last executing test programs: 5m50.887475044s ago: executing program 32 (id=1426): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r0 = creat(&(0x7f0000001380)='./file0\x00', 0x12c) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1000, 0x0) io_setup(0x7, &(0x7f0000000800)=0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = eventfd2(0x1, 0x80001) io_submit(r1, 0x1, &(0x7f0000000100)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x7, 0x0, r2, &(0x7f0000000000)="ddfd39255b462c", 0x7, 0x5, 0x0, 0x3, r3}]) faccessat(r0, &(0x7f0000000280)='./file0\x00', 0x195) r4 = syz_usb_connect(0x0, 0x24, &(0x7f0000000600)=ANY=[@ANYBLOB="12010000a3b370086d04ae08581101020301090212000d000000000904"], 0x0) syz_usb_control_io(r4, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r4, 0x0, 0x0) syz_usb_control_io$hid(r4, 0x0, 0x0) close(r0) syz_usb_control_io$uac1(r4, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r4, 0x0, 0x0) syz_usb_disconnect(r4) setsockopt$RDS_GET_MR_FOR_DEST(r0, 0x114, 0x7, &(0x7f00000001c0)={@pptp={0x18, 0x2, {0x2, @local}}, {&(0x7f0000000080)=""/243, 0xf3}, &(0x7f0000000180), 0x4}, 0xa0) mount(&(0x7f0000000040)=@sg0, &(0x7f0000001440)='./file0\x00', &(0x7f0000000000)='vxfs\x00', 0x800, 0x0) 5m43.668417071s ago: executing program 4 (id=1478): r0 = syz_usb_connect$hid(0x3, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0x18d1, 0x502d, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x5, 0x40, 0x8, [{{0x9, 0x4, 0x0, 0x7, 0x2, 0x3, 0x1, 0x0, 0x9, {0x9, 0x21, 0x8, 0xc, 0x1, {0x22, 0x7bf}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x4, 0x0, 0xf}}, [{{0x9, 0x5, 0x2, 0x3, 0x228, 0x81, 0x0, 0x6}}]}}}]}}]}}, &(0x7f00000001c0)={0xa, &(0x7f0000000040)={0xa, 0x6, 0x110, 0x1, 0xac, 0x9, 0x0, 0xe}, 0x10, &(0x7f0000000080)={0x5, 0xf, 0x10, 0x1, [@wireless={0xb, 0x10, 0x1, 0x8, 0x85, 0x80, 0x3, 0xfffc, 0x9}]}, 0x2, [{0x69, &(0x7f00000000c0)=@string={0x69, 0x3, "b0fcdb1118f8914717f9e0be4f75980bb4f1243a417831b326d97a518a1d6430ff443fd73d8b8a87189edc8dcb13245bf0880a00f69d20b1b0462ceebcfa25b810061281cc681f490a655e0512fbad7e7330a92fbf73c4eea1e3a2b39f17e5c2a7f1362d07bef2"}}, {0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x401}}]}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x6) ioctl$KVM_CAP_HYPERV_SYNIC2(r3, 0x4068aea3, &(0x7f0000000140)) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000480)=ANY=[@ANYBLOB="01000000000000009a000040", @ANYBLOB="93b82cfcfbf286"]) syz_usb_control_io(r0, &(0x7f0000000380)={0x2c, &(0x7f0000000200)={0x40, 0x23, 0x75, {0x75, 0x22, "6af124dd84449ebcf5c2e4623ad384d6200921948297460d8e136cee30d9855f1d54cf161e04d3d75141836781c19779e627a1c965070f56e7c833f7a1405272a89589032315cd91299ca3229f5375a8ac105c1da96575edc16ecc8e6e60572509dc6bb5f2236fb96250eb80149cd3823e094d"}}, &(0x7f0000000280)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x860}}, &(0x7f00000002c0)={0x0, 0xf, 0x5, {0x5, 0xf, 0x5}}, &(0x7f0000000300)={0x20, 0x29, 0xf, {0xf, 0x29, 0x6, 0x8, 0x9b, 0x9, "c95bb36e", "d862153f"}}, &(0x7f0000000340)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x3, 0x10, 0xcc, 0x0, 0x0, 0xcf52, 0x259}}}, &(0x7f0000000800)={0x84, &(0x7f00000003c0)=ANY=[@ANYBLOB="000e6b000000ec823d0a99718552d40da23674aa009cfcea8ad7b0edcbbdae8b84c1dda1d103bd3c969180a5d2086a8c49201f536fabd261306e8a000cf587141f9f6438e056ca88cdfef9c5e5617e9954d347a4c4d44f0dac0500000000000000c266ae4f2387decdb530906fb74d3585"], &(0x7f0000000440)={0x0, 0xa, 0x1, 0x2}, &(0x7f0000000480)={0x0, 0x8, 0x1, 0x3}, &(0x7f00000004c0)={0x20, 0x0, 0x4, {0x2, 0x1}}, &(0x7f0000000500)={0x20, 0x0, 0x4, {0x720, 0x8}}, &(0x7f0000000540)={0x40, 0x7, 0x2, 0x1}, &(0x7f0000000580)={0x40, 0x9, 0x1, 0xff}, &(0x7f00000005c0)={0x40, 0xb, 0x2}, &(0x7f0000000600)={0x40, 0xf, 0x2, 0x8}, &(0x7f0000000640)={0x40, 0x13, 0x6, @random="adafbec7c2be"}, &(0x7f0000000680)={0x40, 0x17, 0x6}, &(0x7f00000006c0)={0x40, 0x19, 0x2, '\x00Q'}, &(0x7f0000000700)={0x40, 0x1a, 0x2, 0xff80}, &(0x7f0000000740)={0x40, 0x1c, 0x1, 0x4}, &(0x7f0000000780)={0x40, 0x1e, 0x1, 0x2}, &(0x7f00000007c0)={0x40, 0x21, 0x1, 0x7f}}) socket(0x1e, 0x1, 0x0) r4 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000140), 0x88980, 0x0) eventfd2(0xfffffc00, 0xabe10a1911afd80c) fadvise64(r4, 0x92, 0x5, 0x2) r5 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000080), 0x0) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r5, 0xc0145401, &(0x7f0000000280)={0x3, 0x0, 0x0, 0x0, 0x7fffffff}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000a, 0x22052, r4, 0x5708e000) madvise(&(0x7f00004e4000/0x3000)=nil, 0x3000, 0x3) 5m42.058579468s ago: executing program 4 (id=1487): openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup/file0\x00', 0x301000, 0x1) (async) mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000080)='./cgroup\x00', &(0x7f0000000040)='hpfs\x00', 0x0, 0x0) 5m41.917237251s ago: executing program 4 (id=1488): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) memfd_create(&(0x7f0000000040)='/dev/rnullb0\x00', 0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x20011, r0, 0xf648d000) r1 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x8}}, 0x2}}, 0x2e) 5m41.695021461s ago: executing program 4 (id=1491): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) mount$9p_unix(0x0, &(0x7f0000000280)='./file0\x00', 0x0, 0x802ca2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f0000000140)='./bus\x00') creat(&(0x7f00000000c0)='./file1\x00', 0x1) truncate(&(0x7f0000000080)='./file1\x00', 0xfe0) llistxattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000003c0)=""/4096, 0x1000) r0 = open(&(0x7f0000000240)='./file1\x00', 0x145142, 0x4) sendfile(r0, r0, 0x0, 0x800000009) mount(&(0x7f00000000c0)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000140)='./file0\x00', &(0x7f0000000080)='tracefs\x00', 0x8010, 0x0) 5m41.588785085s ago: executing program 1 (id=1493): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) (async) unshare(0x22020600) (async) r3 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$IP_VS_SO_SET_TIMEOUT(r3, 0x88, 0x48a, 0x0, 0x0) (async) ioctl$sock_ifreq(r2, 0x8990, &(0x7f0000000180)={'bond0\x00', @ifru_names='rose0\x00'}) (async) ioctl$KVM_SET_IRQCHIP(r1, 0x4048aec9, &(0x7f0000000380)={0x3, 0x0, @ioapic={0x2, 0x2, 0x101, 0x5, 0x0, [{0xd, 0x9, 0x6, '\x00', 0x1}, {0x6, 0x2, 0x26, '\x00', 0xfc}, {0x2, 0xef, 0xd, '\x00', 0xee}, {0xfb, 0x7, 0xd}, {0x13, 0x9, 0x2, '\x00', 0x62}, {0x0, 0x3, 0x2, '\x00', 0xd3}, {0xf, 0x0, 0x8, '\x00', 0x4}, {0x9, 0xdb, 0x1}, {0x81, 0x23, 0x5, '\x00', 0x2}, {0xde, 0x20, 0x3}, {0x40, 0x4, 0xf8, '\x00', 0x1}, {0xf5, 0x5, 0x4, '\x00', 0xb5}, {0x7, 0x3, 0x2b, '\x00', 0x6}, {0x4, 0x0, 0x0, '\x00', 0xe9}, {0x10, 0x39, 0x40, '\x00', 0xcf}, {0x6c, 0x3f, 0x0, '\x00', 0x72}, {0x6e, 0x4, 0x4, '\x00', 0xe}, {0x7, 0x2, 0x8, '\x00', 0x7}, {0xf, 0x7, 0x5}, {0x1, 0x6, 0x9}, {0x4, 0x6, 0x1, '\x00', 0x49}, {0xee, 0x2, 0x91, '\x00', 0xba}, {0x2, 0x8, 0x2, '\x00', 0xc3}, {0x8, 0x9, 0x54, '\x00', 0x9}]}}) (async) openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x28200, 0x0) (async) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$bt_sco(r4, &(0x7f0000000080)={0x1f, @none}, 0x8) (async) listen(r4, 0x86a) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) (async) r5 = socket$kcm(0x2d, 0x2, 0x0) (async) r6 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1770, 0xff00, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x200}}}}}]}}]}}, 0x0) syz_usb_control_io(r6, 0x0, 0x0) (async) syz_usb_control_io$hid(r6, &(0x7f0000000200)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022910500000047"], 0x0}, 0x0) (async) ioctl$sock_kcm_SIOCKCMCLONE(r5, 0x89e2, &(0x7f0000000340)={r5}) (async) mmap(&(0x7f00007ad000/0x11000)=nil, 0x11000, 0xb, 0x810, r1, 0x7e002000) 5m41.563233809s ago: executing program 4 (id=1494): syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000200)="f7790066baa00066b86b4276ef66ba420266b8e20066ef0f29902cbb0000c4e2b1ba8c88d9000000666666440f38826b410f7842280f07b8010000000f01d9c4033921820f47a753fd", 0x49}], 0x1, 0x43, 0x0, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0xb, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac0000000000040600", "f4bd000000801900", [0x0, 0x2000000000001]}}) 5m41.319935699s ago: executing program 1 (id=1497): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) (async) r1 = creat(&(0x7f00000002c0)='./file0\x00', 0x0) (async) pipe2$9p(&(0x7f0000001900)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r3, &(0x7f0000000500)=ANY=[@ANYBLOB="1500000065ffff048000000800395032303030"], 0x15) (async, rerun: 32) r4 = geteuid() (rerun: 32) ioctl$NS_GET_OWNER_UID(r1, 0xb704, &(0x7f0000000080)=0x0) setreuid(r4, r5) (async) r6 = dup(r3) write$FUSE_BMAP(r6, &(0x7f0000000100)={0x18}, 0x18) (async) write$FUSE_NOTIFY_RETRIEVE(r6, &(0x7f00000000c0)={0x14c}, 0x137) (async) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x20008c0, &(0x7f0000000680)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r6}, 0x2c, {[{@directio}], [], 0x6b}}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000006, 0x28011, r0, 0x0) (async, rerun: 64) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x6000000) (async, rerun: 64) sendmsg$TIPC_NL_MEDIA_SET(0xffffffffffffffff, 0x0, 0x4000) (async) listen(0xffffffffffffffff, 0x9) (async) sendmsg$nl_generic(r1, &(0x7f0000000240)={&(0x7f0000000140), 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x80, 0x21, 0x100, 0x70bd29, 0x25dfdbff, {0xb}, [@generic="2d58b246e6a692e2152ca0cc7d8c4065908fa92258668880c4e0ca4e34e4a144cd60b6f678e675d5b814a660aa451e395892bdd8b0a53596c3512039d2cd70c49ebceaa6f5467c102ae04ec9a4043eedf7704d233ce8fa60045a0110ed7a3e73269041333653c2d9f5da"]}, 0x80}, 0x1, 0x0, 0x0, 0x20000000}, 0x40000) ioctl$sock_inet_SIOCSIFNETMASK(r1, 0x891c, &(0x7f0000000280)={'caif0\x00', {0x2, 0x4e23, @local}}) (async, rerun: 32) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) (async, rerun: 32) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r8 = openat$cgroup_devices(r7, &(0x7f0000000100)='devices.deny\x00', 0x2, 0x0) write$cgroup_devices(r8, &(0x7f0000000000)={'b', ' *:* ', 'rwm\x00'}, 0xa) sendfile(r0, r0, &(0x7f0000001000)=0x7fffffff, 0x7ffff000) 5m41.130682916s ago: executing program 4 (id=1499): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x20011, r0, 0xf648d000) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000440)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg$qrtr(r3, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000001b00)=[{&(0x7f0000000700)=""/195, 0xc3}], 0x1, 0x0, 0x0, 0x10000}, 0x38, 0x10020) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x8}}, 0x2}}, 0x2e) 5m41.130481194s ago: executing program 1 (id=1500): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x60a00, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x20011, r0, 0xf648a000) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x145342, 0x0) timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r1 = accept$alg(0xffffffffffffffff, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000000240)=[{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000080)="a748b837fc61e2e5d3462bcadce209af03428128d6717fc79e08fb4f9b865b0d205598622ee6743f613db5eb307bb411688f0e7060bfc1eeccf345101ab6055ae8ce1b9ba549cdc13bff32ef97e12bcc1689a85934261f5d10a7d47abf6560aede795ec36957c1aca3ea7d8856916ce2a56f92e940a9e89c0484102952ea1abed26dded798916d6d80f1bfcf6307b0178e79f9e650dab28dbab09f3b9c382a860011bbc2de", 0xa5}, {}, {&(0x7f0000000140)="4c850a21c1d4966092a356ec883d1ffd87d9903726928fa15415a2112cb0756f7e37c55fe9ed39f78fc2e35c2bba46a6db4309fc09a2eb1ab723cfa1d5a88aa1b676bf33f65329b562", 0x49}], 0x3, 0x0, 0x0, 0x10}], 0x1, 0x4841) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x1b) 5m40.805483097s ago: executing program 33 (id=1499): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x20011, r0, 0xf648d000) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000440)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg$qrtr(r3, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000001b00)=[{&(0x7f0000000700)=""/195, 0xc3}], 0x1, 0x0, 0x0, 0x10000}, 0x38, 0x10020) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x8}}, 0x2}}, 0x2e) 5m40.798539939s ago: executing program 1 (id=1502): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) mount$9p_unix(0x0, &(0x7f0000000280)='./file0\x00', 0x0, 0x802ca2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f0000000140)='./bus\x00') creat(&(0x7f00000000c0)='./file1\x00', 0x1) truncate(&(0x7f0000000080)='./file1\x00', 0xfe0) llistxattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000003c0)=""/4096, 0x1000) r0 = open(&(0x7f0000000240)='./file1\x00', 0x145142, 0x4) sendfile(r0, r0, 0x0, 0x800000009) mount(&(0x7f00000000c0)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000140)='./file0\x00', &(0x7f0000000080)='tracefs\x00', 0x8010, 0x0) 5m40.70518743s ago: executing program 1 (id=1504): setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, &(0x7f0000000000)=0x80, 0x4) (async) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, &(0x7f0000000000)=0x80, 0x4) r0 = socket(0x2, 0x80805, 0x0) getsockopt$bt_hci(r0, 0x84, 0x6c, &(0x7f0000000000)=""/4102, &(0x7f00000010c0)=0x1006) mount(&(0x7f0000000100)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000240)='udf\x00', 0x808000, 0x0) 5m38.462448039s ago: executing program 1 (id=1514): r0 = socket(0x2000000000000021, 0x2, 0x10000000000002) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r1, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) getsockopt$XDP_STATISTICS(r1, 0x11b, 0x7, &(0x7f0000000140), &(0x7f0000000180)=0x30) r2 = socket$kcm(0x21, 0x5, 0x2) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000280)) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000002c0)=0x0) sendmsg$kcm(r2, &(0x7f0000000080)={&(0x7f0000000200)=@nfc_llcp={0x27, r3, 0xffffffffffffffff, 0x2, 0x7, 0x8f, "e418c64e6459d1f66d750751a2801f6cfa7bede9529598a0cd68cea28dda2b8e9693371b054120842e6b84c50f35ab84f309a86af736820c897d00cf1601bd", 0x1b}, 0x80, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18}, 0x0) connect$rxrpc(r0, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x400}}, 0x24) sendmmsg(r0, &(0x7f0000000180)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000000001001000d01000000240000000000000097b0fc417cec0800"/44], 0x18, 0xe000}, 0x5}], 0x1, 0x0) r4 = socket$kcm(0x21, 0x2, 0x2) setsockopt$inet_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000100)=@ccm_128={{}, '\x00', "f6f5c936edf21c33365b713b38704b6e", "06d871fc", "5344a473beb387bd"}, 0x28) sendmsg$kcm(r4, &(0x7f0000000080)={&(0x7f0000000000)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @private=0x4000000}}, 0x80, 0x0, 0x0, &(0x7f00000000c0)=ANY=[], 0x18}, 0x0) mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='nilfs2\x00', 0x200808, 0x0) socket(0x2000000000000021, 0x2, 0x10000000000002) (async) socket$xdp(0x2c, 0x3, 0x0) (async) setsockopt$XDP_RX_RING(r1, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) (async) getsockopt$XDP_STATISTICS(r1, 0x11b, 0x7, &(0x7f0000000140), &(0x7f0000000180)=0x30) (async) socket$kcm(0x21, 0x5, 0x2) (async) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000280)) (async) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000002c0)) (async) sendmsg$kcm(r2, &(0x7f0000000080)={&(0x7f0000000200)=@nfc_llcp={0x27, r3, 0xffffffffffffffff, 0x2, 0x7, 0x8f, "e418c64e6459d1f66d750751a2801f6cfa7bede9529598a0cd68cea28dda2b8e9693371b054120842e6b84c50f35ab84f309a86af736820c897d00cf1601bd", 0x1b}, 0x80, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18}, 0x0) (async) connect$rxrpc(r0, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x400}}, 0x24) (async) sendmmsg(r0, &(0x7f0000000180)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000000001001000d01000000240000000000000097b0fc417cec0800"/44], 0x18, 0xe000}, 0x5}], 0x1, 0x0) (async) socket$kcm(0x21, 0x2, 0x2) (async) setsockopt$inet_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000100)=@ccm_128={{}, '\x00', "f6f5c936edf21c33365b713b38704b6e", "06d871fc", "5344a473beb387bd"}, 0x28) (async) sendmsg$kcm(r4, &(0x7f0000000080)={&(0x7f0000000000)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @private=0x4000000}}, 0x80, 0x0, 0x0, &(0x7f00000000c0)=ANY=[], 0x18}, 0x0) (async) mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='nilfs2\x00', 0x200808, 0x0) (async) 5m38.198854972s ago: executing program 34 (id=1514): r0 = socket(0x2000000000000021, 0x2, 0x10000000000002) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r1, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) getsockopt$XDP_STATISTICS(r1, 0x11b, 0x7, &(0x7f0000000140), &(0x7f0000000180)=0x30) r2 = socket$kcm(0x21, 0x5, 0x2) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000280)) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000002c0)=0x0) sendmsg$kcm(r2, &(0x7f0000000080)={&(0x7f0000000200)=@nfc_llcp={0x27, r3, 0xffffffffffffffff, 0x2, 0x7, 0x8f, "e418c64e6459d1f66d750751a2801f6cfa7bede9529598a0cd68cea28dda2b8e9693371b054120842e6b84c50f35ab84f309a86af736820c897d00cf1601bd", 0x1b}, 0x80, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18}, 0x0) connect$rxrpc(r0, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x400}}, 0x24) sendmmsg(r0, &(0x7f0000000180)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000000001001000d01000000240000000000000097b0fc417cec0800"/44], 0x18, 0xe000}, 0x5}], 0x1, 0x0) r4 = socket$kcm(0x21, 0x2, 0x2) setsockopt$inet_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000100)=@ccm_128={{}, '\x00', "f6f5c936edf21c33365b713b38704b6e", "06d871fc", "5344a473beb387bd"}, 0x28) sendmsg$kcm(r4, &(0x7f0000000080)={&(0x7f0000000000)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @private=0x4000000}}, 0x80, 0x0, 0x0, &(0x7f00000000c0)=ANY=[], 0x18}, 0x0) mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='nilfs2\x00', 0x200808, 0x0) socket(0x2000000000000021, 0x2, 0x10000000000002) (async) socket$xdp(0x2c, 0x3, 0x0) (async) setsockopt$XDP_RX_RING(r1, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) (async) getsockopt$XDP_STATISTICS(r1, 0x11b, 0x7, &(0x7f0000000140), &(0x7f0000000180)=0x30) (async) socket$kcm(0x21, 0x5, 0x2) (async) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000280)) (async) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000002c0)) (async) sendmsg$kcm(r2, &(0x7f0000000080)={&(0x7f0000000200)=@nfc_llcp={0x27, r3, 0xffffffffffffffff, 0x2, 0x7, 0x8f, "e418c64e6459d1f66d750751a2801f6cfa7bede9529598a0cd68cea28dda2b8e9693371b054120842e6b84c50f35ab84f309a86af736820c897d00cf1601bd", 0x1b}, 0x80, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18}, 0x0) (async) connect$rxrpc(r0, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x400}}, 0x24) (async) sendmmsg(r0, &(0x7f0000000180)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000000001001000d01000000240000000000000097b0fc417cec0800"/44], 0x18, 0xe000}, 0x5}], 0x1, 0x0) (async) socket$kcm(0x21, 0x2, 0x2) (async) setsockopt$inet_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000100)=@ccm_128={{}, '\x00', "f6f5c936edf21c33365b713b38704b6e", "06d871fc", "5344a473beb387bd"}, 0x28) (async) sendmsg$kcm(r4, &(0x7f0000000080)={&(0x7f0000000000)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @private=0x4000000}}, 0x80, 0x0, 0x0, &(0x7f00000000c0)=ANY=[], 0x18}, 0x0) (async) mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='nilfs2\x00', 0x200808, 0x0) (async) 3m24.24685743s ago: executing program 3 (id=1986): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) acct(&(0x7f0000000080)='./file1\x00') acct(&(0x7f0000000000)='./file1\x00') sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="050000000a00000000004200000008000313a0a600", @ANYRES32=r2, @ANYBLOB="0a00180003030303030300001400700005000200010000000500080003000000"], 0x3c}}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) ioprio_set$pid(0x1, 0x0, 0x0) r3 = fsopen(&(0x7f0000000180)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x1, 0x0) fchdir(r4) creat(&(0x7f0000001380)='./file0\x00', 0x4) mount(&(0x7f0000000080)=@filename='./file0\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x801008, 0x0) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) r5 = gettid() timer_create(0x5, &(0x7f0000533fa0)={0x0, 0x32, 0x800000000004, @tid=r5}, &(0x7f0000bbdffc)) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000500)={0x0, 0x0, 0x200000000000000, 0x1000, &(0x7f0000ffc000/0x1000)=nil}) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x10) mkdir(&(0x7f0000000040)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000340)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.freeze\x00', 0x275a, 0x0) write$binfmt_script(r8, &(0x7f0000000280), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x28011, r8, 0x0) 3m23.686912448s ago: executing program 3 (id=1989): r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000240)={'syzkaller1\x00', @link_local}) writev(r1, &(0x7f00000008c0)=[{&(0x7f0000000a40)="2e9b3d0007e03dd65193dfb6c575963f8864", 0x12}], 0x1) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x3, 0x6576, 0xd, 0x0, 0x0}) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x4, 0x11, r0, 0x100000000) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r3}) r4 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000140), 0x88980, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000a, 0x22052, r4, 0x5708e000) 3m22.78246868s ago: executing program 3 (id=1998): timer_create(0xfffffffd, 0x0, &(0x7f0000000040)=0x0) r1 = syz_open_dev$vim2m(&(0x7f0000000580), 0x0, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f0000000480)={0x9, 0x1, 0x2}) ioctl$vim2m_VIDIOC_S_FMT(r1, 0xc0d05605, &(0x7f0000000840)={0x2, @win={{}, 0x0, 0x0, 0x0, 0x0, 0x0}}) timer_settime(r0, 0x0, &(0x7f0000000100)={{}, {0x77359400}}, 0x0) r2 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x949902, 0x0) ioctl$PTP_PEROUT_REQUEST2(r2, 0x40383d0c, &(0x7f00000000c0)={{0x4, 0xac}, {0x4, 0xfffffffc}, 0x200001, 0x6}) mount(&(0x7f0000000000)=@rnullb, &(0x7f00000000c0)='./cgroup\x00', &(0x7f0000000040)='hpfs\x00', 0x208002, 0x0) 3m22.640548908s ago: executing program 3 (id=2001): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x2b38094, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) chdir(&(0x7f00000001c0)='./file0/../file0/file0\x00') r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) fcntl$addseals(r0, 0x409, 0x8) fallocate(r0, 0x3, 0x9100, 0x3) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f0000000400)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000340), 0x2000000, &(0x7f0000000100)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) r1 = openat$sw_sync_info(0xffffffffffffff9c, &(0x7f0000000a00), 0x101200, 0x0) recvmsg$can_j1939(r1, &(0x7f0000000e40)={&(0x7f0000000a40)=@nfc_llcp, 0x80, &(0x7f0000000d80)=[{&(0x7f0000000ac0)=""/129, 0x81}, {&(0x7f0000000b80)=""/35, 0x23}, {&(0x7f0000000bc0)=""/45, 0x2d}, {&(0x7f0000000c00)=""/67, 0x43}, {&(0x7f0000000c80)=""/45, 0x2d}, {&(0x7f0000000cc0)=""/102, 0x66}, {&(0x7f0000000d40)=""/19, 0x13}], 0x7, &(0x7f0000000e00)=""/24, 0x18}, 0x40002000) chdir(&(0x7f0000000140)='./bus\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./file0\x00', 0x40, 0x80) renameat2(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000480)='./file7\x00', 0x4) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000900), r2) sendmsg$BATADV_CMD_GET_DAT_CACHE(r2, &(0x7f00000009c0)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000980)={&(0x7f0000000940)={0x34, r3, 0x200, 0x70bd2d, 0x25dfdbff, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xb}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x6ef}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x3}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x7}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000000}, 0x804) sendmsg$MPTCP_PM_CMD_REMOVE(0xffffffffffffffff, &(0x7f0000000f80)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000f40)={&(0x7f0000000ec0)={0x74, 0x0, 0x8, 0x70bd27, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_ADDR={0x58, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @mcast2}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @local}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x9}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @rand_addr=' \x01\x00'}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast2}]}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x1}]}, 0x74}, 0x1, 0x0, 0x0, 0x8880}, 0x0) mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='nilfs2\x00', 0x200808, 0x0) setxattr$security_ima(&(0x7f00000000c0)='./cgroup\x00', &(0x7f0000000100), &(0x7f0000000140)=@sha1={0x1, "dca2b4dbae24be1597522e94e5d2d790c1af52c4"}, 0x15, 0x2) recvmsg$unix(r2, &(0x7f0000000880)={&(0x7f0000000180)=@abs, 0x6e, &(0x7f00000006c0)=[{&(0x7f0000000200)=""/108, 0x6c}, {&(0x7f0000000280)=""/24, 0x18}, {&(0x7f00000002c0)=""/21, 0x15}, {&(0x7f00000004c0)=""/85, 0x55}, {&(0x7f00000003c0)=""/63, 0x3f}, {&(0x7f0000000540)=""/215, 0xd7}, {&(0x7f0000000640)=""/97, 0x61}], 0x7, &(0x7f0000000740)=[@cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x130}, 0x23) 3m22.410548704s ago: executing program 3 (id=2003): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x20000, 0x0) ioctl$IOMMU_IOAS_COPY(r0, 0x3b83, &(0x7f0000000140)={0x28, 0xb, 0x0, 0x0, 0x400, 0x400, 0x8}) (async) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x60a00, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x20011, r1, 0xf6486000) (async) r2 = memfd_create(&(0x7f00000000c0)='\xfd\x0fm3#/\x00n\xaa\xaa\xe4\x01U\x8b\xc2\f\x03\x19\x9c\x8e\xcb\x90\x00\x00\xaegQ\x0e\x94\\y\x0fU2@\'\x8a\x80\x00$\x12\xfc\xe4.)