) madvise(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0xa) sendmsg$inet(r0, &(0x7f0000000e40)={&(0x7f0000000bc0)={0x2, 0x4e22, @multicast2}, 0x10, &(0x7f0000000d80)=[{&(0x7f0000000c00)="05703616b56ab0723e158d92789f0136bfdfe055569cc8c856c3d597fab20c97a2baaa438ab72a4b92dae0aa8c1d1773d2f27251cd638aacf1a39e6311151b04404e7cf318203334ef9bb0d04ae8d20945a9cc38c5fe74", 0x57}, {&(0x7f0000000c80)="d6bc62845b12c598649ed8506a200428cdf7bf38efdbe353cb0290f7b51a543fbe9e37f46bfd6b0fdbbc205fd871b16fd8a5f017e49d1bd751a8bfa82e9e94c089f49c7557c14b1c072a63fc260a0413", 0x50}, {&(0x7f0000000d00)="42cc3c3ce0c5702b62432ed28ef35cae758ea8e04224d48c2e1a595d944a96910ea2eee683de33d7679aa08357d4ae1b4cb23c5fbddc7705f371be8a54c05301abc050ee60ac98c60b6306d73af4482e072d5fbd", 0x54}], 0x3, &(0x7f0000000dc0)=[@ip_tos_int={{0x14, 0x0, 0x1, 0xa}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x32}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r1, @multicast2, @multicast2}}}], 0x50}, 0x24002000) r9 = syz_usb_connect$hid(0x5, 0x3f, &(0x7f0000000e80)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0xff, 0x56a, 0x19, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0xc, 0xb0, 0xf, [{{0x9, 0x4, 0x0, 0x1, 0x2, 0x3, 0x1, 0x2, 0x1, {0x9, 0x21, 0x4, 0xf, 0x1, {0x22, 0x3d3}}, {{{0x9, 0x5, 0x81, 0x3, 0x10, 0xdf, 0x7}}, [{{0x9, 0x5, 0x2, 0x3, 0x8, 0x8, 0x7, 0x5}}]}}}]}}]}}, &(0x7f0000001100)={0xa, &(0x7f0000000ec0)={0xa, 0x6, 0x300, 0xff, 0xf7, 0x10, 0x10, 0x4}, 0x12d, &(0x7f0000000f00)={0x5, 0xf, 0x12d, 0x5, [@ssp_cap={0x20, 0x10, 0xa, 0x1, 0x5, 0x1, 0xf0f, 0x2, [0xc03f, 0xffff00, 0xff3f0f, 0x30, 0xffc180]}, @ptm_cap={0x3}, @generic={0xee, 0x10, 0x4, "b0b705f0ac9ebe85b0a1f2b79d6d7b2ccd27cb5b62324b08505bf89372e9122a65900f99b74da1545425e1d68cb8a4ede8c3acde3efa3b323629cd91c44bce901e3f00c5c174d9c0b113bac123ec2930877d117ffa2e371b5b05c11cba84ffd061d96430ed1d7eeec4c512b9449e3bc41cdafa3acf06d7ebef5e972f5b5271332eb29899e3c2adbbc281f3804ac937cd769aa5a4bfa1d06b2af434aa79c275db4655fd1e2a41a409357b051c98a4b30adf05fda8ebebc830083871cfb6b86d684349d6acc37a76d4a11ee440dad5bc0c6067df849cded3c992742bd837a4dcd570fa3d68ceee3f3ee45441"}, @ss_container_id={0x14, 0x10, 0x4, 0x81, "d3934de8adf047ada1619b4b664bbfa5"}, @ptm_cap={0x3}]}, 0x3, [{0x4, &(0x7f0000001040)=@lang_id={0x4, 0x3, 0x409}}, {0x4, &(0x7f0000001080)=@lang_id={0x4, 0x3, 0x420}}, {0x4, &(0x7f00000010c0)=@lang_id={0x4, 0x3, 0x41e}}]}) syz_usb_control_io$hid(r9, &(0x7f0000001340)={0x24, &(0x7f0000001140)={0x0, 0x22, 0x56, {0x56, 0xb, "b0ac89c08e1fc68c45b24a56676bd5f7541666498057c862a53c14fb2c1194b4c2f0c244f5b4da298d95dc82799e34641dc319ddae7824ed20326ea0e5b152f98743ec2fab380138da8b5a9b1dd6c2309185c438"}}, &(0x7f00000011c0)={0x0, 0x3, 0xdd, @string={0xdd, 0x3, "1a389f1f65743863bd4d4b033964199139c9c8e8ec4a75e4aac5341e5d38410d0422830f7772293ba310559834084a0028c62884f8d3352d520fd30d74ef84bf6f08cbbad8663e01e8be07de668a0d3b44c9fb812ed3d7c3f99bb6b86f5d7bceb15b7ec41053aca8fd2e4f161f7f34678049c2ec794b4991911440b2fc759469015a0dbad6ad2d29f6dab418a08dea26db229cd27dc2a5c437ac185cb8696a9d6ad8140c0494aa2233fbc05b0bc9eedf7fd6ff7a10d4f9ba0a6b6e5b05ac986f7322ea134db9e26444ef598fcfeff14ea605e5881da9396a621e44"}}, &(0x7f00000012c0)={0x0, 0x22, 0x7, {[@local=@item_012={0x1, 0x2, 0x3, "e4"}, @main=@item_4={0x3, 0x0, 0x0, "f215eb8e"}]}}, &(0x7f0000001300)={0x0, 0x21, 0x9, {0x9, 0x21, 0xb1b2, 0xc, 0x1, {0x22, 0xc99}}}}, &(0x7f0000001580)={0x2c, &(0x7f0000001380)={0x20, 0x15, 0xe7, "314f1196d2ca835892ff8a3cc2acfb889f6ce821478ebfbe1f841db24792cd2ffdc0cbda97046a236559b34502e798fa3f0c537148380c5eb9aad7d292c3559d99181a595099b9bfd3ddacbd2eea9659b679e680f03dd41574561b1f957c7ea0dca7a8128bfbc68a659f7304908380c596adade56506559966aa45f98207b6669ac5916c8609d134fd88e517485264c4a97887ee19c4cad17dee74f3e0cd261e4e0c336537e03ae81ce8a5eeb94fb94efbf974ea878cdd59392470bda79aa18f548b9cfbf16b3b579a66aa2d1b01b49eab570c19c240818b87f723ce85030d9b803b279ce7adff"}, &(0x7f0000001480)={0x0, 0xa, 0x1}, &(0x7f00000014c0)={0x0, 0x8, 0x1, 0xa}, &(0x7f0000001500)={0x20, 0x1, 0x29, "418c7cbeb6802ebcbbdba8b9ed24aaa05925882e0e5a9b257544c671fb5718351479287127c9bfa17c"}, &(0x7f0000001540)={0x20, 0x3, 0x1, 0x2}}) close_range(r8, r2, 0x0) sendmsg$DEVLINK_CMD_RATE_NEW(r0, &(0x7f00000017c0)={&(0x7f00000015c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000001780)={&(0x7f0000001640)={0x108, 0x0, 0x400, 0x70bd2d, 0x25dfdbfb, {}, [@DEVLINK_ATTR_RATE_NODE_NAME={0xa3, 0xa8, @random="24a2a4f7f7934415fdf80a14ea20155d606031f74c94937b2cfbb385468c76244d9d2353e46c47ba32dfd41e3a03e04a633bab705f1cf5deb346de476bd4c4986a09a43d88db91167a363828f0c1c6eb4bc4b4c4822ddeec639b0427622f26419741973265d58c7ff6fa2d9fafccc175bc4e9b6b2a79ba1c3cfd54d936a01bc41d164aaa98ab3ccbb086e242326779bdb969f78981fbdce99ebe35b14c562e"}, @DEVLINK_ATTR_PORT_INDEX={0x8}, @DEVLINK_ATTR_RATE_TX_MAX={0xc, 0xa7, 0x80}, @DEVLINK_ATTR_RATE_PARENT_NODE_NAME={0xe}, @DEVLINK_ATTR_RATE_PARENT_NODE_NAME={0xf, 0xa9, @name2}, @handle=@pci={{0x8}, {0x11}}]}, 0x108}, 0x1, 0x0, 0x0, 0x41}, 0x800) 0s ago: executing program 0 (id=603): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x191400) write$sndseq(r0, &(0x7f0000000100)=[{0xc, 0x9, 0x7, 0x4, @tick=0x5, {0x5, 0x10}, {0x1, 0x6}, @ext={0x8f, &(0x7f0000000040)="824369400577116c2953daed2714189bd58e6a3b9658707f7c94e0c7254c25f48d3de0d4fd671e39a56eaa5e93486637db00d3325bb9ce52d4012c19264e887074126cd218e87f141a0c3413cbe85819e7c3c4364a8b51480236205efd0f7085d08213867df55161a907c93d0c6e638e922e9fcb7252f634114a60e553e8cd7869ba8f436380abee8574125b3a42a0"}}, {0x7, 0x7, 0x5, 0x5, @time={0x5, 0x7}, {0x6, 0x4}, {0x3, 0x3}, @time=@tick=0x6}, {0x1, 0x5, 0x1, 0x9, @tick=0xb5f, {0xf1, 0xf3}, {0x0, 0x1}, @connect={{0x54}, {0x7, 0x2}}}], 0x54) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x202681, 0x0) write$tun(r1, &(0x7f00000001c0)={@void, @val={0x3, 0x4, 0x5, 0x15b, 0xd7, 0xc}, @llc={@snap={0xaa, 0x1, "1b", "3fcb69", 0x8100, "313650dd8a710cf17d2d511d057a0fe2faae593533ebb2ae6f7e1960911f20c7939ff9fe36442a8a9f2482b3f407c48a96c3db03dde58d374f516f405a7a0c8408796817faf715c1778e670b71478671a641e84f3321c794ed6375365b9f5c5d9c7a9c767940843533726da439384f207164e05661d8b1adbbd2216e9b31ccda45140680"}}}, 0x96) r2 = add_key$keyring(&(0x7f0000000300), &(0x7f0000000340)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000280), &(0x7f00000002c0)={'syz', 0x2}, 0x0, 0x0, r2) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x14, 0x9, 0x6, 0x3, 0x0, 0x0, {0x3, 0x0, 0xa}}, 0x14}, 0x1, 0x0, 0x0, 0x4000800}, 0x1132b321a9c35cb1) r3 = accept4$inet6(0xffffffffffffffff, &(0x7f0000000480)={0xa, 0x0, 0x0, @private1}, &(0x7f00000004c0)=0x1c, 0x80000) connect$inet6(r3, &(0x7f0000000500)={0xa, 0x4e21, 0x800, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x2ec5}, 0x1c) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000780)='./cgroup.net/syz0\x00', 0x200002, 0x0) syz_clone3(&(0x7f00000007c0)={0x0, &(0x7f0000000540), &(0x7f0000000580), &(0x7f00000005c0), {0x16}, &(0x7f0000000600), 0x0, &(0x7f0000000640)=""/223, &(0x7f0000000740), 0x0, {r4}}, 0x58) r5 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000840)={0x1b, 0x0, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x5, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x1, 0x3, 0x0, @void, @value, @void, @value}, 0x50) r6 = openat$dlm_control(0xffffffffffffff9c, &(0x7f00000008c0), 0x0, 0x0) r7 = signalfd4(r0, &(0x7f0000000900)={[0x8001]}, 0x8, 0x80800) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000b80)={'syztnl1\x00', &(0x7f0000000b00)={'gretap0\x00', 0x0, 0x10, 0x8, 0x2, 0xb8d, {{0x12, 0x4, 0x1, 0x20, 0x48, 0x68, 0x0, 0x2, 0x2f, 0x0, @broadcast, @empty, {[@rr={0x7, 0xb, 0x1e, [@rand_addr=0x64010102, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @timestamp={0x44, 0xc, 0xb3, 0x0, 0x4, [0x9cf6, 0x3]}, @timestamp_prespec={0x44, 0x14, 0x98, 0x3, 0x0, [{@local}, {@broadcast, 0xf}]}, @lsrr={0x83, 0x7, 0x69, [@dev={0xac, 0x14, 0x14, 0x15}]}]}}}}}) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000c00)={0xffffffffffffffff, 0xfffffffd, 0x4e2f95659af1d33c}, 0xc) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000cc0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000c40), &(0x7f0000000c80)='%+9llu \x00'}, 0x20) r11 = bpf$MAP_CREATE(0x0, &(0x7f0000000d00)=@base={0x7, 0x1, 0x6, 0x4, 0x8000, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x3, 0x5, 0x0, @value, @void, @void, @value}, 0x50) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000d80)={0x0, 0x2, 0x10}, 0xc) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000dc0)={0x1, 0xffffffffffffffff}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000e40)={0xe, 0x23, &(0x7f0000000940)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xd2800000, 0x0, 0x0, 0x0, 0x1c68}, {{0x18, 0x1, 0x1, 0x0, r5}}, {}, [@kfunc={0x85, 0x0, 0x2, 0x0, 0x5}, @ldst={0x0, 0x2, 0x6, 0x9, 0x3, 0xc, 0x8}, @tail_call={{0x18, 0x2, 0x1, 0x0, r6}}, @func={0x85, 0x0, 0x1, 0x0, 0x8}, @tail_call={{0x18, 0x2, 0x1, 0x0, r7}}, @call={0x85, 0x0, 0x0, 0x56}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, 0x1}}, @alu={0x7, 0x1, 0x9, 0x5, 0x4, 0xfffffffffffffffe, 0x1}, @func={0x85, 0x0, 0x1, 0x0, 0x4}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000a80)='syzkaller\x00', 0x8000, 0x1f, &(0x7f0000000ac0)=""/31, 0x41100, 0xe, '\x00', r8, @sk_skb=0x26, 0xffffffffffffffff, 0x8, &(0x7f0000000bc0)={0x7, 0x4}, 0x8, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000e00)=[r9, r10, r11, r12, r13], 0x0, 0x10, 0x3, @void, @value}, 0x94) r14 = fcntl$dupfd(r5, 0x406, r13) add_key$user(&(0x7f0000000f00), &(0x7f0000000f40)={'syz', 0x3}, &(0x7f0000000f80)="8e8de7d2c9290816ab8b4549c8cc73671578c6f26faca031445797320b2ecb291247582ffe049352d81b82aef80187e41765c2632258d43cca4be9", 0x3b, r2) ioctl$TIOCGISO7816(r6, 0x80285442, &(0x7f0000000fc0)) r15 = syz_open_dev$ptys(0xc, 0x3, 0x0) ioctl$VFAT_IOCTL_READDIR_SHORT(r15, 0x82307202, &(0x7f0000001000)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) ioctl$IOCTL_GET_NCIDEV_IDX(r14, 0x0, &(0x7f0000001380)=0x0) sendmmsg(r6, &(0x7f0000001ac0)=[{{&(0x7f0000001240)=@rc={0x1f, @any, 0x60}, 0x80, &(0x7f0000001340)=[{&(0x7f00000012c0)="59a3649c7f7c9a879b6a73e064110fb8b9a9ceaaf8792759635f72a9063ad3b125e4698f79aa4ea48bd60d5638fb3c25a0b1f20e5b1818f57870d00e492310c13ec689bee805b805b4db420d1ac07dffb6e85e6b7c9621e1e30ba046d19d29402c72b67dc0c3589d1de719ba56e6b3a93f6476dadb9e2df0228bfd3c549119", 0x7f}], 0x1}}, {{&(0x7f00000013c0)=@nfc_llcp={0x27, r16, 0xffffffffffffffff, 0x4, 0x2, 0x1, "0e5a0344b2c0b31db92e2ad6d494e56acdf91eee8d7c5d6363e5b3ffb4bdfa50f30c746af7b61197013762378880fb54a5a2aa6ad1857a9514023c708414e0", 0x38}, 0x80, &(0x7f0000001640)=[{&(0x7f0000001440)="4e3b286d98f8757a4f70dea18ce036f9f709c44af13512348b1c66834e17d152d49a20066cda0dbff488eb8e2d6042c99bbea3ed5a05e5b50460201fd3c10dc2180826942491e93df28607489462d06aa3e9eb281f8809bed6f82cc93bd64bc354400fd706a7dc5173471935666165b13939f823d5b5d1c55c5df05821206a1c7d694af750a60f148ff43a3299fb0cd7310c95457709f2b1a3a0d62abfba6f95e1db4364871d8b1453d9f647533da544eec7d833492acad6626acf39d12ce2a10b0e6652", 0xc4}, {&(0x7f0000001540)="386219f03d05fde685a192ec4c5ad7da7a9a4f32e414906e92b1dc12fb162a4ff79fc6421239bf9002bf464eee435f76fd77e6351c6fb2cd8afe6b27707b83d6d208a9c3d9499c52079fc8cd64db13c16f92ff4c8b0bb07669a7fbd7409d98ccd41e6daaf1ce1d99b33c5c076f1ffebfda228ccc6cb8451607f160fb3645f446843e25855d55ecaf659db6a6a5eec8f685bd6e208ee4fed6b0cfb4f8a4e2c957b3b6501f852c9a48f4c98f14c0fcea116bca1d96bdc03d6ebbea34751dc487a7df207475e5d191f07866a07a0c36172fcdfd94ac40e6743e1af2f28994fb60685e2d39c2b80eca5bb6677f048391f9d309d5163293653a57609bd57a8272", 0xfe}], 0x2}}, {{&(0x7f0000001680)=@ax25={{0x3, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x3}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bcast, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @null, @null, @null]}, 0x80, &(0x7f00000018c0)=[{&(0x7f0000001700)="975a59c32fc4ebf8b07cf59235543542ce56f0792ec4f8a16b34d20742c712172872b50879a033cad8f7492ea061c3a364a589ddd917bb6977f602cb7cde745cb3cea80cdf5d1f7ba9ee6f9629685cb9d19190a4403e1623bc89cf55fbeac4dd03c3c5a06945f3124701cd4752777674dca6c89d03652d505d3f26b1fda0c5233f9e634245f69b0fad6f1bf8cdba93ffead9f4fee2d01cd3", 0x98}, {&(0x7f00000017c0)="ec1d8fe996809a0aaa05f3b6abc31e030609798d21cf22a93dac40409449a7df5409818d359f9d1f55215304dd40a3b6dee104de1aa91c041e3e565902fd8f598db0f676560a2b6d4b4751ee4b98f4caec909993f850384472fd02a159b9dfc679a788409478463cb50c7924b053df92a73acfe87810a14c0a66d09a16b76aec8a7410989acaebe204cc08ba40f4a9d916f609a04660533c8b6ae36f6c9b05d9ea3aaec816c374a3c23ff307f86f74dc876d0fcac0b78aa823a62f8f038f3a5d0147057a57cffce087440681285c7c19d2154239b220623ac318507a1082f9cf5745be9ee7ef5f7d9aa6ac290699fa912d50c56e29fe525fd2d44442271b", 0xfe}], 0x2, &(0x7f0000001900)=[{0x20, 0x104, 0x10, "a28b36b1287a9658b67e5ae4cc92"}, {0x100, 0x80, 0x6, "355644f1bf2733236793a512907493c13f7967ad96fd82fc7273b8d58f75df2f97d74e573f0a3652f53dd81664e7ac0cd66386d6c50fb0bcd7e023937177872a4bd03fe048024cca90760ab2a1266496c81dac9a2c597c747109aa379f92532482c6a2f1f3141b2bc4bfecdae33a4da52f0039b1cb8423b80df4e03c6a7c2ec8f82ff9e0d7d6684264f229abbeadeb7e3e7d9fdaa0a7621b104dd8e79228408085cd92567c4848aebf750f4b3ca7ed5c2f835c9928596125d56ab3634b1a5208cb276fb90962038c793c56b16116a0fc9cc50e0cc42221f7a75f3f30f4c0ec158af30fecfc8263652c"}, {0x48, 0x103, 0x6, "9ced57991c7b1fc429c0a50723325086826ede516a2f626c92a92223dd0fe653e5b7e267d287aad99bad9f2103dc38472241"}, {0x40, 0x10f, 0x3, "84f5de41d68bd05c9f42cccc10abca10dd6dff63e6ded266158c64d305c12e0a9fd9c06d7ea2eaeae5985eb77e"}], 0x1a8}}], 0x3, 0x801) r17 = socket$kcm(0x29, 0x7, 0x0) sendmsg$kcm(r17, &(0x7f0000002300)={&(0x7f0000001b80)=@ethernet={0x306, @remote}, 0x80, &(0x7f0000002040)=[{&(0x7f0000001c00)="f1e3dec3350e8f72d781216b4faf7f19ffa2cf6e01ca10e6b76fc219b803671ab4a882a8dfaa6c0f42a3ee16133491c44117067c9b96354579653a6ebab46160d497d3b8b658e2b6621e81202577303b7c49b95a8514d924321dd785daaca0ca066ec0f85027738c3b156654526046b46cec885bd0b4b144f774d6a077fc563f", 0x80}, {&(0x7f0000001c80)="d12700f28996452056cdb0e7ca0818bcb0bc1d6e3d371954e0e1b9315a7f1dded4ba7fe860d910b416326b02b98da50400056fb2deac7075998c092a416cd58dee75b4ff1ad5d775274ea33c93905f2a70eff7844f9198e8a1a1097d8ff828d24a40a781b55596aefa43740c3165d77570d127bacd67b5a49e9c148471256b25763baaa6f6f156e1f581ac3b2013635a65ee80dece521f846e35e02589cca0c93405c9e7", 0xa4}, {&(0x7f0000001d40)="c83f8d2a0d1152533ad5cd61700f0136b70a42d7f47d9e24525422ca976ef745ea5d27c7a9429d3f130181af87db9739f4ea63896a59e73af7a4d8c49178ffd3c539a0eaf978b298960078d5f406e2b85eaf0211d555ffa99375b7ff380dde20ce38c54d670aa2832ef7d9f3286242a0a724e246ed3e7c6a2f5cad59e27c49fc3c75d88819718a73decbea4573f84dd592187c5e93e8c0c1193c977851e47b9ac70fb50729ee6b2d7a9412a704869d44b5c6927e05a8263a814d4dfeded834487b4f7328b3572ba5c8f44d1cdfc8d8962c965635e562b9563a59edfeabb0aca88b306f", 0xe3}, {&(0x7f0000001e40)="3df27cd0404c8813f6553dc0c8e7c1c885e7691c93f820b78fc09e265820c5bde7831f303c5370e76ef82acad706ba5512e4f5cab84c71e6a96a80d751dae7fbbb6754269693e528413c0abeb924489a257b03491010215e5db8a44499e2a369fcb7a9f86fe9aa49e7c2ed7e3d0805ad21344176abe5e536a9d1cf71e394d6176d06262f0ced44b173198f88ec26ad3ca1763be54fbba98b80c4c0cd9b12826a8836c5b471867d159a2182162178531fe04a6b2ef25ed1af0db429e478c213ffd4491ce9f048bc", 0xc7}, {&(0x7f0000001f40)="3a3f0b0c4760030ffea19504319acbbe9b827779490ec1e2ea3e6abc3c15f188295d09a58233750a7a8274367db8d98cad5e0158ef7308be5740c89fdc5820214218399a3b219ccae0f28440665dea6b7c", 0x51}, {&(0x7f0000001fc0)="7b5127af", 0x4}, {&(0x7f0000002000)="1847b24f78613f30d6afbde5bace60d7be09c5", 0x13}], 0x7, &(0x7f00000020c0)=[{0x60, 0x109, 0x10, "081decd64b0d67e1dd8fd13d89d67e23318b6af5455cfe80e0f2caeede747ee226da24be6b700ac5ebafc257a72a2caf017ba84b1957015b0a0fd81bf5e76c61db1148d812743cc05a48f9a35c3c"}, {0xc8, 0x10d, 0x0, "78bc94d69740c475af2357056c69a480da9e7903fe7ce95f5b23001bf105b8774be404e664b4676b632cf64e1712a868bfd4e829569b682889ff8c7316e9e33106d895be66743b73e27dc965b8c579f03f97984d3986122dfe01e522160da653d565c8e72ecb8e6ca529bd9441b03421faeeb8198458f2e730f8206389a64e175ff29a89c604a29f320e0969aca18ba9fda657f1f07cfacbc8d568e42ddb63adae1b7db787e15caab349a42546f17667e141c49c23"}, {0x110, 0x110, 0x7, "e3b11edb5950802bbbe4f9732bbdca44679c74ebeaa56e341c097ffaea7c52f329f62802333e1623577ad88263a02b3bf726c35b4a029f51ed382deb2fd3cddc90e6f1dcdecc9e78011b30db99308dc67fff88ccb535f4f969b94806fa6f68204e784987234ce63ed6dd982b05c9123af9edf6c9e91d0e8536dc47c0cd668518cf97ccc22ddbc9b4f8b176263aafb75f1f1755943e49e738fb407d904ccf41fb3ea5b01e1563d3a794431f7a3942f6581282c8c399963c7fb8511debd09416f9510beb377562dea92c273c0467c38cb64db9f5f7cb2491c23d22aa8852776d8476e867629307e2052328d17aeb17a2e6de302352fa70606e0909b4a293994e"}], 0x238}, 0x240480c3) kernel console output (not intermixed with test programs): : New USB device found, idVendor=2040, idProduct=c603, bcdDevice= 1.8e [ 219.035691][ T977] usb 6-1: USB disconnect, device number 3 [ 219.223179][ T5950] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 219.308901][ T5950] usb 3-1: config 0 descriptor?? [ 219.331987][ T5950] usb 3-1: dvb_usb_v2: found a 'Hauppauge 126xxx ATSC+' in warm state [ 219.380381][ T9] ath9k_htc 7-1:1.0: ath9k_htc: Target is unresponsive [ 219.426828][ T9] ath9k_htc: Failed to initialize the device [ 219.482145][ T120] usb 7-1: ath9k_htc: USB layer deinitialized [ 219.532299][ T5950] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 219.580304][ T5950] dvbdev: DVB: registering new adapter (Hauppauge 126xxx ATSC+) [ 219.601148][ T5950] usb 3-1: media controller created [ 219.718747][ T5950] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 220.664421][ T7342] block device autoloading is deprecated and will be removed. [ 220.726431][ T30] audit: type=1326 audit(1747770605.899:55): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7361 comm="syz.5.342" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb4e038e969 code=0x7ffc0000 [ 220.878688][ T7342] syz.4.334: attempt to access beyond end of device [ 220.878688][ T7342] md2: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 220.929252][ T30] audit: type=1326 audit(1747770606.079:56): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7361 comm="syz.5.342" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb4e038e969 code=0x7ffc0000 [ 220.961661][ T30] audit: type=1326 audit(1747770606.079:57): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7361 comm="syz.5.342" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fb4e038d2d0 code=0x7ffc0000 [ 221.005176][ T30] audit: type=1326 audit(1747770606.079:58): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7361 comm="syz.5.342" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fb4e038e56b code=0x7ffc0000 [ 221.196768][ T30] audit: type=1326 audit(1747770606.079:59): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7361 comm="syz.5.342" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fb4e038e56b code=0x7ffc0000 [ 221.220192][ T30] audit: type=1326 audit(1747770606.099:60): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7361 comm="syz.5.342" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fb4e038e56b code=0x7ffc0000 [ 221.226811][ T977] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 221.242656][ T30] audit: type=1326 audit(1747770606.099:61): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7361 comm="syz.5.342" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fb4e038e56b code=0x7ffc0000 [ 221.285111][ T30] audit: type=1326 audit(1747770606.229:62): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7361 comm="syz.5.342" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fb4e038e56b code=0x7ffc0000 [ 221.366809][ T30] audit: type=1326 audit(1747770606.319:63): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7361 comm="syz.5.342" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fb4e038e56b code=0x7ffc0000 [ 221.436475][ T30] audit: type=1326 audit(1747770606.609:64): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7361 comm="syz.5.342" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fb4e038e56b code=0x7ffc0000 [ 221.584465][ T977] usb 6-1: too many endpoints for config 4 interface 0 altsetting 0: 79, using maximum allowed: 30 [ 221.690981][ T977] usb 6-1: config 4 interface 0 altsetting 0 has an endpoint descriptor with address 0x32, changing to 0x2 [ 221.712869][ T977] usb 6-1: config 4 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 91 [ 221.723531][ T977] usb 6-1: config 4 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 79 [ 221.741316][ T977] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 221.797341][ T977] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 221.835263][ T7362] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 221.957345][ T5950] set interface