\x9b\xf2@\xf0\xe0\xdb\x1f\xe6\xb4gc\x13\xda\xf9\xcd7el\xb7\xe6\b\x00\x00\x00\x00\xef\xff\x00vob/~\xc2\x00\b\x00\x00\x00\x00\x00\x00 \xff\xf1\xdem\x9c;%\xb5\"\xe4\xf1x2\x8a\x19p\x04\\\xaa-\x93\xd1\xc4 )\xbfK\xf7E\xf3\x05\xa0\xd0\xe6%\x97\x15\xf0\xab\x86\x90k\x10\xcer\x14\xe0a\xaf\xab\xfe\xd9V\x19\xa5d\x16\x8e]:3\xff\t\xe6\xf7\xb3\xbf\xa3\b[?\xb5\x14t\xd3\x8e\xc0\xe8\xefd\x88\xddz\xa25)\x17\xef\xfb4\xff\xdb\t\x8e\xeb\x1d\\\xf9\x14\xc7\v\xa8\x89\xdb A\xbaBAj\xfe\x18\xc3-+\xd6\xb0K\xee\x1b+\xc7lA\x84\xa6\xfe\x8bU<&\x1a\xe7m\x86\xb7\xa1A\xf9\x02S;C\x99\a.$K\x833\x82\x7f\x1b\'nj\x06\b\xb7\xe8] \x87A[y\xdc\x14\f\xcet\x00\x1f\x0f\xef\xca\xcfz\x7f\an0\xebB\xb8}&\xdd\xc9\xa7\x1dp\t\x9a\xceb \x81\xaaq{H\x88\xdf\xf8\x80\\\x1c8\xfe\xc4\xe3\xb0\x90\xcb\x8b1r\x94\x9f\x00\xce\xc8\xc3\x84\xa0\xc9\b\x00\x81Ks\xba\xbbC6\xd6\x13\xb5\xe086EzD\x18\xd5\x16\x88E\xc6\xf0A9\xf1u\xb3\x85\x02\x12\\Sp\xf4\x9a\xe8\x96^\xe6\xa8K\x12\b}\xff\xcb{\xc6\xf6\xb4\x8b\xb6\xa8Y\xf2\x91\xeeR\v#\xb5)\xb0\x99\x9b-p\xe3\x17\x04\xb0\xdc\x0fk\x11\xe1\x9a\a\x16\xb7\x9b\x88\xfa\x1e`\x84$\xfc\xd7\xf5^X\xd8[}\x032\xd0\x84\xdby\x94Vp\xa5\xcd(\xab\xb6\x95sR\xab\xfc\x8c\'\x9c\x16Q\xad\xbc\xb04%\xb7\xe5\x14\xb1`\x87#X\\W`;\'_4\xc5\xc9\x921<\xd9\xad\x9f\x12@!\xfaI\x88\xab\xef\x86\xe9\a>\xdd7\xb7\x8e\x9c0-o\xc9\xec_|\x02\xc8Ru\x95\xa8#U\xd6J\x87\xf6X\xb6{\x11$\x00\xc8\x14\xcb\xd1nK\xd8\xb9\x0e\x9bA\xed\xbcs\x1fS\r\x12O\x83\x15\xcb(\xdb\xb1S\x1f%\x04\x9a\xa0l\xa3}\xe7r\x02\x00\x00\x00\x8aeh;F[\xe2\x1c\xe26 \x19k&.\x7f\x1d~\xdaI\xd4\x99\a+\xdf]\xbc\xa6\xc3\x0f\x99W\x9c-t\v\xc7J\xfd\x91\x853\xd1j;\x19W\x96V\x8az+\xf9\x82#\xfaC\xa3YN:\xe8\xda\xbc\xb2h\x8f\xe0\xc6d\x96\xccy\xb3\xc2\x98\x1c\xca\xde\"\xaeW\x89\x83\xc2sB\xe7\b\x9b9~}\xc2\xb3\x1d\xcc?\xd1\x89\xef\xca\x00\x00\x00\x00\x00\x00\x00\x00\x00J[\xc4\x04\xc1\xa6\x10\xc2\x9d\x11\t|\xc0\t\xd9(\x80\xe6s\xaa\x88\x8a\xd6\xa2\x01\x10W]Z\x8d\xf7\xd1P\xf9d\x01|\xa3\x03hSq\x95\x8f\xe1J\xd3#/fcCz\xff\x80\xe2M\xa3-r\xf6\x1a\xd74\xdc\xe1\xe4\xc3\x9dU t}\x02\x9a{C|S\xf4\x98\x05\xb9\x15}\xfa\"\xdc\xc2r\xf9\a\xadnD\xb6\x06\xd3\'\x10\x9f|\x17\xd6\x89O\f\x98@\x85\xa5m\x9d\\&\x17o\x11Z=l\xfb\x93\x8exZ', 0x6) ioctl$FS_IOC_RESVSP(r2, 0x40305828, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x8010002}) (async) mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x2000003, 0x97052, r2, 0x0) (async) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000540)=0x118d470b, 0x6) (async) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000580), 0x4000, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) (async) r5 = syz_open_dev$vbi(&(0x7f0000000080), 0x1, 0x2) ioctl$VIDIOC_S_DV_TIMINGS(r5, 0xc0845657, &(0x7f0000000380)={0x0, @bt={0x10, 0x7c5, 0x1, 0x2, 0xd59f80, 0x4, 0x5, 0xb, 0x8, 0x40000005, 0x722, 0x200, 0x7, 0x2000008, 0x3a, 0x27, {0xffff945a, 0x3}, 0x3, 0xf1}}) (async) ioctl$KVM_SET_IRQCHIP(r4, 0xc048aec8, &(0x7f0000000700)={0x5, 0x0, @ioapic={0x10000, 0x3, 0x1ff, 0x3, 0x0, [{0x6, 0x80, 0xfe}, {0xe7, 0x0, 0xfb}, {0x0, 0x9, 0xc, '\x00', 0xa}, {0x2, 0xc6, 0xe, '\x00', 0x40}, {0x0, 0x3, 0x3, '\x00', 0x9}, {0x5, 0x8, 0x0, '\x00', 0x1}, {0x4, 0x83, 0x6, '\x00', 0xcd}, {0x2, 0x4, 0x2, '\x00', 0x48}, {0x9, 0x3, 0xa, '\x00', 0x7}, {0x4, 0x48, 0x4, '\x00', 0x1}, {0x0, 0x7, 0x5, '\x00', 0x75}, {0x8, 0x7a, 0xb, '\x00', 0xf}, {0x2, 0x83, 0x9, '\x00', 0xc3}, {0x9, 0x9, 0x6, '\x00', 0x85}, {0xfa, 0x81, 0x6, '\x00', 0x8}, {0x9, 0xe4, 0x12, '\x00', 0x1}, {0x5c, 0x8, 0x40, '\x00', 0x8}, {0x4a, 0x6, 0xa, '\x00', 0x6}, {0xd, 0x3, 0x2, '\x00', 0x4}, {0x6, 0x4, 0x80, '\x00', 0x80}, {0x7, 0x4, 0xed, '\x00', 0x8}, {0x6, 0xf9, 0xf, '\x00', 0x10}, {0x8, 0x8, 0x81, '\x00', 0xc9}, {0x7b, 0x7f, 0x7, '\x00', 0x42}]}}) r6 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f0000000200)={'vxcan1\x00', 0x0}) r8 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCGPKT(r8, 0x40045436, 0x0) (async) bind$can_j1939(r6, &(0x7f0000000000)={0x1d, r7}, 0x18) (async) sendmsg$can_j1939(r6, &(0x7f00000002c0)={&(0x7f00000000c0)={0x1d, 0x0, 0x2, {0x0, 0x409ee07df186b7eb}}, 0x18, &(0x7f00000004c0)={0x0}, 0x1, 0x0, 0x0, 0xc010}, 0x0) (async) renameat2(0xffffffffffffffff, 0x0, 0xffffffffffffffff, &(0x7f0000000200)='.\x02\x00', 0x0) (async) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1) (async) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r9 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r9, 0x8933, &(0x7f00000001c0)={'batadv0\x00', 0x0}) (async) r11 = syz_usb_connect$printer(0x1, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x8, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x5, 0xd0, 0x3, [{{0x9, 0x4, 0x0, 0xd, 0x2, 0x7, 0x1, 0x1, 0x6, "", {{{0x9, 0x5, 0x1, 0x2, 0x200, 0x2, 0x9, 0x7f}}, [{{0x9, 0x5, 0x82, 0x2, 0x860, 0x1, 0x40, 0x5}}]}}}]}}]}}, &(0x7f0000000940)={0xa, &(0x7f00000005c0)={0xa, 0x6, 0x300, 0x7, 0x4, 0x7b, 0xff, 0x9}, 0x15, &(0x7f0000000600)={0x5, 0xf, 0x15, 0x1, [@ssp_cap={0x10, 0x10, 0xa, 0x1, 0x1, 0x2, 0xf00, 0x44b, [0xff3fcf]}]}, 0x2, [{0x4e, &(0x7f0000000640)=@string={0x4e, 0x3, "f707916364dfa840f11f7eeaf0a093b8fd3753fa36e3f2534d5c158778a16f22944c9333fbe8fa3fc74d675197b933c5c577b0386856322ff2ebb1c665f02b2d384f0fe7b2cc04e3574f7a05"}}, {0x4, &(0x7f00000006c0)=@lang_id={0x4, 0x3, 0x4803}}]}) syz_usb_control_io$printer(r11, &(0x7f0000000ac0)={0x14, &(0x7f0000000980)={0x20, 0xf, 0xc8, {0xc8, 0x10, "8a89e914f1eb5445e1badd3d061c0821ac0ef53b5a474037e1cbb68afb6ad6c981e7e6674a4171e7c3a19cb39032abfe5cbf4f7e976609a5372ddca1eed5db178acb4d345e3306f6c4b3cf9a9e02786b176720bdf3c7cf7734762917e55fbf05a173f1dc45461d95e30829b035cc50f9f73e1455e7659ae2a465ca576f7f7c40e98d35fad02d4f80ccabd8b818dff02575d6666368c1ef5b9b28e975f9ea7ef9397cfa53356c4aa3f337c2435c9a9507bc137ab88cd4c623ad29717a62ef47baa0d7ea73ea5b"}}, &(0x7f0000000a80)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x444}}}, &(0x7f0000000d80)={0x34, &(0x7f0000000b00)={0x66a7edd9140e336e, 0x14, 0xf6, "886613dde6701ca762651fb7595218432f568da0481b0b68d44c76ef2542e65c19c8c74dfc8b4b1aa01d684f7d519bb93f8341a5459c43d53e36c09b51c2b15c3e7b07c56d3e3f7a7d7ca13b93fb6407e25852394bd443d908004e2ecd25c36a4e8b5ee557f0993b09e6b82324d2bcb3e86660b383a336c5bc74d421a22d9e090d6310720e8c9ca0cd08acb0e558c56a5d71c03dab7f233afe15b31d76fe9384c55e95876da59463f67a1d1e3c90738c11ed494192f530c0f7e2a489fda4cce485213915fdcf5d7b65f9af5a2285a84a9c79bda050172b36b5cf18fc1c3d4c69446333623966d19b757b10b8826708d5f7645fa376a8"}, &(0x7f0000000c00)={0x0, 0xa, 0x1, 0x8}, &(0x7f0000000c40)={0x0, 0x8, 0x1, 0x3}, &(0x7f0000000c80)={0x20, 0x0, 0x56, {0x54, "f3ecf075d7fc20ab0a5ae866de42297e6772cc51fd17beeab67c23d8967ec0c705fc0967057426783c1d3f0c1b15aa1212c4bb1040fc9b108497a139c309f3aceeda8e72fb851202fa1ab370abf9b11e04a56ba9"}}, &(0x7f0000000d00)={0x20, 0x1, 0x1}, &(0x7f0000000d40)={0x20, 0x0, 0x1, 0xfa}}) sendto$packet(r9, &(0x7f0000000000)="05178100", 0x4, 0x50, &(0x7f0000000080)={0x11, 0x8100, r10, 0x1, 0x9}, 0x14) (async) syz_usb_connect(0x2, 0x24, &(0x7f0000000180)={{0x12, 0x1, 0x250, 0xf7, 0x8b, 0x42, 0x20, 0x52b, 0x1803, 0x152a, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x7, 0x2, 0xb0, 0x1, [{{0x9, 0x4, 0x2, 0x9, 0x0, 0x10, 0x31, 0x1c, 0x6d}}]}}]}}, &(0x7f00000010c0)={0x0, 0x0, 0x0, 0x0, 0x4, [{0x7, &(0x7f0000000e00)=@string={0x7, 0x3, "4ea689c50d"}}, {0x4, &(0x7f0000001000)=@lang_id={0x4, 0x3, 0x861}}, {0xab, &(0x7f0000000e80)=@string={0xab, 0x3, "fd5ee7e65626611126ba18a3f12245f9b5854635abbaed8f37176e0cba8b441703bc049a909755bbd818753b74e386b7a321f1fcddc1c690a3000f1dcca9a7ac5e4339d330716e13692e8a60c9d989d0f81d1c49ac3ac1bbcf23f3e9adb308910b440d88e2ba6e94f959251468c356d83fbd1006a583d1dcd72ca778a1eec6a53283088ea9b4e61bf31955cec20f831f9148ed9cea46b1867d04f2ccb39ca6832a57c315e859063765"}}, {0x4, &(0x7f0000000f40)=@lang_id={0x4, 0x3, 0xc09}}]}) (async) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) 3m22.070821072s ago: executing program 3 (id=2006): set_mempolicy(0x8006, &(0x7f0000000040)=0xffc, 0x4) (async) r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r0, 0xc0a85320, &(0x7f00000005c0)={{0x80}, 'port0\x00', 0xe2, 0x11cfa, 0x0, 0x8000007, 0x3, 0x4, 0x1, 0x0, 0x6}) (async) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r1, 0x40505330, &(0x7f0000000140)={0x800100, 0xffffffff, 0x2, 0xe1db, 0x1101, 0xff}) (async, rerun: 64) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) (rerun: 64) bind$bt_l2cap(r2, &(0x7f0000000000)={0x1f, 0x0, @none}, 0xe) (async) listen(r2, 0x0) shutdown(r2, 0x1) (async) shutdown(r2, 0x325b44e96ee917b9) (async) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000040)={0x3, 0x6576, 0xd}) r4 = syz_open_dev$vcsn(&(0x7f0000000080), 0x3ff, 0x8002) getsockopt$inet_sctp6_SCTP_EVENTS(r4, 0x84, 0xb, &(0x7f00000000c0), &(0x7f0000000100)=0xe) (async, rerun: 64) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x4, 0x11, r3, 0x100000000) (rerun: 64) r5 = syz_open_dev$evdev(&(0x7f00000004c0), 0x2, 0x109000) (async) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_KEY_STATUS(0xffffffffffffffff, 0x40086e81, &(0x7f0000000080)={@desc={0x1, 0x0, @auto="7eee93785d78a69f"}}) (async) r8 = dup(r7) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) (async) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r8, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@textreal={0x8, 0x0}], 0x1, 0x42, 0x0, 0x0) (async) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r9, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) ioctl$KVM_RUN(r9, 0xae80, 0x0) (async) bind$inet6(0xffffffffffffffff, 0x0, 0x0) (async) ioctl$EVIOCSKEYCODE_V2(r5, 0x40284504, &(0x7f0000002c80)={0x3, 0xa, 0x2, 0xd, "fb739dfb854d30e03bf7c63da7ac6ff5c54f06c2e009fc32dd2369c8e6159333"}) (async, rerun: 32) r10 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000140), 0x88980, 0x0) (rerun: 32) mmap(&(0x7f0000711000/0x1000)=nil, 0x1000, 0xd, 0x4000110, r10, 0x5708a000) 3m21.594152271s ago: executing program 35 (id=2006): set_mempolicy(0x8006, &(0x7f0000000040)=0xffc, 0x4) (async) r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r0, 0xc0a85320, &(0x7f00000005c0)={{0x80}, 'port0\x00', 0xe2, 0x11cfa, 0x0, 0x8000007, 0x3, 0x4, 0x1, 0x0, 0x6}) (async) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r1, 0x40505330, &(0x7f0000000140)={0x800100, 0xffffffff, 0x2, 0xe1db, 0x1101, 0xff}) (async, rerun: 64) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) (rerun: 64) bind$bt_l2cap(r2, &(0x7f0000000000)={0x1f, 0x0, @none}, 0xe) (async) listen(r2, 0x0) shutdown(r2, 0x1) (async) shutdown(r2, 0x325b44e96ee917b9) (async) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000040)={0x3, 0x6576, 0xd}) r4 = syz_open_dev$vcsn(&(0x7f0000000080), 0x3ff, 0x8002) getsockopt$inet_sctp6_SCTP_EVENTS(r4, 0x84, 0xb, &(0x7f00000000c0), &(0x7f0000000100)=0xe) (async, rerun: 64) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x4, 0x11, r3, 0x100000000) (rerun: 64) r5 = syz_open_dev$evdev(&(0x7f00000004c0), 0x2, 0x109000) (async) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_KEY_STATUS(0xffffffffffffffff, 0x40086e81, &(0x7f0000000080)={@desc={0x1, 0x0, @auto="7eee93785d78a69f"}}) (async) r8 = dup(r7) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) (async) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r8, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@textreal={0x8, 0x0}], 0x1, 0x42, 0x0, 0x0) (async) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r9, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) ioctl$KVM_RUN(r9, 0xae80, 0x0) (async) bind$inet6(0xffffffffffffffff, 0x0, 0x0) (async) ioctl$EVIOCSKEYCODE_V2(r5, 0x40284504, &(0x7f0000002c80)={0x3, 0xa, 0x2, 0xd, "fb739dfb854d30e03bf7c63da7ac6ff5c54f06c2e009fc32dd2369c8e6159333"}) (async, rerun: 32) r10 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000140), 0x88980, 0x0) (rerun: 32) mmap(&(0x7f0000711000/0x1000)=nil, 0x1000, 0xd, 0x4000110, r10, 0x5708a000) 3m1.823896785s ago: executing program 6 (id=2114): r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f0000000400)={0x18, 0x0, {0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xa}, 'lo\x00'}}, 0x1e) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='freezer.state\x00', 0x26e1, 0x0) close(r1) ioctl$SIOCSIFHWADDR(r1, 0x8b26, &(0x7f0000000200)={'wlan1\x00', @random="8dffffff8d00"}) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000080)) read(r0, &(0x7f00000001c0)=""/141, 0x8d) mount(&(0x7f0000000100)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000240)='udf\x00', 0x808000, 0x0) syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_tables_names\x00') r2 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VIDIOC_SUBDEV_DV_TIMINGS_CAP(r2, 0xc0905664, &(0x7f0000000280)={0x0, 0x0, '\x00', @raw_data=[0x81, 0x3, 0x5, 0x80000001, 0xcd, 0x5, 0x9, 0x9, 0x9, 0x2, 0xd, 0x7, 0x9, 0x10001, 0x1000000, 0x4, 0x62, 0x3, 0xffff, 0x4d, 0x5, 0x37, 0x9, 0x7fffffff, 0x0, 0x9, 0x4, 0x3, 0xf3, 0x9, 0x4, 0x8]}) 3m1.662953863s ago: executing program 6 (id=2115): r0 = socket$unix(0x1, 0x1, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005ec0)=[{{0x0, 0x0, &(0x7f0000000000)=[{0x0}], 0x1}}], 0x1, 0x1) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3in6={0x18, 0x1, {0x0, r1, 0x4, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, 0x3a) sendmmsg(r2, &(0x7f00000036c0)=[{{0x0, 0x0, 0x0}}], 0x400000000000113, 0x0) sendto$unix(r0, 0x0, 0x0, 0x2000080, 0x0, 0x0) mount(&(0x7f0000000080)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000000)='btrfs\x00', 0x4400, 0x0) socket$unix(0x1, 0x1, 0x0) (async) sendmmsg(0xffffffffffffffff, &(0x7f0000005ec0)=[{{0x0, 0x0, &(0x7f0000000000)=[{0x0}], 0x1}}], 0x1, 0x1) (async) socket$inet6(0xa, 0x2, 0x0) (async) socket$pppl2tp(0x18, 0x1, 0x1) (async) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3in6={0x18, 0x1, {0x0, r1, 0x4, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, 0x3a) (async) sendmmsg(r2, &(0x7f00000036c0)=[{{0x0, 0x0, 0x0}}], 0x400000000000113, 0x0) (async) sendto$unix(r0, 0x0, 0x0, 0x2000080, 0x0, 0x0) (async) mount(&(0x7f0000000080)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000000)='btrfs\x00', 0x4400, 0x0) (async) 3m1.529787146s ago: executing program 6 (id=2116): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) r1 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r1, 0xc0405519, &(0x7f0000000080)={{0x3, 0x4}, 0x0, [0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000000, 0x0, 0x0, 0x0, 0xcb4, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x40000000000, 0x6, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x31413bb4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x101, 0x0, 0x0, 0x0, 0x0, 0x10000000000000]}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x20011, r0, 0xf648b000) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0) r3 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r3, &(0x7f0000000040), 0x10) listen(r3, 0x0) r4 = socket(0x28, 0x5, 0x0) connect$vsock_stream(r4, &(0x7f0000000080), 0x10) setsockopt$sock_linger(r4, 0x1, 0x3c, &(0x7f0000000180)={0x1, 0x5}, 0x8) sendmmsg(r4, &(0x7f0000000100)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)="1b", 0x40000}], 0x1}}], 0x1, 0x24008094) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0xc201}) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000240)={'syzkaller1\x00', @link_local}) write$tun(r2, &(0x7f0000000240)=ANY=[@ANYBLOB="000086dd0500560008005400000060ec970001983a00fc000018c6ba35000000000000000700ff02000000000000000000000000000181"], 0xfdef) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0x0, 0x2) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000040)={0x0, 0x0}) process_vm_readv(r6, &(0x7f00000000c0)=[{&(0x7f0000000180)=""/167, 0xa7}, {&(0x7f0000000280)=""/173, 0xad}], 0x2, &(0x7f00000008c0)=[{&(0x7f0000000340)=""/242, 0xf2}, {&(0x7f0000000440)=""/198, 0xc6}, {&(0x7f0000000540)=""/154, 0x9a}, {&(0x7f0000000600)=""/118, 0x76}, {&(0x7f0000000680)=""/114, 0x72}, {&(0x7f0000000700)=""/164, 0xa4}, {&(0x7f00000007c0)=""/222, 0xde}], 0x7, 0x0) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) (async) syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) (async) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r1, 0xc0405519, &(0x7f0000000080)={{0x3, 0x4}, 0x0, [0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000000, 0x0, 0x0, 0x0, 0xcb4, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x40000000000, 0x6, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x31413bb4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x101, 0x0, 0x0, 0x0, 0x0, 0x10000000000000]}) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x20011, r0, 0xf648b000) (async) openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0) (async) socket(0x28, 0x5, 0x0) (async) bind$vsock_stream(r3, &(0x7f0000000040), 0x10) (async) listen(r3, 0x0) (async) socket(0x28, 0x5, 0x0) (async) connect$vsock_stream(r4, &(0x7f0000000080), 0x10) (async) setsockopt$sock_linger(r4, 0x1, 0x3c, &(0x7f0000000180)={0x1, 0x5}, 0x8) (async) sendmmsg(r4, &(0x7f0000000100)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)="1b", 0x40000}], 0x1}}], 0x1, 0x24008094) (async) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0xc201}) (async) socket$kcm(0x2, 0xa, 0x2) (async) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000240)={'syzkaller1\x00', @link_local}) (async) write$tun(r2, &(0x7f0000000240)=ANY=[@ANYBLOB="000086dd0500560008005400000060ec970001983a00fc000018c6ba35000000000000000700ff02000000000000000000000000000181"], 0xfdef) (async) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) (async) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0x0, 0x2) (async) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000040)) (async) process_vm_readv(r6, &(0x7f00000000c0)=[{&(0x7f0000000180)=""/167, 0xa7}, {&(0x7f0000000280)=""/173, 0xad}], 0x2, &(0x7f00000008c0)=[{&(0x7f0000000340)=""/242, 0xf2}, {&(0x7f0000000440)=""/198, 0xc6}, {&(0x7f0000000540)=""/154, 0x9a}, {&(0x7f0000000600)=""/118, 0x76}, {&(0x7f0000000680)=""/114, 0x72}, {&(0x7f0000000700)=""/164, 0xa4}, {&(0x7f00000007c0)=""/222, 0xde}], 0x7, 0x0) (async) 3m1.143063466s ago: executing program 6 (id=2118): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000140), 0x88980, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x40, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) r4 = dup(r3) ioctl$USBDEVFS_GET_CAPABILITIES(r3, 0x8004551a, &(0x7f0000000040)) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2125099, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101097, 0x0) mount$bind(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b100a, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/file0\x00', 0x0, 0x80000, 0x0) r5 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r5, 0x89f8, &(0x7f00000001c0)={'syztnl2\x00', &(0x7f0000000440)={'erspan0\x00', r6, 0x20, 0x80, 0x1, 0x5c40, {{0x9, 0x4, 0x1, 0x0, 0x24, 0x64, 0x0, 0x5, 0x29, 0x0, @local, @broadcast, {[@generic={0x89, 0xd, "912a2c80b4e4a7ff49736e"}]}}}}}) move_mount(r5, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$bind(&(0x7f0000000400)='./file0/../file0\x00', &(0x7f0000000340)='./file0/file0\x00', 0x0, 0x891008, 0x0) mount$bind(&(0x7f0000000100)='./file0\x00', &(0x7f0000000240)='./file0/../file0\x00', 0x0, 0x10dc43, 0x0) ioctl$KVM_SET_MSRS(r4, 0xc008ae88, &(0x7f00000002c0)=ANY=[@ANYBLOB="820000000000000091000040"]) fadvise64(r0, 0x92, 0x85, 0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xe, 0x40010, r0, 0x5708e000) 3m0.946608059s ago: executing program 6 (id=2122): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = dup(r0) write$UHID_INPUT(r1, &(0x7f0000001980)={0x9, {"a2e3ad084fc752f91b2909094bf70e0dd038e7ff7fc6e5539b324c078b089b34373b6d1a0890e0878f0e1ac6e7049b076d959b669a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31300d366d0936cd3b78130daa61d8e809ea889b5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae19397d696d0d758f2dc7d1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000002335875271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617601000000be70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc94681359bad8deff4b05f60cea0da7710a80000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df0784c8f4ceb360c7e658828563e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b4bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509383815b1b6fc6522d4e48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c478b095b68441a34cb51682a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e01feffffffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369d75f2e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00f16e2d0174035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d618e462071115c8982ba46af4d6adcc9f68a75b9397b035153faf463661c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6ea94f88a4facfd4c735a20307c737afae5136651b1b9bd522dcb399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c105000000302a808d7f5251440613d17ca51055f2f416a44fe180d2d50c312cca7cb14a20dc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb40100000006376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab83c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4000000000000007fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6522fb5f6ffcdd56fed88935fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae233a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af44863c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f48261f7897484c297a1a6613bc18f5a152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57fa9c0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe360500000000000000b77940b5f07722e47a08d3679507000000000000934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817bb903729a7db6ff957697c9ede7885d94ffb0759be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f9c55f4901203a9a8a2c3e90f39c3dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000510b00", 0x1000}}, 0x1006) r2 = socket(0x200000100000011, 0x803, 0x0) (async, rerun: 32) r3 = socket$packet(0x11, 0x3, 0x300) (rerun: 32) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'xfrm0\x00', 0x0}) sendto$packet(r2, &(0x7f0000000480)="4d01000000000000000100e50414090b0092000000000000005ee4cc040c1e5fcc2eae7fc0dacea9ed192143db2c8381a3e349d8", 0x34, 0x81, &(0x7f0000000340)={0x11, 0x0, r4, 0x1, 0x6, 0x6, @random="645bcc77540e"}, 0x14) (async) connect$unix(r1, &(0x7f00000000c0)=@abs={0x0, 0x0, 0x4e20}, 0x6e) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) (async) set_mempolicy(0x2, &(0x7f0000000080)=0x4716, 0x3) (async, rerun: 32) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x821, 0x0) (rerun: 32) r6 = dup(r5) write$6lowpan_enable(r6, &(0x7f0000000000)='0', 0xfffffd2c) (async) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000140)=0xfe8) (async) mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='xfs\x00', 0x1200051, 0x0) 3m0.03572253s ago: executing program 6 (id=2126): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000006, 0x28011, r0, 0x0) r1 = mq_open(&(0x7f0000000000)='\x81!(.\x00', 0x43, 0xa2, 0x0) mq_timedreceive(r1, 0x0, 0x0, 0xfff, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x6000000) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f0000000000)=0xffffffffffffffff, 0x4) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x72, &(0x7f0000000140)={0x0, 0x3, 0x30}, 0xc) sendmsg$TIPC_NL_MEDIA_SET(0xffffffffffffffff, 0x0, 0x4000) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWFLOWTABLE={0x30, 0x16, 0xa, 0x101, 0x0, 0x0, {0x2, 0x0, 0x9}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x4}]}], {0x14}}, 0x58}}, 0x0) listen(0xffffffffffffffff, 0x9) sendfile(r0, r0, &(0x7f0000001000)=0x7fffffff, 0x7ffff000) 2m59.734482716s ago: executing program 36 (id=2126): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000006, 0x28011, r0, 0x0) r1 = mq_open(&(0x7f0000000000)='\x81!(.