failed [ 221.957767][ T5950] usb 3-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 222.107734][ T5950] error writing reg: 0xff, val: 0x00 [ 222.222006][ T7367] syzkaller1: entered promiscuous mode [ 222.296612][ T7367] syzkaller1: entered allmulticast mode [ 222.401917][ T5950] dvb_usb_mxl111sf 3-1:0.0: probe with driver dvb_usb_mxl111sf failed with error -22 [ 222.444584][ T5950] usb 3-1: USB disconnect, device number 29 [ 222.826467][ T1215] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 222.982495][ T977] ath6kl: Failed to submit usb control message: -110 [ 223.007908][ T1215] usb 7-1: Using ep0 maxpacket: 32 [ 223.036576][ T977] ath6kl: unable to send the bmi data to the device: -110 [ 223.044365][ T977] ath6kl: Unable to send get target info: -110 [ 223.070855][ T1215] usb 7-1: unable to get BOS descriptor or descriptor too short [ 223.113649][ T1215] usb 7-1: unable to read config index 0 descriptor/start: -71 [ 223.131462][ T977] ath6kl: Failed to init ath6kl core: -110 [ 223.155595][ T1215] usb 7-1: can't read configurations, error -71 [ 223.171995][ T977] ath6kl_usb 6-1:4.0: probe with driver ath6kl_usb failed with error -110 [ 223.224017][ T977] usb 6-1: USB disconnect, device number 4 [ 223.241882][ T24] usb 4-1: new high-speed USB device number 44 using dummy_hcd [ 223.331708][ T7388] capability: warning: `syz.4.348' uses 32-bit capabilities (legacy support in use) [ 223.435986][ T24] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 223.454159][ T24] usb 4-1: config 0 has no interfaces? [ 223.471714][ T24] usb 4-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 223.496425][ T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 223.515032][ T24] usb 4-1: config 0 descriptor?? [ 223.596463][ T5894] usb 5-1: new high-speed USB device number 37 using dummy_hcd [ 223.759204][ T5894] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 223.803228][ T7385] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 223.807925][ T5894] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 223.850526][ T7385] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 223.878749][ T5894] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 223.890900][ T120] usb 4-1: USB disconnect, device number 44 [ 223.930316][ T9] usb 6-1: new full-speed USB device number 5 using dummy_hcd [ 223.968781][ T5894] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 223.990992][ T5894] usb 5-1: config 0 descriptor?? [ 224.122482][ T9] usb 6-1: New USB device found, idVendor=1d50, idProduct=60a1, bcdDevice=a1.4f [ 224.150167][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 224.161819][ T9] usb 6-1: Product: syz [ 224.175323][ T9] usb 6-1: Manufacturer: syz [ 224.189089][ T9] usb 6-1: SerialNumber: syz [ 224.212820][ T9] usb 6-1: config 0 descriptor?? [ 224.227008][ T120] usb 4-1: new high-speed USB device number 45 using dummy_hcd [ 224.398605][ T120] usb 4-1: Using ep0 maxpacket: 16 [ 224.407304][ T5894] plantronics 0003:047F:FFFF.000C: unknown main item tag 0x0 [ 224.414845][ T1215] usb 7-1: new full-speed USB device number 5 using dummy_hcd [ 224.441328][ T5894] plantronics 0003:047F:FFFF.000C: unknown main item tag 0x0 [ 224.457501][ T120] usb 4-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 224.466906][ T120] usb 4-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 224.478603][ T120] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 224.497775][ T5894] plantronics 0003:047F:FFFF.000C: unknown main item tag 0x0 [ 224.500022][ T120] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 224.514695][ T5894] plantronics 0003:047F:FFFF.000C: No inputs registered, leaving [ 224.527199][ T120] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 224.540210][ T120] usb 4-1: Product: syz [ 224.544602][ T120] usb 4-1: Manufacturer: syz [ 224.549805][ T120] usb 4-1: SerialNumber: syz [ 224.559764][ T5894] plantronics 0003:047F:FFFF.000C: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 224.599804][ T1215] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 224.639241][ T9] airspy 6-1:0.0: Board ID: 00 [ 224.646608][ T1215] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 224.675997][ T9] airspy 6-1:0.0: Firmware version: [ 224.735393][ T1215] usb 7-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 224.776651][ T1215] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 224.785239][ T1215] usb 7-1: Product: syz [ 224.854317][ T1215] usb 7-1: Manufacturer: syz [ 224.887306][ T1215] usb 7-1: SerialNumber: syz [ 224.907469][ T9] airspy 6-1:0.0: usb_control_msg() failed -71 request 0e [ 224.974562][ T9] airspy 6-1:0.0: Registered as swradio24 [ 225.046042][ T9] airspy 6-1:0.0: SDR API is still slightly experimental and functionality changes may follow [ 225.071314][ T9] usb 6-1: USB disconnect, device number 5 [ 225.167200][ T7394] netlink: 16 bytes leftover after parsing attributes in process `syz.6.351'. [ 225.210869][ T7394] netlink: 16 bytes leftover after parsing attributes in process `syz.6.351'. [ 225.251468][ T7394] usb usb8: usbfs: process 7394 (syz.6.351) did not claim interface 0 before use [ 225.802950][ T7403] fuse: Unknown parameter 'grou' [ 225.891090][ T7406] IPVS: sync thread started: state = BACKUP, mcast_ifn = lo, syncid = 5, id = 0 [ 226.146532][ T7410] netlink: 12 bytes leftover after parsing attributes in process `syz.2.353'. [ 226.455560][ T1215] usb 7-1: cannot find UAC_HEADER [ 226.568013][ T7417] xt_TCPMSS: Only works on TCP SYN packets [ 226.596899][ T5887] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 226.699433][ T1215] snd-usb-audio 7-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 226.701836][ T120] usb 4-1: 0:2 : does not exist [ 226.756488][ T5887] usb 3-1: Using ep0 maxpacket: 32 [ 226.775833][ T5887] usb 3-1: config 0 interface 0 has no altsetting 0 [ 226.793761][ T5887] usb 3-1: New USB device found, idVendor=2040, idProduct=c603, bcdDevice= 1.8e [ 226.876809][ T5887] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 226.890121][ T1215] usb 7-1: USB disconnect, device number 5 [ 226.895481][ T120] usb 4-1: USB disconnect, device number 45 [ 226.920996][ T5887] usb 3-1: config 0 descriptor?? [ 226.979523][ T5887] usb 3-1: dvb_usb_v2: found a 'Hauppauge 126xxx ATSC+' in warm state [ 227.034930][ T5887] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 227.184461][ T5887] dvbdev: DVB: registering new adapter (Hauppauge 126xxx ATSC+) [ 227.238997][ T5887] usb 3-1: media controller created [ 227.251969][ T5885] udevd[5885]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 227.458458][ T5894] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 227.512366][ T5979] udevd[5979]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 227.528778][ T1215] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 227.541511][ T5887] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 227.647309][ T5894] usb 6-1: Using ep0 maxpacket: 8 [ 227.667236][ T5894] usb 6-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 227.676938][ T5894] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 227.706530][ T1215] usb 7-1: Using ep0 maxpacket: 16 [ 227.743431][ T1215] usb 7-1: New USB device found, idVendor=054c, idProduct=0038, bcdDevice=16.f5 [ 227.758621][ T1215] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 227.781880][ T5894] pvrusb2: Hardware description: Terratec Grabster AV400 [ 227.810120][ T5894] pvrusb2: ********** [ 227.829874][ T1215] usb 7-1: Product: syz [ 227.842320][ T5894] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 227.854164][ T1215] usb 7-1: Manufacturer: syz [ 227.884616][ T1215] usb 7-1: SerialNumber: syz [ 227.905985][ T5894] pvrusb2: Important functionality might not be entirely working. [ 227.941269][ T1215] usb 7-1: config 0 descriptor?? [ 227.948870][ T5894] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 227.984877][ T1215] visor 7-1:0.0: Sony Clie 3.5 converter detected [ 227.996377][ T5894] pvrusb2: ********** [ 228.014759][ T2342] pvrusb2: Invalid write control endpoint [ 228.259303][ T7424] 8021q: adding VLAN 0 to HW filter on device bond1 [ 228.404268][ T7423] usb 3-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 228.472527][ T7423] error writing reg: 0x1a, val: 0x1e [ 228.669585][ T1215] usb 7-1: clie_3_5_startup: get interface number bad return length: 0 [ 229.047945][ T1215] visor 7-1:0.0: probe with driver visor failed with error -5 [ 229.062374][ T2342] pvrusb2: Invalid write control endpoint [ 229.097548][ T2342] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 229.127083][ T1215] usb 7-1: USB disconnect, device number 6 [ 229.168089][ T2342] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 229.215346][ T2342] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 229.349013][ T2342] pvrusb2: Device being rendered inoperable [ 229.438798][ T2342] cx25840 2-0044: Unable to detect h/w, assuming cx23887 [ 229.497989][ T2342] cx25840 2-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 229.573627][ T2342] pvrusb2: Attached sub-driver cx25840 [ 229.606448][ T2342] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 229.665975][ T2342] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 230.050332][ T7436] B: renamed from veth0 (while UP) [ 230.202363][ T7437] netlink: 8 bytes leftover after parsing attributes in process `syz.3.357'. [ 230.871108][ T5887] set interface failed [ 230.871146][ T5887] usb 3-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 230.960287][ T5887] error writing reg: 0xff, val: 0x00 [ 231.886076][ T5887] dvb_usb_mxl111sf 3-1:0.0: probe with driver dvb_usb_mxl111sf failed with error -22 [ 231.943258][ T5950] usb 6-1: USB disconnect, device number 6 [ 232.031383][ T5887] usb 3-1: USB disconnect, device number 30 [ 232.426472][ T5887] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 232.625017][ T5887] usb 3-1: Using ep0 maxpacket: 32 [ 232.736753][ T5887] usb 3-1: unable to get BOS descriptor or descriptor too short [ 232.825856][ T5887] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 232.874594][ T5887] usb 3-1: can't read configurations, error -71 [ 233.017895][ T30] kauditd_printk_skb: 52 callbacks suppressed [ 233.017916][ T30] audit: type=1800 audit(1747770618.199:117): pid=7458 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.366" name="SYSV00000000" dev="hugetlbfs" ino=0 res=0 errno=0 [ 233.045220][ T5894] usb 4-1: new high-speed USB device number 46 using dummy_hcd [ 233.115971][ T7458] netlink: 4 bytes leftover after parsing attributes in process `syz.5.366'. [ 233.238894][ T5894] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 233.280410][ T5894] usb 4-1: config 0 has no interfaces? [ 233.310716][ T5894] usb 4-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 233.381643][ T5894] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 233.446209][ T5894] usb 4-1: config 0 descriptor?? [ 233.566763][ T52] usb 6-1: new full-speed USB device number 7 using dummy_hcd [ 233.758870][ T52] usb 6-1: unable to get BOS descriptor or descriptor too short [ 233.896464][ T52] usb 6-1: not running at top speed; connect to a high speed hub [ 233.965233][ T5887] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 233.976478][ T52] usb 6-1: config 5 has an invalid interface number: 246 but max is 0 [ 234.042002][ T52] usb 6-1: config 5 has an invalid descriptor of length 0, skipping remainder of the config [ 234.092867][ T52] usb 6-1: config 5 has no interface number 0 [ 234.146471][ T52] usb 6-1: config 5 interface 246 altsetting 4 endpoint 0x3 has invalid maxpacket 1023, setting to 64 [ 234.188899][ T5887] usb 3-1: Using ep0 maxpacket: 32 [ 234.217519][ T5887] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 234.248463][ T52] usb 6-1: config 5 interface 246 altsetting 4 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 234.269304][ T5887] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 234.332262][ T7466] tipc: Started in network mode [ 234.347013][ T5887] usb 3-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 234.366865][ T52] usb 6-1: config 5 interface 246 has no altsetting 0 [ 234.376235][ T7466] tipc: Node identity 00000000000000000000000000004001, cluster identity 4711 [ 234.401064][ T52] usb 6-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=f5.e4 [ 234.414190][ T5887] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 234.425852][ T52] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 234.443794][ T52] usb 6-1: Product: syz [ 234.449787][ T7466] tipc: Enabling of bearer rejected, failed to enable media [ 234.461453][ T52] usb 6-1: Manufacturer: syz [ 234.473827][ T52] usb 6-1: SerialNumber: syz [ 234.480784][ T5887] usb 3-1: config 0 descriptor?? [ 234.880105][ T5928] usb 6-1: Failed to submit usb control message: -71 [ 234.887233][ T52] usb 6-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 234.933471][ T5928] usb 6-1: unable to send the bmi data to the device: -71 [ 234.971434][ T5887] ft260 0003:0403:6030.000D: unknown main item tag 0x0 [ 235.015528][ T5928] usb 6-1: unable to get target info from device [ 235.038952][ T52] usb 6-1: USB disconnect, device number 7 [ 235.084896][ T5928] usb 6-1: could not get target info (-71) [ 235.109514][ T5928] usb 6-1: could not probe fw (-71) [ 235.139352][ T5887] ft260 0003:0403:6030.000D: chip code: 6424 8183 [ 235.227579][ T7388] plantronics 0003:047F:FFFF.000C: timeout initializing reports [ 235.267585][ T5894] usb 5-1: USB disconnect, device number 37 [ 235.413131][ T5887] ft260 0003:0403:6030.000D: failed to retrieve system status [ 235.515890][ T5887] ft260 0003:0403:6030.000D: probe with driver ft260 failed with error -71 [ 235.552411][ T5887] usb 3-1: USB disconnect, device number 32 [ 235.867202][ T5950] usb 5-1: new high-speed USB device number 38 using dummy_hcd [ 236.080268][ T5950] usb 5-1: Using ep0 maxpacket: 8 [ 236.158149][ T5950] usb 5-1: config 162 has an invalid interface number: 97 but max is 0 [ 236.166685][ T5950] usb 5-1: config 162 has an invalid descriptor of length 0, skipping remainder of the config [ 236.185927][ T5950] usb 5-1: config 162 has no interface number 0 [ 236.240019][ T5950] usb 5-1: config 162 interface 97 altsetting 1 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 236.322803][ T5950] usb 5-1: config 162 interface 97 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 236.457644][ T5950] usb 5-1: config 162 interface 97 has no altsetting 0 [ 236.466440][ T5894] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 236.527733][ T5950] usb 5-1: New USB device found, idVendor=0c2e, idProduct=0700, bcdDevice= 4.3b [ 236.560849][ T5950] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 236.657016][ T5894] usb 6-1: Using ep0 maxpacket: 8 [ 236.731104][ T5894] usb 6-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 236.856429][ T5894] usb 6-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 236.884107][ T5894] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 236.972502][ T5894] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 237.060233][ T5894] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 237.142758][ T5894] usb 6-1: Product: syz [ 237.171971][ T5894] usb 6-1: Manufacturer: ࣱ [ 237.184764][ T5894] usb 6-1: SerialNumber: syz [ 237.523631][ T5894] usb 6-1: 0:2 : does not exist [ 237.720007][ T5894] usb 6-1: USB disconnect, device number 8 [ 237.939726][ T120] usb 4-1: USB disconnect, device number 46 [ 238.604984][ T7500] loop2: detected capacity change from 0 to 3 [ 238.616599][ T5894] usb 4-1: new high-speed USB device number 47 using dummy_hcd [ 238.678147][ T5979] Dev loop2: unable to read RDB block 3 [ 238.683842][ T5979] loop2: unable to read partition table [ 238.715148][ T5979] loop2: partition table beyond EOD, truncated [ 238.733022][ T7500] Dev loop2: unable to read RDB block 3 [ 238.756928][ T7502] tipc: Enabling of bearer rejected, failed to enable media [ 238.757087][ T7500] loop2: unable to read partition table [ 238.787074][ T7500] loop2: partition table beyond EOD, truncated [ 238.804589][ T7500] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 238.846648][ T5894] usb 4-1: Using ep0 maxpacket: 8 [ 238.951525][ T5894] usb 4-1: unable to get BOS descriptor or descriptor too short [ 238.979432][ T5894] usb 4-1: config 1 has an invalid interface number: 65 but max is 0 [ 239.003518][ T5894] usb 4-1: config 1 has no interface number 0 [ 239.023836][ T5894] usb 4-1: config 1 interface 65 has no altsetting 0 [ 239.049090][ T5894] usb 4-1: New USB device found, idVendor=04e8, idProduct=6889, bcdDevice=2b.cd [ 239.079791][ T5894] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 239.118372][ T5894] usb 4-1: Product: syz [ 239.165112][ T5894] usb 4-1: Manufacturer: syz [ 239.173044][ T5894] usb 4-1: SerialNumber: syz [ 239.454061][ T5894] kalmia 4-1:1.65 (unnamed net_device) (uninitialized): Error sending init packet. Status -22 [ 239.484075][ T5894] kalmia 4-1:1.65: probe with driver kalmia failed with error -22 [ 239.496449][ T5887] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 239.560371][ T5894] usb 4-1: USB disconnect, device number 47 [ 239.646780][ T5887] usb 7-1: device descriptor read/64, error -71 [ 239.906452][ T5887] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 240.046698][ T5887] usb 7-1: device descriptor read/64, error -71 [ 240.158348][ T5887] usb usb7-port1: attempt power cycle [ 240.548447][ T5887] usb 7-1: new high-speed USB device number 9 using dummy_hcd [ 240.588290][ T5887] usb 7-1: device descriptor read/8, error -71 [ 240.746583][ T5894] usb 3-1: new full-speed USB device number 33 using dummy_hcd [ 240.788023][ T7535] tipc: Enabling of bearer rejected, failed to enable media [ 240.850233][ T5887] usb 7-1: new high-speed USB device number 10 using dummy_hcd [ 240.897229][ T5887] usb 7-1: device descriptor read/8, error -71 [ 240.935002][ T5894] usb 3-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 240.945926][ T5893] usb 6-1: new full-speed USB device number 9 using dummy_hcd [ 240.984310][ T5894] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x93, changing to 0x83 [ 241.036968][ T5887] usb usb7-port1: unable to enumerate USB device [ 241.041497][ T5894] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 241.085166][ T5894] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 241.099303][ T5894] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 241.119976][ T7538] netlink: 'syz.3.391': attribute type 1 has an invalid length. [ 241.138294][ T5894] usb 3-1: New USB device found, idVendor=15c2, idProduct=003b, bcdDevice=66.3e [ 241.148964][ T5893] usb 6-1: config 0 has an invalid interface number: 20 but max is 0 [ 241.169807][ T5893] usb 6-1: config 0 has no interface number 0 [ 241.177201][ T5894] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 241.190298][ T5893] usb 6-1: config 0 interface 20 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 241.206426][ T5894] usb 3-1: Product: syz [ 241.210720][ T5894] usb 3-1: Manufacturer: syz [ 241.215387][ T5894] usb 3-1: SerialNumber: syz [ 241.224551][ T5893] usb 6-1: New USB device found, idVendor=04e6, idProduct=0005, bcdDevice= 1.00 [ 241.233981][ T5893] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 241.243749][ T5893] usb 6-1: Product: syz [ 241.250541][ T5894] usb 3-1: config 0 descriptor?? [ 241.258253][ T5893] usb 6-1: Manufacturer: syz [ 241.263791][ T5893] usb 6-1: SerialNumber: syz [ 241.272511][ T5894] imon:imon_init_intf0: usb_submit_urb failed for intf0 (-90) [ 241.282383][ T5894] imon 3-1:0.0: unable to initialize intf0, err -90 [ 241.290409][ T5893] usb 6-1: config 0 descriptor?? [ 241.296918][ T5894] imon:imon_probe: failed to initialize context! [ 241.303852][ T7533] raw-gadget.3 gadget.5: fail, usb_ep_enable returned -22 [ 241.316521][ T5894] imon 3-1:0.0: unable to register, err -19 [ 241.328034][ T5893] ums-sddr09 6-1:0.20: USB Mass Storage device detected [ 241.416974][ T5893] ums-sddr09 6-1:0.20: probe with driver ums-sddr09 failed with error -22 [ 241.440261][ T7539] bond2: (slave gretap1): making interface the new active one [ 241.490724][ T5893] usb 3-1: USB disconnect, device number 33 [ 241.554409][ T7539] bond2: (slave gretap1): Enslaving as an active interface with an up link [ 241.691670][ T7533] kvm: vcpu 8: requested lapic timer restore with starting count register 0x390=8 (16 ns) > initial count (10 ns). Using initial count to start timer. [ 241.699455][ T5950] usb 5-1: string descriptor 0 read error: -32 [ 241.717524][ T5950] metro_usb 5-1:162.97: interrupt-out endpoint missing [ 241.740120][ T7533] kvm: apic: phys broadcast and lowest prio [ 241.857918][ T7547] loop2: detected capacity change from 0 to 3 [ 241.870684][ T5894] usb 6-1: USB disconnect, device number 9 [ 241.874198][ T7547] Dev loop2: unable to read RDB block 3 [ 241.885673][ T7547] loop2: unable to read partition table [ 241.900134][ T7547] loop2: partition table beyond EOD, truncated [ 241.946715][ T7547] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 242.340895][ T30] audit: type=1326 audit(1747770627.519:118): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7550 comm="syz.6.395" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9af978e969 code=0x7ffc0000 [ 242.454095][ T30] audit: type=1326 audit(1747770627.519:119): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7550 comm="syz.6.395" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9af978e969 code=0x7ffc0000 [ 242.563688][ T30] audit: type=1326 audit(1747770627.559:120): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7550 comm="syz.6.395" exe="/root/syz-executor" sig=0 arch=c000003e syscall=157 compat=0 ip=0x7f9af978e969 code=0x7ffc0000 [ 242.650335][ T30] audit: type=1326 audit(1747770627.559:121): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7550 comm="syz.6.395" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9af978e969 code=0x7ffc0000 [ 242.672558][ C0] vkms_vblank_simulate: vblank timer overrun [ 242.717378][ T7561] netlink: 4 bytes leftover after parsing attributes in process `syz.2.397'. [ 242.737883][ T24] usb 4-1: new high-speed USB device number 48 using dummy_hcd [ 242.814044][ T30] audit: type=1326 audit(1747770627.559:122): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7550 comm="syz.6.395" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9af978e969 code=0x7ffc0000 [ 242.836421][ C0] vkms_vblank_simulate: vblank timer overrun [ 242.921588][ T24] usb 4-1: too many configurations: 253, using maximum allowed: 8 [ 242.935128][ T30] audit: type=1326 audit(1747770627.559:123): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7550 comm="syz.6.395" exe="/root/syz-executor" sig=0 arch=c000003e syscall=157 compat=0 ip=0x7f9af978e969 code=0x7ffc0000 [ 242.957334][ C0] vkms_vblank_simulate: vblank timer overrun [ 243.055049][ T30] audit: type=1326 audit(1747770627.569:124): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7550 comm="syz.6.395" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9af978e969 code=0x7ffc0000 [ 243.158445][ T30] audit: type=1326 audit(1747770627.569:125): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7550 comm="syz.6.395" exe="/root/syz-executor" sig=0 arch=c000003e syscall=317 compat=0 ip=0x7f9af978e969 code=0x7ffc0000 [ 243.295807][ T30] audit: type=1326 audit(1747770627.569:126): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7550 comm="syz.6.395" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f9af978e969 code=0x0 [ 243.348625][ T30] audit: type=1326 audit(1747770627.619:127): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7550 comm="syz.6.395" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f9af978e969 code=0x0 [ 243.370338][ C0] vkms_vblank_simulate: vblank timer overrun [ 243.379095][ T5887] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 243.429534][ T24] usb 4-1: string descriptor 0 read error: -71 [ 243.435910][ T24] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 243.520542][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 243.550798][ T7581] tipc: Started in network mode [ 243.555926][ T7581] tipc: Node identity 00000000000000000000000000004001, cluster identity 4711 [ 243.596981][ T7581] tipc: Enabling of bearer rejected, failed to enable media [ 243.617322][ T24] usb 4-1: can't set config #1, error -71 [ 243.664895][ T24] usb 4-1: USB disconnect, device number 48 [ 243.826692][ T5887] usb 6-1: device descriptor read/64, error -71 [ 243.834412][ T7583] IPVS: ip_vs_add_dest(): lower threshold is higher than upper threshold [ 243.834496][ T5950] IPVS: starting estimator thread 0... [ 243.967396][ T7584] IPVS: using max 27 ests per chain, 64800 per kthread [ 244.030907][ T7586] netlink: 'syz.2.402': attribute type 3 has an invalid length. [ 244.039414][ T7586] netlink: 'syz.2.402': attribute type 3 has an invalid length. [ 244.047552][ T7586] netlink: 'syz.2.402': attribute type 3 has an invalid length. [ 244.066448][ T5887] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 244.074876][ T7586] netlink: 'syz.2.402': attribute type 3 has an invalid length. [ 244.146553][ T7586] netlink: 'syz.2.402': attribute type 3 has an invalid length. [ 244.154415][ T7586] netlink: 'syz.2.402': attribute type 3 has an invalid length. [ 244.162358][ T7586] netlink: 'syz.2.402': attribute type 3 has an invalid length. [ 244.170294][ T7586] netlink: 'syz.2.402': attribute type 3 has an invalid length. [ 244.178408][ T7586] netlink: 'syz.2.402': attribute type 3 has an invalid length. [ 244.296498][ T5887] usb 6-1: Using ep0 maxpacket: 16 [ 244.342970][ T5887] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 244.375605][ T5887] usb 6-1: New USB device found, idVendor=0c70, idProduct=f014, bcdDevice= 0.00 [ 244.409109][ T5887] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 244.447514][ T5887] usb 6-1: config 0 descriptor?? [ 245.213689][ T5887] aquacomputer_d5next 0003:0C70:F014.000E: hidraw0: USB HID v0.00 Device [HID 0c70:f014] on usb-dummy_hcd.5-1/input0 [ 245.748594][ T7599] loop2: detected capacity change from 0 to 3 [ 245.778226][ T7599] Dev loop2: unable to read RDB block 3 [ 245.793961][ T7599] loop2: unable to read partition table [ 245.803120][ T7599] loop2: partition table beyond EOD, truncated [ 245.815475][ T7599] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 246.335053][ T5894] usb 4-1: new high-speed USB device number 49 using dummy_hcd [ 246.531891][ T5894] usb 4-1: Using ep0 maxpacket: 32 [ 246.549594][ T5894] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 246.605664][ T5894] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 246.671339][ T5894] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 246.685050][ T5894] usb 4-1: New USB device found, idVendor=0458, idProduct=5011, bcdDevice= 0.00 [ 246.696855][ T5894] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 246.730524][ T5894] usb 4-1: config 0 descriptor?? [ 246.735220][ T5950] usb 6-1: USB disconnect, device number 11 [ 247.105297][ T7613] tipc: Enabling of bearer rejected, failed to enable media [ 247.223477][ T5894] input: HID 0458:5011 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:0458:5011.000F/input/input23 [ 247.347041][ T5894] input: HID 0458:5011 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:0458:5011.000F/input/input24 [ 247.381028][ T7621] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 247.596061][ T5894] kye 0003:0458:5011.000F: input,hiddev0,hidraw0: USB HID v0.00 Mouse [HID 0458:5011] on usb-dummy_hcd.3-1/input0 [ 247.608343][ T1215] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 247.836468][ T1215] usb 3-1: Using ep0 maxpacket: 32 [ 247.856131][ T1215] usb 3-1: config 0 has an invalid interface number: 184 but max is 0 [ 247.911516][ T1215] usb 3-1: config 0 has no interface number 0 [ 247.936582][ T5950] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 247.963055][ T1215] usb 3-1: config 0 interface 184 has no altsetting 0 [ 247.998202][ T1215] usb 3-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 248.038344][ T1215] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 248.106391][ T1215] usb 3-1: Product: syz [ 248.131023][ T1215] usb 3-1: Manufacturer: syz [ 248.135209][ T7629] x_tables: ip_tables: bpf.1 match: invalid size 528 (kernel) != (user) 536 [ 248.149675][ T1215] usb 3-1: SerialNumber: syz [ 248.156909][ T5950] usb 6-1: Using ep0 maxpacket: 32 [ 248.171596][ T1215] usb 3-1: config 0 descriptor?? [ 248.174683][ T5950] usb 6-1: config index 0 descriptor too short (expected 35577, got 27) [ 248.215807][ T1215] smsc75xx v1.0.0 [ 248.232132][ T5950] usb 6-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 248.415117][ T1215] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -71 [ 248.429141][ T1215] smsc75xx 3-1:0.184: probe with driver smsc75xx failed with error -71 [ 248.438038][ T5950] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 248.476816][ T5950] usb 6-1: config 1 has no interface number 0 [ 248.484177][ T1215] usb 3-1: USB disconnect, device number 35 [ 248.500437][ T5950] usb 6-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 248.516936][ T977] usb 4-1: reset high-speed USB device number 49 using dummy_hcd [ 248.535087][ T5950] usb 6-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 248.586025][ T5950] usb 6-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 248.623151][ T5950] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 248.665052][ T5950] snd_usb_pod 6-1:1.1: Line 6 Pocket POD found [ 248.736828][ T5894] usb 7-1: new full-speed USB device number 11 using dummy_hcd [ 248.744771][ T977] usb 4-1: device descriptor read/64, error -32 [ 248.862349][ T5950] snd_usb_pod 6-1:1.1: Line 6 Pocket POD now attached [ 248.908430][ T7601] raw-gadget.2 gadget.3: fail, usb_ep_queue returned -108 [ 248.953683][ T5894] usb 7-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 248.966405][ T5894] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 384, setting to 64 [ 248.996005][ T977] usb 4-1: reset high-speed USB device number 49 using dummy_hcd [ 249.021347][ T5894] usb 7-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 249.030930][ T5894] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 249.051662][ T5894] usb 7-1: Product: syz [ 249.057873][ T5894] usb 7-1: Manufacturer: syz [ 249.062750][ T5894] usb 7-1: SerialNumber: syz [ 249.078076][ T5894] usb 7-1: config 0 descriptor?? [ 249.111730][ T7629] raw-gadget.4 gadget.6: fail, usb_ep_enable returned -22 [ 249.126417][ T977] usb 4-1: device descriptor read/64, error -32 [ 249.303591][ T7623] mmap: syz.5.416 (7623) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 249.346438][ T5894] rc_core: IR keymap rc-streamzap not found [ 249.365423][ T5894] Registered IR keymap rc-empty [ 249.382137][ T977] usb 4-1: reset high-speed USB device number 49 using dummy_hcd [ 249.454851][ T5894] rc rc0: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/rc/rc0 [ 249.486894][ T977] usb 4-1: device descriptor read/8, error -32 [ 249.544282][ T1215] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 249.572529][ T5894] input: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/rc/rc0/input25 [ 249.716919][ T1215] usb 3-1: Using ep0 maxpacket: 32 [ 249.738527][ T1215] usb 3-1: unable to get BOS descriptor or descriptor too short [ 249.761125][ T1215] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 249.777047][ T1215] usb 3-1: can't read configurations, error -71 [ 249.831149][ T977] usb 4-1: reset high-speed USB device number 49 using dummy_hcd [ 249.857058][ T977] usb 4-1: device descriptor read/8, error -32 [ 249.971005][ T9] usb 4-1: USB disconnect, device number 49 [ 249.980857][ T5950] snd_usb_pod 6-1:1.1: line6_send_raw_message_async_part: usb_submit_urb failed (-22) [ 250.084016][ T24] usb 6-1: USB disconnect, device number 12 [ 250.092672][ T24] snd_usb_pod 6-1:1.1: Line 6 Pocket POD now disconnected [ 250.138113][ T7601] raw-gadget.2 gadget.3: failed to queue disconnect event [ 251.456607][ T24] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 251.656490][ T24] usb 6-1: Using ep0 maxpacket: 32 [ 251.668404][ T24] usb 6-1: config 0 has an invalid interface number: 184 but max is 0 [ 251.683115][ T24] usb 6-1: config 0 has no interface number 0 [ 251.743114][ T24] usb 6-1: config 0 interface 184 has no altsetting 0 [ 251.825536][ T24] usb 6-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 251.864557][ T24] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 251.911340][ T24] usb 6-1: Product: syz [ 251.954725][ T24] usb 6-1: Manufacturer: syz [ 252.006429][ T24] usb 6-1: SerialNumber: syz [ 252.085771][ T24] usb 6-1: config 0 descriptor?? [ 252.112899][ T24] smsc75xx v1.0.0 [ 252.136505][ T24] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -22 [ 252.265264][ T24] smsc75xx 6-1:0.184: probe with driver smsc75xx failed with error -22 [ 252.314474][ T7648] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 252.352621][ T7648] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 252.384959][ T7660] netlink: 8 bytes leftover after parsing attributes in process `syz.2.424'. [ 252.430085][ T7648] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 252.454016][ T9] usb 7-1: USB disconnect, device number 11 [ 252.481177][ T7648] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 252.490053][ T7660] netlink: 8 bytes leftover after parsing attributes in process `syz.2.424'. [ 253.243530][ T55] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 253.255518][ T55] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 253.266308][ T55] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 253.278079][ T55] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 253.297885][ T55] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 254.016549][ T5887] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 254.176492][ T5887] usb 3-1: Using ep0 maxpacket: 32 [ 254.190678][ T5887] usb 3-1: config index 0 descriptor too short (expected 29220, got 36) [ 254.207401][ T5887] usb 3-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 254.264554][ T5887] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 254.304882][ T5887] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 254.355161][ T5887] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 254.403780][ T7668] chnl_net:caif_netlink_parms(): no params data found [ 254.423670][ T5887] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 254.484012][ T5887] usb 3-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 254.528997][ T5887] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 254.616587][ T5887] usb 3-1: config 0 descriptor?? [ 254.645937][ T5950] usb 6-1: USB disconnect, device number 13 [ 254.854195][ T7687] openvswitch: netlink: IP tunnel TTL not specified. [ 254.910881][ T5887] usblp 3-1:0.0: usblp0: USB Bidirectional printer dev 38 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 254.945078][ T5887] usb 3-1: USB disconnect, device number 38 [ 254.958628][ T1215] usb 7-1: new high-speed USB device number 12 using dummy_hcd [ 255.035379][ T5887] usblp0: removed [ 255.166525][ T1215] usb 7-1: Using ep0 maxpacket: 32 [ 255.259010][ T1215] usb 7-1: unable to get BOS descriptor or descriptor too short [ 255.287465][ T1215] usb 7-1: unable to read config index 0 descriptor/start: -71 [ 255.300193][ T7668] bridge0: port 1(bridge_slave_0) entered blocking state [ 255.310106][ T1215] usb 7-1: can't read configurations, error -71 [ 255.317794][ T7668] bridge0: port 1(bridge_slave_0) entered disabled state [ 255.357042][ T7668] bridge_slave_0: entered allmulticast mode [ 255.385091][ T7668] bridge_slave_0: entered promiscuous mode [ 255.388995][ T5887] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 255.392798][ T55] Bluetooth: hci7: command tx timeout [ 255.415097][ T7694] netlink: 9 bytes leftover after parsing attributes in process `syz.5.431'. [ 255.433499][ T7668] bridge0: port 2(bridge_slave_1) entered blocking state [ 255.450797][ T7668] bridge0: port 2(bridge_slave_1) entered disabled state [ 255.468889][ T7668] bridge_slave_1: entered allmulticast mode [ 255.485405][ T7668] bridge_slave_1: entered promiscuous mode [ 255.502035][ T7694] gretap0: entered promiscuous mode [ 255.535593][ T7693] netlink: 5 bytes leftover after parsing attributes in process `syz.5.431'. [ 255.596560][ T5887] usb 3-1: Using ep0 maxpacket: 32 [ 255.605255][ T5887] usb 3-1: config index 0 descriptor too short (expected 29220, got 36) [ 255.624703][ T5887] usb 3-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 255.646476][ T5887] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 255.681001][ T5887] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 255.711662][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.716446][ T5887] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 255.718657][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.765065][ T5887] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 255.846408][ T5887] usb 3-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 255.872367][ T7693] 0ªX¹¦D: renamed from gretap0 [ 255.892366][ T7693] 0ªX¹¦D: left promiscuous mode [ 255.906423][ T5887] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 255.933896][ T5887] usb 3-1: config 0 descriptor?? [ 255.946860][ T7693] 0ªX¹¦D: entered allmulticast mode [ 256.004020][ T7693] A link change request failed with some changes committed already. Interface 30ªX¹¦D may have been left with an inconsistent configuration, please check. [ 256.114948][ T7693] syz.5.431 (7693) used greatest stack depth: 19720 bytes left [ 256.140913][ T7668] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 256.228015][ T7668] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 256.273267][ T7702] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 256.282503][ T7702] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 256.894040][ T7668] team0: Port device team_slave_0 added [ 256.962330][ T7668] team0: Port device team_slave_1 added [ 257.361816][ T7668] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 257.456943][ T55] Bluetooth: hci7: command tx timeout [ 257.471100][ T7668] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 257.557311][ T7711] netlink: 4 bytes leftover after parsing attributes in process `syz.6.435'. [ 257.646446][ T7668] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 257.820785][ T7714] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 257.873319][ T7668] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 257.912572][ T7714] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 257.945944][ T7668] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 257.979548][ T7668] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 257.998060][ T7716] netlink: 20 bytes leftover after parsing attributes in process `syz.3.437'. [ 258.017888][ T52] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 258.060817][ T7716] netlink: 152 bytes leftover after parsing attributes in process `syz.3.437'. [ 258.110908][ T7716] A link change request failed with some changes committed already. Interface macvlan1 may have been left with an inconsistent configuration, please check. [ 258.277622][ T52] usb 6-1: Using ep0 maxpacket: 32 [ 258.324819][ T52] usb 6-1: config 0 has an invalid interface number: 12 but max is 0 [ 258.345863][ T52] usb 6-1: config 0 has no interface number 0 [ 258.480056][ T52] usb 6-1: too many endpoints for config 0 interface 12 altsetting 2: 235, using maximum allowed: 30 [ 258.527661][ T7668] hsr_slave_0: entered promiscuous mode [ 258.556904][ T52] usb 6-1: config 0 interface 12 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 258.600332][ T7668] hsr_slave_1: entered promiscuous mode [ 258.618412][ T52] usb 6-1: config 0 interface 12 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 0 [ 258.651235][ T7668] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 258.805183][ T7668] Cannot create hsr debugfs directory [ 258.870409][ T52] usb 6-1: config 0 interface 12 altsetting 2 has 2 endpoint descriptors, different from the interface descriptor's value: 235 [ 258.944991][ T52] usb 6-1: config 0 interface 12 has no altsetting 0 [ 258.992571][ T52] usb 6-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 259.043914][ T52] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 259.066131][ T52] usb 6-1: Product: syz [ 259.128233][ T52] usb 6-1: Manufacturer: syz [ 259.169094][ T52] usb 6-1: SerialNumber: syz [ 259.227503][ T52] usb 6-1: config 0 descriptor?? [ 259.288327][ T52] f81534 6-1:0.12: unsupported endpoint max packet size [ 259.474043][ T5887] usblp 3-1:0.0: usblp0: USB Bidirectional printer dev 39 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 259.507727][ T1215] usb 6-1: USB disconnect, device number 14 [ 259.548822][ T55] Bluetooth: hci7: command tx timeout [ 259.606641][ T5887] usb 3-1: USB disconnect, device number 39 [ 259.747406][ T5887] usblp0: removed [ 259.956604][ T24] usb 4-1: new high-speed USB device number 51 using dummy_hcd [ 260.141463][ T24] usb 4-1: Using ep0 maxpacket: 16 [ 260.156814][ T5887] usb 3-1: new high-speed USB device number 40 using dummy_hcd [ 260.195113][ T24] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 260.263668][ T24] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 260.298192][ T24] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 260.314804][ T24] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 