\x00', 0x43, 0xa2, 0x0) mq_timedreceive(r1, 0x0, 0x0, 0xfff, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x6000000) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f0000000000)=0xffffffffffffffff, 0x4) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x72, &(0x7f0000000140)={0x0, 0x3, 0x30}, 0xc) sendmsg$TIPC_NL_MEDIA_SET(0xffffffffffffffff, 0x0, 0x4000) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWFLOWTABLE={0x30, 0x16, 0xa, 0x101, 0x0, 0x0, {0x2, 0x0, 0x9}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x4}]}], {0x14}}, 0x58}}, 0x0) listen(0xffffffffffffffff, 0x9) sendfile(r0, r0, &(0x7f0000001000)=0x7fffffff, 0x7ffff000) 2m32.216454834s ago: executing program 5 (id=2282): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) shutdown(r0, 0x1) setsockopt$inet6_tcp_int(r0, 0x6, 0x22, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000300)={@in6={{0xa, 0x4e20, 0x0, @loopback, 0x7}}, 0x0, 0x0, 0x47, 0x0, "09be2271b78506e6dd938d324c415acd403a4480fd1afa34432bcdfa64d957e93efafd27ad06a6f589bb643f167cf0fcd370239aaa93f6ded3c5032c96ead0cdc68474d402ab73e482db7ec1e0a57489"}, 0xd8) bind$inet6(r0, &(0x7f0000000240)={0xa, 0x4e20, 0xf, @empty, 0x5}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000000b00)=[{{&(0x7f0000000100)={0xa, 0x4e20, 0x2, @empty, 0xfffffffe}, 0x1c, &(0x7f0000000580)=[{&(0x7f0000000280)="d5", 0x1}], 0x1}, 0xaa000000}], 0x1, 0x20080058) 2m32.029250093s ago: executing program 5 (id=2283): r0 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) syz_usb_connect(0x2, 0x24, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000011620140480b05101e8c000000010902120001000000000904"], 0x0) setsockopt$sock_int(r2, 0x1, 0x1, &(0x7f00000000c0)=0x3a7b, 0x4) setreuid(0x0, r1) r3 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = syz_pidfd_open(r3, 0x0) ioctl$FS_IOC_GETVERSION(r4, 0xff03, 0x0) add_key$keyring(&(0x7f0000000000), 0x0, 0x0, 0x0, 0xfffffffffffffffe) request_key(&(0x7f0000000540)='id_legacy\x00', &(0x7f0000000580)={'syz', 0x2}, &(0x7f00000005c0)='\x00', 0x0) clock_adjtime(0x0, &(0x7f00000000c0)={0xfffffffffffffffd, 0x5, 0x100000001, 0x4, 0x8000, 0x15c, 0x155, 0x7, 0xb, 0x80, 0xabbb, 0x3, 0x1, 0xf156, 0x1, 0x0, 0x41a0, 0x7fff, 0xc, 0x3, 0xffffffffffffffc8, 0xffff, 0x987, 0x6, 0x2, 0x3}) add_key(&(0x7f00000000c0)='id_legacy\x00', &(0x7f0000000100)={'syz', 0x2}, &(0x7f0000000140)='j', 0x1, 0xfffffffffffffffd) request_key(&(0x7f0000000540)='id_legacy\x00', &(0x7f0000000580)={'syz', 0x2}, 0x0, 0xffffffffffffffff) r5 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x20a02, 0x0) pwritev(r5, &(0x7f0000001280)=[{0x0}, {0x0}, {&(0x7f0000001080)="2b97", 0x2}], 0x3, 0x0, 0xfffffffe) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000000000)={0x0, @in={{0x2, 0x4e24, @private=0x2a010101}}}, &(0x7f0000000100)=0x84) 2m30.504699597s ago: executing program 5 (id=2291): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r0, &(0x7f0000008280)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000820}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32, @ANYRES32], 0x100, 0x40004010}}], 0x2, 0x8048) r1 = ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0x5) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x7ffff000) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000001c0), 0x8042, 0x0) write$vga_arbiter(r2, &(0x7f0000000080)=@other={'lock', ' ', 'io'}, 0x8) r3 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r3, 0x83, 0x10, &(0x7f0000000500)=@ready={0x0, 0x0, 0x8, "72918f72", {0x1, 0x1, 0x1000, 0x2, 0x5}}) io_setup(0x3ff, &(0x7f0000000500)=0x0) r5 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000003140)=ANY=[@ANYBLOB="c01800002000010a00000000000000000a0000002c01018028014880ed00a90013466820cd76bb221fbb4acd690c6a8b9c760a61eeec7793b579aefdb936d00f403d3f04637cdb9ac70e28c5dd66ddedde2d0930650e6821f9a26a4a193c1d06a3e75523f901e44fe087ae32c836c6d6ddba3af8e9a2beae8936168f9fa38c395f5cf7408df69c60bf584bee86a6312e9ce866e456c3eda6f2924082d78a2f385bdbd0c9afb54758c102bf13094645fb6aa34d424ec776691fee3d25307f61fed2752babf7c686e8a3d9b59a8343bcf4121bf5cf400a0c1070855fac565cad8968a97ce0a12a1161054d82d0a240b7de", @ANYRES32=0x0, @ANYBLOB="08001a00", @ANYRES32=0x0, @ANYBLOB="06003800d8510000040049800400e0801a165c80f928efeadc95a00c88d81d8d36eb021f05e357ce0cc80496d946a14b733a0b75dc0e0fe7ec451e3304efabb148cf7740d92633549fc799efeffbb500bf6a3db52cb6551af05b9d13a338392b5a8a8a21422903ac79280ba0651419590f6126813018282ea112a8c697e421a55ef2aac7340a5736e3d51504d8c7f023ee72b55ab9a1a1195cf9edf01e30447d1e000ce0ec914a9a6ae232498e74bcd19c01b7086e3fec56b754ab12185fda15b9525dec81f973a9c4bc9e3346f077651b64733a62e0536a41b5d896c07d71bb8b256ff30493694ca27c654b9cdfd0721dcef4726d97a2974dc7d8e373b0a60174bb0800ee00", @ANYRES32=0x0, @ANYBLOB="0c0043001700000000000000fd11358084a64c4852ce59bc40427a1582ec7e9547999b7be18d57542e2971a2513a2b81d76f6ad9a7ceda50a48bcd2786f06ffd040009808cb297f99a3664c1952c24e42f729fc43262610d3652cef336adc19ee56c82ca3e707eb78d0148b668305d97f7ec33db8e3e9dc65e7c274e7bc24ed3a1184621df12504c07b14a737fcc8ef9009b890c6caeba9729fbfeca6b12211869a2716ea36f7399a7bd7c0f2377c94cfe62f2bcbff380ee256a7c3ec69110da7f9a6d89254f4ec5b539cbc7303ccdc6a8619996b6263165fa024adff951d4d8d2d6587b80d1c30440b0817f52c341360dc5df31f0b5639a5b96e26938d5bc55ea7bef35a4cf126c9183ac38fb34b319abe5f06082c1e8ce526cdb3066d523d12deb8697d8299c1f5edf46514913c4648f2fd1816a58beffaab5040d72e67ac75075da4c92fb2c60d17ee03c6cc004ceb9ef5abe60fe300faa63e19f5eefa54eaed41a4fa62c6a56be9ee7f691162545a8fd930f45517df0436b69efc7d5ac19e930a92ef86472205f87a61dd95dc35a6f258c8c7958a8175e8cd8dbf01f82cca2359aef93e3eb117014c231d67bc6da5248aeac9543ff47663c01581b945dd8507adb1689ac8244b010e66087ffd4c0b930f8ffc7408402d8ce7db0cfd9830cdd85aab9711919563d56d245801c371f040af5b8169de3c6fea317612f4c2317cc526e8ea8c8c1e953c791b20a1aaf4c62f6c906efa621b14e7d3e285aa55b7ef96e4feb652df2cf36e76132f396cedb9db9cf15eeaea7b13e1027ea5d1f5490e6688884e1f1df2a9853024e581c9ae87c12991f4f89aabc4020df65ac4683de032022e2d805273b2d6a62e841a74be316f2152002b87680d37f6b7faf2b24be1ebc0d7a95fc330a592d044fd05ed37465086402a1335ce622bc8526afbc6aad8bb1bc0b63bf46ff0496a8861f0ee2c990adaf568144fb15eb4492e049f762fe735ddf5d283433a9d2fb9faff70364046ed11752282c816611250cc1e14272470c12fbd96a06bd3b873da306810ed786bcdb8983bcc7acf941b819c4f59b132e6c81639b46b8ba630ae11e4751458aeaa9dc2cee291652e638a28d47ecd5e2df8830bc7267883dd7d77fe2392aa484b6dec167a1bf3e00c927b26832f5f8d67f5d1c0c935624bc6c917001dd4df77aea734fa05d4037db5b19cef7d161c5ad1e95b40dcdd369358fada0a2a04d7a99f0b93386f706aa3213c1c4428b8461062b29683b29e56748a65154e9c33eafd6dac22c2ef4f55c4ca8e4a6c0007b31305254a27425066fec4b41e11c8357bf67ce8e2a0facb1b26e1b19543cd5f075cc81b0873ec57bc7edf9a9fb8ae35d3a3ace676225b40a421e645301f304221763ecab8baa7515839ca7f29e9e646af9a1ff1fe8031b5b36a8f2d6d70ae3f514f1c2972df04bb4924373d39301c8708bdf1376d3be64f3614c183c5b5cf95edaf20d2e59ec124eb11526a7f2d28546b31566e161ff39233762c0e4b505f246454f3e27f8dbbedf1610464944ea873600ed8e95fa00d291fa3b1d9cb257ca29710f473ce1de492602202f23ab8102ec101110145fbafc73f41a830decc8fc46a9f8925e091fec25f87a69fa23f63621533da3e4f97d2ad78c1886b6783e46e2923fbc424bb010e5d586e5fce6f5191c161aac64eec1c3afb12b2c6b2047c9c9db9d6beeb10de8b1d8ed9b857c3c7e7c3b59e374c6a7407ef247c178147b3a0f82f8588b74ddbab03d4c78915750c463f68bc8f40f8e4ba87169bf6377c54d21d5a62cb0dcf466daa235ad887f5d2af2d8dd827047847190afa82fb866744bbfd38952705530e699270b1f13dc0b53fdc2de61de45ab153fd017274bb3b4b4c8b9fa2279dc3a6940e072e9fe87bc86011dcc0c1ab07b97868b0f51ff6208df234a2f5a10f896478a4c5d46ffbafaa810b45bb82368d0085f78e959d1b0f26dd7cff09a40d0d12285b1ccf203ef25f3a1cb5fd753c6aadf2a26c1a21b6355ec2ef8d29ac0f08cd44e94f9a9f6b8558c3e5d7db20ce3a8f147c0309fb3f4b856dec934af6072bc942de440d8cd0ec1944362cb579f75a91393e3ebaf5fc807c0df8367834bb0f08ca7c698991662d8b9e9e55dba84b968d316fce6311e5257ccf69348e06a693595bb94bdaba080fb1c0c88a33557c088a51948bd4f01c5544e9fbf5a8e09ae0dff397ea8522a4349d185f9a2f0b595093b29b88b5e2007e12e6b60ae8aed88bbc198dc7709c5e9181ead6ab91a0b7df795a0e9d349c1096bb29bf2e0643a0afc2f2ac9ffe3e5002a796b025da52dce5d89a8d76499a25bb4588202c18a12107b1fb9759f904ca3363921ed36d1fb3f0af559e771b0a708e26b39f00a87cf2e8489f53a6c0ae606ea8ced1b876895c1c21ece89b1955c4d827ffd4da4b994eb2dcff368ef534b34f6a566efd9480f1b6e308947684dc4960a083d3cf52960be62cf0c0d4ce6d256ff28141c274b7dc8dac819c04d4f1155a8bb4c29a2a00535ca4ea89ce1e218146b73e2103fadcf2c2de446e6c128cbe749c5f7aaf392e764a9397e06e443cb3e44d08af9a2ce55b0ef8cf1803f2167a67d59547d522d65934fba7875301db570cc4424f629a39a7bd36333029bdb818a3739f454966af6ffe4d237d6965cc81f335d8a787450abbe7c8ddfd2f8b749594cea4df455cdfb5eb5f7b0b4f67875adafb11b61639fd0be25bbf0d19cea430058fff31b0fb0ae36a84ad6ccd17038638fe38905fc24384bc60a15058c6b6defe60ed71c7697612b084d6a2cd0b15056f593335906c82265f38c47dcc1c1043da1ce74578a1919e03df4e155396b3dea89acd39d1449f00a9e8cf5ceb0684928432d21e6b7e83c099d285c126a430767e1e718c9dcaf83ae26120ed83c95d7d16a493d16c0a01f8bc05ac987bf8e378d7c8d28c201930890773c1d6ab6440cd3ff2454f17ced7e463d9753891a56833f5f673eb138d7e7ce6666b65ea74f6f0d3cc2d86dd7940ccf108ef7f0ad3c5c7da744c1988aee2a7fa5fd1bf52698221c6ed21de5077effb9bdb50b882523fa932bd1e3efe50b630599dfaf3b13167f57db1a12caeb51278b7fbd9768da62d45b1f056aac361b2da6cc4933a9159379a4152ad66a69362e347af0d414e8716c9869511034c2a366bfb5b125cfc5720c05af7895f4e318d89e85ad02e76c0d643b77c3bbab28865823d696dc5306e1731f56c29ddd25e378749493c762d9966e34b53049a84f4da9ff286bb20ea8c6918ae6df35bd82719ab07d197afe2c87cace76d139175fcfbb8ebc49a131d484244295baca1dec61526a5f844a6950899a0bfc13417b3df9b6580e5657a0d92bab2cfaab91e1513e0cb11c0f029841bf63da801ed3171aa7c039b45675b9197924a5429feeb52a7152d4b82304ff39f2d666edf8ccbfb35d2eee45af364ba98cc978ec7f4f361c4a9fb2bf1155e059c9874c9b00113b6d85ccfbeeb3bf33435ced0c94135a00162d1a1279041fca05ddb2ac02a0a34bbb15f5aac25ac3cdcc32cbb882b6456602bd011cb665661b483b20bcb6cadaf993b3d6fe59757e9fd2b00ebc3b6adfca5bd7bc016eac63adc33f450303dfc89a025d2e3e7fa99854cd468654428c4dbf40b078b24c939882bff81d871d19383b86a5d78e3dc5f53bbf31c56c9ceb28c43179b0f9829d9fdb9c126eaeee6858de67dc6cf0f75552fad19ab1dd381dfaf963790353816b68c1e4e0938d1312746e90d5ed32c32be83f2e1890ce24bd3594b8393280937ddd35475106a0336a61ef483202ca11d58dbb4345c5d68b41e949ad32a36b86983950a12dcb29e02b31880d041805197670fc30c8d6c30f736de8cf7955dd8ae6a46d6fa0d9955056abe5ef41acc00f94f9466327fa207f1f85aac9baceb25fcde2e8f1c6c5f68a66a62a7165c29afb66a17932c892fcd6c894c54abb3f56bbf1dd5901a60b2dc2a51615e6897e894aa15678403ce35a2dd94a31d03092a92e54be81c53adfefa653c00f63a76f2d6471625df5ccfdccffb30e1c545e435c3b3fad6249246d3c2f5796514a899d87905ef0a5bd1032c4718b467dc2df510183beb72b9140cf670e82c649460d782cbf33791088756a796c48d0f7df2b856a4b3e2914c7f8e707a05ed5956473c8eeca35aeb2b96c939b5bfd874e519b9d624e5b3fde44de50c1e9ccbd2642638ab2c1de38127c4c59c5d5710d82c619b634151b0fb1bb94a357e2e38b888f8fb30934009fbee693451b343f0cd656411565e4149433383a8ee7194bdf3907f8a9136296188c74bb3fb276da9cc275101882ac5046fa42b9142efce704014b17b72d0a7b2421b5efb3a0411da62d42019bf78d6a6c5c56f3e8e5fbd0240547c6db5404f1218ab391f361a5ecb9c2cd64c32693ca8dab991688b496daada1d02b5d9cd1b9df7f1258e1a9a70e22f229078b0b33f30cb3e4021335a4392548dbf11dd0ab1c138571179412f35b4106f9bfc0c5bf57b63909a5fd8892a584569cb7b9c330417ae9468d6583f2c923060e156d4a8c69114ac5281b8104b3dcee2abe8b94b7a0551079f6bc89dfe3c521a046b70b1d2a9f1df20fda6dd84adf9e57b34b795ffd5b3dca4c62c815177744c2c21046861135e70fed347985962f5409580c263a72cfd878fe10192902948c6bab642fab9be6b9b93fe41fdea762a9c78d1631f81c4d76c3187d23a26ad0d37ba1f44114afe994c18f8404f7ed02956eeec1ab8c87b0cf8450146705817beec015783b22e6d9125179887dc74b162b2890ffbf8c3443bf732c125f7d2ba0f75d0f81198eaf12e1251e85a34ebd23087ba790d6ad8a6c4cf0c85d410fef6bf6796e9a4c25699dd8bf51063b65b46aa5ad69ed243722b5ac050672fd3ba0c2d8b5e013f403dda3c30db4ca94da891a6d90ac9cfda97c0fce5bf7ed8c0d4b309ece7bbf0f536fcce750495dca0ba52c0c2e1972763f973a28925d8846b6a941bfc9dd1e96b889112336b1530327eaaddcb78ab1db7c35c4ef54a2888f770de481f0a6ba5b827a5013b6c9c0f9e6e629d7f0f65d260ee4ad62061305ba91ec2a29c27dc22b4d07cd090a66705f062ef25f632eaa2842b36dcf2807abb94403c458d78453a5bf20bae90912372db3e4ba83e66928dad13a734ecd912cff58640e8c3b4012ab0fd32f8679875b0f46812deb0f143d8c94b2d0c8d0d9bfc7c1f5eb6609179e1e4119e6c240d8ad581233f4b2bc55c39f3e46f4516ab2b2ac271f773809718f80efc4cd4fc28ebb09d7e8429203127de4aee25cb61bef5d71a3fd7b43741bb8d0f0b530f4d06e2c92c632930c8fec4c6a2b66f43efee55b50254dac26cbefde31cef6d044ce90e61bec3affde7682a14fd8327358b09b3445cc4af0bcf125d43d458d8089176f238d4253fc0e3f7b3b72fbd88bca0973539fdcab07ca1da7027a50ae01a071e080dd04718a82dc0ef72228a84598556d2f85777e72b4227475313a779b7cbc5c80314f7358cdb1e4ab8e178ef933e7192c60304770262e4b99d476b8f42c8eb2b10ba6ba0dd51a52710ac75d49f29ff6abfd791755a88c0456513b7e47915855ddb6b5c38b5955cac22aa6f2e96a135540b2da8d22b4c83590e585185946caf2307af83e4a9fc809301cb53284407cd5ed383477e0a0a1852b0b94c1c382d5a192ac2fc705f7eb05f2655a5c0220bc2eb03b8132290d7a2a3871d4c93fb48f0521c10590f35a90b813155483a2d64a408d21bcae12b5bf8977a42c7cf6810d7b300fcfe7b780688d227dba545cdb8104fc31d873f2ca8afe8a8ee1c8bfdc13663d5f4509b836e3901e41128bd694fef92737864630545ffba4afac3acc7b49a870566f245a2a3ed34ff266ff66ef1f45ecf83f33f548746c3f2d0868a2b0fda71312475a1e601c8b71a7b9231afa40936c42f7d1e3d053dc7dbf12956654590f55b12c6c77b9d7372d9805a84d6f99040e21b9791c62dda870814a60dbf27c4a82f3979410091ef1106220f96627d8f7f189de07ca85e0dab440efe5b8fdc8d7e434ba6162f0b5df11c0bd6489945c946953a21a2d0f0e8924337f401f42f96a87c26f76e4e6623eca76b8c81aa96741b248e07cc8fccb203903da21d364640549640aff4016c83c6e2586893212706aedd30c4b2b2c9c205d1332ea492d4aad97c2646c8082b6d769b5f5d606bec26fb762adf1308325c1c2ec38e2cfa424e41513718625a7d7004a7de11f937d177eee3da060e04b4f1311957fe7897e5f43d32f4c3b4234c3afdf3b069432ac235046efbe4e243c071f06c155bbc48cdac07171b38253c0de4afea667572ebbc28894cd2f9e21992d4d696710a0250acc1a355d951146cd46883787104494c20ca9abb33b07bb3e54b8c5861a1425f4d989029844ecdde4d851e57c9d39d757f473d55e4b0f0aeff40b304d3e04f6e2e9394b1e172d7482dad0b3ca2568aa3297391d614f912a08003300f50000000400238000000008004f00", @ANYRES32, @ANYBLOB="0b055bfae918f58d7afbadef493d7e358a95c4e330bcf2a04bc03c39d71670dab91ae5b106d1c2843ce4304ea577f9d8a1a0f848d602b9800600d00023000000f9768407cc2561184d2c4fc38602f7f8b7e4d6b3bb83f9abe034d3786433df04f18ac95f6d7d3fd067778f4450b81274918a59ba3a86b640f0b2f491691fbbf30d5968d8cac55f7faa350f658846cbf96a27bd30c15510f812038d31664a2401cbc2c9e12721a435f68c7490e6f85b04973390512b4a52fe2b005b277d1a2cb4f6609b499d2b554549f538e79bb251b0fb6cba3c2bd4ee5c2a261e87f8df3edb54c1acb4056770de689c1d57b90400e280e2bc598ed974dc397766010698def2d7772b1038bb9c17e0763cb138433f1e202f1611d0039a04209f742c012cea110be51c9b094f857d693685c3b632090db81a1ed81922c1bca49c033497098432b5cac25c7d29faaac98f1299fb1dd174a79b15697edc8badb40500dbca74b1ebf60400c1808723e75eb0d3bf1d6a19c1bcd4235f17e1b00f7a41329670f7d087b53a6ec1ea26f9b87f7bbde89b7abffc784f40bf50bafb1754a0ec5cf72e9089b5d61b9740aa1c56f016dd00d7da62d26242bfc367d029cd67bcb19fef0163b26f5a6fea1270de2665889035884d5137da65ac46509dfb7cd208e92dcf60f2faf30a5e53c8a2e83b6ee7ab4bfc225320e76ea3c10f3d8d440cebb9868fcf5dc7f513157d7b8a9322b23b544ca2131d65720f9a9279715eadf1fc70e535f868a25b760d349e142202b7ad4b65b80befeef4f8c1386507a2321365931e6facedda8269229e4815e587b5fcc9ea37e3a0a58273b4376cd8eebac1bcfc597dfab36b14aa33851094d9441bae8a044afc9b7afb784bfbd08a9db6a0f26ba9dac482446a7277903c08f0c639639658e8d4e28a3147ec1ef16f645271a41e746bdcad23b9238399ff08de694cc9746e60f02c6660e7f9bc90e77b70983b5d90a2c21537512c878c1cdbc1248969b461e35ca569d572593cd7918d45c0f6de5e4a4adef3ddad9ac2fd4795d1cb54f10427f07f7eee39c1fdecd2a177fd764774524be8c9ca3e08004c00", @ANYRES32, @ANYRES32, @ANYBLOB="08001b"], 0x18c0}}, 0x0) io_submit(r4, 0x2, &(0x7f0000000300)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff, 0x0}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)='m', 0x1}]) r6 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$inet(r6, &(0x7f0000000740)={&(0x7f0000000140)={0x2, 0x4e22, @local}, 0x10, 0x0, 0x0, &(0x7f0000000600)=[@ip_retopts={{0x2c, 0x0, 0x7, {[@timestamp_prespec={0x44, 0x1c, 0x17, 0x3, 0x5, [{@initdev={0xac, 0x1e, 0x0, 0x0}, 0x7188}, {@broadcast, 0x9}, {@dev={0xac, 0x14, 0x14, 0x22}, 0xfffffffa}]}]}}}], 0x30}, 0x4000014) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000000140)={{0x1, 0x1, 0x18, r1, {0x1000}}, './cgroup\x00'}) syz_usb_ep_write$ath9k_ep1(r3, 0x82, 0x20, &(0x7f0000000100)=ANY=[@ANYBLOB="0c00004e1560254722cb66187f3b68d00c08004e15"]) mount(&(0x7f0000000100)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000000)='ext2\x00', 0x200000, 0x0) 2m28.606597338s ago: executing program 5 (id=2301): mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='ramfs\x00', 0x2014800, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x204) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) r2 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) sendfile(r2, r1, 0x0, 0x7ffff002) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) (async) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='ramfs\x00', 0x2014800, 0x0) (async) open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) (async) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x204) (async) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) (async) openat$cuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async) sendfile(r2, r1, 0x0, 0x7ffff002) (async) 2m28.43799034s ago: executing program 5 (id=2302): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_procs(r0, &(0x7f00000020c0)='tasks\x00', 0x2, 0x0) (async) r1 = openat$cgroup_procs(r0, &(0x7f00000020c0)='tasks\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f00000000c0), 0x12) (async) write$cgroup_pid(r1, &(0x7f00000000c0), 0x12) mount(&(0x7f0000000000)=@rnullb, &(0x7f00000000c0)='./cgroup\x00', &(0x7f0000000040)='gfs2\x00', 0x208002, 0x0) close(r1) 2m28.151228292s ago: executing program 5 (id=2303): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000140), 0x88980, 0x0) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$netlink(r1, &(0x7f00000016c0)={0x10, 0x0, 0x25dfdbfb, 0x40000044}, 0xc) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000001300)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x58, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x11c}, @NFTA_SET_DATA_TYPE={0x8, 0x6, 0x1, 0x0, 0xffffff00}, @NFTA_SET_DESC={0xc, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x4}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x80}, 0x1, 0x0, 0x0, 0x4000850}, 0x0) fadvise64(r0, 0x92, 0x5, 0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000a, 0x22052, r0, 0x5708e000) 2m27.808993388s ago: executing program 37 (id=2303): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000140), 0x88980, 0x0) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$netlink(r1, &(0x7f00000016c0)={0x10, 0x0, 0x25dfdbfb, 0x40000044}, 0xc) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000001300)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x58, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x11c}, @NFTA_SET_DATA_TYPE={0x8, 0x6, 0x1, 0x0, 0xffffff00}, @NFTA_SET_DESC={0xc, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x4}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x80}, 0x1, 0x0, 0x0, 0x4000850}, 0x0) fadvise64(r0, 0x92, 0x5, 0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000a, 0x22052, r0, 0x5708e000) 1m40.516611162s ago: executing program 2 (id=2529): syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000200)="f7790066baa00066b86b4276ef66ba420266b8e20066ef0f29902cbb0000c4e2b1ba8c88d9000000666666440f38826b410f7842280f07b8010000000f01d9c4033921820f47a753fd", 0x49}], 0x1, 0x43, 0x0, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0xb, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac000000000000000041a9e50b00", "f4bd000000801900", [0x0, 0x2000000000001]}}) 1m40.350546705s ago: executing program 2 (id=2530): set_mempolicy(0x8006, &(0x7f0000000040)=0xfff, 0x5) (async) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) (async) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) (async) write$tun(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="000086dd00000a0000008d00000064c80f59004d110000000000000000000000000000000000ff0200000000000000000000000000014e244e22"], 0x83) (async) r2 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000040)={0x3, 0x6576, 0xd}) set_mempolicy(0x3, &(0x7f0000000080)=0x89, 0xf749) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x4, 0x11, r2, 0x100000000) (async) r3 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000140), 0x88980, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000a, 0x22052, r3, 0x5708e000) 1m39.95475323s ago: executing program 2 (id=2531): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x145342, 0x0) timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3) sendfile(r0, r0, 0x0, 0x7ffff000) r1 = syz_usb_connect(0x6, 0x4c9, &(0x7f0000000b40)={{0x12, 0x1, 0x0, 0x20, 0x7c, 0xa2, 0x40, 0x5d1, 0x2012, 0x4a15, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x4b7, 0x3, 0x0, 0x0, 0xd0, 0x0, [{{0x9, 0x4, 0xc8, 0xa, 0x0, 0xb3, 0xf7, 0x2e, 0x6, [@uac_control={{0xa, 0x24, 0x1, 0x5, 0x6}, [@mixer_unit={0x7, 0x24, 0x4, 0x6, 0x3, 'bB'}, @selector_unit={0x5, 0x24, 0x5, 0x3}, @selector_unit={0x6, 0x24, 0x5, 0x3, 0x1, "ba"}]}, @hid_hid={0x9, 0x21, 0x40, 0x8, 0x1, {0x22, 0x59b}}]}}, {{0x9, 0x4, 0x82, 0x6, 0x9, 0x69, 0x50, 0x96, 0x9, [], [{{0x9, 0x5, 0x5, 0x0, 0x400, 0x0, 0x8, 0x7}}, {{0x9, 0x5, 0xb, 0x8, 0x8, 0x7, 0x1, 0x9}}, {{0x9, 0x5, 0x8, 0x8, 0x200, 0x4, 0x3f, 0x41}}, {{0x9, 0x5, 0x1, 0x8, 0x400, 0xdf, 0x3, 0x2, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0xc, 0x1}]}}, {{0x9, 0x5, 0xa, 0x0, 0x10, 0x5, 0x4, 0xfe, [@uac_iso={0x7, 0x25, 0x1, 0x2, 0x2}, @generic={0xdb, 0x3, "30c0704919473b452514e50b3afcd7d7d4f1c5db9826f38753079c3db471c11a20356205c6f9b46e1be41c60915bc56d8bf17b2815178094f8ea0047145a1b219627ed47fa065bc928967572b226d9152b0d3c7b5368ab269c7029a14d3a814ea3e77a3a78c060a998592d59809ad21307e4880e5b52040fd8a0863958e9aba639fba6f7791aba79042faa0f373cd7a0e21a86d5cf22ff3bb928f878b08df9f70e864750b524e47e2c79930dc23e4aa61954fdf52b42f5ca27639e31914aeca95f75e355cad433a3882f9553261ecf65d4b5b40091f1f6ad06"}]}}, {{0x9, 0x5, 0x80, 0x0, 0x3ff, 0x8, 0x4, 0x2}}, {{0x9, 0x5, 0x6, 0x3, 0x20, 0x6, 0x1, 0x2, [@generic={0x4d, 0x0, "7c360d68f5903ff7f7057bccedb153fa6d70029a1c032953fa8b8419a3794272645d464d5e4dd5785a42137d6efc4aaa7184d58abc2189cf4ac1fc802e8e0ba74e6a089aaea408621e6610"}, @generic={0x20, 0x11, "6d1ecc9d0957e20db58ac0d9ffbb831fc3c3340ccd7ea890683593be140c"}]}}, {{0x9, 0x5, 0xc, 0x0, 0x20, 0xe, 0x5, 0x7, [@uac_iso={0x7, 0x25, 0x1, 0x3, 0x3a, 0x3}]}}, {{0x9, 0x5, 0xe, 0x0, 0x3ff, 0x5, 0x7, 0x3, [@uac_iso={0x7, 0x25, 0x1, 0x3, 0xc}, @generic={0xd3, 0xf, "a1247fa7b9f0e85c636761e83e7276d4819a6c887ef004e2988aff78b6813312da48be599a38b82a5829aa8d1f77e677f55039d9fe5a5f3aeb13e9f13ab9cdc87039289eaf2718e0a600e84150d2d321af472b8bde13ec4c83fc4fa26652cd666aaaa24445d3d569c51570d6e18b698be27e225bce7647cafce9716eada50d703808e2684e72e4c6527772c72a151c1c9e6c46749becd94c8d62779391af4aedda36a2a3d9cd3d2d78578abf8f5b67dff016382c39bbef2bc2082b69840fc870273711f2ec4a1b2545b04d88091ce2e6e4"}]}}]}}, {{0x9, 0x4, 0x23, 0x5, 0x6, 0xdd, 0xfc, 0xb3, 0x6, [@uac_as], [{{0x9, 0x5, 0x2, 0xc, 0x8, 0x4, 0x91, 0x1, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0xd, 0xe778}, @generic={0x8d, 0x19, "bad9163b132f0e0aa751e23f1d740e9ac9aa200630d11c7cc63db3501f620e813acb0912a561d57636b56174264a4ec6d919479da45194d7eb045011fd876a31e96e652d7d5ca81d2af34f99795dbc74ed2ef908615b79b0b74808198c8b515eb53ee301653e5b5ef908dda80b7d85519c37c1defb8c6aa4588f80fcb293d3e9c251a6d075f5028dfaf55f"}]}}, {{0x9, 0x5, 0xf, 0x3, 0x400, 0x2, 0x1, 0x10, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x7, 0x1}, @uac_iso={0x7, 0x25, 0x1, 0x82, 0x3, 0x401}]}}, {{0x9, 0x5, 0x8, 0xc, 0x400, 0x8, 0x4, 0xe4}}, {{0x9, 0x5, 0x8, 0x10, 0x40, 0x81, 0x0, 0x90, [@generic={0xf1, 0x3e, "7befebae506c61161b5b07e2c423bf33823e35f5fcd09af9edd802e65db144d2c7ebb2fdb2d7dae01be03a37233d80a985e3c40aab6d9ebd9a7b776f1481f964a633dddb30043c0df21395759f4557a49581d35f28ad9841f38ae6b199a152ccf39ff729276a420547bba49e324238aa1f4c5e3dc507d6ab8791a7bf35464ef672dc47cff465a002a3510035641d22e810359657a9498e51b6ec4922a7bf3bbb96c639d0f3c0c015c471f2f57f3a9cefeee8182fe6944ee8dc55c6257a530e03884428a49a990b9a2a3cb971376a0295e3eaf56682f10b236999edda50ec4fb08a734c7f1b5535e87860c68b6e330d"}, @generic={0x17, 0xb, "8ab2b2a1346d435372f8d956ec72db4b51a948aba3"}]}}, {{0x9, 0x5, 0xe, 0x8, 0x40, 0x4, 0x7, 0x7}}, {{0x9, 0x5, 0x8, 0x3, 0x400, 0x3, 0x1, 0xff, [@uac_iso={0x7, 0x25, 0x1, 0x83, 0x0, 0xed}]}}]}}]}}]}}, 0x0) syz_usb_control_io$cdc_ecm(r1, 0x0, &(0x7f0000000040)={0x1c, &(0x7f0000000200)={0x40, 0x3, 0x2, "acd5"}, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$printer(r1, 0x0, 0x0) syz_usb_control_io(r1, &(0x7f0000000280)={0x2c, &(0x7f0000000080)={0x0, 0x3, 0x85, {0x85, 0x22, "e64d9fb1631bdc084bff608ac1a0faf22433d9d169cc924ac38e2d4018987b588c70be6690017caf3e8877212384f88bd22299f9f717c78a37117eafa456a0d1085c75b14c2af64476b02c9a1468454df6d3374eb059678919aeafeb5bcc008aa37c6a1db1ed64fee166dff93806eb528515c06962af3dde529d4eae301ed37908dbd4"}}, &(0x7f0000000000)={0x0, 0x3, 0x15, @string={0x15, 0x3, "a398b15e0fa7c826a3f24933fd4681371bd0b5"}}, &(0x7f0000000140)={0x0, 0xf, 0x3f, {0x5, 0xf, 0x3f, 0x4, [@ss_container_id={0x14, 0x10, 0x4, 0x65, "86c44a2c659a94239db825ff6e25ff62"}, @ss_container_id={0x14, 0x10, 0x4, 0xf, "2860b589e37382dff3cec5aba8fa6a36"}, @wireless={0xb, 0x10, 0x1, 0x4, 0x21, 0x5, 0x59, 0x101, 0x16}, @ext_cap={0x7, 0x10, 0x2, 0x10, 0x8, 0x4, 0x7}]}}, &(0x7f00000001c0)={0x20, 0x29, 0xf, {0xf, 0x29, 0xb0, 0x0, 0x8, 0x5, "8737e8f5", "37e4d996"}}, &(0x7f0000000240)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0xf8, 0x0, 0x80, 0xe, 0x7f, 0x7, 0x400}}}, &(0x7f0000001040)={0x84, &(0x7f0000000640)={0x20, 0xa, 0xd6, "6374ca597f98e84cdb4ab519b98911b9058d432a235bb9eefcc14b13f61faecb038debf64f890851431309c9e08bcce09a12ca7229f485000f9a1a14a5bf487e1b75a648c38903c391854fdb4222ee9364178aa13e8ec8d9364305bc8607ffe909cf481ac9a26f7808d69ed55ff0fcc1e38dde24f4bb613a6b62c78bf605723d3c9cbd72ffca8777ad8a8c22a62b0125d11ebad8e02e1b274890711489893c507873b99dddaa02cf3394ce3db4233cbb59d3f2dc54f4267f42776d03b086e9f9f09858b1e3368754aa857d5621fbd57c8527460ab59f"}, &(0x7f00000002c0)={0x0, 