260.380706][ T5887] usb 3-1: Using ep0 maxpacket: 32 [ 260.424270][ T5887] usb 3-1: unable to get BOS descriptor or descriptor too short [ 260.468939][ T5887] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 260.480344][ T24] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 260.518075][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 260.534084][ T5887] usb 3-1: can't read configurations, error -71 [ 260.583834][ T24] usb 4-1: Product: syz [ 260.607535][ T24] usb 4-1: Manufacturer: syz [ 260.616158][ T24] usb 4-1: SerialNumber: syz [ 260.642563][ T7668] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 260.742095][ T7668] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 260.841174][ T7668] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 260.895665][ T24] usb 4-1: unit 1 not found! [ 260.939647][ T7668] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 261.087904][ T24] usb 4-1: USB disconnect, device number 51 [ 261.262718][ T5885] udevd[5885]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 261.363159][ T7753] netlink: 20 bytes leftover after parsing attributes in process `syz.6.448'. [ 261.428182][ T977] usb 6-1: new high-speed USB device number 15 using dummy_hcd [ 261.447677][ T7753] netlink: 152 bytes leftover after parsing attributes in process `syz.6.448'. [ 261.477399][ T7753] A link change request failed with some changes committed already. Interface macvlan1 may have been left with an inconsistent configuration, please check. [ 261.617012][ T977] usb 6-1: Using ep0 maxpacket: 16 [ 261.617064][ T55] Bluetooth: hci7: command tx timeout [ 261.656119][ T977] usb 6-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 261.728840][ T5887] usb 3-1: new high-speed USB device number 42 using dummy_hcd [ 261.745807][ T7668] 8021q: adding VLAN 0 to HW filter on device bond0 [ 261.756448][ T977] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 261.771375][ T977] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 261.851792][ T977] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 261.880326][ T7668] 8021q: adding VLAN 0 to HW filter on device team0 [ 261.905037][ T977] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 261.977670][ T5887] usb 3-1: config 0 has no interfaces? [ 261.983047][ T977] usb 6-1: Product: syz [ 261.989352][ T977] usb 6-1: Manufacturer: syz [ 262.003577][ T5928] bridge0: port 1(bridge_slave_0) entered blocking state [ 262.009049][ T977] usb 6-1: SerialNumber: syz [ 262.010857][ T5928] bridge0: port 1(bridge_slave_0) entered forwarding state [ 262.025714][ T5887] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 262.044670][ T5887] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 262.045973][ T5928] bridge0: port 2(bridge_slave_1) entered blocking state [ 262.060027][ T5928] bridge0: port 2(bridge_slave_1) entered forwarding state [ 262.116421][ T24] usb 7-1: new high-speed USB device number 14 using dummy_hcd [ 262.137391][ T5887] usb 3-1: Product: syz [ 262.141643][ T5887] usb 3-1: Manufacturer: syz [ 262.156583][ T5887] usb 3-1: SerialNumber: syz [ 262.194068][ T5887] usb 3-1: config 0 descriptor?? [ 262.276731][ T24] usb 7-1: Using ep0 maxpacket: 8 [ 262.284303][ T24] usb 7-1: config 179 has an invalid interface number: 65 but max is 0 [ 262.294205][ T24] usb 7-1: config 179 has no interface number 0 [ 262.308380][ T24] usb 7-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 262.319668][ T5950] usb 4-1: new high-speed USB device number 52 using dummy_hcd [ 262.357531][ T24] usb 7-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 262.393385][ T7668] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 262.400964][ T24] usb 7-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 262.419554][ T7751] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 262.430844][ T7751] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 262.472483][ T24] usb 7-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 262.503406][ T977] usb 6-1: 0:2 : does not exist [ 262.516467][ T5950] usb 4-1: Using ep0 maxpacket: 16 [ 262.532829][ T5950] usb 4-1: too many configurations: 60, using maximum allowed: 8 [ 262.578841][ T24] usb 7-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 262.630429][ T7668] veth0_vlan: entered promiscuous mode [ 262.630457][ T5950] usb 4-1: New USB device found, idVendor=0471, idProduct=032c, bcdDevice=ba.e9 [ 262.663996][ T24] usb 7-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 262.690341][ T5950] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=204 [ 262.707422][ T24] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 262.725454][ T5950] usb 4-1: Product: syz [ 262.726001][ T7668] veth1_vlan: entered promiscuous mode [ 262.732323][ T5950] usb 4-1: Manufacturer: syz [ 262.752227][ T7756] raw-gadget.3 gadget.6: fail, usb_ep_enable returned -22 [ 262.763886][ T5950] usb 4-1: SerialNumber: syz [ 262.778638][ T5950] usb 4-1: config 0 descriptor?? [ 262.925698][ T977] usb 6-1: 1:0: cannot get min/max values for control 4 (id 1) [ 262.965928][ T7668] veth0_macvtap: entered promiscuous mode [ 262.997925][ T5950] pwc: Philips SPC 880NC USB webcam detected. [ 263.037846][ T7668] veth1_macvtap: entered promiscuous mode [ 263.055106][ T5950] pwc: Warning: more than 1 configuration available. [ 263.080429][ T5950] pwc: Failed to set LED on/off time (-71) [ 263.102902][ T5950] pwc: send_video_command error -71 [ 263.119637][ T5950] pwc: Failed to set video mode VGA@30 fps; return code = -71 [ 263.129292][ T7668] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 263.138366][ T5950] Philips webcam 4-1:0.0: probe with driver Philips webcam failed with error -71 [ 263.154804][ T7668] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 263.212595][ T5950] usb 4-1: USB disconnect, device number 52 [ 263.738642][ T7668] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 263.777056][ T7668] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 263.809884][ T7668] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 263.832524][ T7668] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 263.988964][ T7766] netlink: 8 bytes leftover after parsing attributes in process `syz.5.452'. [ 264.379467][ T977] usb 6-1: USB disconnect, device number 15 [ 264.445306][ T5885] udevd[5885]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 264.478544][ T1215] usb 7-1: USB disconnect, device number 14 [ 264.478572][ C1] xpad 7-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 264.492959][ C1] xpad 7-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 264.697190][ T7773] loop6: detected capacity change from 0 to 524287999 [ 264.706354][ T7773] Buffer I/O error on dev loop6, logical block 0, async page read [ 264.714619][ T7773] Buffer I/O error on dev loop6, logical block 0, async page read [ 264.723424][ T7773] Buffer I/O error on dev loop6, logical block 0, async page read [ 264.731831][ T7773] Buffer I/O error on dev loop6, logical block 0, async page read [ 264.740180][ T7773] Buffer I/O error on dev loop6, logical block 0, async page read [ 264.770807][ T7773] Buffer I/O error on dev loop6, logical block 0, async page read [ 264.780997][ T7773] Buffer I/O error on dev loop6, logical block 0, async page read [ 264.790779][ T7773] Buffer I/O error on dev loop6, logical block 0, async page read [ 264.898442][ T7773] ldm_validate_partition_table(): Disk read failed. [ 264.907388][ T7773] Buffer I/O error on dev loop6, logical block 0, async page read [ 264.915748][ T7773] Buffer I/O error on dev loop6, logical block 0, async page read [ 264.927711][ T7773] Dev loop6: unable to read RDB block 0 [ 264.934482][ T7773] loop6: unable to read partition table [ 264.941691][ T7773] loop_reread_partitions: partition scan of loop6 (3Ÿ ¾x³˜CÖ) failed (rc=-5) [ 265.046698][ T7774] Invalid logical block size (8) [ 265.301658][ T966] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 265.343228][ T966] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 265.555403][ T966] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 265.613399][ T966] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 265.792042][ T52] usb 3-1: USB disconnect, device number 42 [ 266.146823][ T5829] usb 6-1: new high-speed USB device number 16 using dummy_hcd [ 266.150247][ T7784] input: syz1 as /devices/virtual/input/input26 [ 266.203694][ T7786] fuse: Unknown parameter 'ˆ«"€±G)ŤÂ' [ 266.355392][ T5829] usb 6-1: Using ep0 maxpacket: 32 [ 266.392190][ T5829] usb 6-1: unable to get BOS descriptor or descriptor too short [ 266.432027][ T5829] usb 6-1: unable to read config index 0 descriptor/start: -71 [ 266.471064][ T5829] usb 6-1: can't read configurations, error -71 [ 267.026434][ T1215] usb 4-1: new full-speed USB device number 53 using dummy_hcd [ 267.065161][ T7807] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 267.203817][ T1215] usb 4-1: config 0 has an invalid interface number: 46 but max is 8 [ 267.243500][ T1215] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 267.262880][ T1215] usb 4-1: config 0 has no interface number 0 [ 267.289472][ T1215] usb 4-1: config 0 interface 46 altsetting 0 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 267.612394][ T1215] usb 4-1: config 0 interface 46 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 267.741908][ T1215] usb 4-1: New USB device found, idVendor=045a, idProduct=5210, bcdDevice= 1.01 [ 267.765221][ T1215] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 267.796679][ T1215] usb 4-1: Product: syz [ 267.801023][ T1215] usb 4-1: Manufacturer: syz [ 267.818358][ T1215] usb 4-1: SerialNumber: syz [ 267.849657][ T1215] usb 4-1: config 0 descriptor?? [ 267.877558][ T7800] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 267.886524][ T977] usb 7-1: new high-speed USB device number 15 using dummy_hcd [ 267.908420][ T1215] ums-karma 4-1:0.46: USB Mass Storage device detected [ 268.106614][ T1215] ums-karma 4-1:0.46: probe with driver ums-karma failed with error -5 [ 268.250822][ T5829] usb 4-1: USB disconnect, device number 53 [ 268.287847][ T977] usb 7-1: config 0 has no interfaces? [ 268.570920][ T977] usb 7-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 268.616406][ T977] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 268.624480][ T977] usb 7-1: Product: syz [ 268.702911][ T977] usb 7-1: Manufacturer: syz [ 268.717699][ T5829] usb 6-1: new high-speed USB device number 18 using dummy_hcd [ 268.745869][ T977] usb 7-1: SerialNumber: syz [ 268.828261][ T977] usb 7-1: config 0 descriptor?? [ 269.166871][ T5829] usb 6-1: device descriptor read/64, error -71 [ 269.326416][ T5887] usb 4-1: new high-speed USB device number 54 using dummy_hcd [ 269.406583][ T5829] usb 6-1: new high-speed USB device number 19 using dummy_hcd [ 269.466448][ T5887] usb 4-1: device descriptor read/64, error -71 [ 269.562281][ T5829] usb 6-1: Using ep0 maxpacket: 8 [ 269.634796][ T5829] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 269.648353][ T5829] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 269.672296][ T5829] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 269.706397][ T5887] usb 4-1: new high-speed USB device number 55 using dummy_hcd [ 269.722845][ T5829] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 269.825602][ T5829] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 269.847648][ T5887] usb 4-1: device descriptor read/64, error -71 [ 269.961589][ T5829] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 270.007361][ T5887] usb usb4-port1: attempt power cycle [ 270.216477][ T5894] usb 3-1: new high-speed USB device number 43 using dummy_hcd [ 270.336608][ T5829] usb 6-1: usb_control_msg returned -32 [ 270.342345][ T5829] usbtmc 6-1:16.0: can't read capabilities [ 270.376808][ T5894] usb 3-1: Using ep0 maxpacket: 32 [ 270.431519][ T5894] usb 3-1: unable to get BOS descriptor or descriptor too short [ 270.441025][ T5894] usb 3-1: config 3 has no interfaces? [ 270.446517][ T5887] usb 4-1: new high-speed USB device number 56 using dummy_hcd [ 270.468710][ T5887] usb 4-1: device descriptor read/8, error -71 [ 270.495768][ T5894] usb 3-1: New USB device found, idVendor=49fe, idProduct=0a7c, bcdDevice=68.85 [ 270.516451][ T5894] usb 3-1: New USB device strings: Mfr=214, Product=81, SerialNumber=3 [ 270.524872][ T5894] usb 3-1: Product: syz [ 270.576356][ T5894] usb 3-1: Manufacturer: syz [ 270.586944][ T5894] usb 3-1: SerialNumber: syz [ 270.670565][ T977] usb 7-1: USB disconnect, device number 15 [ 270.726437][ T5887] usb 4-1: new high-speed USB device number 57 using dummy_hcd [ 270.787644][ T5887] usb 4-1: device descriptor read/8, error -71 [ 270.900111][ T5887] usb usb4-port1: unable to enumerate USB device [ 270.936035][ T7842] input: syz0 as /devices/virtual/input/input27 [ 271.406000][ T7847] loop2: detected capacity change from 0 to 7 [ 271.458091][ T5887] usb 6-1: USB disconnect, device number 19 [ 271.462828][ T7847] Dev loop2: unable to read RDB block 7 [ 271.483333][ T7847] loop2: unable to read partition table [ 271.525002][ T7847] loop2: partition table beyond EOD, truncated [ 271.563900][ T7847] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 272.202402][ T977] usb 7-1: new high-speed USB device number 16 using dummy_hcd [ 272.322565][ T7854] netlink: 16178 bytes leftover after parsing attributes in process `syz.3.473'. [ 272.422823][ T977] usb 7-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 272.476517][ T977] usb 7-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 272.523287][ T977] usb 7-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 272.592141][ T977] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 272.659275][ T7849] raw-gadget.1 gadget.6: fail, usb_ep_enable returned -22 [ 272.685780][ T977] usb 7-1: Quirk or no altset; falling back to MIDI 1.0 [ 272.926742][ T9] usb 4-1: new high-speed USB device number 58 using dummy_hcd [ 273.259344][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 273.290409][ T7857] loop2: detected capacity change from 0 to 7 [ 273.305301][ T7857] ldm_parse_privhead(): Cannot find PRIVHEAD structure. LDM database is corrupt. Aborting. [ 273.329502][ T7857] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 273.336643][ T7857] Dev loop2: unable to read RDB block 7 [ 273.342439][ T7857] loop2: unable to read partition table [ 273.433707][ T977] usb 7-1: USB disconnect, device number 16 [ 273.457721][ T7857] loop2: partition table beyond EOD, truncated [ 273.467813][ T7857] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 273.494538][ T9] usb 4-1: unable to get BOS descriptor or descriptor too short [ 273.527367][ T9] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 273.563192][ T9] usb 4-1: can't read configurations, error -71 [ 274.082373][ T7868] validate_nla: 43 callbacks suppressed [ 274.082399][ T7868] netlink: 'syz.6.476': attribute type 3 has an invalid length. [ 274.106495][ T7868] netlink: 8 bytes leftover after parsing attributes in process `syz.6.476'. [ 274.251308][ T5894] usb 3-1: USB disconnect, device number 43 [ 274.730689][ T7880] team0: Cannot enslave team device to itself [ 274.777485][ T5894] usb 3-1: new full-speed USB device number 44 using dummy_hcd [ 274.971675][ T5894] usb 3-1: New USB device found, idVendor=2770, idProduct=930c, bcdDevice=8d.6a [ 275.022616][ T7890] loop2: detected capacity change from 0 to 7 [ 275.031887][ T5894] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 275.094091][ T7890] Dev loop2: unable to read RDB block 7 [ 275.113612][ T7890] loop2: unable to read partition table [ 275.144203][ T7890] loop2: partition table beyond EOD, truncated [ 275.153034][ T5894] usb 3-1: Product: syz [ 275.171476][ T5894] usb 3-1: Manufacturer: syz [ 275.181305][ T7890] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 275.206962][ T5894] usb 3-1: SerialNumber: syz [ 275.235995][ T5894] usb 3-1: config 0 descriptor?? [ 275.299344][ T5894] gspca_main: sq930x-2.14.0 probing 2770:930c [ 275.733176][ T7897] x_tables: unsorted underflow at hook 1 [ 275.883112][ T7873] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 275.917293][ T7873] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 276.167598][ T5894] gspca_sq930x: ucbus_write failed -71 [ 276.397073][ T5894] gspca_sq930x: Sensor ov9630 not yet treated [ 276.423753][ T7901] netlink: 20 bytes leftover after parsing attributes in process `syz.6.485'. [ 276.456769][ T5894] sq930x 3-1:0.0: probe with driver sq930x failed with error -22 [ 276.531031][ T5894] usb 3-1: USB disconnect, device number 44 [ 277.037302][ T5829] usb 4-1: new high-speed USB device number 60 using dummy_hcd [ 277.206409][ T5829] usb 4-1: Using ep0 maxpacket: 32 [ 277.284410][ T7908] loop2: detected capacity change from 0 to 7 [ 277.319285][ T7908] ldm_parse_privhead(): Cannot find PRIVHEAD structure. LDM database is corrupt. Aborting. [ 277.336743][ T7908] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 277.353742][ T7908] Dev loop2: unable to read RDB block 7 [ 277.369133][ T7908] loop2: unable to read partition table [ 277.375416][ T7908] loop2: partition table beyond EOD, truncated [ 277.402540][ T7908] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 277.482274][ T5829] usb 4-1: unable to get BOS descriptor or descriptor too short [ 277.500467][ T5894] usb 7-1: new full-speed USB device number 17 using dummy_hcd [ 277.547526][ T5829] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 277.555192][ T5829] usb 4-1: can't read configurations, error -71 [ 277.688635][ T5894] usb 7-1: config 7 has an invalid interface number: 101 but max is 0 [ 277.707370][ T5894] usb 7-1: config 7 has no interface number 0 [ 277.720138][ T5894] usb 7-1: New USB device found, idVendor=0fd9, idProduct=002c, bcdDevice= 6.4c [ 277.744603][ T5894] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 277.757506][ T5894] usb 7-1: Product: syz [ 277.762415][ T5894] usb 7-1: Manufacturer: syz [ 277.771860][ T5894] usb 7-1: SerialNumber: syz [ 278.161693][ T7927] loop2: detected capacity change from 0 to 7 [ 278.179546][ T7927] Dev loop2: unable to read RDB block 7 [ 278.185230][ T7927] loop2: unable to read partition table [ 278.245902][ T7927] loop2: partition table beyond EOD, truncated [ 278.283310][ T7927] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 278.607332][ T7941] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 278.616388][ T7941] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 278.716449][ T5829] usb 4-1: new full-speed USB device number 61 using dummy_hcd [ 278.753551][ T7944] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 278.773092][ T7944] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 278.919485][ T5829] usb 4-1: config 0 has an invalid interface number: 52 but max is 0 [ 278.940548][ T5829] usb 4-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 278.976024][ T5829] usb 4-1: config 0 has no interface number 0 [ 278.986803][ T977] usb 6-1: new full-speed USB device number 20 using dummy_hcd [ 279.017735][ T5829] usb 4-1: config 0 interface 52 altsetting 1 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 279.053275][ T5829] usb 4-1: config 0 interface 52 altsetting 1 endpoint 0x8F has invalid maxpacket 65535, setting to 64 [ 279.111719][ T5829] usb 4-1: config 0 interface 52 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 279.169638][ T977] usb 6-1: unable to get BOS descriptor or descriptor too short [ 279.188629][ T5829] usb 4-1: config 0 interface 52 has no altsetting 0 [ 279.198353][ T977] usb 6-1: not running at top speed; connect to a high speed hub [ 279.238689][ T977] usb 6-1: config 14 has an invalid interface number: 242 but max is 0 [ 279.269966][ T5829] usb 4-1: New USB device found, idVendor=06cb, idProduct=0007, bcdDevice= 0.00 [ 279.285122][ T977] usb 6-1: config 14 has no interface number 0 [ 279.299183][ T5829] usb 4-1: New USB device strings: Mfr=0, Product=149, SerialNumber=35 [ 279.308734][ T977] usb 6-1: config 14 interface 242 has no altsetting 0 [ 279.325641][ T5829] usb 4-1: Product: syz [ 279.332374][ T977] usb 6-1: New USB device found, idVendor=0b48, idProduct=3007, bcdDevice=43.0d [ 279.375292][ T977] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 279.389980][ T5829] usb 4-1: SerialNumber: syz [ 279.439708][ T5829] usb 4-1: config 0 descriptor?? [ 279.451253][ T977] usb 6-1: Product: syz [ 279.465003][ T977] usb 6-1: Manufacturer: syz [ 279.599095][ T977] usb 6-1: SerialNumber: syz [ 279.725560][ T5829] input: syz (Stick) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.52/input/input28 [ 279.829506][ T7942] [U] ³•¯ [ 279.864193][ T977] dvb-usb: found a 'Technotrend TT Connect S2-3600' in warm state. [ 279.931067][ T5829] usb 4-1: USB disconnect, device number 61 [ 279.931134][ C0] synaptics_usb 4-1:0.52: synusb_irq - usb_submit_urb failed with result: -19 [ 279.970187][ T977] pctv452e: pctv452e_power_ctrl: 1 [ 279.970187][ T977] [ 279.988551][ T5185] synaptics_usb 4-1:0.52: synusb_open - usb_submit_urb failed, error: -19 [ 280.052454][ T977] pctv452e: pctv452e_power_ctrl: Warning set interface returned: -22 [ 280.052454][ T977] [ 280.119342][ T977] dvb-usb: bulk message failed: -22 (5/0) [ 280.191202][ T977] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 280.319488][ T977] dvb-usb: Technotrend TT Connect S2-3600 error while loading driver (-19) [ 280.398128][ T977] usb 6-1: USB disconnect, device number 20 [ 280.808438][ T7955] bridge1: entered allmulticast mode [ 282.007472][ T7968] netlink: 28 bytes leftover after parsing attributes in process `syz.2.503'. [ 282.039275][ T7968] netlink: 'syz.2.503': attribute type 1 has an invalid length. [ 282.048006][ T7971] netlink: 'syz.5.504': attribute type 27 has an invalid length. [ 282.066908][ T7968] netlink: 24 bytes leftover after parsing attributes in process `syz.2.503'. [ 282.076972][ T7971] netlink: 'syz.5.504': attribute type 3 has an invalid length. [ 282.084704][ T7971] netlink: 132 bytes leftover after parsing attributes in process `syz.5.504'. [ 282.447831][ T5836] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 282.486784][ T5836] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9 [ 282.504305][ T5836] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9 [ 282.513870][ T5836] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4 [ 282.521144][ T7976] loop2: detected capacity change from 0 to 7 [ 282.523991][ T7976] Dev loop2: unable to read RDB block 7 [ 282.539642][ T5836] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2 [ 282.544257][ T7976] loop2: unable to read partition table [ 282.566220][ T7976] loop2: partition table beyond EOD, truncated [ 282.588964][ T7976] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 282.686450][ T24] usb 6-1: new high-speed USB device number 21 using dummy_hcd [ 282.746154][ T5200] Dev loop2: unable to read RDB block 7 [ 282.772676][ T5200] loop2: unable to read partition table [ 282.817296][ T5200] loop2: partition table beyond EOD, truncated [ 282.846418][ T24] usb 6-1: Using ep0 maxpacket: 32 [ 282.897708][ T24] usb 6-1: unable to get BOS descriptor or descriptor too short [ 282.917047][ T24] usb 6-1: unable to read config index 0 descriptor/start: -71 [ 282.929201][ T5894] as10x_usb: device has been detected [ 282.936513][ T24] usb 6-1: can't read configurations, error -71 [ 282.961507][ T5894] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT Deluxe) [ 283.058159][ T5894] usb 7-1: DVB: registering adapter 1 frontend 0 (Elgato EyeTV DTT Deluxe)... [ 283.265262][ T7977] chnl_net:caif_netlink_parms(): no params data found [ 283.331263][ T5894] as10x_usb: error during firmware upload part1 [ 283.346552][ T5950] usb 3-1: new high-speed USB device number 45 using dummy_hcd [ 283.348936][ T5894] Registered device Elgato EyeTV DTT Deluxe [ 283.529395][ T52] usb 7-1: USB disconnect, device number 17 [ 283.541901][ T5950] usb 3-1: Using ep0 maxpacket: 32 [ 283.588485][ T7980] loop2: detected capacity change from 0 to 3 [ 283.633985][ T7980] Dev loop2: unable to read RDB block 3 [ 283.686516][ T7980] loop2: AHDI p1 p2 p3 [ 283.701466][ T52] Unregistered device Elgato EyeTV DTT Deluxe [ 283.709995][ T52] as10x_usb: device has been disconnected [ 283.776921][ T7980] loop2: partition table partially beyond EOD, truncated [ 283.876723][ T7980] loop2: p1 start 167772418 is beyond EOD, truncated [ 283.901527][ T7980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 283.951066][ T7977] bridge0: port 1(bridge_slave_0) entered blocking state [ 283.989583][ T5950] usb 3-1: unable to get BOS descriptor or descriptor too short [ 284.009906][ T7977] bridge0: port 1(bridge_slave_0) entered disabled state [ 284.047003][ T5950] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 284.067675][ T7977] bridge_slave_0: entered allmulticast mode [ 284.075116][ T5950] usb 3-1: can't read configurations, error -71 [ 284.087882][ T7977] bridge_slave_0: entered promiscuous mode [ 284.103159][ T7977] bridge0: port 2(bridge_slave_1) entered blocking state [ 284.113799][ T7977] bridge0: port 2(bridge_slave_1) entered disabled state [ 284.138888][ T7991] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 284.169568][ T7977] bridge_slave_1: entered allmulticast mode [ 284.215260][ T7977] bridge_slave_1: entered promiscuous mode [ 284.470153][ T7977] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 284.535028][ T7977] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 284.660052][ T5836] Bluetooth: hci8: command tx timeout [ 284.905569][ T7977] team0: Port device team_slave_0 added [ 284.960128][ T7977] team0: Port device team_slave_1 added [ 285.228281][ T7977] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 285.247226][ T7977] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 285.291117][ T7977] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 285.383406][ T5829] hid-generic 0080:0001:7FFF.0010: unexpected long global item [ 285.415339][ T5829] hid-generic 0080:0001:7FFF.0010: probe with driver hid-generic failed with error -22 [ 285.447244][ T7977] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 285.471996][ T7977] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 285.535773][ T7977] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 285.783991][ T7977] hsr_slave_0: entered promiscuous mode [ 285.791849][ T7977] hsr_slave_1: entered promiscuous mode [ 285.821539][ T7977] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 285.852303][ T7977] Cannot create hsr debugfs directory [ 286.216425][ T5887] usb 6-1: new high-speed USB device number 23 using dummy_hcd [ 286.396910][ T5887] usb 6-1: Using ep0 maxpacket: 16 [ 286.412118][ T5887] usb 6-1: config 1 interface 0 altsetting 13 bulk endpoint 0x1 has invalid maxpacket 64 [ 286.443127][ T5887] usb 6-1: config 1 interface 0 has no altsetting 0 [ 286.486541][ T5829] usb 3-1: new high-speed USB device number 47 using dummy_hcd [ 286.497053][ T5887] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 286.575558][ T5887] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 286.631918][ T7977] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 286.660033][ T5829] usb 3-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 286.675072][ T5887] usb 6-1: Product: syz [ 286.690873][ T5887] usb 6-1: Manufacturer: syz [ 286.697276][ T5829] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 286.727116][ T5887] usb 6-1: SerialNumber: syz [ 286.729744][ T7977] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 286.746077][ T5836] Bluetooth: hci8: command tx timeout [ 286.767774][ T7977] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 286.784437][ T7977] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 286.821071][ T8007] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 286.836399][ T5829] usb 3-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 286.905198][ T5829] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 286.936471][ T5829] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 287.065838][ T8007] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 287.082585][ T5829] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 287.107149][ T8007] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 287.121517][ T5829] usb 3-1: invalid MIDI out EP 0 [ 287.150636][ T8007] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 287.196964][ T8007] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 287.256993][ T8007] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 287.338885][ T8014] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 287.349568][ T7977] 8021q: adding VLAN 0 to HW filter on device bond0 [ 287.371866][ T8014] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 287.412764][ T5979] udevd[5979]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:27.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 287.493328][ T7977] 8021q: adding VLAN 0 to HW filter on device team0 [ 287.499393][ T5829] snd-usb-audio 3-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 287.510087][ T8007] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 287.548471][ T8007] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 287.581176][ T5928] bridge0: port 1(bridge_slave_0) entered blocking state [ 287.588419][ T5928] bridge0: port 1(bridge_slave_0) entered forwarding state [ 287.628513][ T8007] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 287.648810][ T5829] usb 3-1: USB disconnect, device number 47 [ 287.650118][ T8007] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 287.738194][ T5928] bridge0: port 2(bridge_slave_1) entered blocking state [ 287.745428][ T5928] bridge0: port 2(bridge_slave_1) entered forwarding state [ 287.801497][ T8007] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 287.918934][ T5887] usb 6-1: USB disconnect, device number 23 [ 288.168077][ T7977] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 288.439298][ T7977] veth0_vlan: entered promiscuous mode [ 288.514267][ T7977] veth1_vlan: entered promiscuous mode [ 288.557565][ T8017] loop2: detected capacity change from 0 to 7 [ 288.652229][ T8017] Dev loop2: unable to read RDB block 7 [ 288.683402][ T8017] loop2: unable to read partition table [ 288.715466][ T7977] veth0_macvtap: entered promiscuous mode [ 288.742734][ T8017] loop2: partition table beyond EOD, truncated [ 288.796523][ T8017] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 288.806690][ T7977] veth1_macvtap: entered promiscuous mode [ 288.863095][ T5836] Bluetooth: hci8: command tx timeout [ 289.133277][ T7977] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 289.211613][ T7977] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 289.251760][ T8026] capability: warning: `syz.6.517' uses deprecated v2 capabilities in a way that may be insecure [ 289.271094][ T7977] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 289.354482][ T7977] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 289.499715][ T7977] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 289.529556][ T7977] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 289.686736][ T977] usb 7-1: new high-speed USB device number 18 using dummy_hcd [ 289.857027][ T977] usb 7-1: Using ep0 maxpacket: 32 [ 289.867585][ T8030] loop2: detected capacity change from 0 to 7 [ 289.881721][ T8030] ldm_parse_privhead(): Cannot find PRIVHEAD structure. LDM database is corrupt. Aborting. [ 289.910250][ T8030] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 289.946763][ T8030] Dev loop2: unable to read RDB block 7 [ 289.966558][ T8030] loop2: unable to read partition table [ 289.981616][ T8030] loop2: partition table beyond EOD, truncated [ 290.022950][ T8030] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 290.064411][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 290.102387][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 290.160642][ T977] usb 7-1: unable to get BOS descriptor or descriptor too short [ 290.181624][ T977] usb 7-1: unable to read config index 0 descriptor/start: -71 [ 290.233120][ T977] usb 7-1: can't read configurations, error -71 [ 290.368887][ T5928] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 290.385069][ T5928] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 290.897318][ T5836] Bluetooth: hci8: command tx timeout [ 290.943582][ T8048] netlink: 20 bytes leftover after parsing attributes in process `syz.6.523'. [ 290.954866][ T8048] netlink: 152 bytes leftover after parsing attributes in process `syz.6.523'. [ 290.964501][ T9] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 290.983860][ T8048] A link change request failed with some changes committed already. Interface macvlan1 may have been left with an inconsistent configuration, please check. [ 291.106635][ T9] usb 9-1: device descriptor read/64, error -71 [ 291.380098][ T9] usb 9-1: new high-speed USB device number 3 using dummy_hcd [ 291.496910][ T5887] usb 7-1: new high-speed USB device number 20 using dummy_hcd [ 291.526653][ T9] usb 9-1: device descriptor read/64, error -71 [ 291.647909][ T9] usb usb9-port1: attempt power cycle [ 291.666871][ T5887] usb 7-1: Using ep0 maxpacket: 16 [ 291.673873][ T5887] usb 7-1: config index 0 descriptor too short (expected 69, got 36) [ 291.705947][ T5887] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 291.730251][ T5887] usb 7-1: New USB device found, idVendor=093a, idProduct=2622, bcdDevice=b7.89 [ 291.747421][ T5887] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 291.767901][ T5887] usb 7-1: Product: syz [ 291.780765][ T5887] usb 7-1: Manufacturer: syz [ 291.785397][ T5887] usb 7-1: SerialNumber: syz [ 291.817243][ T5887] usb 7-1: config 0 descriptor?? [ 291.836730][ T5887] gspca_main: gspca_pac7302-2.14.0 probing 093a:2622 [ 291.866393][ T52] usb 6-1: new high-speed USB device number 24 using dummy_hcd [ 292.006517][ T9] usb 9-1: new high-speed USB device number 4 using dummy_hcd [ 292.007064][ T52] usb 6-1: device descriptor read/64, error -71 [ 292.047670][ T9] usb 9-1: device descriptor read/8, error -71 [ 292.256952][ T52] usb 6-1: new high-speed USB device number 25 using dummy_hcd [ 292.308303][ T9] usb 9-1: new high-speed USB device number 5 using dummy_hcd [ 292.344929][ T9] usb 9-1: device descriptor read/8, error -71 [ 292.429894][ T52] usb 6-1: device descriptor read/64, error -71 [ 292.487480][ T9] usb usb9-port1: unable to enumerate USB device [ 292.546703][ T5887] gspca_pac7302: reg_w() failed i: 78 v: 00 error -110 [ 292.553673][ T5887] gspca_pac7302 7-1:0.0: probe with driver gspca_pac7302 failed with error -110 [ 292.583847][ T52] usb usb6-port1: attempt power cycle [ 292.926450][ T52] usb 6-1: new high-speed USB device number 26 using dummy_hcd [ 292.970855][ T52] usb 6-1: device descriptor read/8, error -71 [ 293.226670][ T52] usb 6-1: new high-speed USB device number 27 using dummy_hcd [ 293.268582][ T52] usb 6-1: device descriptor read/8, error -71 [ 293.402352][ T52] usb usb6-port1: unable to enumerate USB device [ 294.227861][ T5894] usb 7-1: USB disconnect, device number 20 [ 294.417668][ T9] usb 6-1: new high-speed USB device number 28 using dummy_hcd [ 294.439104][ T8061] netlink: 8 bytes leftover after parsing attributes in process `syz.6.527'. [ 294.448166][ T8061] netlink: 4 bytes leftover after parsing attributes in process `syz.6.527'. [ 294.484923][ T8061] netlink: 'syz.6.527': attribute type 13 has an invalid length. [ 294.495016][ T8061] netlink: 'syz.6.527': attribute type 12 has an invalid length. [ 294.608112][ T9] usb 6-1: Using ep0 maxpacket: 16 [ 294.631108][ T9] usb 6-1: New USB device found, idVendor=061d, idProduct=c020, bcdDevice=9c.15 [ 294.684032][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 294.708827][ T9] usb 6-1: Product: syz [ 294.729684][ T9] usb 6-1: Manufacturer: syz [ 294.756915][ T9] usb 6-1: SerialNumber: syz [ 294.774525][ T9] usb 6-1: config 0 descriptor?? [ 294.789314][ T9] ssu100 6-1:0.0: Quatech SSU-100 USB to Serial Driver converter detected [ 294.986815][ T52] usb 7-1: new high-speed USB device number 21 using dummy_hcd [ 295.176908][ T5894] usb 9-1: new high-speed USB device number 6 using dummy_hcd [ 295.186606][ T52] usb 7-1: Using ep0 maxpacket: 16 [ 295.198638][ T52] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 11 [ 295.209921][ T52] usb 7-1: config 1 interface 0 altsetting 3 endpoint 0xB has invalid wMaxPacketSize 0 [ 295.223251][ T52] usb 7-1: config 1 interface 0 altsetting 3 bulk endpoint 0xB has invalid maxpacket 0 [ 295.265074][ T9] ssu100 6-1:0.0: probe with driver ssu100 failed with error -71 [ 295.266639][ T52] usb 7-1: config 1 interface 0 altsetting 3 endpoint 0x8A has invalid wMaxPacketSize 0 [ 295.323737][ T52] usb 7-1: config 1 interface 0 altsetting 3 bulk endpoint 0x8A has invalid maxpacket 0 [ 295.347302][ T9] usb 6-1: USB disconnect, device number 28 [ 295.367163][ T5894] usb 9-1: Using ep0 maxpacket: 8 [ 295.375849][ T52] usb 7-1: config 1 interface 0 has no altsetting 0 [ 295.388952][ T5894] usb 9-1: config 64 has an invalid interface number: 19 but max is 0 [ 295.408793][ T5894] usb 9-1: config 64 has no interface number 0 [ 295.415075][ T5894] usb 9-1: config 64 interface 19 altsetting 0 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 295.434833][ T52] usb 7-1: New USB device found, idVendor=04e6, idProduct=0003, bcdDevice= 1.77 [ 295.443690][ T5894] usb 9-1: New USB device found, idVendor=2201, idProduct=012c, bcdDevice=3f.e0 [ 295.453203][ T5894] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 295.457078][ T8071] netlink: 12 bytes leftover after parsing attributes in process `syz.5.530'. [ 295.479168][ T5894] usb 9-1: probing VID:PID(2201:012C) [ 295.497019][ T5894] usb 9-1: vub300 testing UNKNOWN EndPoint(0) 02 [ 295.503438][ T5894] usb 9-1: vub300 ignoring EndPoint(0) 02 [ 295.510731][ T52] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 295.538520][ T5894] usb 9-1: Could not find two sets of bulk-in/out endpoint pairs [ 295.560444][ T52] ums-sddr09 7-1:1.0: USB Mass Storage device detected [ 295.603326][ T5894] vub300 9-1:64.19: probe with driver vub300 failed with error -22 [ 295.708793][ T8066] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 295.730322][ T8066] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 295.777343][ T5894] usb 9-1: USB disconnect, device number 6 [ 295.859158][ T52] ums-sddr09 7-1:1.0: probe with driver ums-sddr09 failed with error -22 [ 295.926684][ T52] usb 7-1: USB disconnect, device number 21 [ 296.459725][ T9] usb 6-1: new high-speed USB device number 29 using dummy_hcd [ 296.487805][ T8081] netlink: 20 bytes leftover after parsing attributes in process `syz.8.534'. [ 296.510134][ T8081] netlink: 152 bytes leftover after parsing attributes in process `syz.8.534'. [ 296.544084][ T8081] A link change request failed with some changes committed already. Interface macvlan1 may have been left with an inconsistent configuration, please check. [ 296.659710][ T9] usb 6-1: Using ep0 maxpacket: 16 [ 296.687766][ T9] usb 6-1: too many endpoints for config 1 interface 0 altsetting 0: 255, using maximum allowed: 30 [ 296.729626][ T55] Bluetooth: hci9: unexpected cc 0x0c03 length: 249 > 1 [ 296.749656][ T9] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 32 [ 296.759968][ T9] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 296.769999][ T55] Bluetooth: hci9: unexpected cc 0x1003 length: 249 > 9 [ 296.780893][ T55] Bluetooth: hci9: unexpected cc 0x1001 length: 249 > 9 [ 296.788259][ T9] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 296.800375][ T9] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 296.810470][ T55] Bluetooth: hci9: unexpected cc 0x0c23 length: 249 > 4 [ 296.817877][ T9] usb 6-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 255 [ 296.831848][ T55] Bluetooth: hci9: unexpected cc 0x0c38 length: 249 > 2 [ 296.833051][ T9] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 296.856668][ T52] usb 7-1: new high-speed USB device number 22 using dummy_hcd [ 296.897278][ T9] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 296.905343][ T9] usb 6-1: SerialNumber: syz [ 296.948375][ T8079] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 296.979653][ T8079] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 297.016889][ T52] usb 7-1: Using ep0 maxpacket: 16 [ 297.060370][ T52] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 297.128024][ T52] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 297.177079][ T52] usb 7-1: New USB device found, idVendor=060b, idProduct=500a, bcdDevice= 0.00 [ 297.196739][ T5950] usb 9-1: new full-speed USB device number 7 using dummy_hcd [ 297.214632][ T52] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 297.266098][ T52] usb 7-1: config 0 descriptor?? [ 297.854892][ T8088] chnl_net:caif_netlink_parms(): no params data found [ 298.188803][ T8088] bridge0: port 1(bridge_slave_0) entered blocking state [ 298.197471][ T8088] bridge0: port 1(bridge_slave_0) entered disabled state [ 298.212055][ T8088] bridge_slave_0: entered allmulticast mode [ 298.235361][ T8088] bridge_slave_0: entered promiscuous mode [ 298.264495][ T8088] bridge0: port 2(bridge_slave_1) entered blocking state [ 298.293150][ T8088] bridge0: port 2(bridge_slave_1) entered disabled state [ 298.309610][ T8088] bridge_slave_1: entered allmulticast mode [ 298.322026][ T8088] bridge_slave_1: entered promiscuous mode [ 298.445725][ T8088] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 298.464966][ T8088] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 298.668274][ T8088] team0: Port device team_slave_0 added [ 298.691949][ T8088] team0: Port device team_slave_1 added [ 298.897373][ T5836] Bluetooth: hci9: command tx timeout [ 298.952562][ T8088] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 298.960322][ T8088] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 298.986746][ T8088] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 299.002990][ T8088] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 299.020327][ T8088] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 299.046384][ C0] vkms_vblank_simulate: vblank timer overrun [ 299.060424][ T8088] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 299.644691][ T9] usb 6-1: USB disconnect, device number 29 [ 299.779190][ T8088] hsr_slave_0: entered promiscuous mode [ 299.799067][ T8088] hsr_slave_1: entered promiscuous mode [ 299.808950][ T52] usb 7-1: string descriptor 0 read error: -71 [ 299.824675][ T8088] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 299.845154][ T8088] Cannot create hsr debugfs directory [ 299.896446][ T5950] usb 9-1: new high-speed USB device number 8 using dummy_hcd [ 299.926846][ T52] usbhid 7-1:0.0: can't add hid device: -71 [ 299.932929][ T52] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 300.050288][ T52] usb 7-1: USB disconnect, device number 22 [ 300.076642][ T5950] usb 9-1: Using ep0 maxpacket: 32 [ 300.106846][ T5950] usb 9-1: config 0 interface 0 has no altsetting 0 [ 300.116419][ T5950] usb 9-1: New USB device found, idVendor=2040, idProduct=c603, bcdDevice= 1.8e [ 300.125517][ T5950] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 300.210485][ T5950] usb 9-1: config 0 descriptor?? [ 300.519797][ T5950] usb 9-1: dvb_usb_v2: found a 'Hauppauge 126xxx ATSC+' in warm state [ 300.555990][ T5950] usb 9-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 300.634391][ T5950] dvbdev: DVB: registering new adapter (Hauppauge 126xxx ATSC+) [ 300.660155][ T52] usb 7-1: new high-speed USB device number 23 using dummy_hcd [ 300.782047][ T5950] usb 9-1: media controller created [ 300.850143][ T5950] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 300.919887][ T52] usb 7-1: device descriptor read/64, error -71 [ 300.976876][ T5836] Bluetooth: hci9: command tx timeout [ 301.179275][ T52] usb 7-1: new high-speed USB device number 24 using dummy_hcd [ 301.356603][ T52] usb 7-1: device descriptor read/64, error -71 [ 301.467572][ T52] usb usb7-port1: attempt power cycle [ 301.649901][ T8088] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 301.675453][ T8088] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 301.750820][ T8088] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 301.771923][ T8088] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 301.816675][ T52] usb 7-1: new high-speed USB device number 25 using dummy_hcd [ 301.849130][ T52] usb 7-1: device descriptor read/8, error -71 [ 302.137338][ T52] usb 7-1: new high-speed USB device number 26 using dummy_hcd [ 302.197355][ T52] usb 7-1: device descriptor read/8, error -71 [ 302.306874][ T52] usb usb7-port1: unable to enumerate USB device [ 302.481026][ T8132] ptrace attach of "./syz-executor exec"[7026] was attempted by "./syz-executor exec"[8132] [ 302.738934][ T5950] set interface failed [ 302.738969][ T5950] usb 9-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 302.836619][ T5950] error writing reg: 0xff, val: 0x00 [ 302.883445][ T8137] netlink: 20 bytes leftover after parsing attributes in process `syz.8.545'. [ 302.946679][ T8137] netlink: 152 bytes leftover after parsing attributes in process `syz.8.545'. [ 303.018386][ T8137] A link change request failed with some changes committed already. Interface macvlan1 may have been left with an inconsistent configuration, please check. [ 303.058663][ T5836] Bluetooth: hci9: command tx timeout [ 303.059535][ T5950] dvb_usb_mxl111sf 9-1:0.0: probe with driver dvb_usb_mxl111sf failed with error -22 [ 303.107076][ T5950] usb 9-1: USB disconnect, device number 8 [ 303.119289][ T8088] 8021q: adding VLAN 0 to HW filter on device bond0 [ 303.149054][ T8088] 8021q: adding VLAN 0 to HW filter on device team0 [ 303.188252][ T2213] bridge0: port 1(bridge_slave_0) entered blocking state [ 303.195511][ T2213] bridge0: port 1(bridge_slave_0) entered forwarding state [ 303.284652][ T2213] bridge0: port 2(bridge_slave_1) entered blocking state [ 303.291951][ T2213] bridge0: port 2(bridge_slave_1) entered forwarding state [ 303.901566][ T8088] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 304.130269][ T8088] veth0_vlan: entered promiscuous mode [ 304.178781][ T8088] veth1_vlan: entered promiscuous mode [ 304.342248][ T8088] veth0_macvtap: entered promiscuous mode [ 304.437833][ T8088] veth1_macvtap: entered promiscuous mode [ 304.585772][ T8088] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 304.606405][ T52] usb 7-1: new high-speed USB device number 27 using dummy_hcd [ 304.716888][ T8088] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 304.811561][ T8088] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 304.902446][ T8088] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 304.983488][ T8088] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 305.032901][ T8088] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 305.140086][ T55] Bluetooth: hci9: command tx timeout [ 305.693729][ T53] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 305.771819][ T53] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 306.079570][ T53] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 306.116474][ T53] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 306.187898][ T8166] netlink: 8 bytes leftover after parsing attributes in process `syz.5.553'. [ 306.956424][ T5950] usb 10-1: new high-speed USB device number 2 using dummy_hcd [ 306.968095][ T5836] Bluetooth: hci10: unexpected cc 0x0c03 length: 249 > 1 [ 306.991966][ T5836] Bluetooth: hci10: unexpected cc 0x1003 length: 249 > 9 [ 307.000695][ T5836] Bluetooth: hci10: unexpected cc 0x1001 length: 249 > 9 [ 307.016467][ T5836] Bluetooth: hci10: unexpected cc 0x0c23 length: 249 > 4 [ 307.027331][ T5836] Bluetooth: hci10: unexpected cc 0x0c38 length: 249 > 2 [ 307.110392][ T8182] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 307.147144][ T5894] usb 6-1: new high-speed USB device number 30 using dummy_hcd [ 307.147731][ T5950] usb 10-1: Using ep0 maxpacket: 32 [ 307.196817][ T8177] loop2: detected capacity change from 0 to 7 [ 307.215734][ T5885] ldm_parse_privhead(): Cannot find PRIVHEAD structure. LDM database is corrupt. Aborting. [ 307.248135][ T5885] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 307.261688][ T5885] Dev loop2: unable to read RDB block 7 [ 307.270913][ T5885] loop2: unable to read partition table [ 307.286140][ T5885] loop2: partition table beyond EOD, truncated [ 307.358662][ T5894] usb 6-1: config 0 interface 0 altsetting 253 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 307.383943][ T8177] ldm_parse_privhead(): Cannot find PRIVHEAD structure. LDM database is corrupt. Aborting. [ 307.408228][ T5894] usb 6-1: config 0 interface 0 has no altsetting 0 [ 307.415126][ T8177] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 307.426086][ T5894] usb 6-1: New USB device found, idVendor=1b96, idProduct=0009, bcdDevice= 0.00 [ 307.446516][ T8177] Dev loop2: unable to read RDB block 7 [ 307.470152][ T5894] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 307.480937][ T8177] loop2: unable to read partition table [ 307.490691][ T8177] loop2: partition table beyond EOD, truncated [ 307.501982][ T5894] usb 6-1: config 0 descriptor?? [ 307.522650][ T8177] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 307.593636][ T5950] usb 10-1: unable to get BOS descriptor or descriptor too short [ 307.742813][ T5950] usb 10-1: unable to read config index 0 descriptor/start: -71 [ 307.768494][ T5950] usb 10-1: can't read configurations, error -71 [ 307.777403][ T52] usb 7-1: device descriptor read/64, error -71 [ 308.072952][ T52] usb 7-1: new high-speed USB device number 28 using dummy_hcd [ 308.328762][ T52] usb 7-1: config 0 has no interfaces? [ 308.391799][ T52] usb 7-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 308.436716][ T52] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 308.446757][ T52] usb 7-1: Product: syz [ 308.460720][ T52] usb 7-1: Manufacturer: syz [ 308.465349][ T52] usb 7-1: SerialNumber: syz [ 308.573198][ T52] usb 7-1: config 0 descriptor?? [ 308.823096][ T8184] chnl_net:caif_netlink_parms(): no params data found [ 309.136451][ T5836] Bluetooth: hci10: command tx timeout [ 309.622588][ T8207] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 310.335729][ T5894] usbhid 6-1:0.0: can't add hid device: -71 [ 310.352457][ T5894] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 310.389614][ T8184] bridge0: port 1(bridge_slave_0) entered blocking state [ 310.407875][ T5894] usb 6-1: USB disconnect, device number 30 [ 310.441458][ T8184] bridge0: port 1(bridge_slave_0) entered disabled state [ 310.495488][ T8184] bridge_slave_0: entered allmulticast mode [ 310.559259][ T8184] bridge_slave_0: entered promiscuous mode [ 310.670652][ T8184] bridge0: port 2(bridge_slave_1) entered blocking state [ 310.715158][ T8224] raw_sendmsg: syz.8.563 forgot to set AF_INET. Fix it! [ 310.716547][ T8184] bridge0: port 2(bridge_slave_1) entered disabled state [ 310.794309][ T8184] bridge_slave_1: entered allmulticast mode [ 310.846530][ T8184] bridge_slave_1: entered promiscuous mode [ 310.874619][ T9] usb 7-1: USB disconnect, device number 28 [ 310.998800][ T8228] IPVS: set_ctl: invalid protocol: 59 172.20.20.187:20004 [ 311.112719][ T5894] usb 9-1: new high-speed USB device number 9 using dummy_hcd [ 311.217196][ T5836] Bluetooth: hci10: command tx timeout [ 311.284726][ T8234] netlink: 8 bytes leftover after parsing attributes in process `syz.9.565'. [ 311.297897][ T5894] usb 9-1: Using ep0 maxpacket: 32 [ 311.323292][ T8234] FAULT_INJECTION: forcing a failure. [ 311.323292][ T8234] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 311.366997][ T5894] usb 9-1: New USB device found, idVendor=174f, idProduct=6a31, bcdDevice=26.3f [ 311.382534][ T5894] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 311.392005][ T5894] usb 9-1: Product: syz [ 311.396910][ T5894] usb 9-1: Manufacturer: syz [ 311.401706][ T5894] usb 9-1: SerialNumber: syz [ 311.425806][ T8234] CPU: 1 UID: 0 PID: 8234 Comm: syz.9.565 Not tainted 6.15.0-rc7-syzkaller #0 PREEMPT(full) [ 311.425836][ T8234] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 311.425854][ T8234] Call Trace: [ 311.425866][ T8234] [ 311.425876][ T8234] dump_stack_lvl+0x189/0x250 [ 311.425921][ T8234] ? __lock_acquire+0xaac/0xd20 [ 311.425954][ T8234] ? __pfx_dump_stack_lvl+0x10/0x10 [ 311.425984][ T8234] ? __pfx__printk+0x10/0x10 [ 311.426005][ T8234] ? __might_fault+0xb0/0x130 [ 311.426045][ T8234] should_fail_ex+0x414/0x560 [ 311.426072][ T8234] _copy_from_user+0x2d/0xb0 [ 311.426103][ T8234] __se_sys_sendfile64+0xa6/0x190 [ 311.426129][ T8234] ? rcu_is_watching+0x15/0xb0 [ 311.426145][ T8234] ? __pfx___se_sys_sendfile64+0x10/0x10 [ 311.426172][ T8234] ? do_syscall_64+0xba/0x210 [ 311.426198][ T8234] do_syscall_64+0xf6/0x210 [ 311.426229][ T8234] ? clear_bhb_loop+0x60/0xb0 [ 311.426257][ T8234] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 311.426276][ T8234] RIP: 0033:0x7fd4eb78e969 [ 311.426299][ T8234] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 311.426316][ T8234] RSP: 002b:00007fd4ec65b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 311.426338][ T8234] RAX: ffffffffffffffda RBX: 00007fd4eb9b6160 RCX: 00007fd4eb78e969 [ 311.426352][ T8234] RDX: 0000200000002700 RSI: 0000000000000009 RDI: 000000000000000a [ 311.426364][ T8234] RBP: 00007fd4ec65b090 R08: 0000000000000000 R09: 0000000000000000 [ 311.426376][ T8234] R10: 000000000000001c R11: 0000000000000246 R12: 0000000000000001 [ 311.426388][ T8234] R13: 0000000000000000 R14: 00007fd4eb9b6160 R15: 00007fd4ebadfa28 [ 311.426419][ T8234] [ 311.607411][ T5894] usb 9-1: config 0 descriptor?? [ 311.616369][ T5894] gspca_main: stk1135-2.14.0 probing 174f:6a31 [ 311.827528][ T5894] gspca_stk1135: reg_w 0x2 err -71 [ 311.839162][ T5894] gspca_stk1135: serial bus timeout: status=0x00 [ 311.845681][ T5894] gspca_stk1135: Sensor write failed [ 311.895371][ T5894] gspca_stk1135: serial bus timeout: status=0x00 [ 311.908543][ T8184] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 311.977504][ T5894] gspca_stk1135: Sensor write failed [ 312.021491][ T8184] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 312.046989][ T5950] usb 7-1: new high-speed USB device number 29 using dummy_hcd [ 312.053980][ T5894] gspca_stk1135: serial bus timeout: status=0x00 [ 312.133847][ T8184] team0: Port device team_slave_0 added [ 312.167619][ T8184] team0: Port device team_slave_1 added [ 312.186406][ T5950] usb 7-1: device descriptor read/64, error -71 [ 312.426526][ T5950] usb 7-1: new high-speed USB device number 30 using dummy_hcd [ 312.588327][ T5950] usb 7-1: device descriptor read/64, error -71 [ 312.656807][ T5894] gspca_stk1135: Sensor read failed [ 312.662921][ T5894] gspca_stk1135: serial bus timeout: status=0x00 [ 312.669499][ T5894] gspca_stk1135: Sensor read failed [ 312.675407][ T5894] gspca_stk1135: Detected sensor type unknown (0x0) [ 312.722534][ T5950] usb usb7-port1: attempt power cycle [ 312.742467][ T5894] gspca_stk1135: serial bus timeout: status=0x00 [ 312.762373][ T5894] gspca_stk1135: Sensor read failed [ 312.768580][ T5894] gspca_stk1135: serial bus timeout: status=0x00 [ 312.775111][ T5894] gspca_stk1135: Sensor read failed [ 312.781894][ T5894] gspca_stk1135: serial bus timeout: status=0x00 [ 312.789699][ T5894] gspca_stk1135: Sensor write failed [ 312.797298][ T5894] gspca_stk1135: serial bus timeout: status=0x00 [ 312.803963][ T5894] gspca_stk1135: Sensor write failed [ 312.811473][ T5894] stk1135 9-1:0.0: probe with driver stk1135 failed with error -71 [ 312.834331][ T5894] usb 9-1: USB disconnect, device number 9 [ 312.861099][ T8184] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 312.935944][ T8184] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 313.023816][ T8184] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 313.090659][ T8184] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 313.107513][ T5950] usb 7-1: new high-speed USB device number 31 using dummy_hcd [ 313.110351][ T8184] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 313.216445][ T5894] usb 9-1: new high-speed USB device number 10 using dummy_hcd [ 313.232499][ T5950] usb 7-1: device descriptor read/8, error -71 [ 313.303268][ T55] Bluetooth: hci10: command tx timeout [ 313.376684][ T5894] usb 9-1: Using ep0 maxpacket: 32 [ 313.395945][ T5894] usb 9-1: New USB device found, idVendor=174f, idProduct=6a31, bcdDevice=26.3f [ 313.405540][ T5894] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 313.417815][ T8184] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 313.486699][ T5950] usb 7-1: new high-speed USB device number 32 using dummy_hcd [ 313.505907][ T5894] usb 9-1: Product: syz [ 313.521692][ T5894] usb 9-1: Manufacturer: syz [ 313.529186][ T5950] usb 7-1: device descriptor read/8, error -71 [ 313.550514][ T5894] usb 9-1: SerialNumber: syz [ 313.648438][ T5950] usb usb7-port1: unable to enumerate USB device [ 313.740787][ T5894] usb 9-1: config 0 descriptor?? [ 313.752850][ T5894] usb 9-1: can't set config #0, error -71 [ 313.755264][ T8184] hsr_slave_0: entered promiscuous mode [ 313.790381][ T5894] usb 9-1: USB disconnect, device number 10 [ 313.844466][ T8184] hsr_slave_1: entered promiscuous mode [ 313.877443][ T8184] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 313.916429][ T8184] Cannot create hsr debugfs directory [ 314.098092][ T55] Bluetooth: hci5: command 0x0406 tx timeout [ 314.521935][ T8254] netlink: 8 bytes leftover after parsing attributes in process `syz.9.570'. [ 314.534730][ T8254] netlink: 8 bytes leftover after parsing attributes in process `syz.9.570'. [ 314.577699][ T8254] netlink: 8 bytes leftover after parsing attributes in process `syz.9.570'. [ 315.108741][ T8262] netlink: 'syz.5.572': attribute type 1 has an invalid length. [ 315.366386][ T5894] usb 9-1: new high-speed USB device number 11 using dummy_hcd [ 315.376620][ T5836] Bluetooth: hci10: command tx timeout [ 315.406209][ T8262] 8021q: adding VLAN 0 to HW filter on device bond2 [ 315.603966][ T5894] usb 9-1: config 0 interface 0 altsetting 253 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 315.626146][ T8184] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 315.665159][ T5894] usb 9-1: config 0 interface 0 has no altsetting 0 [ 315.692916][ T5894] usb 9-1: New USB device found, idVendor=1b96, idProduct=0009, bcdDevice= 0.00 [ 315.721755][ T5894] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 315.741108][ T8269] vlan2: entered allmulticast mode [ 315.747992][ T5894] usb 9-1: config 0 descriptor?? [ 315.783819][ T8269] netdevsim netdevsim5 netdevsim0: entered allmulticast mode [ 315.798548][ T5829] usb 10-1: new high-speed USB device number 4 using dummy_hcd [ 315.823504][ T8269] bond2: (slave vlan2): making interface the new active one [ 315.842868][ T8269] bond2: (slave vlan2): Enslaving as an active interface with an up link [ 315.966462][ T5829] usb 10-1: Using ep0 maxpacket: 32 [ 315.984051][ T8275] loop2: detected capacity change from 0 to 7 [ 316.002605][ T8184] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 316.064524][ T8275] ldm_parse_privhead(): Cannot find PRIVHEAD structure. LDM database is corrupt. Aborting. [ 316.097653][ T8275] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 316.118670][ T8275] Dev loop2: unable to read RDB block 7 [ 316.151718][ T8275] loop2: unable to read partition table [ 316.169186][ T8275] loop2: partition table beyond EOD, truncated [ 316.217281][ T8278] openvswitch: netlink: IP tunnel attribute has 4 unknown bytes. [ 316.217441][ T8275] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 316.284025][ T5894] usbhid 9-1:0.0: can't add hid device: -71 [ 316.291576][ T5894] usbhid 9-1:0.0: probe with driver usbhid failed with error -71 [ 316.293695][ T8279] netlink: 56 bytes leftover after parsing attributes in process `syz.5.576'. [ 316.325284][ T5829] usb 10-1: unable to get BOS descriptor or descriptor too short [ 316.339175][ T8279] netlink: 24 bytes leftover after parsing attributes in process `syz.5.576'. [ 316.349604][ T5829] usb 10-1: unable to read config index 0 descriptor/start: -71 [ 316.358339][ T5829] usb 10-1: can't read configurations, error -71 [ 316.375689][ T8184] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 316.406719][ T5894] usb 9-1: USB disconnect, device number 11 [ 316.617901][ T8283] netlink: 72 bytes leftover after parsing attributes in process `syz.5.577'. [ 316.648477][ T8184] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 317.162426][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.178490][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.246470][ T5887] usb 9-1: new high-speed USB device number 12 using dummy_hcd [ 317.430171][ T5887] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 317.446811][ T5887] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 317.461222][ T5887] usb 9-1: New USB device found, idVendor=057e, idProduct=2009, bcdDevice= 0.00 [ 317.473114][ T5887] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 317.536039][ T5894] usb 6-1: new full-speed USB device number 31 using dummy_hcd [ 317.544275][ T5887] usb 9-1: config 0 descriptor?? [ 317.975161][ T5894] usb 6-1: not running at top speed; connect to a high speed hub [ 317.994731][ T5894] usb 6-1: config 8 has an invalid interface number: 113 but max is 0 [ 318.016912][ T5894] usb 6-1: config 8 has no interface number 0 [ 318.041776][ T5894] usb 6-1: config 8 interface 113 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 318.076566][ T5894] usb 6-1: config 8 interface 113 altsetting 0 has a duplicate endpoint with address 0x6, skipping [ 318.120642][ T8184] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 318.151844][ T5894] usb 6-1: config 8 interface 113 altsetting 0 has a duplicate endpoint with address 0x6, skipping [ 318.168297][ T5887] usbhid 9-1:0.0: can't add hid device: -71 [ 318.175248][ T5887] usbhid 9-1:0.0: probe with driver usbhid failed with error -71 [ 318.176875][ T5894] usb 6-1: config 8 interface 113 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 318.342289][ T5887] usb 9-1: USB disconnect, device number 12 [ 318.397013][ T5894] usb 6-1: config 8 interface 113 altsetting 0 endpoint 0x8 has invalid maxpacket 512, setting to 64 [ 318.457797][ T8184] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 318.488004][ T5894] usb 6-1: config 8 interface 113 altsetting 0 has a duplicate endpoint with address 0xF, skipping [ 318.513390][ T8184] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 318.566440][ T5894] usb 6-1: config 8 interface 113 altsetting 0 has a duplicate endpoint with address 0x5, skipping [ 318.577413][ T8184] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 318.629605][ T5894] usb 6-1: New USB device found, idVendor=1046, idProduct=9967, bcdDevice=16.97 [ 318.649789][ T5894] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 318.663339][ T5894] usb 6-1: Product: syz [ 318.671660][ T5894] usb 6-1: Manufacturer: Ћ [ 318.676334][ T5894] usb 6-1: SerialNumber: syz [ 318.698725][ T8294] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 319.513982][ T30] audit: type=1326 audit(1747770704.689:128): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8316 comm="syz.8.585" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe0b638e969 code=0x7ffc0000 [ 319.628011][ T30] audit: type=1326 audit(1747770704.689:129): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8316 comm="syz.8.585" exe="/root/syz-executor" sig=0 arch=c000003e syscall=433 compat=0 ip=0x7fe0b638e969 code=0x7ffc0000 [ 320.338441][ T30] audit: type=1326 audit(1747770704.689:130): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8316 comm="syz.8.585" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe0b638e969 code=0x7ffc0000 [ 320.456441][ T30] audit: type=1326 audit(1747770704.689:131): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8316 comm="syz.8.585" exe="/root/syz-executor" sig=0 arch=c000003e syscall=42 compat=0 ip=0x7fe0b638e969 code=0x7ffc0000 [ 320.520694][ T8184] 8021q: adding VLAN 0 to HW filter on device bond0 [ 320.606435][ T30] audit: type=1326 audit(1747770704.689:132): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8316 comm="syz.8.585" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe0b638e969 code=0x7ffc0000 [ 320.633464][ T30] audit: type=1326 audit(1747770704.689:133): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8316 comm="syz.8.585" exe="/root/syz-executor" sig=0 arch=c000003e syscall=307 compat=0 ip=0x7fe0b638e969 code=0x7ffc0000 [ 320.766821][ T5894] gspca_main: ov519-2.14.0 probing 1046:9967 [ 320.776431][ T9] usb 10-1: new high-speed USB device number 6 using dummy_hcd [ 320.826339][ T5894] ov519 6-1:8.113: reg_w 00 failed -71 [ 320.967245][ T8184] 8021q: adding VLAN 0 to HW filter on device team0 [ 321.005664][ T9] usb 10-1: unable to read config index 0 descriptor/start: -61 [ 321.014481][ T53] bridge0: port 1(bridge_slave_0) entered blocking state [ 321.021698][ T53] bridge0: port 1(bridge_slave_0) entered forwarding state [ 321.056336][ T9] usb 10-1: can't read configurations, error -61 [ 321.120176][ T53] bridge0: port 2(bridge_slave_1) entered blocking state [ 321.127475][ T53] bridge0: port 2(bridge_slave_1) entered forwarding state [ 321.266434][ T9] usb 10-1: new high-speed USB device number 7 using dummy_hcd [ 321.458309][ T9] usb 10-1: unable to read config index 0 descriptor/start: -61 [ 321.466062][ T9] usb 10-1: can't read configurations, error -61 [ 321.553781][ T9] usb usb10-port1: attempt power cycle [ 321.813700][ T8184] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 321.946785][ T9] usb 10-1: new high-speed USB device number 8 using dummy_hcd [ 322.073133][ T9] usb 10-1: device descriptor read/8, error -71 [ 322.260271][ T8338] usb usb2: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 322.273809][ T8184] veth0_vlan: entered promiscuous mode [ 322.290731][ T8184] veth1_vlan: entered promiscuous mode [ 322.318528][ T8338] usb usb2: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 322.349544][ T8184] veth0_macvtap: entered promiscuous mode [ 322.428352][ T8184] veth1_macvtap: entered promiscuous mode [ 322.603078][ T8184] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 322.711517][ T8184] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 322.745772][ T8184] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 322.759733][ T8184] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 322.807203][ T8184] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 322.832850][ T8184] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 323.046569][ T9] usb 10-1: new high-speed USB device number 9 using dummy_hcd [ 323.175165][ T9] usb 10-1: Using ep0 maxpacket: 32 [ 323.195632][ T8343] loop2: detected capacity change from 0 to 7 [ 323.239265][ T8343] ldm_parse_privhead(): Cannot find PRIVHEAD structure. LDM database is corrupt. Aborting. [ 323.292515][ T8343] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 323.336363][ T53] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 323.408542][ T8343] Dev loop2: unable to read RDB block 7 [ 323.414447][ T53] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 323.450622][ T5887] usb 9-1: new high-speed USB device number 13 using dummy_hcd [ 323.511313][ T8343] loop2: unable to read partition table [ 323.537903][ T53] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 323.561580][ T53] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 323.633178][ T5887] usb 9-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 323.670501][ T8343] loop2: partition table beyond EOD, truncated [ 323.677313][ T5887] usb 9-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 323.946868][ T8343] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 323.981426][ T5887] usb 9-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 324.025181][ T9] usb 10-1: unable to get BOS descriptor or descriptor too short [ 324.061593][ T5887] usb 9-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 324.067473][ T9] usb 10-1: unable to read config index 0 descriptor/start: -71 [ 324.113540][ T5887] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 324.186508][ T9] usb 10-1: can't read configurations, error -71 [ 324.195688][ T5887] usb 9-1: Quirk or no altset; falling back to MIDI 1.0 [ 324.233591][ T9] usb usb10-port1: unable to enumerate USB device [ 324.248182][ T5887] usb 9-1: invalid MIDI out EP 0 [ 324.340190][ T55] Bluetooth: hci6: command 0x0406 tx timeout [ 324.488453][ T5887] snd-usb-audio 9-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 324.646606][ T5979] udevd[5979]: error opening ATTR{/sys/devices/platform/dummy_hcd.8/usb9/9-1/9-1:27.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 325.386384][ T5887] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 325.610364][ T5887] usb 1-1: Using ep0 maxpacket: 32 [ 325.668969][ T5887] usb 1-1: config 0 interface 0 has no altsetting 0 [ 325.688445][ T5887] usb 1-1: New USB device found, idVendor=2040, idProduct=c603, bcdDevice= 1.8e [ 325.716730][ T5887] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 325.740956][ T5887] usb 1-1: config 0 descriptor?? [ 325.821251][ T5887] usb 1-1: dvb_usb_v2: found a 'Hauppauge 126xxx ATSC+' in warm state [ 325.887857][ T5887] usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 325.917032][ T5887] dvbdev: DVB: registering new adapter (Hauppauge 126xxx ATSC+) [ 325.932157][ T5887] usb 1-1: media controller created [ 325.993283][ T5887] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 326.525588][ T8378] rdma_op ffff88803776d9f0 conn xmit_rdma 0000000000000000 [ 327.577412][ T8385] netlink: 44 bytes leftover after parsing attributes in process `syz.9.596'. [ 328.256913][ T5894] ov519 6-1:8.113: Can't determine sensor slave IDs [ 328.263575][ T5894] ov519 6-1:8.113: OV519 Config failed [ 328.276484][ T5894] ov519 6-1:8.113: probe with driver ov519 failed with error -22 [ 328.350958][ T5894] usb 6-1: USB disconnect, device number 31 [ 328.451061][ T1215] usb 9-1: USB disconnect, device number 13 [ 328.953282][ T8397] netlink: 'syz.8.599': attribute type 27 has an invalid length. [ 329.232027][ T8397] bridge0: port 2(bridge_slave_1) entered disabled state [ 329.239884][ T8397] bridge0: port 1(bridge_slave_0) entered disabled state [ 330.530915][ T8397] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 330.561173][ T8397] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 330.737122][ T5893] usb 6-1: new high-speed USB device number 32 using dummy_hcd [ 330.906752][ T5893] usb 6-1: Using ep0 maxpacket: 32 [ 330.914622][ T5893] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 331.067389][ T5893] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 331.106375][ T5893] usb 6-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 331.126530][ T5893] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 331.149023][ T5887] set interface failed [ 331.149060][ T5887] usb 1-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 331.179162][ T5887] error writing reg: 0xff, val: 0x00 [ 331.237625][ T5893] usb 6-1: config 0 descriptor?? [ 331.277721][ T8397] netdevsim netdevsim8 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 331.366510][ T8397] netdevsim netdevsim8 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 331.408926][ T5887] dvb_usb_mxl111sf 1-1:0.0: probe with driver dvb_usb_mxl111sf failed with error -22 [ 331.506770][ T8397] netdevsim netdevsim8 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 331.630588][ T8397] netdevsim netdevsim8 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 331.667149][ T5887] usb 1-1: USB disconnect, device number 22 [ 331.858660][ T31] INFO: task syz.0.241:6868 blocked for more than 143 seconds. [ 331.872147][ T31] Not tainted 6.15.0-rc7-syzkaller #0 [ 331.895672][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 331.982181][ T5893] ft260 0003:0403:6030.0011: unknown main item tag 0x0 [ 332.075923][ T31] task:syz.0.241 state:D stack:24824 pid:6868 tgid:6863 ppid:5850 task_flags:0x440040 flags:0x00004006 [ 332.119281][ T31] Call Trace: [ 332.122647][ T31] [ 332.125614][ T31] __schedule+0x16e2/0x4cd0 [ 332.178526][ T5893] ft260 0003:0403:6030.0011: chip code: 6424 8183 [ 332.276369][ T31] ? schedule+0x165/0x360 [ 332.280836][ T31] ? __pfx___schedule+0x10/0x10 [ 332.285781][ T31] ? schedule+0x91/0x360 [ 332.353418][ T31] schedule+0x165/0x360 [ 332.379143][ T31] ? rwsem_down_read_slowpath+0x568/0x880 [ 332.384954][ T31] schedule_preempt_disabled+0x13/0x30 [ 332.400287][ T31] rwsem_down_read_slowpath+0x552/0x880 [ 332.405961][ T31] ? __pfx_rwsem_down_read_slowpath+0x10/0x10 [ 332.440850][ T31] ? page_cache_ra_order+0x445/0xc70 [ 332.446459][ T31] ? cgroup_rstat_updated+0x144/0xb50 [ 332.451907][ T31] down_read+0x98/0x2e0 [ 332.456116][ T31] page_cache_ra_order+0x445/0xc70 [ 332.466499][ T31] ? maybe_unlock_mmap_for_io+0x16a/0x2d0 [ 332.472324][ T31] do_sync_mmap_readahead+0x31a/0x5f0 [ 332.510241][ T31] ? count_memcg_event_mm+0x8a/0x3a0 [ 332.528327][ T31] ? __pfx_do_sync_mmap_readahead+0x10/0x10 [ 332.534328][ T31] ? count_memcg_event_mm+0x348/0x3a0 [ 332.564285][ T31] ? filemap_fault_recheck_pte_none+0x25e/0x2d0 [ 332.580009][ T31] filemap_fault+0x62a/0x1200 [ 332.584799][ T31] ? __pfx_filemap_fault+0x10/0x10 [ 332.636607][ T31] __do_fault+0x135/0x390 [ 332.641043][ T31] __handle_mm_fault+0x17f9/0x5380 [ 332.666383][ T31] ? __pfx___handle_mm_fault+0x10/0x10 [ 332.671968][ T31] ? find_vma+0xe7/0x160 [ 332.696539][ T31] ? __pfx_find_vma+0x10/0x10 [ 332.701365][ T31] handle_mm_fault+0x3f6/0x8c0 [ 332.706192][ T31] do_user_addr_fault+0x764/0x1390 [ 332.746462][ T31] exc_page_fault+0x68/0x110 [ 332.751154][ T31] asm_exc_page_fault+0x26/0x30 [ 332.756037][ T31] RIP: 0010:__put_user_nocheck_4+0x3/0x10 [ 332.796518][ T31] Code: d9 0f 01 cb 89 01 31 c9 0f 01 ca e9 47 2c 03 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 01 cb <89> 01 31 c9 0f 01 ca c3 cc cc cc cc 90 90 90 90 90 90 90 90 90 90 [ 332.906762][ T31] RSP: 0018:ffffc900035478d8 EFLAGS: 00050202 [ 332.912919][ T31] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00002000000c2030 [ 332.958118][ T31] RDX: ffff88802f590000 RSI: 0000000000000002 RDI: 00000000ffffffff [ 332.976578][ T31] RBP: ffffc90003547a50 R08: ffffc90003547687 R09: 1ffff920006a8ed0 [ 333.016597][ T31] R10: dffffc0000000000 R11: fffff520006a8ed1 R12: 0000000000000002 [ 333.057187][ T31] R13: dffffc0000000000 R14: 0000000000000000 R15: 00002000000c2000 [ 333.116615][ T31] ____sys_recvmsg+0x2ab/0x460 [ 333.121523][ T31] ? __pfx_____sys_recvmsg+0x10/0x10 [ 333.183142][ T31] ? import_iovec+0x74/0xa0 [ 333.206485][ T31] ___sys_recvmsg+0x1b5/0x510 [ 333.223389][ T31] ? __pfx____sys_recvmsg+0x10/0x10 [ 333.256768][ T31] ? __might_fault+0xb0/0x130 [ 333.261610][ T31] do_recvmmsg+0x307/0x760 [ 333.266112][ T31] ? __pfx_do_recvmmsg+0x10/0x10 [ 333.306309][ T31] ? count_memcg_event_mm+0x92/0x3b0 [ 333.311745][ T31] ? count_memcg_event_mm+0x35b/0x3b0 [ 333.356406][ T31] ? __pfx_lock_vma_under_rcu+0x10/0x10 [ 333.362040][ T31] ? _raw_spin_unlock_irqrestore+0x85/0x110 [ 333.376312][ T31] __x64_sys_recvmmsg+0x190/0x240 [ 333.396299][ T31] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 333.416313][ T31] ? do_syscall_64+0xba/0x210 [ 333.426573][ T31] do_syscall_64+0xf6/0x210 [ 333.446575][ T31] ? clear_bhb_loop+0x60/0xb0 [ 333.451394][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 333.486450][ T31] RIP: 0033:0x7f52e0b8e969 [ 333.491510][ T31] RSP: 002b:00007f52e1999038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 333.526417][ T31] RAX: ffffffffffffffda RBX: 00007f52e0db6080 RCX: 00007f52e0b8e969 [ 333.556322][ T31] RDX: 0000000000010106 RSI: 00002000000000c0 RDI: 0000000000000004 [ 333.564470][ T31] RBP: 00007f52e0c10ab1 R08: 0000000000000000 R09: 0000000000000000 [ 333.656477][ T31] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000 [ 333.664537][ T31] R13: 0000000000000001 R14: 00007f52e0db6080 R15: 00007f52e0edfa28 [ 333.726371][ T31] [ 333.734540][ T31] INFO: task syz.1.260:6950 blocked for more than 145 seconds. [ 333.856355][ T31] Not tainted 6.15.0-rc7-syzkaller #0 [ 333.862345][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 333.903634][ T31] task:syz.1.260 state:D stack:25272 pid:6950 tgid:6950 ppid:5848 task_flags:0x440040 flags:0x00000004 [ 333.916123][ T31] Call Trace: [ 333.919811][ T31] [ 333.922793][ T31] __schedule+0x16e2/0x4cd0 [ 333.928855][ T31] ? schedule+0x165/0x360 [ 333.933249][ T31] ? __pfx___schedule+0x10/0x10 [ 333.940639][ T31] ? schedule+0x91/0x360 [ 333.949081][ T31] schedule+0x165/0x360 [ 333.953309][ T31] ? rwsem_down_read_slowpath+0x568/0x880 [ 333.976691][ T31] schedule_preempt_disabled+0x13/0x30 [ 333.982258][ T31] rwsem_down_read_slowpath+0x552/0x880 [ 333.991444][ T31] ? __pfx_rwsem_down_read_slowpath+0x10/0x10 [ 333.998756][ T31] ? page_cache_ra_order+0x445/0xc70 [ 334.004110][ T31] ? cgroup_rstat_updated+0x144/0xb50 [ 334.010173][ T31] down_read+0x98/0x2e0 [ 334.014421][ T31] page_cache_ra_order+0x445/0xc70 [ 334.020268][ T31] ? maybe_unlock_mmap_for_io+0x225/0x2d0 [ 334.026614][ T31] do_sync_mmap_readahead+0x4b5/0x5f0 [ 334.032074][ T31] ? __pfx_do_sync_mmap_readahead+0x10/0x10 [ 334.038547][ T31] ? count_memcg_event_mm+0x348/0x3a0 [ 334.043982][ T31] ? __filemap_get_folio+0x9a6/0xaf0 [ 334.056381][ T31] ? __lruvec_stat_mod_folio+0x79/0x2f0 [ 334.066627][ T31] ? filemap_fault_recheck_pte_none+0x75/0x2d0 [ 334.072858][ T31] filemap_fault+0x62a/0x1200 [ 334.118258][ T31] ? __pagetable_ctor+0x253/0x340 [ 334.123377][ T31] ? __pfx_filemap_fault+0x10/0x10 [ 334.156372][ T31] ? rcu_is_watching+0x15/0xb0 [ 334.161240][ T31] ? __raw_spin_lock_init+0x45/0x100 [ 334.186641][ T31] __do_fault+0x135/0x390 [ 334.191086][ T31] __handle_mm_fault+0x17f9/0x5380 [ 334.218168][ T31] ? __lock_acquire+0xaac/0xd20 [ 334.223228][ T31] ? __pfx___handle_mm_fault+0x10/0x10 [ 334.243345][ T31] ? lock_vma_under_rcu+0xf8/0x710 [ 334.250901][ T31] ? lock_vma_under_rcu+0xf8/0x710 [ 334.276394][ T31] ? __pfx_lock_vma_under_rcu+0x10/0x10 [ 334.282053][ T31] handle_mm_fault+0x3f6/0x8c0 [ 334.303478][ T31] do_user_addr_fault+0xa81/0x1390 [ 334.309254][ T31] ? rcu_is_watching+0x15/0xb0 [ 334.314134][ T31] ? trace_irq_disable+0x37/0x110 [ 334.376618][ T31] exc_page_fault+0x68/0x110 [ 334.381330][ T31] asm_exc_page_fault+0x26/0x30 [ 334.386224][ T31] RIP: 0033:0x7f8560a64f79 [ 334.417837][ T31] RSP: 002b:00007f8560edfb90 EFLAGS: 00010246 [ 334.424090][ T31] RAX: 0000200000000140 RBX: 0000000000000002 RCX: ffffffffffffee7f [ 334.438903][ T31] RDX: 801908723cda0673 RSI: 0000200000001180 RDI: 00005555689953c8 [ 334.455513][ T31] RBP: 00007f8560db7ba0 R08: 00007f8560a00000 R09: 0000000000000046 [ 334.466971][ T31] R10: 0000000000000000 R11: 0000000000000001 R12: 00007f8560db616c [ 334.475022][ T31] R13: 00007f8560edfc80 R14: fffffffffffffffe R15: 00007f8560edfca0 [ 334.483630][ T31] [ 334.487045][ T31] INFO: task syz.1.260:6951 blocked for more than 145 seconds. [ 334.497312][ T31] Not tainted 6.15.0-rc7-syzkaller #0 [ 334.566781][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 334.575639][ T31] task:syz.1.260 state:D stack:25848 pid:6951 tgid:6950 ppid:5848 task_flags:0x440140 flags:0x00004004 [ 334.656791][ T31] Call Trace: [ 334.661610][ T31] [ 334.664582][ T31] __schedule+0x16e2/0x4cd0 [ 334.669441][ T31] ? schedule+0x165/0x360 [ 334.686326][ T31] ? __pfx___schedule+0x10/0x10 [ 334.705074][ T31] ? schedule+0x91/0x360 [ 334.709546][ T31] schedule+0x165/0x360 [ 334.713777][ T31] ? rwsem_down_read_slowpath+0x568/0x880 [ 334.736313][ T31] schedule_preempt_disabled+0x13/0x30 [ 334.741960][ T31] rwsem_down_read_slowpath+0x552/0x880 [ 334.766638][ T31] ? __pfx_rwsem_down_read_slowpath+0x10/0x10 [ 334.772889][ T31] ? page_cache_ra_order+0x445/0xc70 [ 334.806800][ T31] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 334.813025][ T31] ? cgroup_rstat_updated+0x144/0xb50 [ 334.831868][ T31] down_read+0x98/0x2e0 [ 334.837765][ T31] page_cache_ra_order+0x445/0xc70 [ 334.842960][ T31] ? maybe_unlock_mmap_for_io+0x16a/0x2d0 [ 334.856479][ T31] do_sync_mmap_readahead+0x4b5/0x5f0 [ 334.897976][ T31] ? __pfx_do_sync_mmap_readahead+0x10/0x10 [ 334.906520][ T31] ? count_memcg_event_mm+0x348/0x3a0 [ 334.916423][ T31] ? __filemap_get_folio+0x9a6/0xaf0 [ 334.926536][ T31] ? filemap_map_pages+0x1370/0x1740 [ 334.934272][ T31] ? filemap_fault_recheck_pte_none+0x75/0x2d0 [ 334.941302][ T31] filemap_fault+0x62a/0x1200 [ 334.946056][ T31] ? __pfx_filemap_fault+0x10/0x10 [ 334.951429][ T31] ? __pfx_filemap_map_pages+0x10/0x10 [ 334.957007][ T31] ? __handle_mm_fault+0x280a/0x5380 [ 334.966419][ T31] __do_fault+0x135/0x390 [ 334.972159][ T31] __handle_mm_fault+0x363e/0x5380 [ 334.989241][ T31] ? __pfx___handle_mm_fault+0x10/0x10 [ 334.994829][ T31] ? find_vma+0xe7/0x160 [ 335.003453][ T31] ? __pfx_find_vma+0x10/0x10 [ 335.010825][ T31] handle_mm_fault+0x3f6/0x8c0 [ 335.016652][ T31] do_user_addr_fault+0x764/0x1390 [ 335.021859][ T31] exc_page_fault+0x68/0x110 [ 335.026659][ T31] asm_exc_page_fault+0x26/0x30 [ 335.036696][ T31] RIP: 0010:rep_movs_alternative+0x4a/0x90 [ 335.042639][ T31] Code: cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 73 e8 eb c5 a4 e9 7f f2 03 00 48 8b 06 48 89 07 48 8d 47 08 48 83 e0 f8 48 [ 335.064443][ T31] RSP: 0018:ffffc9001cc3fa18 EFLAGS: 00050206 [ 335.071916][ T31] RAX: 00007ffffffff001 RBX: 0000000000001000 RCX: 0000000000001000 [ 335.080106][ T31] RDX: 0000000000000001 RSI: 00002000000fc000 RDI: ffff888057c24000 [ 335.086527][ T5200] udevd[5200]: worker [5883] /devices/virtual/block/loop6 is taking a long time [ 335.088254][ T31] RBP: 000000007ff03000 R08: ffff888057c24fff R09: 1ffff1100af849ff [ 335.123705][ T31] R10: dffffc0000000000 R11: ffffed100af84a00 R12: 0000000000000000 [ 335.152341][ T31] R13: 0000000000001000 R14: ffff888057c24000 R15: 00002000000fc000 [ 335.192974][ T31] _copy_from_user+0x7a/0xb0 [ 335.197887][ T31] snd_rawmidi_kernel_write1+0x3ab/0x650 [ 335.203607][ T31] snd_rawmidi_write+0x5ad/0xbd0 [ 335.226503][ T31] ? __pfx_snd_rawmidi_write+0x10/0x10 [ 335.232066][ T31] ? __pfx_default_wake_function+0x10/0x10 [ 335.254212][ T31] ? common_file_perm+0x199/0x200 [ 335.264381][ T31] ? bpf_lsm_file_permission+0x9/0x20 [ 335.270431][ T31] ? security_file_permission+0x75/0x290 [ 335.286405][ T31] ? rw_verify_area+0x258/0x650 [ 335.291392][ T31] ? __pfx_snd_rawmidi_write+0x10/0x10 [ 335.316440][ T31] vfs_write+0x27b/0xa90 [ 335.327327][ T31] ? __pfx_vfs_write+0x10/0x10 [ 335.362277][ T31] ? __fget_files+0x2a/0x420 [ 335.369182][ T31] ? __fget_files+0x2a/0x420 [ 335.378145][ T31] ? __fget_files+0x3a0/0x420 [ 335.382915][ T31] ? __fget_files+0x2a/0x420 [ 335.387920][ T31] ksys_write+0x145/0x250 [ 335.392303][ T31] ? rcu_is_watching+0x15/0xb0 [ 335.397414][ T31] ? __pfx_ksys_write+0x10/0x10 [ 335.406564][ T31] ? do_syscall_64+0xba/0x210 [ 335.411329][ T31] do_syscall_64+0xf6/0x210 [ 335.415882][ T31] ? clear_bhb_loop+0x60/0xb0 [ 335.421077][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 335.427834][ T31] RIP: 0033:0x7f8560b8e969 [ 335.436554][ T31] RSP: 002b:00007f85619af038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 335.445040][ T31] RAX: ffffffffffffffda RBX: 00007f8560db5fa0 RCX: 00007f8560b8e969 [ 335.466452][ T31] RDX: 00000000fffffd2c RSI: 0000200000000000 RDI: 0000000000000005 [ 335.474507][ T31] RBP: 00007f8560c10ab1 R08: 0000000000000000 R09: 0000000000000000 [ 335.507423][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 335.523724][ T31] R13: 0000000000000000 R14: 00007f8560db5fa0 R15: 00007f8560edfa28 [ 335.532122][ T31] [ 335.600654][ T31] INFO: task syz.1.260:6953 blocked for more than 147 seconds. [ 335.755958][ T31] Not tainted 6.15.0-rc7-syzkaller #0 [ 335.762550][ T31] Blocked by coredump. [ 335.786784][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 335.796808][ T31] task:syz.1.260 state:D stack:26040 pid:6953 tgid:6950 ppid:5848 task_flags:0x400548 flags:0x00004004 [ 335.809168][ T31] Call Trace: [ 335.816580][ T31] [ 335.819576][ T31] __schedule+0x16e2/0x4cd0 [ 335.824169][ T31] ? schedule+0x165/0x360 [ 335.829465][ T31] ? __pfx___schedule+0x10/0x10 [ 335.834453][ T31] ? schedule+0x91/0x360 [ 335.839580][ T31] schedule+0x165/0x360 [ 335.848981][ T31] schedule_preempt_disabled+0x13/0x30 [ 335.854554][ T31] __mutex_lock+0x724/0xe80 [ 335.866973][ T31] ? __mutex_lock+0x51b/0xe80 [ 335.871749][ T31] ? io_uring_del_tctx_node+0xf0/0x2c0 [ 335.886433][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 335.896586][ T31] ? do_raw_spin_unlock+0x122/0x240 [ 335.901889][ T31] ? _raw_spin_unlock+0x28/0x50 [ 335.926709][ T31] ? xa_erase+0xd5/0xf0 [ 335.930973][ T31] io_uring_del_tctx_node+0xf0/0x2c0 [ 335.976392][ T31] io_uring_clean_tctx+0xd4/0x1a0 [ 335.981574][ T31] ? schedule+0x165/0x360 [ 336.006438][ T31] ? __pfx_io_uring_clean_tctx+0x10/0x10 [ 336.023013][ T31] ? io_uring_drop_tctx_refs+0x108/0x1c0 [ 336.066460][ T31] io_uring_cancel_generic+0x68f/0x730 [ 336.106335][ T31] ? __pfx_io_uring_cancel_generic+0x10/0x10 [ 336.126310][ T31] ? __pfx_autoremove_wake_function+0x10/0x10 [ 336.132727][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 336.138272][ T31] ? io_uring_unreg_ringfd+0x52f/0x540 [ 336.156330][ T31] do_exit+0x56a/0x2550 [ 336.160640][ T31] ? do_raw_spin_lock+0x121/0x290 [ 336.165735][ T31] ? __pfx_do_exit+0x10/0x10 [ 336.199825][ T31] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 336.226462][ T31] do_group_exit+0x21c/0x2d0 [ 336.236379][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 336.241702][ T31] get_signal+0x125e/0x1310 [ 336.299530][ T31] arch_do_signal_or_restart+0x95/0x780 [ 336.319446][ T31] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 336.325740][ T31] ? local_irq_enable_exit_to_user+0x5/0x10 [ 336.356835][ T31] syscall_exit_to_user_mode+0x8b/0x120 [ 336.362545][ T31] do_syscall_64+0x103/0x210 [ 336.396489][ T31] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 336.403407][ T31] ? clear_bhb_loop+0x60/0xb0 [ 336.411754][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 336.429342][ T31] RIP: 0033:0x7f8560b8e969 [ 336.434630][ T31] RSP: 002b:00007f856198e0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 336.443537][ T31] RAX: fffffffffffffe00 RBX: 00007f8560db6088 RCX: 00007f8560b8e969 [ 336.451635][ T31] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f8560db6088 [ 336.459765][ T31] RBP: 00007f8560db6080 R08: 0000000000000000 R09: 0000000000000000 [ 336.476385][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8560db608c [ 336.485539][ T31] R13: 0000000000000000 R14: 00007f8560edf940 R15: 00007f8560edfa28 [ 336.493828][ T31] [ 336.505588][ T31] INFO: task syz.1.260:6954 blocked for more than 147 seconds. [ 336.513419][ T31] Not tainted 6.15.0-rc7-syzkaller #0 [ 336.521919][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 336.530811][ T31] task:syz.1.260 state:D stack:23496 pid:6954 tgid:6950 ppid:5848 task_flags:0x440040 flags:0x00004004 [ 336.544612][ T31] Call Trace: [ 336.556574][ T31] [ 336.559684][ T31] __schedule+0x16e2/0x4cd0 [ 336.566382][ T31] ? schedule+0x165/0x360 [ 336.576897][ T31] ? __pfx___schedule+0x10/0x10 [ 336.582084][ T31] ? schedule+0x91/0x360 [ 336.586696][ T31] schedule+0x165/0x360 [ 336.607875][ T31] ? rwsem_down_read_slowpath+0x568/0x880 [ 336.621091][ T31] schedule_preempt_disabled+0x13/0x30 [ 336.634004][ T31] rwsem_down_read_slowpath+0x552/0x880 [ 336.645401][ T31] ? __pfx_rwsem_down_read_slowpath+0x10/0x10 [ 336.671714][ T31] ? page_cache_ra_order+0x445/0xc70 [ 336.678532][ T31] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 336.686554][ T31] ? cgroup_rstat_updated+0x144/0xb50 [ 336.716594][ T31] down_read+0x98/0x2e0 [ 336.720977][ T31] page_cache_ra_order+0x445/0xc70 [ 336.726651][ T31] ? maybe_unlock_mmap_for_io+0x16a/0x2d0 [ 336.736556][ T31] do_sync_mmap_readahead+0x4b5/0x5f0 [ 336.742062][ T31] ? __pfx_do_sync_mmap_readahead+0x10/0x10 [ 336.748635][ T31] ? count_memcg_event_mm+0x348/0x3a0 [ 336.761533][ T31] ? __filemap_get_folio+0x9a6/0xaf0 [ 336.777083][ T31] ? filemap_map_pages+0x1370/0x1740 [ 336.782579][ T31] ? filemap_fault_recheck_pte_none+0x75/0x2d0 [ 336.794278][ T31] filemap_fault+0x62a/0x1200 [ 336.811363][ T31] ? __pfx_filemap_fault+0x10/0x10 [ 336.846342][ T31] ? __pfx_filemap_map_pages+0x10/0x10 [ 336.866587][ T31] ? __handle_mm_fault+0x280a/0x5380 [ 336.877446][ T31] __do_fault+0x135/0x390 [ 336.881932][ T31] __handle_mm_fault+0x363e/0x5380 [ 336.888532][ T31] ? __pfx___handle_mm_fault+0x10/0x10 [ 336.897445][ T31] ? find_vma+0xe7/0x160 [ 336.901773][ T31] ? __pfx_find_vma+0x10/0x10 [ 336.916394][ T31] handle_mm_fault+0x3f6/0x8c0 [ 336.921365][ T31] do_user_addr_fault+0x764/0x1390 [ 337.006449][ T31] exc_page_fault+0x68/0x110 [ 337.021587][ T31] asm_exc_page_fault+0x26/0x30 [ 337.026533][ T31] RIP: 0010:rep_movs_alternative+0x30/0x90 [ 337.036509][ T31] Code: 83 f9 08 73 25 85 c9 74 0f 8a 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 c3 cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 <48> 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 [ 337.057527][ T31] RSP: 0018:ffffc9001ccafcd8 EFLAGS: 00050246 [ 337.063718][ T31] RAX: 00007ffffffff001 RBX: 0000000000000008 RCX: 0000000000000008 [ 337.076388][ T31] RDX: 0000000000000001 RSI: 0000200000001bc0 RDI: ffffc9001ccafd60 [ 337.087176][ T31] RBP: ffffc9001ccafdd0 R08: ffffc9001ccafd67 R09: 1ffff92003995fac [ 337.099850][ T31] R10: dffffc0000000000 R11: fffff52003995fad R12: 0000200000001bc0 [ 337.116330][ T31] R13: ffffc9001ccafd60 R14: ffffc9001ccafd60 R15: 0000200000001bc0 [ 337.146605][ T31] _copy_from_user+0x7a/0xb0 [ 337.151302][ T31] io_register_iowq_max_workers+0x95/0x6c0 [ 337.166531][ T31] ? __fget_files+0x2a/0x420 [ 337.182688][ T31] ? __pfx_io_register_iowq_max_workers+0x10/0x10 [ 337.189756][ T31] ? __fget_files+0x3a0/0x420 [ 337.196411][ T31] ? __fget_files+0x2a/0x420 [ 337.227749][ T5893] ft260 0003:0403:6030.0011: failed to retrieve system status [ 337.261068][ T31] ? io_is_uring_fops+0xd/0x50 [ 337.265918][ T31] __se_sys_io_uring_register+0xf97/0x11b0 [ 337.272355][ T5893] ft260 0003:0403:6030.0011: probe with driver ft260 failed with error -110 [ 337.281666][ T31] ? __pfx___se_sys_io_uring_register+0x10/0x10 [ 337.296040][ T31] ? rcu_is_watching+0x15/0xb0 [ 337.323803][ T31] ? do_syscall_64+0xba/0x210 [ 337.346828][ T31] do_syscall_64+0xf6/0x210 [ 337.351436][ T31] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 337.366495][ T31] ? clear_bhb_loop+0x60/0xb0 [ 337.382015][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 337.388758][ T31] RIP: 0033:0x7f8560b8e969 [ 337.396451][ T31] RSP: 002b:00007f8561954038 EFLAGS: 00000246 ORIG_RAX: 00000000000001ab [ 337.406375][ T31] RAX: ffffffffffffffda RBX: 00007f8560db6160 RCX: 00007f8560b8e969 [ 337.420405][ T31] RDX: 0000200000001bc0 RSI: 0000000000000013 RDI: 000000000000000a [ 337.433619][ T31] RBP: 00007f8560c10ab1 R08: 0000000000000000 R09: 0000000000000000 [ 337.442056][ T31] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000 [ 337.450302][ T31] R13: 0000000000000000 R14: 00007f8560db6160 R15: 00007f8560edfa28 [ 337.458748][ T31] [ 337.461985][ T31] [ 337.461985][ T31] Showing all locks held in the system: [ 337.546364][ T31] 3 locks held by kworker/0:0/9: [ 337.551391][ T31] #0: ffff88801a080d48 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x9b1/0x17a0 [ 337.575052][ T31] #1: ffffc900000e7c60 (deferred_process_work){+.+.}-{0:0}, at: process_scheduled_works+0x9ec/0x17a0 [ 337.596675][ T31] #2: ffffffff8f2fa848 (rtnl_mutex){+.+.}-{4:4}, at: switchdev_deferred_process_work+0xe/0x20 [ 337.612383][ T31] 1 lock held by khungtaskd/31: [ 337.653970][ T31] #0: ffffffff8df3dee0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 337.672187][ T31] 3 locks held by kworker/u8:2/36: [ 337.686687][ T31] #0: ffff88801af2c148 ((wq_completion)cfg80211){+.+.}-{0:0}, at: process_scheduled_works+0x9b1/0x17a0 [ 337.698458][ T31] #1: ffffc90000ad7c60 ((work_completion)(&(&rdev->dfs_update_channels_wk)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ec/0x17a0 [ 337.713054][ T31] #2: ffffffff8f2fa848 (rtnl_mutex){+.+.}-{4:4}, at: cfg80211_dfs_channels_update_work+0xb6/0x630 [ 337.733604][ T31] 3 locks held by kworker/u8:3/53: [ 337.747134][ T31] #0: ffff88801a089148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x9b1/0x17a0 [ 337.806561][ T31] #1: ffffc90000be7c60 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x9ec/0x17a0 [ 337.834857][ T31] #2: ffffffff8f2fa848 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 [ 337.852749][ T31] 3 locks held by kworker/u8:4/68: [ 337.886629][ T31] #0: ffff8880588bf148 ((wq_completion)loop6){+.+.}-{0:0}, at: process_scheduled_works+0x9b1/0x17a0 [ 337.952037][ T31] #1: ffffc90001557c60 ((work_completion)(&lo->rootcg_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ec/0x17a0 [ 337.966167][ T31] #2: ffff888148c5aa20 (&sb->s_type->i_mutex_key#8){++++}-{4:4}, at: blkdev_read_iter+0x2f8/0x440 [ 338.011169][ T31] 4 locks held by kworker/u8:5/966: [ 338.016889][ T31] #0: ffff88801aef6148 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x9b1/0x17a0 [ 338.028418][ T31] #1: ffffc90003a87c60 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x9ec/0x17a0 [ 338.039906][ T31] #2: ffffffff8f2edd10 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0x145/0xbd0 [ 338.061323][ T31] #3: ffffffff8f2fa848 (rtnl_mutex){+.+.}-{4:4}, at: wg_netns_pre_exit+0x1c/0x1d0 [ 338.070982][ T31] 3 locks held by kworker/u8:6/2213: [ 338.086429][ T31] #0: ffff88801a089148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x9b1/0x17a0 [ 338.101218][ T31] #1: ffffc90005547c60 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ec/0x17a0 [ 338.121380][ T31] #2: ffff888058950768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xc4/0x460 [ 338.146368][ T31] 2 locks held by getty/5590: [ 338.151119][ T31] #0: ffff888034c5a0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 338.166379][ T31] #1: ffffc90002ffe2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 [ 338.196442][ T31] 1 lock held by udevd/5883: [ 338.201107][ T31] #0: ffff888148c51320 (&sb->s_type->i_mutex_key#8){++++}-{4:4}, at: blkdev_read_iter+0x2f8/0x440 [ 338.216761][ T31] 3 locks held by kworker/u8:8/5928: [ 338.222139][ T31] #0: ffff888030203148 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x9b1/0x17a0 [ 338.235093][ T31] #1: ffffc9000498fc60 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ec/0x17a0 [ 338.262848][ T31] #2: ffffffff8f2fa848 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_verify_work+0x19/0x30 [ 338.273058][ T31] 1 lock held by syz.0.241/6868: [ 338.286439][ T31] #0: ffff888148c5abc0 (mapping.invalidate_lock){++++}-{4:4}, at: page_cache_ra_order+0x445/0xc70 [ 338.306433][ T31] 5 locks held by syz.0.241/6870: [ 338.311534][ T31] 1 lock held by syz.1.260/6950: [ 338.326647][ T31] #0: ffff888148c5abc0 (mapping.invalidate_lock){++++}-{4:4}, at: page_cache_ra_order+0x445/0xc70 [ 338.342831][ T31] 1 lock held by syz.1.260/6951: [ 338.356516][ T31] #0: ffff888148c5abc0 (mapping.invalidate_lock){++++}-{4:4}, at: page_cache_ra_order+0x445/0xc70 [ 338.367731][ T31] 1 lock held by syz.1.260/6953: [ 338.372682][ T31] #0: ffff88805fa060a8 (&ctx->uring_lock){+.+.}-{4:4}, at: io_uring_del_tctx_node+0xf0/0x2c0 [ 338.391276][ T31] 2 locks held by syz.1.260/6954: [ 338.417046][ T31] #0: ffff88805fa060a8 (&ctx->uring_lock){+.+.}-{4:4}, at: __se_sys_io_uring_register+0x1e1/0x11b0 [ 338.436675][ T31] #1: ffff888148c5abc0 (mapping.invalidate_lock){++++}-{4:4}, at: page_cache_ra_order+0x445/0xc70 [ 338.447874][ T31] 1 lock held by syz.4.370/7476: [ 338.453247][ T31] #0: ffff888148c5abc0 (mapping.invalidate_lock){++++}-{4:4}, at: page_cache_ra_order+0x445/0xc70 [ 338.476367][ T31] 1 lock held by syz.7.420/7785: [ 338.481430][ T31] #0: ffff888148c5abc0 (mapping.invalidate_lock){++++}-{4:4}, at: page_cache_ra_order+0x445/0xc70 [ 338.516675][ T31] 1 lock held by syz.7.420/7786: [ 338.521670][ T31] #0: ffff888148c5abc0 (mapping.invalidate_lock){++++}-{4:4}, at: page_cache_ra_order+0x445/0xc70 [ 338.546365][ T31] 1 lock held by syz.7.420/7787: [ 338.562039][ T31] #0: ffff888148c5aa20 (&sb->s_type->i_mutex_key#8){++++}-{4:4}, at: blkdev_fallocate+0x1d8/0x4b0 [ 338.595991][ T31] 2 locks held by syz.3.500/7958: [ 338.603623][ T31] #0: ffff8880592b4318 (sk_lock-AF_INET6){+.+.}-{0:0}, at: sctp_getsockopt+0x135/0xb60 [ 338.633815][ T31] #1: ffff888148c5abc0 (mapping.invalidate_lock){++++}-{4:4}, at: page_cache_ra_order+0x445/0xc70 [ 338.666400][ T31] 1 lock held by syz.2.519/8031: [ 338.671410][ T31] #0: ffff888148c5abc0 (mapping.invalidate_lock){++++}-{4:4}, at: page_cache_ra_order+0x445/0xc70 [ 338.699831][ T31] 2 locks held by syz.8.599/8393: [ 338.705025][ T31] #0: ffff888078e89408 (&sb->s_type->i_mutex_key#11){+.+.}-{4:4}, at: sock_close+0x9b/0x240 [ 338.717119][ T31] #1: ffffffff8f2fa848 (rtnl_mutex){+.+.}-{4:4}, at: ipv6_sock_mc_close+0xce/0x140 [ 338.736463][ T31] 3 locks held by syz.8.599/8397: [ 338.741688][ T31] #0: ffffffff8f2fa848 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8db/0x1c70 [ 338.751285][ T31] #1: ffff888058950768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_stop+0x3f6/0x4a0 [ 338.766587][ T31] #2: ffffffff8df439b8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x3b7/0x730 [ 338.786922][ T31] 1 lock held by syz.8.599/8400: [ 338.791916][ T31] #0: ffffffff8f2fa848 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8db/0x1c70 [ 338.806447][ T31] 2 locks held by syz.6.600/8401: [ 338.843070][ T31] #0: ffff8880329acd80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x1fe/0x500 [ 338.853194][ T31] #1: ffff8880329ac078 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x66a/0x1330 [ 338.877845][ T31] 1 lock held by syz.5.601/8408: [ 338.882846][ T31] #0: ffffffff8f2fa848 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 [ 338.895847][ T31] 1 lock held by syz.9.602/8411: [ 338.916869][ T31] #0: ffffffff8f2fa848 (rtnl_mutex){+.+.}-{4:4}, at: ip_mroute_setsockopt+0x107/0xf60 [ 338.937245][ T31] 4 locks held by syz.0.603/8418: [ 338.942333][ T31] #0: ffff88807cd94d80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x1fe/0x500 [ 338.962779][ T31] #1: ffff88807cd94078 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x66a/0x1330 [ 338.972715][ T31] #2: ffffffff8f460288 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xa1/0x230 [ 338.984669][ T31] #3: ffff888028078338 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x70/0x680 [ 339.007806][ T31] [ 339.019781][ T31] ============================================= [ 339.019781][ T31] [ 339.037040][ T31] NMI backtrace for cpu 1 [ 339.037062][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.15.0-rc7-syzkaller #0 PREEMPT(full) [ 339.037086][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 339.037097][ T31] Call Trace: [ 339.037105][ T31] [ 339.037114][ T31] dump_stack_lvl+0x189/0x250 [ 339.037147][ T31] ? __wake_up_klogd+0xd9/0x110 [ 339.037185][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 339.037215][ T31] ? __pfx__printk+0x10/0x10 [ 339.037250][ T31] nmi_cpu_backtrace+0x39e/0x3d0 [ 339.037276][ T31] ? __pfx_nmi_cpu_backtrace+0x10/0x10 [ 339.037295][ T31] ? _printk+0xcf/0x120 [ 339.037320][ T31] ? __pfx__printk+0x10/0x10 [ 339.037343][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 339.037368][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 339.037391][ T31] watchdog+0xfee/0x1030 [ 339.037419][ T31] ? watchdog+0x1de/0x1030 [ 339.037454][ T31] kthread+0x70e/0x8a0 [ 339.037483][ T31] ? __pfx_watchdog+0x10/0x10 [ 339.037508][ T31] ? __pfx_kthread+0x10/0x10 [ 339.037534][ T31] ? __pfx_kthread+0x10/0x10 [ 339.037558][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 339.037582][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 339.037609][ T31] ? __pfx_kthread+0x10/0x10 [ 339.037632][ T31] ret_from_fork+0x4b/0x80 [ 339.037654][ T31] ? __pfx_kthread+0x10/0x10 [ 339.037678][ T31] ret_from_fork_asm+0x1a/0x30 [ 339.037714][ T31] [ 339.037722][ T31] Sending NMI from CPU 1 to CPUs 0: [ 339.184817][ C0] NMI backtrace for cpu 0 [ 339.184834][ C0] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.15.0-rc7-syzkaller #0 PREEMPT(full) [ 339.184854][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 339.184866][ C0] RIP: 0010:pv_native_safe_halt+0x13/0x20 [ 339.184893][ C0] Code: c3 d4 02 00 cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 63 8f 11 00 f3 0f 1e fa fb f4 98 d4 02 00 cc cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 [ 339.184908][ C0] RSP: 0018:ffffffff8dc07d80 EFLAGS: 000002c6 [ 339.184923][ C0] RAX: 82d61899d4d3bd00 RBX: ffffffff81977108 RCX: 82d61899d4d3bd00 [ 339.184937][ C0] RDX: 0000000000000001 RSI: ffffffff8d74e096 RDI: ffffffff8bc1f300 [ 339.184949][ C0] RBP: ffffffff8dc07ec0 R08: ffff8880b8832b5b R09: 1ffff1101710656b [ 339.184988][ C0] R10: dffffc0000000000 R11: ffffed101710656c R12: ffffffff8f7f3370 [ 339.185001][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: 1ffffffff1b92a48 [ 339.185012][ C0] FS: 0000000000000000(0000) GS:ffff8881260c2000(0000) knlGS:0000000000000000 [ 339.185026][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 339.185037][ C0] CR2: 000020000029e000 CR3: 000000003246c000 CR4: 00000000003526f0 [ 339.185053][ C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 339.185063][ C0] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 339.185073][ C0] Call Trace: [ 339.185080][ C0] [ 339.185087][ C0] default_idle+0x13/0x20 [ 339.185111][ C0] default_idle_call+0x74/0xb0 [ 339.185136][ C0] do_idle+0x1e8/0x510 [ 339.185157][ C0] ? __pfx_do_idle+0x10/0x10 [ 339.185183][ C0] cpu_startup_entry+0x44/0x60 [ 339.185199][ C0] rest_init+0x2de/0x300 [ 339.185213][ C0] ? __pfx_x86_late_time_init+0x10/0x10 [ 339.185235][ C0] start_kernel+0x470/0x4f0 [ 339.185261][ C0] x86_64_start_reservations+0x2a/0x30 [ 339.185280][ C0] x86_64_start_kernel+0x66/0x70 [ 339.185297][ C0] common_startup_64+0x13e/0x147 [ 339.185330][ C0] [ 339.416514][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 339.423433][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.15.0-rc7-syzkaller #0 PREEMPT(full) [ 339.433503][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 339.443592][ T31] Call Trace: [ 339.446918][ T31] [ 339.449891][ T31] dump_stack_lvl+0x99/0x250 [ 339.455319][ T31] ? __asan_memcpy+0x40/0x70 [ 339.459968][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 339.465238][ T31] ? __pfx__printk+0x10/0x10 [ 339.469889][ T31] panic+0x2db/0x790 [ 339.473912][ T31] ? __pfx_panic+0x10/0x10 [ 339.478348][ T31] ? tick_nohz_tick_stopped+0x86/0xb0 [ 339.483735][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 339.489233][ T31] ? nmi_trigger_cpumask_backtrace+0x2b6/0x300 [ 339.495444][ T31] watchdog+0x102d/0x1030 [ 339.499809][ T31] ? watchdog+0x1de/0x1030 [ 339.504305][ T31] kthread+0x70e/0x8a0 [ 339.508393][ T31] ? __pfx_watchdog+0x10/0x10 [ 339.513117][ T31] ? __pfx_kthread+0x10/0x10 [ 339.517745][ T31] ? __pfx_kthread+0x10/0x10 [ 339.522372][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 339.527596][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 339.532827][ T31] ? __pfx_kthread+0x10/0x10 [ 339.537436][ T31] ret_from_fork+0x4b/0x80 [ 339.541862][ T31] ? __pfx_kthread+0x10/0x10 [ 339.546469][ T31] ret_from_fork_asm+0x1a/0x30 [ 339.551262][ T31] [ 339.554575][ T31] Kernel Offset: disabled [ 339.558934][ T31] Rebooting in 86400 seconds..