0xa, 0x1, 0x2}, &(0x7f0000000740)={0x0, 0x8, 0x1, 0x5}, &(0x7f0000000780)={0x20, 0x0, 0x4, {0x3, 0x3}}, &(0x7f00000007c0)={0x20, 0x0, 0x8, {0x20, 0x80, [0xf0]}}, &(0x7f0000000800)={0x40, 0x7, 0x2, 0x1ff}, &(0x7f0000000840)={0x40, 0x9, 0x1, 0x5}, &(0x7f0000000880)={0x40, 0xb, 0x2, "a341"}, &(0x7f00000008c0)={0x40, 0xf, 0x2, 0x1}, &(0x7f0000000900)={0x40, 0x13, 0x6, @multicast}, &(0x7f0000000940)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x25}}, &(0x7f0000000980)={0x40, 0x19, 0x2, "cb17"}, &(0x7f00000009c0)={0x40, 0x1a, 0x2, 0x81}, &(0x7f0000000a00)={0x40, 0x1c, 0x1, 0x6}, &(0x7f0000000a40)={0x40, 0x1e, 0x1, 0x7}, &(0x7f0000000a80)={0x40, 0x21, 0x1, 0x2}}) syz_usb_ep_write$ath9k_ep1(r1, 0x82, 0x2ec, &(0x7f0000000340)={[{0x61, 0x4e00, "ccb4eb984e2398bf40bb8ca041f74e5e4a2d2f2077637b73cb6e32869bf73410bcbcd1e7af9d86c4f2558072b4010453e867ee1317efc4feb2f36fe1c124ebcaa0413d383f160655dc3272c24313abf119bbafc5efa9099d09f753d38a63f934f5"}, {0xa0, 0x4e00, "0c3a8c838ca53839d02e6a7af3e455697a665788703a2126bfffa53b01bcfb5dd7e6902f4fd8929d4631b8cb1db21d0f7fe1b5a902a411f24d1fd78ebf04a68e3d68edd71afc0bd3ecfada650a8db4ed11f366705e0279ba340e96e4e0386c029b2154e7a4f7f76533aa7cdb9861a57b5fc36fe263dbe8fe5a8638795ba69e804053eb562c61412cd73f5bb83c7c4c16c9d14d7f3c8c4822be317e7671430ac7"}, {0xbe, 0x4e00, "a513d9866d3d8950d69b70c9eaa68a5e880861532a35f2b40e1622c1bde83ee4bb8554ef7f4497f35aad824ceb659b52def5566babc9d89e25b83dff4b1d9e60596ccb2cd6206823aa1f4612bbc69d3c40f8a0172c140fc0727769b2acd8d40f49b2bf622a8aebdeaedd99b596b7ba6a5087f5ee5dc62a43bad34343d3eb01f111b8fe94f4b272215fd131059cfbf275b08b0b0fc7a60bd4133e2f4b84923364bc1e66b6dc8e5f7078a28e86920669b531e7fd75d4b214cdd3395c86f8fd"}, {0x56, 0x4e00, "1afbf28a3b6f91d142ccc6b5bda9cd3c43ba5c65de48bddddaca73f90105f8be7fc412143c591fecddb6ba71498bf3bd95be04212d0122b29cd54fda6d1b691958bc568413f870e1adb1b3a2e43ee2ac60d36cf8bf67"}, {0x9d, 0x4e00, "4db271cb9ceb789783c43b8ea650dd8463b74360c844ed6a40706b366b8222cc467fb77f4d96667457a8f9b38535b4e127d58e2d18d24c5bc6e01ed12c6a1330780bebfbfd5315c1d5ff385ba3cd56070ed1c297e2cd50378bbc7e2d95b126e212bf9955877d6758f1147a4b6ed07b2b470ebbab32e602f0b6106af103d574960c2a717243d43a087c05673d818ae91f7f0558eafb4982dd6e5a285d09"}, {0x18, 0x4e00, "c269ac9787269f41f538bd8c36aea4e07f48c61eb2f07364"}]}) 1m38.614314671s ago: executing program 2 (id=2535): r0 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) setsockopt$llc_int(r0, 0x10c, 0x2, &(0x7f0000000000)=0xffff, 0x4) sendmmsg(0xffffffffffffffff, &(0x7f0000005ec0)=[{{0x0, 0x0, &(0x7f0000000000)=[{0x0}], 0x1}}], 0x1, 0x1) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = openat$vmci(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r2, 0x7a7, &(0x7f0000000080)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r2, 0x7a0, &(0x7f0000000000)={@my=0x0}) r3 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3in6={0x18, 0x1, {0x0, r1, 0x4, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, 0x3a) sendmmsg(r3, &(0x7f00000036c0)=[{{0x0, 0x0, 0x0}}], 0x400000000000113, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r4, &(0x7f0000000240)={@val={0x0, 0x86dd}, @val={0x0, 0x0, 0x11}, @mpls={[], @ipv6=@icmpv6={0x0, 0x6, "ec9700", 0x30, 0x2c, 0x0, @local, @mcast2, {[@fragment={0x3a}], @ndisc_redir={0x89, 0x2, 0x0, '\x00', @private0, @ipv4={'\x00', '\xff\xff', @multicast1}}}}}}, 0xfdef) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r6, 0x84, 0x12, &(0x7f0000000540), &(0x7f0000000580)=0x4) mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f00000000c0)='nilfs2\x00', 0x40500c9, 0x0) getsockopt(r0, 0x2, 0x2, &(0x7f0000000080)=""/43, &(0x7f0000000100)=0x2b) 1m38.158800564s ago: executing program 2 (id=2540): r0 = syz_open_dev$vim2m(&(0x7f0000000040), 0xc8, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1}) r1 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000340)={'vxcan0\x00', 0x0}) bind$can_j1939(r1, &(0x7f0000000380)={0x1d, r2, 0x2, {0x1, 0x0, 0x3}, 0xfd}, 0x18) sendmmsg(r1, &(0x7f0000004c80)=[{{0x0, 0x0, &(0x7f0000000c00)=[{&(0x7f0000000980)="dd", 0x1}], 0x1}}], 0x1, 0x20004) ioctl$MEDIA_IOC_REQUEST_ALLOC(0xffffffffffffffff, 0x80047c05, &(0x7f0000000000)=0xffffffffffffffff) ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000340)=@mmap={0x0, 0x2, 0x4, 0xffffff7f, 0x7fffffff, {0x77359400}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "186856f3"}, 0x0, 0x1, {}, 0x0, 0x0, r3}) r4 = syz_open_dev$dri(&(0x7f0000000080), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r4, 0xc02064a5, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x0}) r5 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x66002, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000003a80)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x101, 0x0, 0x0, {0x5}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x5c, 0x3, 0xa, 0x3, 0x0, 0x0, {0x5}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x3}, @NFTA_CHAIN_HOOK={0x28, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_HOOK_HOOKNUM={0x8}, @NFTA_HOOK_DEV={0x14, 0x3, 'wlan0\x00'}]}]}], {0x14}}, 0xa4}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) fstat(r7, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0}) setreuid(0x0, r8) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x22052, r5, 0x2000) 1m37.658949635s ago: executing program 2 (id=2544): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x66002, 0x0) mmap(&(0x7f0000ade000/0x2000)=nil, 0x2000, 0xf3ec8cd8cc2660ce, 0x13, r0, 0x4001000) ioctl$BLKRRPART(r0, 0x125f, 0x0) r1 = syz_usb_connect(0x5, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="120100007856bb40da0b53813de20102030109021200010000000009040000000206"], 0x0) syz_usb_control_io$uac1(r1, 0x0, &(0x7f0000000580)={0x44, &(0x7f0000000280)=ANY=[@ANYBLOB="01000400000012c71076"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = socket$unix(0x1, 0x1, 0x0) bind$unix(r2, &(0x7f0000000000)=@file={0x1, './file0\x00'}, 0x6e) listen(r2, 0x0) mount$9p_unix(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x100c000, &(0x7f0000000380)) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x200002, 0x0) openat$cgroup_procs(r3, &(0x7f0000000080)='cgroup.threads\x00', 0x2, 0x0) 1m21.890385603s ago: executing program 38 (id=2544): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x66002, 0x0) mmap(&(0x7f0000ade000/0x2000)=nil, 0x2000, 0xf3ec8cd8cc2660ce, 0x13, r0, 0x4001000) ioctl$BLKRRPART(r0, 0x125f, 0x0) r1 = syz_usb_connect(0x5, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="120100007856bb40da0b53813de20102030109021200010000000009040000000206"], 0x0) syz_usb_control_io$uac1(r1, 0x0, &(0x7f0000000580)={0x44, &(0x7f0000000280)=ANY=[@ANYBLOB="01000400000012c71076"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = socket$unix(0x1, 0x1, 0x0) bind$unix(r2, &(0x7f0000000000)=@file={0x1, './file0\x00'}, 0x6e) listen(r2, 0x0) mount$9p_unix(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x100c000, &(0x7f0000000380)) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x200002, 0x0) openat$cgroup_procs(r3, &(0x7f0000000080)='cgroup.threads\x00', 0x2, 0x0) 7.294976353s ago: executing program 7 (id=3051): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) r1 = syz_usb_connect(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x141, 0x48, 0x13, 0x44, 0x20, 0x424, 0x7500, 0x69ee, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0xb8, 0x7, 0x2, 0x96, 0xd1, 0xca, 0x0, [], [{{0x9, 0x5, 0x6, 0x2, 0x200, 0xd, 0x0, 0x6}}, {{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r1, 0x0, 0x0) syz_usb_control_io$uac1(r1, 0x0, &(0x7f0000000400)={0x44, &(0x7f0000000140)={0x0, 0xe, 0x4, "bf7ad941"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000a00)={0x2c, &(0x7f0000000800)={0x20, 0x15, 0x4, "e6ac881b"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r1, 0x0, &(0x7f0000000500)={0x44, &(0x7f00000000c0)={0x0, 0x7, 0x4, "2032efad"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r3, 0x800448f0, 0x0) ioctl$sock_netdev_private(r2, 0x89f1, &(0x7f0000000000)) fadvise64(r0, 0x7, 0x1ff, 0x1) r4 = syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000040)={0x0, &(0x7f0000000240)=[@wr_crn={0x46, 0x20, {0x8, 0x7}}, @wr_crn={0x46, 0x20, {0x0, 0x8000000000000001}}, @wrmsr={0x1e, 0x20, {0x3b9, 0x9}}, @wr_crn={0x46, 0x20, {0x0, 0x9}}, @cpuid={0x14, 0x18, {0x7, 0x65d7}}, @wr_crn={0x46, 0x20, {0x4, 0x6c}}, @wr_crn={0x46, 0x20, {0x8, 0x4}}, @rdmsr={0x32, 0x18, {0xc0011653}}, @wrmsr={0x1e, 0x20, {0xa1d, 0x440a2e16}}, @wrmsr={0x1e, 0x20, {0x774, 0x9}}, @cpuid={0x14, 0x18, {0x0, 0x7fff}}, @uexit={0x0, 0x18, 0x7}, @wrmsr={0x1e, 0x20, {0xb93, 0x1}}, @code={0xa, 0x4f, {"6743de469fc4e205ae83002800000f0866b834008ee866ba6100ed66ba4100b805000000efb9800000c00f3235001000000f30470f07f3abc4030538090a"}}, @wrmsr={0x1e, 0x20, {0x982, 0x3}}, @wr_crn={0x46, 0x20, {0x3, 0xcfa}}, @code={0xa, 0x59, {"430f3526d9f70f07b9a40a00000f320f01c80f01c348b86ba80000000000000f23d80f21f835400000d00f23f8b805000000b9020000000f01d92e0fec9cca00000000400ff2498d"}}, @code={0xa, 0x4c, {"360f7842c30fc79a4d000000b9170800000f32c4c295b61966b802018ed0410fab9a00a00000c4e2752b23b9980000400f323e26d9fa26430f01c4"}}, @wrmsr={0x1e, 0x20, {0x994, 0x2}}, @rdmsr={0x32, 0x18, {0x840}}, @code={0xa, 0x72, {"c441f173dc000f072e8b99002000006540d8dd66baf80cb89c836689ef66bafc0cb0f2eec7442400a8000000c7442402b48c0000ff2c2466baf80cb810c7c88bef66bafc0cb8ccfa0000ef400f0052000f20d835080000000f22d8c7f81a440000"}}, @wr_crn={0x46, 0x20, {0x0, 0x7}}, @cpuid={0x14, 0x18, {0x2a1bec85, 0x4}}, @rdmsr={0x32, 0x18, {0x830}}, @cpuid={0x14, 0x18, {0x7ff, 0xffffffff}}, @cpuid={0x14, 0x18, {0x7, 0x20004}}, @cpuid={0x14, 0x18, {0x8, 0x2}}], 0x3f6}) ioctl$KVM_CAP_HYPERV_ENLIGHTENED_VMCS(r4, 0x4068aea3, &(0x7f00000000c0)={0xa3, 0x0, &(0x7f0000000080)}) sendfile(r0, r0, &(0x7f0000001000)=0x7fffffff, 0x7ffff000) 6.846832499s ago: executing program 9 (id=3055): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000140), 0x88980, 0x0) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) readv(r1, &(0x7f0000000180)=[{&(0x7f0000000200)=""/92, 0x5c}, {&(0x7f0000000280)=""/65, 0x41}, {&(0x7f0000000300)=""/96, 0x60}, {&(0x7f0000000380)=""/147, 0x93}], 0x4) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/timer_list\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x20000023896) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r3, 0xc04064a0, &(0x7f0000000200)={0x0, &(0x7f0000000140)=[0x0], &(0x7f0000000180)=[0x0], 0x0, 0x0, 0x1, 0x1}) ioctl$DRM_IOCTL_MODE_SETCRTC(r3, 0xc06864a2, &(0x7f00000002c0)={0x0, 0x0, r4, 0x0, 0x80, 0x5, 0x9, 0x0, {0x9, 0xd6, 0x1c, 0xd, 0x5, 0x401, 0xfff5, 0xa, 0x0, 0x52, 0x8000, 0x7e9, 0x401, 0x9aa1, "cb630dab3a0338057401a192419598961f50dc45c87d55a52a28b8f01c0e0e7a"}}) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r3, 0xc01864c6, &(0x7f00000003c0)={&(0x7f0000000280)=[r4, r5], 0x2, 0x80000, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r6, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x9}) ioctl$DRM_IOCTL_MODE_GETPLANE(r2, 0xc02064b6, &(0x7f0000000500)={0x0, r4, 0x0, 0x0, 0x0, 0x9, &(0x7f00000004c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_GETPLANE(r3, 0xc02064b6, &(0x7f0000000580)={r7, r4, r8, 0x0, 0x0, 0x1, &(0x7f0000000540)=[0x0]}) ioctl$DRM_IOCTL_MODE_SETCRTC(r6, 0xc06864a2, &(0x7f0000000340)={0x0, 0x0, r4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "030000008600000025ccf0f8b91dd208db851ba62b00d84829647030eaf92651"}}) r9 = socket(0x10, 0x3, 0x0) r10 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r10, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setreuid(0x0, r11) fcntl$F_GET_FILE_RW_HINT(r1, 0x40d, &(0x7f00000005c0)) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setgid(r12) close_range(r3, 0xffffffffffffffff, 0x0) setsockopt$SO_J1939_FILTER(r2, 0x6b, 0x1, &(0x7f0000000000)=[{0x1, 0x2, {0x1, 0xff, 0x4}, {0x1, 0x0, 0x2}, 0x2, 0xfe}, {0x2, 0x1, {0x0, 0x1, 0x1}, {0x1, 0x0, 0x8694d01652ca12b9}, 0xfd, 0xfe}, {0x1, 0x0, {0x3, 0xff, 0x4}, {0x0, 0xff, 0x2}, 0xfe}, {0x1, 0x2, {0x1, 0x1, 0x3}, {0x1, 0x1, 0x3}, 0x0, 0x1}, {0x3, 0x3, {0x1, 0x0, 0x2}, {0x0, 0xff, 0x4}, 0xfd, 0xff}, {0x0, 0x1, {0x2, 0xf0, 0x1}, {0x3, 0xff, 0x1}, 0x2, 0x1}, {0x0, 0x1, {0x2}, {0x1, 0x1, 0x4}, 0xfd, 0xfe}, {0x2, 0x3, {0x1, 0xf0}, {0x2, 0xf0}, 0xff, 0x7f}, {0x3, 0x1, {0x1, 0x0, 0x4}, {0x2}, 0xfd, 0xff}, {0x0, 0x2, {0x1, 0xff, 0x1}, {0x1, 0x11f, 0x1}, 0x0, 0xfe}], 0x140) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x4a34d2d8fd9e5d2d, 0x22052, r0, 0x5708e000) 4.314656696s ago: executing program 8 (id=3065): timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)=0x0) timer_settime(r0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, &(0x7f0000000100)) mount(&(0x7f0000000000)=@md0, &(0x7f00000000c0)='./cgroup/file0\x00', &(0x7f0000000080)='pvfs2\x00', 0x82, 0x0) 4.174976687s ago: executing program 7 (id=3066): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x828c4dc44bb3513c, 0x0) r1 = ioctl$NS_GET_PARENT(0xffffffffffffffff, 0xb702, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x3, 0x80010, r1, 0x0) writev(r0, &(0x7f0000000300)=[{&(0x7f0000000680)="580000004b8004023655fdbaded39d65000b4824ca940417a3cd3639e431e8e2125f6c00940f6a0325010ebc0000000000000080001328baf0fffeffe809005300fff5dd02000000000000000c10003d5bcf6916b4114b32793792c395da89991a8be619c7ce1ecf8b6e3501aeb67cdb99f356f9518492cbf6d88e98f0df275f9f6dd0e185ac9b0b8902c883e0b63cf78a6f36b97cab227f62b6d35dcd058a8957d1bbf401e51d4302cbc17c3201e7b12fa4daac244b96d402183b429bbe400236cd1f8d50f2568ac466a6d40024f87588cbe7808c481b157f18acb07cee62b1d238ba704435ee1c055697eb1ee0e2cfa36d2efbf1ac9fa85fe4", 0xfdae}], 0x1) 4.090878722s ago: executing program 7 (id=3067): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x20011, r0, 0x8e629000) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r1 = syz_open_procfs(0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x1c3042, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) getdents64(r1, 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000340)={'vcan0\x00', 0x0}) sendto$packet(r4, &(0x7f0000000000)='g', 0x48, 0x0, &(0x7f00000000c0)={0x11, 0xd, r5, 0x1, 0x0, 0x6, @remote}, 0x14) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) 3.746894215s ago: executing program 9 (id=3068): r0 = socket$packet(0x11, 0x3, 0x300) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x36) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000300)={0x4376ea830d5c5499, 0x0, [0x8, 0x3, 0x200000, 0xf2a, 0x8, 0x7, 0xffffffffffffffff, 0x800002]}) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f00000ab000/0x18000)=nil, &(0x7f0000000000)=[@textreal={0x8, &(0x7f0000000140)="36d0e866b8970000000f23c80f21f866350c00a0000f23f89d0f326635000400000f302e8dcc0f23742e3b5753baf80466b8f494f78e66efbafc0c66b83ac80000666fda6509", 0x46}], 0x1, 0x1a, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) openat$uhid(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$VIDIOC_S_CROP(0xffffffffffffffff, 0x4014563c, &(0x7f0000000040)={0x9, {0xa15c, 0x404, 0x7607, 0xffffffff}}) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000000)=0x2, 0x4) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0xfe, 0x0, 0x7fff0003}]}) setsockopt$SO_J1939_SEND_PRIO(0xffffffffffffffff, 0x6b, 0x3, 0x0, 0x0) close_range(r4, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x200000d, 0x4008031, 0xffffffffffffffff, 0x0) r5 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$EVIOCGBITSND(0xffffffffffffffff, 0x80404532, &(0x7f0000001440)=""/181) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r7 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r7}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r8 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r8, 0x84, 0x6f, &(0x7f0000000100)={0x0, 0x1c, &(0x7f00000002c0)=[@in6={0xa, 0x4e20, 0x2, @empty}]}, &(0x7f0000000180)=0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r8, 0x84, 0x85, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x4e20, 0x3, @private2, 0xffffffff}}, 0x0, 0x300}, 0x90) close_range(r6, 0xffffffffffffffff, 0x0) setsockopt$rose(r5, 0x104, 0x7, &(0x7f0000000280)=0x1000000, 0x4) mount(&(0x7f0000000000)=@filename='./cgroup\x00', &(0x7f00000000c0)='./cgroup\x00', &(0x7f0000000040)='vxfs\x00', 0x208002, 0x0) 3.494185523s ago: executing program 7 (id=3070): r0 = socket$nl_crypto(0x10, 0x3, 0x15) ioctl$sock_TIOCOUTQ(r0, 0x5411, &(0x7f00000000c0)) (async) mount(&(0x7f0000000000)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000400)='cramfs\x00', 0x0, 0x0) 3.304442387s ago: executing program 7 (id=3072): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000140), 0x8900, 0x0) fadvise64(r0, 0x92, 0x5, 0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000a, 0x22052, r0, 0x93771000) r1 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'vxcan1\x00', 0x0}) bind$can_j1939(r1, &(0x7f0000000040)={0x1d, r2, 0x1, {0x0, 0x1}, 0xfe}, 0x18) 2.806911434s ago: executing program 9 (id=3073): move_mount(0xffffffffffffff9c, 0x0, 0xffffffffffffff9c, &(0x7f0000003040)='./file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00', 0x247) r0 = socket$kcm(0x2d, 0x2, 0x0) r1 = socket$kcm(0x2d, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000200)={'tunl0\x00', &(0x7f0000000180)={'sit0\x00', 0x0, 0x7800, 0x1, 0x80000004, 0x2, {{0x5, 0x4, 0x3, 0x0, 0x14, 0x64, 0x0, 0x4, 0x29, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @loopback}}}}) r2 = socket$packet(0x11, 0x3, 0x300) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r3, 0x107, 0xf, &(0x7f0000000100)=0xa, 0x4) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000000c0)={'geneve0\x00', 0x0}) sendto$packet(r3, &(0x7f0000000180)="0b036800e0ff64000200475400f6a13bb10000000800894f4820", 0x1fffe, 0x0, &(0x7f0000000140)={0x11, 0x0, r4}, 0x14) ioctl$sock_kcm_SIOCKCMCLONE(r1, 0x89e2, &(0x7f0000000380)={r0}) bind$xdp(r5, &(0x7f0000000080)={0x2d, 0x0, 0x0, 0xa}, 0x10) close(r5) r6 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) syz_usb_connect(0x5, 0x36, &(0x7f0000000a40)=ANY=[@ANYBLOB="12014101afb4f2102505a0a4f12b01fb03010902240001fe00c0000904eb02027f9c1f000905060220000200020905822b"], 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x22052, r6, 0x93774000) 2.694877936s ago: executing program 7 (id=3074): syz_usb_connect(0x1, 0x10b, &(0x7f0000000180)=ANY=[@ANYRES8, @ANYBLOB="5daa660c59da2102a1210e8ce8abd6e57f41ce2d319701b5729bf38093e37c85435b461bc8966741e5bdd8d52b911eeb77c59d7074919792026bbf9cf8a15acb6baad2a88377db6a63bfe713411eb067923846ff0f3aa733ed5f267fb0296bcef011aaf0394493222dd8c987de18e80f230dbcb471350a70baac34416daa34982a388da09b16253ae7382d24370778ecd58450d34725497e37673df2461cb0ec4aa604f14fae60803d53"], 0x0) syz_open_dev$loop(&(0x7f0000000000), 0x8, 0x2180) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$OSF_MSG_ADD(r0, &(0x7f0000000140)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000100)={&(0x7f0000000280)=ANY=[@ANYBLOB="6010000000050102000000000000000005000006540201000100000004000000080301000400230073797a310000000000000000000000000000000000000000000000000000000007d11d64ceebf8390e7a8a4f48bdac15f125aeaf03113573910ba4b0625fe63f872aad6c46a82b6a30e962d1f11344f7f9d5a8aa3dfd3d7887b1ac87b7b43bee0800030003000000080000000700efda030000000900000000100300020000000101000007000400000000000700000000000400010000008272000006000e460100000002000000ff070700010000000900000002000700010000000200000000080010000000000180ffff090d0200000000000000008005005307010000000200000002000500020000007a00000004000700030000000a00000001007b86010000007f00000005000100000000000800000002000800020000000000000000000500010000005300000007000700020000000100000003000400020000000200000002000100030000000400000003000a00000000009401000000040010020000000100008002000100010000000b00000003000500010000000f000000050001000000000002000000000010000100000007000000f7ff000402000000030000000400080000000000aaac00000400800002000000100000000600ab00020000000000000004000800010000000600000071150900000000000400000010904b8e02000000070000000001ff000000000073ffffff0300020002000000090000000200dc8e0000000002000000010015af02000000040000007f00080001000000ce0a000005000e000100000006000000ffff0100b101e86c368fa02d54020100020000000500000001ee80001000140073797a310000000000000000000000000000000000000000000000000000000020877cf3277281cd9f612841a50e139e633ed4d75f8179380d8144cd7511a9c4ccd9dc8ad05e95795271dbeeca9caa4c0989050ca474ae065a6712cd0014aec58902590002000000000000000400000002000000030000000200ff0003000000b40100000800050002000000000000804b0006000100000009000000060006000300000002000000af00001001000000090000000700001003000000ff010000324c0900000000000b0000006a003a000100000027030000070000000300000002000000050002000100000010000000020000800000000005000000060003000200000004000000400003000100000009000000b30f00000200000005000000cac0100003000000000000006606060000000000cb16562444fd800000000000090000000400010001000000640a00000600070000000000ffff000000800000000000000c00000083000f00020000004002000081004c00020000007083000001f8020001000000000000800100e6280300000000000000c8005e0e02000000100000000b00040003000000030000000900060003000000040000000000001000000000060000007f00050003000000010000000800010000000000460500000500060002000000cf38000081000200020000000d0000000000080002000000030000000400050003000000030000000000090001000000ff01000080000a000300000002000000010007000300000007000000feffcd3c0000000009000000540201000000000040000000050602000900190073797a3000000000000000000000000000000000000000000000000000000000e3c9ef5af1583189a612089dafe1ee3aa7f59d3b665d21d39b287af39b075cfff5be21eac112480741f9109923a362e27754bf225f2caff0e07da9801271c6900008ff00010000001000000008000000010000000800000002000c0001000000080000000600060001000000000800000b00030000000000090000000500000801000000ffffffffe0000200010000005d01bd577f0001ff00000000090000000000070401000000000000800407faff0100000005000000fbff010002000000aa16000037ae080003000000070000000600004002000000018000000000ff0f02000000050000000500150f03000000bf0f0000008a0002010000000200000000003c0003000000ff0100006403060002000000000000000500eae503000000080000000200050002000000fdffffff010009000300000000000000ffff030000000000090000000200070003000000c600000006000800000000000800000007008c00020000008f00000002000002000000000010000008000200010000000500000003008100010000000700000007000800010000000100000033000700020000000002000000000800030000000010000000000100020000000000000080060002020000000f0000000600fbff00000000070000000600020000000000070000000f000101030000000600000002000a0003000000080000004000200002000000090000000900000000000000020000000400000000000000030000005402010002000000030000000008070008001f0073797a3000000000000000000000000000000000000000000000000000000000050cc68ead81f6bdf60597765f994c282f42b113de88e06555cad307b965b4eaf366487eace1f48918b88660bb567dd1dd238d9da0c502309a155625f7d7b5e4010004000000000000020000060003000300000002000000030001000000000099fdffff0000770000000000090000000300060002000000080000004000feff02000000000000005573050002000000080000000700000000000000010000800600080003000000ffffffff0400faff00000000000000000100080001000000000000000000080003000000ff07000000000f000100000001800000030005000200000089a16e090600090001000000ff070000587e080002000000ffffff7f00080600030000004000000085ff070002000000040000000500080003000000060000000000010b000000004000000002002f0b03000000ff000000160d02000300000004000000070001800000000070c7000062f308000200000000000000070004000000000007000000faff510b02000000000000000900010002000000ff0300000000060003000000ffffff7f0600010001000000080000005ecf00080300000002000000050002000100000009000000040007000300000002000000050001000200000008000000070008000300000004000000050004000200000007000000ff7f000001000000ff0100000180080000000000030000000200020000000000090000000700ff000000000008000000cf0909000200000005000000540201000200000080884637014600000900000000007a3100000000000000000000000000000000000000000000000000000000937c88f36d0de09132bf53ad0506e1b84a07e6b96bd3d26d12fd98d7ed5195e8d70219f5df501d4ff721ae677f8f12759f14e76a9d2594b65db60104fdff02000000a344000005000008000000000800000000f08f05030000000400000001000000030000002208000000100500020000000200000004001c00030000000500000001000100030000009d0a0000040007000000000000000000be000800020000000600000000000300030000000f000000ffff020002000000090000000b00070003000000070000000000faff030000008000000007009cee02000000050000000d000000010000000a00000000000300020000000100000003000700474403be660000000080080002000000e00000000100050003000000050000007f007baf000000000d0000000010130000000000070000000600ffff00000000010001009300090000000000323000000600800201000000090000007f00e5000200000003000000c501020003000000060000000600010003000000cb000000ff070800000000007043ffff0100ff0000000000010000000000ff00030000000700000001004a0301000000feffffff000a0b0003000000370c1b67050005000000000001000000ffff5a06010000007f0000000500000000000000010000000100780b03000000ff000000dc800400020000000600000006000d00020000000900000002000500000000000900000006000000020000000700000054020100000000000300000009f803178000200073797a31000000000000000000000000000000000000000000000000000000004f997d0304dce382eea23fb20700903b48a87f9b8c476b4fab364bc1d5c69401d5cafb4c2e54cf20fe07c4426f52ab25ad12ff1046eba931a4bcba125f9502d80a0009000000000024000000050001800100000000000000020004000200000008000000a800bf0003000000020000000200050003000000080000000500000000000000ff010000008003000300000000800000ff0304000000000008000000050001000100000006000000213769bf030000000100000066ec040002000000010000000000010001000000080000007900fdff0100000006000000800002000200000005000000ff07020003000000006000000600080001000000040000000800c00002000000dfaf00008b005c00000000000100000000080180020000000800000003000e0003000000040000000400070000000000f1d438160080ff07030000000900000003000200000000002d0000000200080003000000ff0100000010f7ff0000000000ffffff0800ff0f0000000005000000080008000300000004000000000200000200000000000000ff7f000000000000537700000e0000101d2250bfd20e0000090002000300000000000000cf00020000000000070000000200030003000000ff7f0000030008000100000003000000881e060003000000070000000100f8ff01000000030000004a08830001000000020000000104060c030000007c000000f300f7ff02000000070000000100000000000000050000005402010003000000000000200b04040075061d0073797a3000000000000000000000000000000000000000000000000000000000341a53b7f74793daec2c079d83709b4a974ad7ca87b89cf21e22c4c2d593fd07f3225a3c7e7d72a2b4b612df90618a6da1773d1a184e8f3ff1a118100485f48309000200020000000800000000100e0002000000020000001000080002000000bf0000000300002000000000fcffffff0100fcff01000000ff0f00000500d507000000003b6c0000050002000000000000000000f9ff0400a9c40e6efef8ffff3b780700050000000600000065000200030000006c0000001c0d0d0000000000060000000800ff0f0200000081000000080008000200000007000000ffff04000000000002000000ff030000030000000400000001000300000000000100000004000800010000007f00000001005d2e03000000090000000300050002000000020000002506070002000000a10100000600000000000000090000000300000001000000020000000200e231000000000600000005000800010000000600000008000104020000000000000002000101030000000500000003000000020000000d0000000101030001000000f3ffffffbb0000020000000005000000070003000100000000100000ffff5d0d0200000002000000f9ffff010300000044050000230003000100000007000000540b0900030000000500000008000500010000001fae0000080003000300000003000000f8ff050002000000050000000700800101000000ffffffff0004070002000000fcffffff8233060002000000feffffff"], 0x1060}, 0x1, 0x0, 0x0, 0x80}, 0x4000001) r1 = syz_open_dev$loop(&(0x7f0000001300), 0x5, 0x200481) ioctl$LOOP_SET_BLOCK_SIZE(r1, 0x4c09, 0xfffffffffffffc01) (async) ioctl$LOOP_SET_BLOCK_SIZE(r1, 0x4c09, 0xfffffffffffffc01) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) (async) r3 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SG_IO(r3, 0x2285, 0x0) fcntl$dupfd(r3, 0x0, r3) (async) r4 = fcntl$dupfd(r3, 0x0, r3) write$sndseq(r4, &(0x7f0000000180)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @raw32}, {0x0, 0x0, 0x0, 0x0, @time, {}, {}, @quote}], 0x38) write$sndseq(r4, &(0x7f0000000200)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @raw32}, {0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0x0, 0x0}}, {0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time}, {0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @control}, {0x0, 0x0, 0x0, 0x0, @time, {}, {}, @connect}, {0x0, 0x0, 0x0, 0x0, @time, {}, {}, @raw8={"448cc880fe353ca0f2c2e953"}}, {0x0, 0x0, 0x0, 0x0, @time, {}, {}, @connect}], 0xc4) write$sndseq(r4, &(0x7f0000000640)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {0x8}, @ext={0x0, 0x0}}, {0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @addr}, {0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @connect}, {0x0, 0x0, 0x0, 0x0, @time, {}, {}, @raw32}, {0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @connect}, {0x0, 0x0, 0x0, 0x0, @time, {}, {}, @control={0x6, 0x7fff, 0x8}}, {0x0, 0x0, 0x0, 0x0, @time={0xffffff81}, {}, {}, @time=@time}], 0xc4) write$sndseq(r4, &(0x7f0000002840)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @raw32}, {0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @control}, {0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @addr}], 0x54) write$sndseq(r4, &(0x7f0000000300)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @result}, {0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @raw32}, {0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @queue}, {0x0, 0x0, 0x0, 0x0, @time, {}, {}, @ext={0x0, 0x0}}, {0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time}, {0x0, 0x0, 0x0, 0x0, @time, {}, {}, @connect}, {0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @control}], 0xc4) setuid(0xee01) (async) setuid(0xee01) keyctl$session_to_parent(0x12) (async) keyctl$session_to_parent(0x12) fchmod(r2, 0x0) mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='msdos\x00', 0x200000, 0x0) (async) mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='msdos\x00', 0x200000, 0x0) 2.296877044s ago: executing program 8 (id=3075): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) unshare(0x22020600) ioctl$sock_ifreq(r2, 0x8990, &(0x7f0000000180)={'bond0\x00', @ifru_names='rose0\x00'}) unshare(0x40300) ioctl$KVM_SET_IRQCHIP(r1, 0x4048aec9, &(0x7f0000000380)={0x3, 0x0, @ioapic={0x2, 0x2, 0x101, 0x5, 0x0, [{0xd, 0x9, 0x6, '\x00', 0x1}, {0x6, 0x2, 0x26, '\x00', 0xfc}, {0x2, 0xef, 0xd, '\x00', 0xee}, {0xfb, 0x7, 0xd}, {0x13, 0x9, 0x2, '\x00', 0x62}, {0x0, 0x3, 0x2, '\x00', 0xd3}, {0xf, 0x0, 0x7f, '\x00', 0x4}, {0x9, 0xdb, 0x1}, {0x81, 0x23, 0x5, '\x00', 0x2}, {0xde, 0x20, 0x3}, {0x40, 0x4, 0xf8, '\x00', 0x1}, {0xf5, 0x5, 0x4, '\x00', 0xb5}, {0x7, 0x3, 0x2b, '\x00', 0x6}, {0x4, 0x0, 0x0, '\x00', 0xe9}, {0x10, 0x39, 0x40, '\x00', 0xcf}, {0x6c, 0x3f, 0x0, '\x00', 0x72}, {0x6e, 0x4, 0x4, '\x00', 0xe}, {0x7, 0x2, 0x8, '\x00', 0x7}, {0xf, 0x7, 0x5}, {0x1, 0x6, 0x9}, {0x4, 0x6, 0x1, '\x00', 0x49}, {0xee, 0x2, 0x91, '\x00', 0xba}, {0x2, 0x8, 0x2, '\x00', 0xc3}, {0x8, 0x9, 0x54, '\x00', 0x9}]}}) r3 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x28200, 0x0) personality(0x5400004) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r4 = socket$kcm(0x2d, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r4, 0x89e2, &(0x7f0000000340)={r4}) mmap(&(0x7f0000787000/0x4000)=nil, 0x4000, 0xb, 0x202812, r3, 0x7dfff000) 2.021844933s ago: executing program 8 (id=3077): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_STATS_CPU(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000a80)={0x14, 0x4, 0x1, 0x101, 0x0, 0x0, {0x2, 0x0, 0x7}}, 0x14}, 0x1, 0x0, 0x0, 0x4000040}, 0x14) (async, rerun: 32) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000140), 0x88980, 0x0) (rerun: 32) sigaltstack(&(0x7f0000000000)={0xffffffffffffffff, 0x0, 0xfffffffffffffefa}, &(0x7f0000000080)={&(0x7f0000000040)}) (async) sigaltstack(&(0x7f00000001c0)={0x0, 0x80000000}, 0x0) (async) fadvise64(r1, 0x92, 0x5, 0x2) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000a, 0x22052, r1, 0x5708e000) 1.60725718s ago: executing program 8 (id=3078): sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000035c0)={0x0, 0x0, &(0x7f0000003580)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x1, 0x70bdab, 0x0, {{@in6=@private1={0xfc, 0x1, '\x00', 0x1}, @in6=@empty, 0x0, 0x0, 0x2000, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0xffffffffffffffff}, {@in=@multicast2, 0x4, 0x6c}, @in6=@remote, {0x200000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000000}, {0x5, 0x4, 0xd, 0xa}, {0x0, 0x400}, 0xfffffffc, 0x0, 0xa, 0x1, 0x6}}, 0xf0}}, 0x20000000) socket$netlink(0x10, 0x3, 0x0) (async) r0 = socket$netlink(0x10, 0x3, 0x0) syz_usb_connect(0x5, 0x24, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x50, 0x1a, 0x29, 0x20, 0x17cc, 0x1000, 0xc561, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0x94, 0x2, 0x0, 0x91, 0x85, 0x8d}}]}}]}}, 0x0) sendmsg$netlink(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="1800000076"], 0x1c}], 0x1, 0x0, 0x0, 0x4004000}, 0x0) (async) sendmsg$netlink(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="1800000076"], 0x1c}], 0x1, 0x0, 0x0, 0x4004000}, 0x0) creat(&(0x7f0000000080)='./file0\x00', 0xac) mount(&(0x7f0000000040)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='jfs\x00', 0x8010, 0x0) 1.27886499s ago: executing program 0 (id=3079): r0 = socket(0x22, 0x2, 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f0000000580)={'batadv_slave_0\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r2, 0x890b, &(0x7f00000002c0)={@mcast2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @dev={0xfe, 0x80, '\x00', 0x25}, 0x1, 0x6, 0x0, 0x100, 0x4, 0x540000, r3}) ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f0000000800)={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private2, @private0, 0x1, 0x6, 0x0, 0x100, 0x6, 0x40, r3}) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000400)=ANY=[@ANYBLOB="180100001f00010000000b80000096000601008014000320fc0100000000000000000000140001"], 0x118}], 0x1, 0x0, 0x0, 0x14}, 0x0) faccessat(0xffffffffffffffff, 0x0, 0x3) ioctl$BTRFS_IOC_DEFRAG_RANGE(r1, 0x40309410, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) r4 = creat(&(0x7f0000000080)='./file0\x00', 0xac) mount(&(0x7f0000000180)=@rnullb, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='jfs\x00', 0x8010, 0x0) recvmsg$kcm(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000001c0)=""/243, 0xf3}], 0x1}, 0x22063) write$tun(r4, &(0x7f0000000440)={@void, @val={0x2, 0x2, 0x7fb8, 0x10, 0x9}, @llc={@llc={0x2, 0xf8, 'j', "42e44c84f028e339e4f5cf54d74d4875fc46d99144ef59fb4b05fbd9a706270d6579760bb96e81e87716baebdfd561b6487e4404efa7e832e58cf4ea6ef720a5131ff89f07446e8506d60ef0594d1ae5d658fd175138aacf9847876eb5687b59c7aca1196b2edf4d431ef1a97f50480bb32626fa5344c4f34ada479fcc9cc47eb7d328afcf2dd3643be68e237270850e5025bf8b1dcb991d26027fb8a4383ea3f5d54cc39cf18fcb58f20554e78ea4ad1dc0a6721eeb361d"}}}, 0xc5) ioctl$sock_bt_bnep_BNEPGETCONNLIST(r0, 0x800442d2, &(0x7f0000000100)={0x3, &(0x7f0000000340)=[{}, {0x0, 0x0, 0x0, @link_local}, {0x0, 0x0, 0x0, @dev}]}) 1.269853291s ago: executing program 0 (id=3080): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xd}}, 0x6}, 0x1c) r1 = socket$inet_smc(0x2b, 0x1, 0x0) getsockopt$inet_int(r1, 0x0, 0x14, 0x0, &(0x7f0000000080)) (async) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0x106}, 0x1c) openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x202040, 0x0) sendto$inet6(r0, &(0x7f0000000400)="25eed0aee8c79f49b53c108367401019c41e56367aa3f23916ddf42df6a5ca47adc0f14939ee362a401f6425b5933ed45ac2e4089f33e87ea4fa53cb6f37fa25746f5805cefb6f78a3d525962f72cff39e3fd9074e3260c84fdfced1c00ba3c8cfcd6220a22b568b9ea6d0e366394ae3490b19d046c22e484b0aa11954836b45d4047ab5007b7b758a16f51f05661f02e1cc365db0bf3b54c3c468a8b5462008bc5ffb9db10bed599639774620b78184ada2301d9d494c2c7622d859213c2d7cc96412661b8f8afb818669f98776b43d6f8c598c00e43ade1e0808a35608882523edf4820dc6b1de1a71cb3dcec7265acaaeab264a1082660423eaf763e3d5e6756b9d2e4115906f4284e5e11388dae00c59c49d5bdc02592fbd96f69a586c8e6f36af50d6de76993809225f4a7dfbd1e7feee4438420c40ee1587ef9279cba9847f32d185f2405d680fd8776df5edc7c149279dc808c693dab77ec90071fff6b0b63f5eaadf5e2118dbeebbeb235b90b8b1b871af2ebc579d404578310950526b7be662a9d89be66d6a02522e7352357c02c3a56f8ff816331bd070041ba511613602956381e6d78b645d02dbc77a188168b6312a0998fe17cfd2940c8e5d39e5a95c50f8b0cee4a9c145b23997f830c08fe2e8af162363f4e14d78fd1275af0192483de50d521d85ed5dd21e51e9fba69d7c208ae998c914f5a2393f0594abb1228eb6df78d022707d2e705854e20338e898482ced2d8b853d8cd972bf7d2df97c7fbc2fffb60e9ec9335bf4e98c6d53244dabe2d1d038c75476b620b9263bda96ec2c61f3306dfcfb9f023c3c9678e0ef245b8c3de356f4c4dfe2d791e213b592f8106467517bd0eb3be609108ac41507edb9029c1975fe0c08e461b66b0850a9faf160e658fd770266fa0c70deab155084869592563fe0c136728a2999c6a5d40891a0de089cec58b1ffe2d40e44513b3d51c8c34935b75a351d0d7f9049e6e488585c819437a4e7b338cd5772a744fe79a21327f919ef4bdb9936a5dccd353a45e2642b8cad7aea0152de1d15577c37eff9fc206115e1ed9612183f5aa55ba23b2e2b77432f038b3cc3f0c189414de1402b002ba4464448d74fac86d1ab674a4eb3d8b6e8af11ee37145026fdedb952097fa069ddd516a76c8a647c0faf5a47a75a7294b0eba99291457e4614f0e985bd363de3593590e6f303e511220ce37e1e66711dac26dadaa5f26ab172ef6c7a2f53ed66c0813867e1d53e769efafac557c3977836517f216c53625d8752073fed32346d274613fef1f874d71a632a48220978d6efbf4fb938a46777f05b10cc71d1996772e2536a22b171e2cabffb9099e73026e56210a6162140681048fa9e55388619d83278ea60e5421eaade222b61237aae0d6684f19e090d88da58d0f8e0b4725c41bfc94a5a066d842f768d7ecc527ae2f8ed793ef072da9258db0d11d36637c4765afed52049524efb6feaaa3239dcce104e0889fb10e6a4b7923b4932fecafb1add915f673426c5d6fe7f0290ee8df38763c3737a8bdb4e78b64dd66831440a5dc4e14ccbd14a13f1c513773b9daf0e06cab2bf564b57c8145af47cc64a539fa8326467b318b2e8df6b6c", 0x481, 0x4000, 0x0, 0x0) (async) r2 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) (async) r3 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000080), 0x2) write$binfmt_aout(r3, &(0x7f00000000c0)=ANY=[@ANYBLOB="03040000b500000001008aea0000feff"], 0xc8) sendfile(r0, r2, 0x0, 0x7ffff000) 1.051104062s ago: executing program 9 (id=3081): mount(&(0x7f0000000080)=@rnullb, &(0x7f00000000c0)='./cgroup\x00', &(0x7f0000000040)='hpfs\x00', 0x1082000, 0x0) 950.960368ms ago: executing program 9 (id=3082): r0 = accept4$netrom(0xffffffffffffffff, &(0x7f00000000c0)={{0x3, @netrom}, [@rose, @remote, @null, @null, @remote, @remote, @bcast, @default]}, &(0x7f0000000140)=0x48, 0x80000) fcntl$setstatus(r0, 0x4, 0x0) 936.370523ms ago: executing program 9 (id=3083): r0 = syz_open_dev$cec(&(0x7f0000002340), 0x0, 0x0) ioctl$CEC_S_MODE(r0, 0x40046109, &(0x7f0000000100)=0x22) close(r0) r1 = fsopen(&(0x7f0000000180)='ramfs\x00', 0x0) r2 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000440), 0x10000, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$IPVS_CMD_SET_CONFIG(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000c000000080005"], 0x24}}, 0x0) sendmsg$IPVS_CMD_GET_INFO(r2, &(0x7f0000000600)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000005c0)={&(0x7f00000004c0)={0xe0, r4, 0x400, 0x70bd29, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x91}, @IPVS_CMD_ATTR_SERVICE={0x5c, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x18}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0xa}, @IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'dh\x00'}, @IPVS_SVC_ATTR_FWMARK={0x8}, @IPVS_SVC_ATTR_SCHED_NAME={0x9, 0x6, 'lblc\x00'}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e21}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x4}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@ipv4={'\x00', '\xff\xff', @local}}]}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast2}]}, @IPVS_CMD_ATTR_SERVICE={0x54, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x0, 0x20}}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'fo\x00'}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e23}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@loopback}, @IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x2f}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x80}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7}]}, 0xe0}}, 0x4010) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r5 = fsmount(r1, 0x1, 0x18) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0xfffffe93, 0x0) ioctl$IOC_PR_PREEMPT(r5, 0x401870cb, &(0x7f0000000400)={0x38, 0xffff, 0x4, 0x8}) r6 = open$dir(&(0x7f00000000c0)='./file0\x00', 0x220000, 0x20) symlinkat(&(0x7f0000000000)='.\x00', r6, &(0x7f0000000140)='./file0\x00') sendmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000240)="c980248476a792168877f3d82c2109d56dc3f3025d4540fe1ee8fe23b08f550d47a7313a47220e8265747a0756af1266090693903cb4cb28bad7f86721ec65e5a8961c6072122e430441f5d630da2bb82c5acc342d3fa2061bcdd3337758f0567136e48f75cf52faf8b03ae9eaf053685cf23996aaac20c155200536d5e98b1db3a45bb777c6d779559307d9b61cb454ad4b9d55db5b922f153b1f9ac82cd0a81139de819393667b602c0fe36b7b3d84b212f238b23e0793439d35a7", 0xbc}], 0x1}, 0x8000) r7 = syz_usb_connect(0x5, 0x36, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000014da2108ab12a390eb1e000000010902240001b30000040904410017ff5d810009050f1f01040000000905830300b3"], 0x0) syz_usb_ep_write$ath9k_ep2(r7, 0x83, 0x8, &(0x7f00000000c0)=ANY=[]) openat2(r5, &(0x7f00000003c0)='./file0/../file0\x00', &(0x7f0000000380)={0x100, 0x0, 0x8}, 0x18) creat(&(0x7f0000001380)='./file0\x00', 0x4) mount(&(0x7f0000000000)=@rnullb, &(0x7f0000001440)='./file0\x00', &(0x7f0000000040)='ext4\x00', 0x8000, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000340)={0x4, &(0x7f0000000300)=[{0x200, 0xa6, 0x0, 0xa}, {0x40, 0xe1, 0xe, 0xbb45}, {0xbc1, 0x3, 0x8, 0x3}, {0x7, 0x8, 0x6, 0x5}]}) 357.665241ms ago: executing program 0 (id=3084): openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) (async) r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) r1 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000040)='/dev/comedi4\x00', 0x181001, 0x0) ioctl$COMEDI_INSN(r1, 0x8028640c, &(0x7f0000000080)={0xc000003, 0xf, &(0x7f0000000580)=[0x7d2, 0x8004, 0x1, 0xffff, 0x9, 0x1ed, 0x2, 0x3, 0xbb, 0x7, 0x2070, 0xfec, 0xfffffff7, 0x1ac, 0xfffffff8], 0x0, 0x4}) (async) ioctl$COMEDI_INSN(r1, 0x8028640c, &(0x7f0000000080)={0xc000003, 0xf, &(0x7f0000000580)=[0x7d2, 0x8004, 0x1, 0xffff, 0x9, 0x1ed, 0x2, 0x3, 0xbb, 0x7, 0x2070, 0xfec, 0xfffffff7, 0x1ac, 0xfffffff8], 0x0, 0x4}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x20011, r0, 0x8e629000) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x20011, r0, 0x8e629000) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r2 = syz_open_procfs(0x0, 0x0) r3 = socket(0x2b, 0x80801, 0x1) setsockopt$WPAN_SECURITY_LEVEL(r3, 0x0, 0x2, &(0x7f0000000140)=0x2, 0x4) getsockopt$WPAN_SECURITY_LEVEL(r3, 0x0, 0x2, 0x0, &(0x7f0000000280)) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x1c3042, 0x0) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) getdents64(r2, 0x0, 0x0) r5 = syz_open_dev$cec(&(0x7f0000000180), 0x0, 0x0) ioctl$CEC_DQEVENT(r5, 0x541b, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) (async) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) (async) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) 266.894879ms ago: executing program 8 (id=3085): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x68, &(0x7f0000000080)=0xa40, 0x4) shmget$private(0x0, 0x4000, 0x102, &(0x7f0000ffc000/0x4000)=nil) munmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000) creat(&(0x7f0000000140)='./file0\x00', 0x71) mount(&(0x7f0000000180)=@rnullb, &(0x7f0000001440)='./file0\x00', &(0x7f0000000000)='hfsplus\x00', 0x208083, 0x0) 208.677442ms ago: executing program 8 (id=3086): r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.net/syz1\x00', 0x200002, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f00000001c0)='freezer.state\x00', 0x275a, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0x32600) ioctl$TUNSETVNETHDRSZ(r1, 0x400454d8, &(0x7f0000000340)=0x77) (async) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0) (async) ioctl$SG_SET_FORCE_PACK_ID(r1, 0x227b, &(0x7f0000000080)) (async) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r2, 0x84, 0x10, &(0x7f0000000180)=@sack_info={0x0, 0x0, 0x8}, 0xc) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000200)={0x3, 0x7, 0xd, 0x0, 0x0}) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x4, 0x11, r3, 0x100000000) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f00000000c0)={r4}) (async) r5 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) ioctl$FS_IOC_SETFLAGS(r5, 0x40086602, &(0x7f0000000000)=0x20) (async) link(&(0x7f00000001c0)='./file1\x00', &(0x7f0000000240)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') r6 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000140), 0x88980, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000a, 0x22052, r6, 0x5708e000) 188.939493ms ago: executing program 0 (id=3087): mount(&(0x7f0000000080)=@nullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f00000000c0)='fuseblk\x00', 0xb30d2, 0x0) 62.880094ms ago: executing program 0 (id=3088): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x2a280, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000080), 0x47ffffa, 0x62800) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x5, 0x12, r1, 0x0) preadv(r0, &(0x7f0000000080)=[{&(0x7f0000000280)=""/212, 0xfffffed3}], 0x1, 0xffeffffb, 0x1007) 0s ago: executing program 0 (id=3089): creat(&(0x7f0000000140)='./file0\x00', 0x71) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = dup(r0) write$UHID_INPUT(r1, &(0x7f0000004000)={0xf, {"a2e3ad21ed0d09f91b5b090987f70906d038e7ff7fc6e5539b0d3d0e8b089b39326d07060890e0878f0e1ac6e7049b334a959b3e9a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31070b07580936cd3b78130daa61d8e8040000005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383701d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b6080000007a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb06ffc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb15da202d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0x1000}}, 0x1006) mount(&(0x7f0000000180)=@md0, &(0x7f0000001440)='./file0\x00', &(0x7f0000000000)='autofs\x00', 0x308003, 0x0) creat(&(0x7f0000000140)='./file0\x00', 0x71) (async) syz_open_dev$tty1(0xc, 0x4, 0x1) (async) dup(r0) (async) write$UHID_INPUT(r1, &(0x7f0000004000)={0xf, {"a2e3ad21ed0d09f91b5b090987f70906d038e7ff7fc6e5539b0d3d0e8b089b39326d07060890e0878f0e1ac6e7049b334a959b3e9a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31070b07580936cd3b78130daa61d8e8040000005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383701d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b6080000007a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb06ffc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb15da202d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0x1000}}, 0x1006) (async) mount(&(0x7f0000000180)=@md0, &(0x7f0000001440)='./file0\x00', &(0x7f0000000000)='autofs\x00', 0x308003, 0x0) (async) kernel console output (not intermixed with test programs): USB device number 2 using dummy_hcd [ 588.700699][ T5904] usb 10-1: not running at top speed; connect to a high speed hub [ 588.713276][ T5904] usb 10-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 588.766237][ T5904] usb 10-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 588.827822][ T5904] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 588.850042][ T5904] usb 10-1: Product: syz [ 588.861156][ T5904] usb 10-1: Manufacturer: syz [ 588.879148][ T5904] usb 10-1: SerialNumber: syz [ 588.908593][T15082] raw-gadget.0 gadget.9: fail, usb_ep_enable returned -22 [ 588.937376][ T9506] syz_tun (unregistering): left allmulticast mode [ 588.949768][ T5167] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 588.960987][ T5167] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 588.969773][ T5167] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 588.998326][ T5167] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 589.017978][ T5167] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 589.796530][ T5904] cdc_ncm 10-1:1.0: bind() failure [ 589.828788][ T5904] cdc_ncm 10-1:1.1: CDC Union missing and no IAD found [ 589.867363][ T5904] cdc_ncm 10-1:1.1: bind() failure [ 589.934113][ T5904] usb 10-1: USB disconnect, device number 2 [ 590.212956][ T60] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 590.303406][T15110] fuse: Unknown parameter 'g' [ 590.618251][ T60] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 590.725533][ T30] audit: type=1800 audit(1754179758.036:131): pid=15125 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.9.2379" name="file1" dev="overlay" ino=42 res=0 errno=0 [ 590.777945][T15118] IPVS: Scheduler module ip_vs_sip not found [ 590.838936][ T60] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 590.886581][T15092] chnl_net:caif_netlink_parms(): no params data found [ 591.013481][ T60] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 591.064638][ T5167] Bluetooth: hci1: command tx timeout [ 591.345845][T15144] /dev/rnullb0: Can't open blockdev [ 591.505016][T15092] bridge0: port 1(bridge_slave_0) entered blocking state [ 591.517831][T15092] bridge0: port 1(bridge_slave_0) entered disabled state [ 591.527177][T15092] bridge_slave_0: entered allmulticast mode [ 591.535507][T15092] bridge_slave_0: entered promiscuous mode [ 591.547757][T15147] /dev/rnullb0: Can't open blockdev [ 591.576907][T15092] bridge0: port 2(bridge_slave_1) entered blocking state [ 591.584410][T15092] bridge0: port 2(bridge_slave_1) entered disabled state [ 591.594599][T15092] bridge_slave_1: entered allmulticast mode [ 591.604563][T15092] bridge_slave_1: entered promiscuous mode [ 591.781273][T15092] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 591.823462][T15151] MTD: Attempt to mount non-MTD device "/dev/rnullb0" [ 591.831395][T15092] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 591.846686][T15151] /dev/rnullb0: Can't open blockdev [ 591.854900][ T60] bridge0: port 3(team0) entered disabled state [ 591.910694][ T60] bridge_slave_1: left allmulticast mode [ 591.933741][ T60] bridge_slave_1: left promiscuous mode [ 591.949233][ T60] bridge0: port 2(bridge_slave_1) entered disabled state [ 591.971061][T15156] loop2: detected capacity change from 0 to 7 [ 591.980605][T13132] Dev loop2: unable to read RDB block 7 [ 591.989121][T13132] loop2: unable to read partition table [ 591.996386][T13132] loop2: partition table beyond EOD, truncated [ 592.015704][T15156] Dev loop2: unable to read RDB block 7 [ 592.021352][T15156] loop2: unable to read partition table [ 592.039039][ T60] bridge_slave_0: left allmulticast mode [ 592.047862][ T60] bridge_slave_0: left promiscuous mode [ 592.062874][ T60] bridge0: port 1(bridge_slave_0) entered disabled state [ 592.073191][T15156] loop2: partition table beyond EOD, truncated [ 592.111457][T15156] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 592.333779][ T5919] usb 9-1: new high-speed USB device number 8 using dummy_hcd [ 592.496380][ T5919] usb 9-1: Using ep0 maxpacket: 16 [ 592.524222][ T5919] usb 9-1: config 0 has an invalid interface number: 53 but max is 0 [ 592.532453][ T5919] usb 9-1: config 0 has no interface number 0 [ 592.550731][ T5919] usb 9-1: New USB device found, idVendor=03fd, idProduct=ebbe, bcdDevice=ed.e2 [ 592.573582][ T5919] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 592.581634][ T5919] usb 9-1: Product: syz [ 592.604603][ T5919] usb 9-1: Manufacturer: syz [ 592.610359][ T5919] usb 9-1: SerialNumber: syz [ 592.645317][ T5919] usb 9-1: config 0 descriptor?? [ 592.862752][T15160] netlink: 8 bytes leftover after parsing attributes in process `syz.8.2386'. [ 592.991251][ T60] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 593.015441][ T60] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 593.033267][ T60] bond0 (unregistering): Released all slaves [ 593.095973][T15160] netlink: 33 bytes leftover after parsing attributes in process `syz.8.2386'. [ 593.113270][T15160] netlink: 33 bytes leftover after parsing attributes in process `syz.8.2386'. [ 593.138619][ T5846] usb 9-1: USB disconnect, device number 8 [ 593.145036][ T5167] Bluetooth: hci1: command tx timeout [ 593.230282][T15092] team0: Port device team_slave_0 added [ 593.284647][T15092] team0: Port device team_slave_1 added [ 593.503027][T15092] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 593.513752][T15092] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 593.541137][T15092] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 593.584195][T15092] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 593.597581][T15092] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 593.636038][T15092] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 593.741719][ T5896] usb 10-1: new full-speed USB device number 3 using dummy_hcd [ 593.798756][ T30] audit: type=1326 audit(1754179761.106:132): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15187 comm="syz.8.2391" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f6a0918eb69 code=0x0 [ 593.876528][T15186] block nbd7: NBD_DISCONNECT [ 593.888281][T15186] block nbd7: Send disconnect failed -22 [ 593.912247][ T5896] usb 10-1: unable to get BOS descriptor or descriptor too short [ 593.934483][ T5896] usb 10-1: not running at top speed; connect to a high speed hub [ 593.951112][ T5896] usb 10-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 593.971223][ T5896] usb 10-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 593.990345][T15092] hsr_slave_0: entered promiscuous mode [ 594.008405][ T5896] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 594.015507][T15092] hsr_slave_1: entered promiscuous mode [ 594.024614][T15092] debugfs: 'hsr0' already exists in 'hsr' [ 594.031320][ T5896] usb 10-1: Product: syz [ 594.036375][T15092] Cannot create hsr debugfs directory [ 594.041905][ T5896] usb 10-1: Manufacturer: syz [ 594.053133][ T5896] usb 10-1: SerialNumber: syz [ 594.058647][ T60] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 594.074000][T15181] raw-gadget.1 gadget.9: fail, usb_ep_enable returned -22 [ 594.083126][ T60] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 594.094942][ T60] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 594.102487][ T60] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 594.132287][ T60] veth1_macvtap: left promiscuous mode [ 594.138348][ T60] veth0_macvtap: left promiscuous mode [ 594.144260][ T60] veth1_vlan: left promiscuous mode [ 594.150552][ T60] veth0_vlan: left promiscuous mode [ 594.301067][T15181] netlink: 8 bytes leftover after parsing attributes in process `syz.9.2389'. [ 594.630952][T15185] block nbd7: Disconnected due to user request. [ 594.644187][T15185] block nbd7: shutting down sockets [ 594.979001][T15210] loop2: detected capacity change from 0 to 7 [ 595.012041][T15210] Dev loop2: unable to read RDB block 7 [ 595.026848][T15210] loop2: unable to read partition table [ 595.037202][T15210] loop2: partition table beyond EOD, truncated [ 595.048382][T15210] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 595.225044][ T5167] Bluetooth: hci1: command tx timeout [ 595.246640][T15217] netlink: 'syz.8.2395': attribute type 83 has an invalid length. [ 595.403999][ T60] team_slave_1 (unregistering): left promiscuous mode [ 595.404567][T15219] netlink: 328 bytes leftover after parsing attributes in process `syz.8.2396'. [ 595.413029][ T60] team_slave_1 (unregistering): left allmulticast mode [ 595.431857][ T60] team0 (unregistering): Port device team_slave_1 removed [ 595.479100][ T60] team_slave_0 (unregistering): left promiscuous mode [ 595.486249][ T60] team_slave_0 (unregistering): left allmulticast mode [ 595.494909][ T60] team0 (unregistering): Port device team_slave_0 removed [ 596.828551][T15247] loop2: detected capacity change from 0 to 7 [ 596.870146][ T5896] cdc_ncm 10-1:1.0: CDC Union missing and no IAD found [ 596.888242][T13037] Dev loop2: unable to read RDB block 7 [ 596.899893][T13037] loop2: unable to read partition table [ 596.906960][ T5896] cdc_ncm 10-1:1.0: bind() failure [ 596.930819][ T60] IPVS: stop unused estimator thread 0... [ 596.936704][T13037] loop2: partition table beyond EOD, truncated [ 596.948030][T15247] Dev loop2: unable to read RDB block 7 [ 596.957925][ T5896] cdc_ncm 10-1:1.1: CDC Union missing and no IAD found [ 596.965815][T15247] loop2: unable to read partition table [ 596.981497][T15247] loop2: partition table beyond EOD, truncated [ 597.002631][ T5896] cdc_ncm 10-1:1.1: bind() failure [ 597.018978][T15247] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 597.059093][ T5896] usb 10-1: USB disconnect, device number 3 [ 597.264859][T15255] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 597.303811][ T5167] Bluetooth: hci1: command tx timeout [ 597.472702][ T5896] usb 10-1: new high-speed USB device number 4 using dummy_hcd [ 597.682394][ T5896] usb 10-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 597.721247][ T5896] usb 10-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 597.735898][T15092] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 597.759219][ T5896] usb 10-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 597.773191][T15092] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 597.781252][ T5896] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 597.794994][ T5896] usb 10-1: Product: syz [ 597.801137][T15092] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 597.808330][ T5896] usb 10-1: Manufacturer: syz [ 597.816526][ T5896] usb 10-1: SerialNumber: syz [ 597.829977][T15092] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 598.169046][T15092] 8021q: adding VLAN 0 to HW filter on device bond0 [ 598.234114][T15092] 8021q: adding VLAN 0 to HW filter on device team0 [ 598.276992][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 598.284217][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 598.341430][T11423] bridge0: port 2(bridge_slave_1) entered blocking state [ 598.348657][T11423] bridge0: port 2(bridge_slave_1) entered forwarding state [ 598.892710][ T5896] cdc_ncm 10-1:1.0: bind() failure [ 598.913320][ T5896] cdc_ncm 10-1:1.1: CDC Union missing and no IAD found [ 598.943794][ T5896] cdc_ncm 10-1:1.1: bind() failure [ 598.959871][T15307] netlink: 28 bytes leftover after parsing attributes in process `syz.7.2413'. [ 599.017219][T15092] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 599.109686][T15250] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 599.120003][T15092] veth0_vlan: entered promiscuous mode [ 599.138458][T15250] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 599.142466][T15092] veth1_vlan: entered promiscuous mode [ 599.235112][T15092] veth0_macvtap: entered promiscuous mode [ 599.268311][T15092] veth1_macvtap: entered promiscuous mode [ 599.345388][T15092] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 599.366557][T15092] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 599.390205][T15313] fuse: Bad value for 'fd' [ 599.411922][ T12] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 599.488439][ T12] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 599.506206][ T12] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 599.563592][ T12] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 599.708533][ T1086] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 599.731591][ T1086] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 599.881772][ T5887] usb 10-1: USB disconnect, device number 4 [ 599.907930][ T60] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 599.932448][ T60] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 600.091024][T15331] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2371'. [ 600.676489][ T30] audit: type=1800 audit(1754179767.966:133): pid=15342 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=set_data cause=unavailable-hash-algorithm comm="syz.2.2417" name="/" dev="pipefs" ino=55987 res=0 errno=0 [ 602.518147][ T5887] usb 3-1: new full-speed USB device number 111 using dummy_hcd [ 602.603697][T15230] usb 10-1: new high-speed USB device number 5 using dummy_hcd [ 602.685543][ T5887] usb 3-1: config 202 has an invalid interface number: 113 but max is 0 [ 602.708986][ T5887] usb 3-1: config 202 has no interface number 0 [ 602.723603][ T5887] usb 3-1: config 202 interface 113 has no altsetting 0 [ 602.744695][ T5887] usb 3-1: New USB device found, idVendor=1286, idProduct=2046, bcdDevice=7e.5f [ 602.764997][T15230] usb 10-1: Using ep0 maxpacket: 16 [ 602.765691][ T5887] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 602.772374][T15230] usb 10-1: config 0 has an invalid interface number: 174 but max is 0 [ 602.797563][T15230] usb 10-1: config 0 has no interface number 0 [ 602.808694][ T5887] usb 3-1: Product: syz [ 602.812910][ T5887] usb 3-1: Manufacturer: syz [ 602.815532][T15230] usb 10-1: New USB device found, idVendor=0b05, idProduct=171f, bcdDevice=ec.b2 [ 602.819763][ T5887] usb 3-1: SerialNumber: syz [ 602.827726][T15230] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 602.854190][T15230] usb 10-1: Product: syz [ 602.863942][T15230] usb 10-1: Manufacturer: syz [ 602.871009][T15230] usb 10-1: SerialNumber: syz [ 602.887479][T15230] usb 10-1: config 0 descriptor?? [ 603.106422][T15230] dvb-usb: found a 'ASUS My Cinema U3000 Mini DVBT Tuner' in warm state. [ 603.150962][T15230] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 603.168152][T15230] dvbdev: DVB: registering new adapter (ASUS My Cinema U3000 Mini DVBT Tuner) [ 603.207839][T15230] usb 10-1: media controller created [ 603.311357][T15230] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 603.337335][ T5887] usb 3-1: NFC: intf ffff8880591e1000 id ffffffff8ef668e0 [ 603.362491][T15436] loop2: detected capacity change from 0 to 7 [ 603.369751][ T5887] usb 3-1: USB disconnect, device number 111 [ 603.403849][T15436] Dev loop2: unable to read RDB block 7 [ 603.409488][T15436] loop2: unable to read partition table [ 603.443962][T15436] loop2: partition table beyond EOD, truncated [ 603.452132][T15436] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 603.616663][T15230] DVB: Unable to find symbol dib7000p_attach() [ 603.622893][T15230] dvb-usb: no frontend was attached by 'ASUS My Cinema U3000 Mini DVBT Tuner' [ 603.737328][T15446] netlink: 8 bytes leftover after parsing attributes in process `syz.7.2435'. [ 603.793676][T15230] rc_core: IR keymap rc-dib0700-rc5 not found [ 603.799815][T15230] Registered IR keymap rc-empty [ 603.821739][T15230] dvb-usb: could not initialize remote control. [ 603.834060][T15230] dvb-usb: ASUS My Cinema U3000 Mini DVBT Tuner successfully initialized and connected. [ 603.903607][T15230] usb 10-1: USB disconnect, device number 5 [ 604.005339][T15230] dvb-usb: ASUS My Cinema U3000 Mini DVBT Tuner successfully deinitialized and disconnected. [ 604.006900][T15446] netdevsim netdevsim7 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 604.346002][T15459] netlink: 37 bytes leftover after parsing attributes in process `syz.9.2438'. [ 604.378051][T15462] /dev/rnullb0: Can't open blockdev [ 604.489740][T15446] netdevsim netdevsim7 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 604.850928][T15446] netdevsim netdevsim7 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 604.971487][T15475] /dev/rnullb0: Can't open blockdev [ 605.092894][T15446] netdevsim netdevsim7 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 605.246673][T15485] /dev/rnullb0: Can't open blockdev [ 605.329492][ T30] audit: type=1800 audit(1754179772.636:134): pid=15489 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.2445" name="file1" dev="overlay" ino=61 res=0 errno=0 [ 605.362595][ T36] netdevsim netdevsim7 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 605.429296][ T12] netdevsim netdevsim7 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 605.532906][ T12] netdevsim netdevsim7 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 605.607775][ T12] netdevsim netdevsim7 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 605.764143][ T5846] usb 3-1: new high-speed USB device number 112 using dummy_hcd [ 605.822723][T15504] netlink: 8 bytes leftover after parsing attributes in process `syz.9.2448'. [ 605.838560][T15504] netlink: 8 bytes leftover after parsing attributes in process `syz.9.2448'. [ 605.909367][ T5846] usb 3-1: device descriptor read/64, error -71 [ 606.117891][T15513] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 606.175936][ T5846] usb 3-1: new high-speed USB device number 113 using dummy_hcd [ 606.346840][T15518] netlink: 65051 bytes leftover after parsing attributes in process `syz.8.2451'. [ 606.357041][ T5846] usb 3-1: device descriptor read/64, error -71 [ 606.464215][ T5846] usb usb3-port1: attempt power cycle [ 606.736399][ T30] audit: type=1800 audit(1754179774.046:135): pid=15533 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.9.2454" name="file1" dev="overlay" ino=136 res=0 errno=0 [ 606.824158][ T5846] usb 3-1: new high-speed USB device number 114 using dummy_hcd [ 606.893848][ T5846] usb 3-1: device descriptor read/8, error -71 [ 607.135434][ T5846] usb 3-1: new high-speed USB device number 115 using dummy_hcd [ 607.184342][ T5846] usb 3-1: device descriptor read/8, error -71 [ 607.222321][T15547] loop2: detected capacity change from 0 to 7 [ 607.238728][T13132] Dev loop2: unable to read RDB block 7 [ 607.245046][T13132] loop2: unable to read partition table [ 607.250977][T13132] loop2: partition table beyond EOD, truncated [ 607.284586][T15547] Dev loop2: unable to read RDB block 7 [ 607.298327][T15547] loop2: unable to read partition table [ 607.304395][ T5846] usb usb3-port1: unable to enumerate USB device [ 607.333836][T15547] loop2: partition table beyond EOD, truncated [ 607.362325][T15547] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 607.402136][T15553] netlink: 8 bytes leftover after parsing attributes in process `syz.7.2460'. [ 607.645531][T15566] tc_dump_action: action bad kind [ 607.835415][T15173] usb 9-1: new high-speed USB device number 9 using dummy_hcd [ 607.891789][ T30] audit: type=1326 audit(1754179775.196:136): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15574 comm="syz.7.2465" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f96dc78eb69 code=0x0 [ 607.949962][ T30] audit: type=1800 audit(1754179775.196:137): pid=15576 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.9.2464" name="file1" dev="overlay" ino=168 res=0 errno=0 [ 608.044924][T15173] usb 9-1: config 17 has an invalid descriptor of length 222, skipping remainder of the config [ 608.062329][T15173] usb 9-1: config 17 interface 0 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 608.078667][T15173] usb 9-1: config 17 interface 0 has no altsetting 0 [ 608.088327][T15173] usb 9-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 608.099978][T15173] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 608.108201][T15173] usb 9-1: Product: syz [ 608.116652][T15173] usb 9-1: Manufacturer: syz [ 608.121765][T15173] usb 9-1: SerialNumber: syz [ 608.365107][ T5887] usb 10-1: new high-speed USB device number 6 using dummy_hcd [ 608.524127][ T5887] usb 10-1: Using ep0 maxpacket: 8 [ 608.543086][ T5887] usb 10-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 608.572116][ T5887] usb 10-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 608.601449][ T5887] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 608.610742][ T5887] usb 10-1: Product: syz [ 608.619005][ T5887] usb 10-1: Manufacturer: syz [ 608.625254][ T5887] usb 10-1: SerialNumber: syz [ 608.645967][ T5887] usb 10-1: config 0 descriptor?? [ 608.669927][ T5887] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 609.041957][T15173] IPVS: starting estimator thread 0... [ 609.153699][T15610] IPVS: using max 23 ests per chain, 55200 per kthread [ 609.191796][T15598] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 609.203346][T15598] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 609.304640][T15173] usb 3-1: new high-speed USB device number 116 using dummy_hcd [ 609.484116][T15173] usb 3-1: Using ep0 maxpacket: 8 [ 609.496492][T15173] usb 3-1: config 0 has no interfaces? [ 609.506354][T15173] usb 3-1: New USB device found, idVendor=10c4, idProduct=8244, bcdDevice=dc.00 [ 609.516608][T15173] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 609.524865][T15173] usb 3-1: Product: syz [ 609.529231][T15173] usb 3-1: Manufacturer: syz [ 609.534005][T15173] usb 3-1: SerialNumber: syz [ 609.544981][T15173] usb 3-1: config 0 descriptor?? [ 609.764618][ T5846] usb 3-1: USB disconnect, device number 116 [ 610.756384][ T44] usb 9-1: USB disconnect, device number 9 [ 611.870332][T15681] sctp: [Deprecated]: syz.8.2476 (pid 15681) Use of struct sctp_assoc_value in delayed_ack socket option. [ 611.870332][T15681] Use struct sctp_sack_info instead [ 612.282606][ T5887] gspca_zc3xx: i2c_r status error 0e [ 612.503741][ T5887] gspca_zc3xx: reg_r err -71 [ 612.508462][ T5887] gspca_zc3xx 10-1:0.0: probe with driver gspca_zc3xx failed with error -71 [ 612.552957][ T5887] usb 10-1: USB disconnect, device number 6 [ 613.170250][T15715] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 613.475086][ T1682] usb 9-1: new high-speed USB device number 10 using dummy_hcd [ 613.647772][ T1682] usb 9-1: Using ep0 maxpacket: 16 [ 613.671772][ T1682] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 613.704727][ T1682] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 613.732883][ T1682] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 613.779267][ T1682] usb 9-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 613.798696][ T1682] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 613.841315][ T1682] usb 9-1: config 0 descriptor?? [ 613.862283][T15742] /dev/rnullb0: Can't open blockdev [ 614.184904][T15752] MTD: Attempt to mount non-MTD device "/dev/rnullb0" [ 614.192062][T15752] /dev/rnullb0: Can't open blockdev [ 614.223771][ T7457] usb 10-1: new high-speed USB device number 7 using dummy_hcd [ 614.338966][ T1682] microsoft 0003:045E:07DA.001C: hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.8-1/input0 [ 614.381576][ T1682] microsoft 0003:045E:07DA.001C: no inputs found [ 614.390274][ T7457] usb 10-1: config 220 has an invalid interface number: 76 but max is 2 [ 614.417561][ T1682] microsoft 0003:045E:07DA.001C: could not initialize ff, continuing anyway [ 614.421659][ T7457] usb 10-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 614.468083][ T7457] usb 10-1: config 220 has no interface number 2 [ 614.497151][ T7457] usb 10-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 614.531632][ T7457] usb 10-1: config 220 interface 0 has no altsetting 0 [ 614.543744][ T7457] usb 10-1: config 220 interface 76 has no altsetting 0 [ 614.561018][ T7457] usb 10-1: config 220 interface 1 has no altsetting 0 [ 614.581113][ T7457] usb 10-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 614.591934][ T7457] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 614.612839][ T7457] usb 10-1: Product: syz [ 614.617505][ T7457] usb 10-1: Manufacturer: syz [ 614.622250][ T7457] usb 10-1: SerialNumber: syz [ 614.853185][T15746] /dev/rnullb0: Can't open blockdev [ 615.080937][ T7457] usb 10-1: selecting invalid altsetting 0 [ 615.099505][ T7457] usb 10-1: Found UVC 7.01 device syz (8086:0b07) [ 615.106326][ T7457] usb 10-1: No valid video chain found. [ 615.120700][ T7457] usb 10-1: selecting invalid altsetting 0 [ 615.128866][ T7457] usbtest 10-1:220.1: probe with driver usbtest failed with error -22 [ 615.143460][ T7457] usb 10-1: USB disconnect, device number 7 [ 616.183835][ T5167] Bluetooth: hci4: Entering manufacturer mode failed (-110) [ 616.185020][T11902] Bluetooth: hci4: command 0xfc11 tx timeout [ 616.249706][ T44] usb 9-1: USB disconnect, device number 10 [ 616.512262][T15816] loop2: detected capacity change from 0 to 7 [ 616.529727][T13132] Dev loop2: unable to read RDB block 7 [ 616.539160][T13132] loop2: unable to read partition table [ 616.546813][T13132] loop2: partition table beyond EOD, truncated [ 616.558024][T15816] Dev loop2: unable to read RDB block 7 [ 616.564375][T15816] loop2: unable to read partition table [ 616.572134][T15816] loop2: partition table beyond EOD, truncated [ 616.580570][ T1682] usb 10-1: new high-speed USB device number 8 using dummy_hcd [ 616.590190][T15816] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 616.753749][ T1682] usb 10-1: Using ep0 maxpacket: 32 [ 616.787781][ T1682] usb 10-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 616.810148][ T1682] usb 10-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 616.833045][ T1682] usb 10-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 616.853356][ T1682] usb 10-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 616.873678][ T1682] usb 10-1: Product: syz [ 616.879572][ T1682] usb 10-1: Manufacturer: syz [ 616.908707][ T1682] hub 10-1:4.0: USB hub found [ 617.072697][T15836] netlink: 40 bytes leftover after parsing attributes in process `syz.8.2503'. [ 617.108080][ T1682] hub 10-1:4.0: 2 ports detected [ 617.313730][T15315] usb 3-1: new high-speed USB device number 117 using dummy_hcd [ 617.497970][T15315] usb 3-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 617.516988][T15315] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 617.532198][T15315] usb 3-1: config 0 descriptor?? [ 617.555311][T15315] cp210x 3-1:0.0: cp210x converter detected [ 617.610016][T15851] loop2: detected capacity change from 0 to 7 [ 617.618948][T15851] Dev loop2: unable to read RDB block 7 [ 617.626108][T15851] loop2: unable to read partition table [ 617.632251][T15851] loop2: partition table beyond EOD, truncated [ 617.639655][T15851] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 617.770204][T15315] usb 3-1: cp210x converter now attached to ttyUSB0 [ 618.065993][T11451] usb 3-1: USB disconnect, device number 117 [ 618.085954][T11451] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 618.098593][T11451] cp210x 3-1:0.0: device disconnected [ 618.330492][T15863] ucma_write: process 365 (syz.7.2511) changed security contexts after opening file descriptor, this is not allowed. [ 618.345807][ T1682] hub 10-1:4.0: hub_hub_status failed (err = -32) [ 618.365322][ T1682] hub 10-1:4.0: config failed, can't get hub status (err -32) [ 618.673730][T15873] ./file0: Can't lookup blockdev [ 618.835628][T15878] loop2: detected capacity change from 0 to 7 [ 618.934621][T15878] Dev loop2: unable to read RDB block 7 [ 618.942351][T15878] loop2: unable to read partition table [ 618.949906][T15878] loop2: partition table beyond EOD, truncated [ 619.001718][T15878] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 619.315677][ T44] usb 10-1: USB disconnect, device number 8 [ 619.363364][T15890] netlink: 8 bytes leftover after parsing attributes in process `syz.7.2520'. [ 619.396637][T15315] usb 9-1: new high-speed USB device number 11 using dummy_hcd [ 619.412343][T15896] /dev/rnullb0: Can't open blockdev [ 619.563707][T15315] usb 9-1: Using ep0 maxpacket: 8 [ 619.577000][T15315] usb 9-1: config index 0 descriptor too short (expected 6427, got 27) [ 619.602438][T15315] usb 9-1: config 0 has an invalid interface number: 21 but max is 0 [ 619.628398][T15315] usb 9-1: config 0 has no interface number 0 [ 619.635563][T15315] usb 9-1: config 0 interface 21 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 619.663534][T15315] usb 9-1: config 0 interface 21 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 619.685669][T15315] usb 9-1: config 0 interface 21 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 619.724553][T15315] usb 9-1: New USB device found, idVendor=06cd, idProduct=0202, bcdDevice=92.d4 [ 619.742975][T15315] usb 9-1: New USB device strings: Mfr=0, Product=1, SerialNumber=0 [ 619.764567][T15315] usb 9-1: Product: syz [ 619.782011][T15315] usb 9-1: config 0 descriptor?? [ 619.804398][T15885] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 620.024929][T15885] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 620.049885][T15885] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 620.204908][T15925] loop2: detected capacity change from 0 to 7 [ 620.213312][T15925] Dev loop2: unable to read RDB block 7 [ 620.224765][T15925] loop2: unable to read partition table [ 620.230720][T15925] loop2: partition table beyond EOD, truncated [ 620.237968][T15925] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 620.371501][T15933] /dev/rnullb0: Can't open blockdev [ 620.413679][ T44] usb 10-1: new high-speed USB device number 9 using dummy_hcd [ 620.465336][T15315] usb 9-1: USB disconnect, device number 11 [ 620.664149][ T44] usb 10-1: Using ep0 maxpacket: 32 [ 620.672586][ T44] usb 10-1: config 0 has an invalid interface number: 253 but max is 0 [ 620.685688][ T44] usb 10-1: config 0 has no interface number 0 [ 620.692029][ T44] usb 10-1: config 0 interface 253 altsetting 2 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 620.704893][ T44] usb 10-1: config 0 interface 253 has no altsetting 0 [ 620.715206][ T44] usb 10-1: New USB device found, idVendor=2770, idProduct=9120, bcdDevice=ea.ae [ 620.724988][ T44] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 620.733252][ T44] usb 10-1: Product: syz [ 620.738123][ T44] usb 10-1: Manufacturer: syz [ 620.743102][ T44] usb 10-1: SerialNumber: syz [ 620.759192][ T44] usb 10-1: config 0 descriptor?? [ 620.772234][ T44] gspca_main: sq905-2.14.0 probing 2770:9120 [ 621.269836][ T44] gspca_sq905: sq905_command: usb_control_msg failed (-71) [ 621.277924][ T44] sq905 10-1:0.253: probe with driver sq905 failed with error -71 [ 621.290882][ T44] usb 10-1: USB disconnect, device number 9 [ 622.163406][T15966] ICMPv6: Received fragmented ndisc packet. Carefully consider disabling suppress_frag_ndisc. [ 622.482700][T15983] netlink: 256 bytes leftover after parsing attributes in process `syz.9.2538'. [ 622.502349][T15984] loop2: detected capacity change from 0 to 7 [ 622.560316][T13132] Dev loop2: unable to read RDB block 7 [ 622.581244][T13132] loop2: unable to read partition table [ 622.604932][T13132] loop2: partition table beyond EOD, truncated [ 622.633861][T15984] Dev loop2: unable to read RDB block 7 [ 622.667225][T15984] loop2: unable to read partition table [ 622.697934][T15984] loop2: partition table beyond EOD, truncated [ 622.726485][T15984] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 623.283724][ T5887] usb 3-1: new high-speed USB device number 118 using dummy_hcd [ 623.460250][ T5887] usb 3-1: New USB device found, idVendor=0bda, idProduct=8153, bcdDevice=e2.3d [ 623.460894][T16021] /dev/rnullb0: Can't open blockdev [ 623.486533][ T5887] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 623.506762][ T5887] usb 3-1: Product: syz [ 623.510988][ T5887] usb 3-1: Manufacturer: syz [ 623.527510][ T5887] usb 3-1: SerialNumber: syz [ 623.550063][ T5887] r8152-cfgselector 3-1: Unknown version 0x0000 [ 623.574923][ T5887] r8152-cfgselector 3-1: config 0 descriptor?? [ 623.653861][T16026] /dev/rnullb0: Can't open blockdev [ 624.009791][T16043] loop2: detected capacity change from 0 to 7 [ 624.027480][T13132] Dev loop2: unable to read RDB block 7 [ 624.033376][T13132] loop2: unable to read partition table [ 624.048307][T13132] loop2: partition table beyond EOD, truncated [ 624.060830][T16043] Dev loop2: unable to read RDB block 7 [ 624.069958][T16043] loop2: unable to read partition table [ 624.080923][T16043] loop2: partition table beyond EOD, truncated [ 624.090729][T16043] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 624.350626][ T1306] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.807095][T16065] /dev/rnullb0: Can't open blockdev [ 625.015156][T16073] /dev/rnullb0: Can't open blockdev [ 625.130973][T16076] netlink: 'syz.8.2557': attribute type 16 has an invalid length. [ 625.142609][T16076] netlink: 64138 bytes leftover after parsing attributes in process `syz.8.2557'. [ 625.308740][T16081] netlink: 52 bytes leftover after parsing attributes in process `syz.9.2558'. [ 625.319582][T16081] netlink: 52 bytes leftover after parsing attributes in process `syz.9.2558'. [ 625.329690][T16081] netlink: 52 bytes leftover after parsing attributes in process `syz.9.2558'. [ 625.379962][T16083] syz.8.2559: attempt to access beyond end of device [ 625.379962][T16083] nbd8: rw=0, sector=0, nr_sectors = 1 limit=0 [ 625.393088][T16083] hpfs: hpfs_map_sector(): read error [ 625.472110][T16085] MTD: Attempt to mount non-MTD device "/dev/rnullb0" [ 625.481572][T16085] /dev/rnullb0: Can't open blockdev [ 625.538796][T16087] loop2: detected capacity change from 0 to 7 [ 625.549254][T13132] Dev loop2: unable to read RDB block 7 [ 625.556796][T13132] loop2: unable to read partition table [ 625.562783][T13132] loop2: partition table beyond EOD, truncated [ 625.570371][T16087] Dev loop2: unable to read RDB block 7 [ 625.576897][T16087] loop2: unable to read partition table [ 625.587572][T16087] loop2: partition table beyond EOD, truncated [ 625.593758][ T44] usb 10-1: new low-speed USB device number 10 using dummy_hcd [ 625.602982][T16087] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 625.727780][ T44] usb 10-1: device descriptor read/64, error -71 [ 625.742651][T16089] netlink: 88 bytes leftover after parsing attributes in process `syz.7.2562'. [ 625.758350][T16093] /dev/rnullb0: Can't open blockdev [ 625.867366][T16098] syz.7.2565 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 625.990428][T16100] /dev/rnullb0: Can't open blockdev [ 625.993590][ T44] usb 10-1: new low-speed USB device number 11 using dummy_hcd [ 626.000887][T16101] /dev/rnullb0: Can't open blockdev [ 626.143689][ T44] usb 10-1: device descriptor read/64, error -71 [ 626.258428][ T44] usb usb10-port1: attempt power cycle [ 626.360611][T16112] /dev/rnullb0: Can't open blockdev [ 626.378098][T16117] /dev/rnullb0: Can't open blockdev [ 626.614971][ T44] usb 10-1: new low-speed USB device number 12 using dummy_hcd [ 626.640304][T16126] loop2: detected capacity change from 0 to 7 [ 626.651706][T16127] binder: 16123:16127 ioctl c0306201 2000000003c0 returned -22 [ 626.652536][T13132] Dev loop2: unable to read RDB block 7 [ 626.665693][ T44] usb 10-1: device descriptor read/8, error -71 [ 626.668859][T13132] loop2: unable to read partition table [ 626.678424][T16127] binder: 16123:16127 ioctl 0 200000000080 returned -22 [ 626.683231][T13132] loop2: partition table beyond EOD, truncated [ 626.697535][T16127] /dev/rnullb0: Can't open blockdev [ 626.698548][T16126] Dev loop2: unable to read RDB block 7 [ 626.723844][T16126] loop2: unable to read partition table [ 626.758099][T16126] loop2: partition table beyond EOD, truncated [ 626.764782][T16126] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 626.923790][ T44] usb 10-1: new low-speed USB device number 13 using dummy_hcd [ 626.973050][ T44] usb 10-1: device descriptor read/8, error -71 [ 627.099127][T16143] tmpfs: Bad value for 'mpol' [ 627.114251][ T44] usb usb10-port1: unable to enumerate USB device [ 627.873921][T15230] usb 9-1: new high-speed USB device number 13 using dummy_hcd [ 628.037482][T15230] usb 9-1: device descriptor read/64, error -71 [ 628.303617][T15230] usb 9-1: new high-speed USB device number 14 using dummy_hcd [ 628.443827][T15230] usb 9-1: device descriptor read/64, error -71 [ 628.535617][T16174] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 628.554020][T15230] usb usb9-port1: attempt power cycle [ 628.605744][T16177] loop2: detected capacity change from 0 to 7 [ 628.635599][T16177] Dev loop2: unable to read RDB block 7 [ 628.666043][T16177] loop2: unable to read partition table [ 628.703774][T16177] loop2: partition table beyond EOD, truncated [ 628.733942][T16177] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 628.886429][ T30] audit: type=1800 audit(628.820:138): pid=16182 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.9.2583" name="file1" dev="overlay" ino=323 res=0 errno=0 [ 628.908026][T15230] usb 9-1: new high-speed USB device number 15 using dummy_hcd [ 628.957042][T15230] usb 9-1: device descriptor read/8, error -71 [ 629.203749][T15230] usb 9-1: new high-speed USB device number 16 using dummy_hcd [ 629.253605][T15230] usb 9-1: device descriptor read/8, error -71 [ 629.303881][T15173] usb 10-1: new high-speed USB device number 14 using dummy_hcd [ 629.374622][T15230] usb usb9-port1: unable to enumerate USB device [ 629.453634][T15173] usb 10-1: device descriptor read/64, error -71 [ 629.703755][T15173] usb 10-1: new high-speed USB device number 15 using dummy_hcd [ 629.874720][T15173] usb 10-1: device descriptor read/64, error -71 [ 630.003984][T15173] usb usb10-port1: attempt power cycle [ 630.347662][T15173] usb 10-1: new high-speed USB device number 16 using dummy_hcd [ 630.374380][T15173] usb 10-1: device descriptor read/8, error -71 [ 630.627662][T16232] /dev/rnullb0: Can't open blockdev [ 630.638892][T15173] usb 10-1: new high-speed USB device number 17 using dummy_hcd [ 630.684839][T15173] usb 10-1: device descriptor read/8, error -71 [ 630.798769][T15173] usb usb10-port1: unable to enumerate USB device [ 631.251047][T16252] ./cgroup: Can't lookup blockdev [ 632.123274][T16281] loop2: detected capacity change from 0 to 7 [ 632.137942][T13132] Dev loop2: unable to read RDB block 7 [ 632.146362][T13132] loop2: unable to read partition table [ 632.152318][T13132] loop2: partition table beyond EOD, truncated [ 632.165611][T16281] Dev loop2: unable to read RDB block 7 [ 632.171817][T16281] loop2: unable to read partition table [ 632.178286][T16281] loop2: partition table beyond EOD, truncated [ 632.187272][T16281] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 632.215372][T16257] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 632.244747][T16257] Bluetooth: hci0: Error when powering off device on rfkill (-4) [ 632.361129][T16257] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 632.372596][T16257] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 632.466777][T16257] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 632.483598][T16257] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 632.617519][T16257] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 632.633793][T16257] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 633.033299][T16299] 9pnet_fd: Insufficient options for proto=fd [ 633.654217][T15173] usb 10-1: new full-speed USB device number 18 using dummy_hcd [ 634.084546][T15173] usb 10-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 634.096524][T15173] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 634.105075][T15173] usb 10-1: Product: syz [ 634.109352][T15173] usb 10-1: Manufacturer: syz [ 634.114112][T15173] usb 10-1: SerialNumber: syz [ 634.130888][T15173] usb 10-1: config 0 descriptor?? [ 634.353989][T15173] usb 10-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 634.472780][T16339] /dev/rnullb0: Can't open blockdev [ 635.094111][T16337] /dev/rnullb0: Can't open blockdev [ 635.340937][T16357] /dev/rnullb0: Can't open blockdev [ 635.390879][T16360] binder: 16359:16360 ioctl c018620b 0 returned -14 [ 635.524778][T16364] FAULT_INJECTION: forcing a failure. [ 635.524778][T16364] name failslab, interval 1, probability 0, space 0, times 0 [ 635.526838][ T30] audit: type=1800 audit(635.480:139): pid=16364 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.7.2606" name="file1" dev="overlay" ino=897 res=0 errno=0 [ 635.559423][T16364] CPU: 1 UID: 0 PID: 16364 Comm: syz.7.2606 Not tainted 6.16.0-next-20250731-syzkaller #0 PREEMPT(full) [ 635.559455][T16364] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 635.559471][T16364] Call Trace: [ 635.559480][T16364] [ 635.559489][T16364] dump_stack_lvl+0x189/0x250 [ 635.559527][T16364] ? __pfx____ratelimit+0x10/0x10 [ 635.559560][T16364] ? __pfx_dump_stack_lvl+0x10/0x10 [ 635.559591][T16364] ? __pfx__printk+0x10/0x10 [ 635.559625][T16364] ? __pfx___might_resched+0x10/0x10 [ 635.559651][T16364] ? fs_reclaim_acquire+0x7d/0x100 [ 635.559689][T16364] should_fail_ex+0x414/0x560 [ 635.559721][T16364] should_failslab+0xa8/0x100 [ 635.559746][T16364] __kmalloc_noprof+0xcb/0x4f0 [ 635.559779][T16364] ? alloc_pipe_info+0x1fd/0x4d0 [ 635.559810][T16364] alloc_pipe_info+0x1fd/0x4d0 [ 635.559839][T16364] splice_direct_to_actor+0xa5d/0xcc0 [ 635.559868][T16364] ? __lock_acquire+0xab9/0xd20 [ 635.559905][T16364] ? __pfx_aa_file_perm+0x10/0x10 [ 635.559932][T16364] ? __lock_acquire+0xab9/0xd20 [ 635.559952][T16364] ? __pfx_direct_splice_actor+0x10/0x10 [ 635.559977][T16364] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 635.560013][T16364] do_splice_direct+0x181/0x270 [ 635.560043][T16364] ? __pfx_do_splice_direct+0x10/0x10 [ 635.560070][T16364] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 635.560106][T16364] ? rw_verify_area+0x255/0x4d0 [ 635.560133][T16364] do_sendfile+0x4da/0x7e0 [ 635.560163][T16364] ? __pfx_vfs_write+0x10/0x10 [ 635.560194][T16364] ? __pfx_do_sendfile+0x10/0x10 [ 635.560224][T16364] ? __fget_files+0x3a0/0x420 [ 635.560264][T16364] __se_sys_sendfile64+0x13e/0x190 [ 635.560296][T16364] ? __pfx___se_sys_sendfile64+0x10/0x10 [ 635.560323][T16364] ? rcu_is_watching+0x15/0xb0 [ 635.560354][T16364] ? do_syscall_64+0xbe/0x3b0 [ 635.560378][T16364] do_syscall_64+0xfa/0x3b0 [ 635.560397][T16364] ? lockdep_hardirqs_on+0x9c/0x150 [ 635.560430][T16364] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 635.560453][T16364] ? clear_bhb_loop+0x60/0xb0 [ 635.560479][T16364] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 635.560500][T16364] RIP: 0033:0x7f96dc78eb69 [ 635.560520][T16364] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 635.560539][T16364] RSP: 002b:00007f96dd51d038 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 635.560561][T16364] RAX: ffffffffffffffda RBX: 00007f96dc9b5fa0 RCX: 00007f96dc78eb69 [ 635.560579][T16364] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000004 [ 635.560592][T16364] RBP: 00007f96dd51d090 R08: 0000000000000000 R09: 0000000000000000 [ 635.560607][T16364] R10: 0000000800000009 R11: 0000000000000246 R12: 0000000000000001 [ 635.560622][T16364] R13: 0000000000000000 R14: 00007f96dc9b5fa0 R15: 00007ffffc04ec08 [ 635.560655][T16364] [ 636.052540][T16375] netlink: 8 bytes leftover after parsing attributes in process `syz.8.2609'. [ 636.081300][T16376] netlink: 8 bytes leftover after parsing attributes in process `syz.8.2609'. [ 636.296235][T16312] /dev/rnullb0: Can't open blockdev [ 636.307861][T15173] dvb_usb_rtl28xxu 10-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 636.350160][T15173] usb 10-1: USB disconnect, device number 18 [ 636.620032][ T30] audit: type=1800 audit(636.570:140): pid=16386 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.7.2611" name="file1" dev="overlay" ino=916 res=0 errno=0 [ 636.803139][T16393] netlink: 'syz.7.2612': attribute type 7 has an invalid length. [ 636.829485][T16393] : entered promiscuous mode [ 636.923707][T15173] usb 9-1: new high-speed USB device number 17 using dummy_hcd [ 636.988284][T16400] netlink: 260 bytes leftover after parsing attributes in process `syz.9.2614'. [ 637.035732][T16400] /dev/rnullb0: Can't open blockdev [ 637.100124][T15173] usb 9-1: device descriptor read/64, error -71 [ 637.109162][T16403] netlink: 'syz.7.2615': attribute type 21 has an invalid length. [ 637.117376][T16403] netlink: 132 bytes leftover after parsing attributes in process `syz.7.2615'. [ 637.375022][T15173] usb 9-1: new high-speed USB device number 18 using dummy_hcd [ 637.480766][T16416] loop2: detected capacity change from 0 to 7 [ 637.514683][T16416] Dev loop2: unable to read RDB block 7 [ 637.520357][T16416] loop2: unable to read partition table [ 637.534119][T15173] usb 9-1: device descriptor read/64, error -71 [ 637.543920][T16416] loop2: partition table beyond EOD, truncated [ 637.573794][T16416] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 637.646583][T15173] usb usb9-port1: attempt power cycle [ 637.831963][T16428] netlink: 16 bytes leftover after parsing attributes in process `syz.9.2618'. [ 638.006408][T15173] usb 9-1: new high-speed USB device number 19 using dummy_hcd [ 638.034525][T15173] usb 9-1: device descriptor read/8, error -71 [ 638.284039][T15173] usb 9-1: new high-speed USB device number 20 using dummy_hcd [ 638.317370][T15173] usb 9-1: device descriptor read/8, error -71 [ 638.447230][T15173] usb usb9-port1: unable to enumerate USB device [ 638.877401][ T30] audit: type=1800 audit(638.820:141): pid=16447 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.7.2622" name="file1" dev="overlay" ino=955 res=0 errno=0 [ 638.922405][T16446] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 639.103009][T16452] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 639.488831][T11902] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 639.499498][T11902] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 639.511135][T11902] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 639.520014][T11902] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 639.531296][T11902] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 639.563694][ T5167] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 639.582633][ T5167] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 639.600868][ T5167] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 639.615551][ T44] usb 10-1: new high-speed USB device number 19 using dummy_hcd [ 639.616029][ T5167] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 639.635375][ T5167] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 639.801019][T16468] netlink: 92 bytes leftover after parsing attributes in process `syz.8.2625'. [ 639.825653][ T44] usb 10-1: config 160 has an invalid interface number: 200 but max is 0 [ 639.839086][T16470] loop2: detected capacity change from 0 to 7 [ 639.843766][T16468] netlink: 24 bytes leftover after parsing attributes in process `syz.8.2625'. [ 639.858455][ T44] usb 10-1: config 160 has no interface number 0 [ 639.865983][T16470] Dev loop2: unable to read RDB block 7 [ 639.871621][T16470] loop2: unable to read partition table [ 639.882456][ T44] usb 10-1: config 160 interface 200 has no altsetting 0 [ 639.902302][ T44] usb 10-1: New USB device found, idVendor=21bb, idProduct=2070, bcdDevice=87.0a [ 639.923828][T16470] loop2: partition table beyond EOD, truncated [ 639.927370][ T44] usb 10-1: New USB device strings: Mfr=171, Product=0, SerialNumber=3 [ 639.945427][T16470] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 639.952304][ T44] usb 10-1: Manufacturer: syz [ 639.962095][ T44] usb 10-1: SerialNumber: syz [ 640.194400][T16457] /dev/rnullb0: Can't open blockdev [ 640.225560][ T44] usb 10-1: Quirk or no altset; falling back to MIDI 1.0 [ 640.232749][ T44] usb 10-1: MIDIStreaming interface descriptor not found [ 640.316215][ T44] usb 10-1: USB disconnect, device number 19 [ 640.453983][T13031] udevd[13031]: error opening ATTR{/sys/devices/platform/dummy_hcd.9/usb10/10-1/10-1:160.200/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 640.555566][T16465] chnl_net:caif_netlink_parms(): no params data found [ 640.699144][ T30] audit: type=1800 audit(640.650:142): pid=16482 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.7.2628" name="file1" dev="overlay" ino=985 res=0 errno=0 [ 640.700008][T16482] FAULT_INJECTION: forcing a failure. [ 640.700008][T16482] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 640.719443][ C1] vkms_vblank_simulate: vblank timer overrun [ 640.805098][T16482] CPU: 1 UID: 0 PID: 16482 Comm: syz.7.2628 Not tainted 6.16.0-next-20250731-syzkaller #0 PREEMPT(full) [ 640.805128][T16482] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 640.805143][T16482] Call Trace: [ 640.805152][T16482] [ 640.805161][T16482] dump_stack_lvl+0x189/0x250 [ 640.805196][T16482] ? __pfx____ratelimit+0x10/0x10 [ 640.805228][T16482] ? __pfx_dump_stack_lvl+0x10/0x10 [ 640.805258][T16482] ? __pfx__printk+0x10/0x10 [ 640.805291][T16482] ? fs_reclaim_acquire+0x7d/0x100 [ 640.805324][T16482] should_fail_ex+0x414/0x560 [ 640.805356][T16482] prepare_alloc_pages+0x213/0x610 [ 640.805389][T16482] __alloc_frozen_pages_noprof+0x123/0x370 [ 640.805420][T16482] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 640.805463][T16482] alloc_pages_bulk_noprof+0x560/0x710 [ 640.805490][T16482] ? rcu_is_watching+0x15/0xb0 [ 640.805516][T16482] ? trace_kmalloc+0x1f/0xd0 [ 640.805546][T16482] ? __kmalloc_noprof+0x29b/0x4f0 [ 640.805578][T16482] ? copy_splice_read+0x143/0x9b0 [ 640.805608][T16482] copy_splice_read+0x173/0x9b0 [ 640.805647][T16482] ? __pfx_copy_splice_read+0x10/0x10 [ 640.805669][T16482] ? look_up_lock_class+0x74/0x170 [ 640.805704][T16482] ? register_lock_class+0x51/0x320 [ 640.805730][T16482] ? __pfx_pipe_lock_cmp_fn+0x10/0x10 [ 640.805763][T16482] ? alloc_pipe_info+0x374/0x4d0 [ 640.805789][T16482] ? __pfx_ovl_splice_read+0x10/0x10 [ 640.805818][T16482] splice_direct_to_actor+0x4d0/0xcc0 [ 640.805866][T16482] ? __pfx_direct_splice_actor+0x10/0x10 [ 640.805891][T16482] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 640.805929][T16482] do_splice_direct+0x181/0x270 [ 640.805958][T16482] ? __pfx_do_splice_direct+0x10/0x10 [ 640.805984][T16482] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 640.806030][T16482] ? rw_verify_area+0x255/0x4d0 [ 640.806056][T16482] do_sendfile+0x4da/0x7e0 [ 640.806085][T16482] ? __pfx_vfs_write+0x10/0x10 [ 640.806115][T16482] ? __pfx_do_sendfile+0x10/0x10 [ 640.806144][T16482] ? __fget_files+0x3a0/0x420 [ 640.806184][T16482] __se_sys_sendfile64+0x13e/0x190 [ 640.806215][T16482] ? __pfx___se_sys_sendfile64+0x10/0x10 [ 640.806241][T16482] ? rcu_is_watching+0x15/0xb0 [ 640.806273][T16482] ? do_syscall_64+0xbe/0x3b0 [ 640.806297][T16482] do_syscall_64+0xfa/0x3b0 [ 640.806316][T16482] ? lockdep_hardirqs_on+0x9c/0x150 [ 640.806347][T16482] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 640.806370][T16482] ? clear_bhb_loop+0x60/0xb0 [ 640.806397][T16482] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 640.806419][T16482] RIP: 0033:0x7f96dc78eb69 [ 640.806438][T16482] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 640.806458][T16482] RSP: 002b:00007f96dd51d038 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 640.806481][T16482] RAX: ffffffffffffffda RBX: 00007f96dc9b5fa0 RCX: 00007f96dc78eb69 [ 640.806498][T16482] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000004 [ 640.806512][T16482] RBP: 00007f96dd51d090 R08: 0000000000000000 R09: 0000000000000000 [ 640.806526][T16482] R10: 0000000800000009 R11: 0000000000000246 R12: 0000000000000001 [ 640.806541][T16482] R13: 0000000000000000 R14: 00007f96dc9b5fa0 R15: 00007ffffc04ec08 [ 640.806575][T16482] [ 641.126685][ C1] vkms_vblank_simulate: vblank timer overrun [ 641.210822][T16465] bridge0: port 1(bridge_slave_0) entered blocking state [ 641.218183][T16465] bridge0: port 1(bridge_slave_0) entered disabled state [ 641.227268][T16465] bridge_slave_0: entered allmulticast mode [ 641.235161][T16465] bridge_slave_0: entered promiscuous mode [ 641.243415][T16465] bridge0: port 2(bridge_slave_1) entered blocking state [ 641.250942][T16465] bridge0: port 2(bridge_slave_1) entered disabled state [ 641.258400][T16465] bridge_slave_1: entered allmulticast mode [ 641.266517][T16465] bridge_slave_1: entered promiscuous mode [ 641.460983][T16496] /dev/rnullb0: Can't open blockdev [ 641.491958][T16465] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 641.501559][ T1682] usb 10-1: new high-speed USB device number 20 using dummy_hcd [ 641.548624][T16465] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 641.665041][ T1682] usb 10-1: Using ep0 maxpacket: 16 [ 641.675577][T16465] team0: Port device team_slave_0 added [ 641.682000][ T1682] usb 10-1: config 1 has an invalid interface number: 4 but max is 2 [ 641.689549][T16465] team0: Port device team_slave_1 added [ 641.690465][ T1682] usb 10-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 641.706672][ T5167] Bluetooth: hci4: command tx timeout [ 641.717429][ T1682] usb 10-1: config 1 has no interface number 1 [ 641.725191][ T1682] usb 10-1: too many endpoints for config 1 interface 4 altsetting 0: 102, using maximum allowed: 30 [ 641.736514][ T1682] usb 10-1: config 1 interface 4 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 102 [ 641.752844][ T1682] usb 10-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.53 [ 641.762326][ T1682] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 641.770583][ T1682] usb 10-1: Product: syz [ 641.776126][ T1682] usb 10-1: Manufacturer: syz [ 641.787826][ T1682] usb 10-1: SerialNumber: syz [ 641.797384][T16465] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 641.804482][T16465] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 641.836727][T16465] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 641.842797][T16506] /dev/rnullb0: Can't open blockdev [ 641.855307][T16465] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 641.862492][T16465] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 641.888645][T16465] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 641.959158][T16465] hsr_slave_0: entered promiscuous mode [ 641.966287][T16465] hsr_slave_1: entered promiscuous mode [ 641.972743][T16465] debugfs: 'hsr0' already exists in 'hsr' [ 641.978660][T16465] Cannot create hsr debugfs directory [ 642.056391][ T1682] usb 10-1: USB disconnect, device number 20 [ 642.126814][T13132] udevd[13132]: error opening ATTR{/sys/devices/platform/dummy_hcd.9/usb10/10-1/10-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 642.863610][ T44] usb 9-1: new high-speed USB device number 21 using dummy_hcd [ 643.023913][ T44] usb 9-1: Using ep0 maxpacket: 8 [ 643.049549][ T44] usb 9-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 643.072760][ T44] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 643.095577][ T44] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 643.115965][ T44] usb 9-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 643.143561][ T44] usb 9-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 643.159637][T16465] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 643.169602][ T44] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 643.182947][T16465] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 643.218484][T16465] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 643.248683][T16465] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 643.407761][T16543] /dev/rnullb0: Can't open blockdev [ 643.413326][ T44] usb 9-1: GET_CAPABILITIES returned 0 [ 643.421187][T16465] 8021q: adding VLAN 0 to HW filter on device bond0 [ 643.421634][ T44] usbtmc 9-1:16.0: can't read capabilities [ 643.463678][ T30] audit: type=1326 audit(643.400:143): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16517 comm="syz.9.2634" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa6eb58eb69 code=0x7fc00000 [ 643.506495][T16465] 8021q: adding VLAN 0 to HW filter on device team0 [ 643.530055][ T1086] bridge0: port 1(bridge_slave_0) entered blocking state [ 643.537346][ T1086] bridge0: port 1(bridge_slave_0) entered forwarding state [ 643.579474][T11423] bridge0: port 2(bridge_slave_1) entered blocking state [ 643.586857][T11423] bridge0: port 2(bridge_slave_1) entered forwarding state [ 643.616831][ T5887] usb 9-1: USB disconnect, device number 21 [ 643.680212][T16548] /dev/rnullb0: Can't open blockdev [ 643.783701][ T5167] Bluetooth: hci4: command tx timeout [ 643.992662][T16465] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 644.089906][T16465] veth0_vlan: entered promiscuous mode [ 644.118064][T16465] veth1_vlan: entered promiscuous mode [ 644.230457][T16465] veth0_macvtap: entered promiscuous mode [ 644.237921][T16565] program syz.8.2637 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 644.247673][T16465] veth1_macvtap: entered promiscuous mode [ 644.249228][T16565] /dev/rnullb0: Can't open blockdev [ 644.312474][T16465] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 644.349202][T16465] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 644.378707][T11423] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 644.393094][T11423] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 644.421474][T11423] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 644.446211][T11423] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 644.595144][T16572] overlayfs: failed to resolve './file0/file1': -2 [ 644.628885][T16572] netlink: 28 bytes leftover after parsing attributes in process `syz.9.2639'. [ 644.656556][T16572] netlink: 24 bytes leftover after parsing attributes in process `syz.9.2639'. [ 644.670253][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 644.702339][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 644.787539][T16574] netlink: 8 bytes leftover after parsing attributes in process `syz.8.2640'. [ 644.833296][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 644.861303][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 645.050841][T16588] /dev/rnullb0: Can't open blockdev [ 645.092964][T16592] /dev/rnullb0: Can't open blockdev [ 645.656938][T16616] /dev/rnullb0: Can't open blockdev [ 645.733939][ T5846] usb 9-1: new high-speed USB device number 22 using dummy_hcd [ 645.863280][T16624] /dev/rnullb0: Can't open blockdev [ 645.869187][ T5167] Bluetooth: hci4: command tx timeout [ 645.874230][ T5846] usb 9-1: device descriptor read/64, error -71 [ 646.097955][T16633] /dev/rnullb0: Can't open blockdev [ 646.116919][T16632] /dev/rnullb0: Can't open blockdev [ 646.133572][ T5846] usb 9-1: new high-speed USB device number 23 using dummy_hcd [ 646.294002][ T5846] usb 9-1: device descriptor read/64, error -71 [ 646.655158][ T5846] usb usb9-port1: attempt power cycle [ 646.724457][T16642] netlink: 'syz.9.2654': attribute type 1 has an invalid length. [ 646.772072][T16642] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 646.863019][T16651] MTD: Attempt to mount non-MTD device "/dev/rnullb0" [ 646.870740][T16651] /dev/rnullb0: Can't open blockdev [ 646.993685][ T5846] usb 9-1: new high-speed USB device number 24 using dummy_hcd [ 647.034320][ T5846] usb 9-1: device descriptor read/8, error -71 [ 647.052382][T16637] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 647.063863][T16637] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 647.074529][ T5887] usb 10-1: new high-speed USB device number 21 using dummy_hcd [ 647.245671][ T5887] usb 10-1: Using ep0 maxpacket: 16 [ 647.254721][ T5887] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 647.281612][ T5887] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 647.303629][ T5846] usb 9-1: new high-speed USB device number 25 using dummy_hcd [ 647.311588][ T5887] usb 10-1: New USB device found, idVendor=6161, idProduct=4d15, bcdDevice= 0.00 [ 647.334883][ T5887] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 647.344399][ T5846] usb 9-1: device descriptor read/8, error -71 [ 647.364988][ T5887] usb 10-1: config 0 descriptor?? [ 647.454074][ T5846] usb usb9-port1: unable to enumerate USB device [ 647.774117][ T5919] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 647.969859][ T5919] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 647.986181][ T5919] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 647.986831][ C1] IPv4: Oversized IP packet from 172.20.20.24 [ 648.004603][ T5919] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 648.012592][ T5887] usbhid 10-1:0.0: can't add hid device: -32 [ 648.019958][ T5887] usbhid 10-1:0.0: probe with driver usbhid failed with error -32 [ 648.031749][ T5887] usb 10-1: USB disconnect, device number 21 [ 648.052143][ T5919] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 648.069407][ T5919] usb 1-1: Product: ퟏ븵맳楎꿳ꙣ堄Ỡᖒ挩騔㸨儴蠳恘ﶲ辴襚⣚儲⁨퇉軗ᱨ霭굏୷嚨錅᳆ヾ꽲쀩廷ꎷ㈞껇康䭡ũ￾遦輌බᯰ놚∎桓ιɽ鵩䟠腳弖䕍✻냋갉︎덯፴ᠼ퍯緤᨟ၲ휌뷛弻쌆躕봹ᆢጆ뒝迬꒱뇭ㅟ䚛ꒅ寀䈈譟穜臂爅鎂볺騱ꪡ륛䶡麊 [ 648.121053][ T5919] usb 1-1: Manufacturer: Ь [ 648.142216][ T5919] usb 1-1: SerialNumber: syz [ 648.262844][T16686] netlink: 12 bytes leftover after parsing attributes in process `syz.7.2659'. [ 648.276666][T16686] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 648.301012][T16686] usb usb6: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 648.646206][ T5919] usb 1-1: 0:2 : does not exist [ 648.699686][ T5919] usb 1-1: USB disconnect, device number 30 [ 648.825165][T16705] /dev/rnullb0: Can't open blockdev [ 648.883653][ T5887] usb 9-1: new high-speed USB device number 26 using dummy_hcd [ 648.950475][T16711] /dev/rnullb0: Can't open blockdev [ 649.049076][ T5887] usb 9-1: device descriptor read/64, error -71 [ 649.098886][T16711] syzkaller0: entered promiscuous mode [ 649.106515][T16711] syzkaller0: entered allmulticast mode [ 649.304787][ T5887] usb 9-1: new high-speed USB device number 27 using dummy_hcd [ 649.444048][ T5887] usb 9-1: device descriptor read/64, error -71 [ 649.555998][ T5887] usb usb9-port1: attempt power cycle [ 649.590577][ T5846] usb 1-1: new high-speed USB device number 31 using dummy_hcd [ 649.762670][ T5846] usb 1-1: Using ep0 maxpacket: 16 [ 649.792362][ T5846] usb 1-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1023 [ 649.811943][ T5846] usb 1-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 8 [ 649.845855][ T5846] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 649.855267][ T5846] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 649.863321][ T5846] usb 1-1: Product: 돽ୂŧᝉ焼浴芜唂⵰঍坴㔑蕺璷귔瀆အ줕晻霚䥖䰡둵呲빡똚ɯ芔츐᠘亻⫁ﭹ䖾⣂땥㲓㧏刈撦뿪䌆杦㇡䰶뮨㸶䫸絴봈⊈ᑿ룰㇥숒⩇໻ܞ炭Ỹ挱ꜹ检既굋똇좲Ƽ猻혆浧ࡗ쀭뻐朝㞞촉眤꾸焴捡믐錇䙅紐閶蛝ҋ庣἞ກ㸧摲덨鲫 [ 649.893459][ C1] vkms_vblank_simulate: vblank timer overrun [ 649.905146][ T5887] usb 9-1: new high-speed USB device number 28 using dummy_hcd [ 649.912980][ T5846] usb 1-1: Manufacturer: љ [ 649.918206][ T5846] usb 1-1: SerialNumber: ⠁ [ 649.940556][ T5887] usb 9-1: device descriptor read/8, error -71 [ 650.180988][T16723] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 650.188913][T16723] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 650.203624][ T5887] usb 9-1: new high-speed USB device number 29 using dummy_hcd [ 650.227477][ T5887] usb 9-1: device descriptor read/8, error -71 [ 650.344443][ T5887] usb usb9-port1: unable to enumerate USB device [ 650.408740][ T5846] cdc_ncm 1-1:1.0: bind() failure [ 650.433032][ T5846] cdc_ncm 1-1:1.1: probe with driver cdc_ncm failed with error -71 [ 650.451689][ T5846] cdc_mbim 1-1:1.1: probe with driver cdc_mbim failed with error -71 [ 650.467858][ T5846] usbtest 1-1:1.1: probe with driver usbtest failed with error -71 [ 650.486879][ T5846] usb 1-1: USB disconnect, device number 31 [ 651.263755][ T5846] usb 1-1: new high-speed USB device number 32 using dummy_hcd [ 651.406469][ T5846] usb 1-1: device descriptor read/64, error -71 [ 651.653584][ T5846] usb 1-1: new high-speed USB device number 33 using dummy_hcd [ 651.793902][ T5846] usb 1-1: device descriptor read/64, error -71 [ 651.906787][ T5846] usb usb1-port1: attempt power cycle [ 651.995221][T16745] /dev/rnullb0: Can't open blockdev [ 652.041439][T16748] /dev/rnullb0: Can't open blockdev [ 652.246711][T16752] /dev/rnullb0: Can't open blockdev [ 652.323545][ T5846] usb 1-1: new high-speed USB device number 34 using dummy_hcd [ 652.394160][ T5846] usb 1-1: device descriptor read/8, error -71 [ 652.462620][T16760] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2674'. [ 652.484443][T16760] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2674'. [ 652.633620][ T5846] usb 1-1: new high-speed USB device number 35 using dummy_hcd [ 652.674358][ T5846] usb 1-1: device descriptor read/8, error -71 [ 652.803950][ T5846] usb usb1-port1: unable to enumerate USB device [ 652.856105][T16774] 9pnet_fd: Insufficient options for proto=fd [ 653.301673][T16786] syz.9.2678: attempt to access beyond end of device [ 653.301673][T16786] nbd9: rw=0, sector=2, nr_sectors = 2 limit=0 [ 653.314996][T16786] syz.9.2678: attempt to access beyond end of device [ 653.314996][T16786] nbd9: rw=0, sector=16, nr_sectors = 2 limit=0 [ 653.521473][T16794] Bluetooth: MGMT ver 1.23 [ 653.798937][T16805] netlink: 28 bytes leftover after parsing attributes in process `syz.9.2682'. [ 654.034972][T16817] /dev/rnullb0: Can't open blockdev [ 654.776452][ T5919] usb 9-1: new high-speed USB device number 30 using dummy_hcd [ 654.801596][T16844] loop2: detected capacity change from 0 to 7 [ 654.810135][T16844] Dev loop2: unable to read RDB block 7 [ 654.819604][T16844] loop2: unable to read partition table [ 654.843739][T16844] loop2: partition table beyond EOD, truncated [ 654.849994][T16844] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 654.874379][T16846] netlink: 'syz.0.2690': attribute type 7 has an invalid length. [ 654.943775][ T5919] usb 9-1: Using ep0 maxpacket: 8 [ 654.963337][ T5919] usb 9-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 654.979828][ T5919] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 655.001018][ T5919] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 655.031916][ T5919] usb 9-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 655.076151][ T5919] usb 9-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 655.093568][ T5919] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 655.326073][ T5919] usb 9-1: GET_CAPABILITIES returned 0 [ 655.341963][ T5919] usbtmc 9-1:16.0: can't read capabilities [ 655.568114][ T5919] usb 9-1: USB disconnect, device number 30 [ 655.885004][T16879] netlink: 'syz.9.2698': attribute type 5 has an invalid length. [ 656.170129][T16884] loop2: detected capacity change from 0 to 7 [ 656.185891][T16884] Dev loop2: unable to read RDB block 7 [ 656.205572][T16884] loop2: unable to read partition table [ 656.218949][T16884] loop2: partition table beyond EOD, truncated [ 656.245641][T16884] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 656.405998][T16891] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 656.442612][T16891] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 656.565511][T16893] /dev/rnullb0: Can't open blockdev [ 656.623672][ T5887] usb 9-1: new high-speed USB device number 31 using dummy_hcd [ 656.811122][T16903] /dev/rnullb0: Can't open blockdev [ 656.965772][T16913] gfs2: gfs2 mount does not exist [ 657.136433][T16921] loop2: detected capacity change from 0 to 7 [ 657.218252][T16921] Dev loop2: unable to read RDB block 7 [ 657.253700][T16921] loop2: unable to read partition table [ 657.260384][T16921] loop2: partition table beyond EOD, truncated [ 657.305116][T16921] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 657.386256][T16929] netlink: 24 bytes leftover after parsing attributes in process `syz.9.2711'. [ 657.566513][T16938] /dev/rnullb0: Can't open blockdev [ 657.854113][T16949] /dev/rnullb0: Can't open blockdev [ 658.253612][ T5846] usb 10-1: new high-speed USB device number 22 using dummy_hcd [ 658.478653][ T5846] usb 10-1: Using ep0 maxpacket: 32 [ 658.613651][ T5846] usb 10-1: config 0 has an invalid interface number: 37 but max is 0 [ 658.621887][ T5846] usb 10-1: config 0 has no interface number 0 [ 658.663658][ T5846] usb 10-1: config 0 interface 37 has no altsetting 0 [ 658.722036][ T5846] usb 10-1: New USB device found, idVendor=07b8, idProduct=401a, bcdDevice=10.8f [ 658.748729][ T5846] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 658.787498][ T5846] usb 10-1: Product: syz [ 658.791815][ T5846] usb 10-1: Manufacturer: syz [ 658.811928][ T5846] usb 10-1: SerialNumber: syz [ 658.859764][ T5846] usb 10-1: config 0 descriptor?? [ 658.890598][ T5846] rtl8150 10-1:0.37: couldn't find required endpoints [ 658.898746][ T5846] rtl8150 10-1:0.37: probe with driver rtl8150 failed with error -5 [ 658.956896][T16971] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 658.986225][T16971] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 659.204362][ T5846] usb 9-1: new low-speed USB device number 32 using dummy_hcd [ 659.335096][T16982] loop2: detected capacity change from 0 to 7 [ 659.368792][T16982] Dev loop2: unable to read RDB block 7 [ 659.393516][ T5846] usb 9-1: Invalid ep0 maxpacket: 16 [ 659.398709][T16982] loop2: unable to read partition table [ 659.414058][T16982] loop2: partition table beyond EOD, truncated [ 659.433546][T16982] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 659.533961][ T5846] usb 9-1: new low-speed USB device number 33 using dummy_hcd [ 659.733546][ T5846] usb 9-1: Invalid ep0 maxpacket: 16 [ 659.766583][ T5846] usb usb9-port1: attempt power cycle [ 659.781634][T16941] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 659.810459][T16941] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 660.144097][ T5846] usb 9-1: new low-speed USB device number 34 using dummy_hcd [ 660.181909][ T5846] usb 9-1: Invalid ep0 maxpacket: 16 [ 660.335089][ T5846] usb 9-1: new low-speed USB device number 35 using dummy_hcd [ 660.377280][ T5846] usb 9-1: Invalid ep0 maxpacket: 16 [ 660.394943][ T5846] usb usb9-port1: unable to enumerate USB device [ 661.009017][T17019] overlayfs: failed to resolve './file1': -2 [ 661.122924][ T5846] usb 10-1: USB disconnect, device number 22 [ 661.288004][T17024] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 661.323194][T17027] loop2: detected capacity change from 0 to 7 [ 661.337192][T17027] Dev loop2: unable to read RDB block 7 [ 661.342821][T17027] loop2: unable to read partition table [ 661.353235][T17027] loop2: partition table beyond EOD, truncated [ 661.373954][T17027] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 661.631829][T17037] usb usb8: usbfs: process 17037 (syz.9.2733) did not claim interface 0 before use [ 662.363844][ T5919] usb 9-1: new high-speed USB device number 36 using dummy_hcd [ 662.540916][ T5919] usb 9-1: Using ep0 maxpacket: 8 [ 662.549510][ T5919] usb 9-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 662.563521][ T5919] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 662.574296][ T5919] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 662.585184][ T5919] usb 9-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 662.600529][ T5919] usb 9-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 662.612960][ T5919] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 662.843637][ T5919] usb 9-1: GET_CAPABILITIES returned 0 [ 662.849185][ T5919] usbtmc 9-1:16.0: can't read capabilities [ 663.352240][ T5887] usb 9-1: USB disconnect, device number 36 [ 663.437391][T17084] /dev/rnullb0: Can't open blockdev [ 663.541776][T17086] loop2: detected capacity change from 0 to 7 [ 663.566748][T13132] Dev loop2: unable to read RDB block 7 [ 663.572593][T13132] loop2: unable to read partition table [ 663.579806][T13132] loop2: partition table beyond EOD, truncated [ 663.590986][T17086] Dev loop2: unable to read RDB block 7 [ 663.603093][T17086] loop2: unable to read partition table [ 663.616570][T17086] loop2: partition table beyond EOD, truncated [ 663.633055][T17086] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 664.364227][T17110] /dev/rnullb0: Can't open blockdev [ 664.596957][T17121] /dev/rnullb0: Can't open blockdev [ 664.897561][T17131] /dev/rnullb0: Can't open blockdev [ 664.935439][T17132] /dev/rnullb0: Can't open blockdev [ 665.272154][T17144] /dev/rnullb0: Can't open blockdev [ 665.479890][T17151] overlayfs: overlapping lowerdir path [ 665.707647][T17162] loop2: detected capacity change from 0 to 7 [ 665.728507][T17162] Dev loop2: unable to read RDB block 7 [ 665.734339][T17162] loop2: unable to read partition table [ 665.744204][T17162] loop2: partition table beyond EOD, truncated [ 665.759937][T17162] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 665.979659][T17171] /dev/rnullb0: Can't open blockdev [ 666.004796][T17172] vhci_hcd vhci_hcd.0: pdev(7) rhport(0) sockfd(4) [ 666.011363][T17172] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 666.075225][T17172] vhci_hcd vhci_hcd.0: Device attached [ 666.092446][T17174] vhci_hcd: connection closed [ 666.153576][ T1086] vhci_hcd: stop threads [ 666.162578][ T1086] vhci_hcd: release socket [ 666.202790][ T1086] vhci_hcd: disconnect device [ 666.264925][ T5919] vhci_hcd: vhci_device speed not set [ 666.305540][T17185] overlay: filesystem on ./bus not supported [ 666.464041][T15173] usb 1-1: new high-speed USB device number 36 using dummy_hcd [ 666.627040][T15173] usb 1-1: device descriptor read/64, error -71 [ 666.787920][ T30] audit: type=1800 audit(666.740:144): pid=17197 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.7.2764" name="file1" dev="overlay" ino=1215 res=0 errno=0 [ 666.842313][ T30] audit: type=1326 audit(666.770:145): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17196 comm="syz.7.2764" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f96dc78eb69 code=0x0 [ 666.874291][T15173] usb 1-1: new high-speed USB device number 37 using dummy_hcd [ 667.013552][T15173] usb 1-1: device descriptor read/64, error -71 [ 667.124054][T15173] usb usb1-port1: attempt power cycle [ 667.201830][T17205] /dev/rnullb0: Can't open blockdev [ 667.523310][T15173] usb 1-1: new high-speed USB device number 38 using dummy_hcd [ 667.590874][T15173] usb 1-1: device descriptor read/8, error -71 [ 667.697054][T17218] /dev/rnullb0: Can't open blockdev [ 667.760164][T17221] loop2: detected capacity change from 0 to 7 [ 667.767782][T17221] Dev loop2: unable to read RDB block 7 [ 667.785235][T17221] loop2: unable to read partition table [ 667.791139][T17221] loop2: partition table beyond EOD, truncated [ 667.833670][T17221] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 667.853573][T15173] usb 1-1: new high-speed USB device number 39 using dummy_hcd [ 667.893048][T15173] usb 1-1: device descriptor read/8, error -71 [ 668.013922][T15173] usb usb1-port1: unable to enumerate USB device [ 668.478490][T17235] netlink: 8 bytes leftover after parsing attributes in process `syz.7.2772'. [ 668.527121][T17235] netlink: 8 bytes leftover after parsing attributes in process `syz.7.2772'. [ 669.369897][ T30] audit: type=1800 audit(669.320:146): pid=17258 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.7.2775" name="file1" dev="overlay" ino=1259 res=0 errno=0 [ 669.402871][T17258] netlink: 24 bytes leftover after parsing attributes in process `syz.7.2775'. [ 669.415140][ T5919] usb 10-1: new high-speed USB device number 23 using dummy_hcd [ 669.727711][T17270] loop2: detected capacity change from 0 to 7 [ 669.764944][T13132] Dev loop2: unable to read RDB block 7 [ 669.803708][T13132] loop2: unable to read partition table [ 669.810085][T13132] loop2: partition table beyond EOD, truncated [ 669.882554][T17270] Dev loop2: unable to read RDB block 7 [ 669.890086][T17270] loop2: unable to read partition table [ 669.910466][T17270] loop2: partition table beyond EOD, truncated [ 669.939866][T17270] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 669.956108][ T5919] usb 10-1: device descriptor read/64, error -71 [ 670.184327][T17279] ceph: Path missing in source [ 670.213572][ T5919] usb 10-1: new high-speed USB device number 24 using dummy_hcd [ 670.398081][ T5919] usb 10-1: Using ep0 maxpacket: 16 [ 670.421469][ T5919] usb 10-1: config 0 has an invalid interface number: 105 but max is 0 [ 670.470428][T17284] binder: 17283:17284 ioctl c018620b 0 returned -14 [ 670.473556][ T5919] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 670.513472][ T5919] usb 10-1: config 0 has no interface number 0 [ 670.598744][ T5919] usb 10-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice= b.28 [ 670.628020][ T5919] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 670.669041][ T5919] usb 10-1: Product: syz [ 670.701049][ T5919] usb 10-1: Manufacturer: syz [ 670.725956][ T5919] usb 10-1: SerialNumber: syz [ 670.859676][ T5919] usb 10-1: config 0 descriptor?? [ 670.909786][ T5919] usb 10-1: Found UVC 0.00 device syz (046d:08f3) [ 670.961365][ T5919] usb 10-1: No valid video chain found. [ 671.089791][T17293] ISOFS: Unable to identify CD-ROM format. [ 671.275904][ T5919] usb 10-1: USB disconnect, device number 24 [ 671.460727][T17301] vhci_hcd vhci_hcd.0: pdev(7) rhport(0) sockfd(7) [ 671.467300][T17301] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 671.497684][T17301] vhci_hcd vhci_hcd.0: Device attached [ 671.673705][T15173] vhci_hcd: vhci_device speed not set [ 671.735181][T15173] usb 47-1: new high-speed USB device number 3 using vhci_hcd [ 672.014714][ T5887] usb 1-1: new high-speed USB device number 40 using dummy_hcd [ 672.185962][ T5887] usb 1-1: Using ep0 maxpacket: 8 [ 672.219217][ T5887] usb 1-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2e.04 [ 672.241579][T17105] Set syz1 is full, maxelem 65536 reached [ 672.249280][ T5887] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 672.273879][ T5887] usb 1-1: Product: syz [ 672.278100][ T5887] usb 1-1: Manufacturer: syz [ 672.303551][ T5887] usb 1-1: SerialNumber: syz [ 672.362808][ T5887] usb 1-1: config 0 descriptor?? [ 672.583677][T17321] /dev/rnullb0: Can't open blockdev [ 672.615418][ T5887] usb 1-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 672.714204][T17325] loop2: detected capacity change from 0 to 7 [ 672.727223][T17325] Dev loop2: unable to read RDB block 7 [ 672.756676][T17327] 9p: Unknown access argument : -22 [ 672.762222][T17325] loop2: unable to read partition table [ 672.784046][T17325] loop2: partition table beyond EOD, truncated [ 672.819240][T17327] /dev/rnullb0: Can't open blockdev [ 672.823210][T17325] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 673.088344][T17339] dlm: no locking on control device [ 673.342298][ T30] audit: type=1326 audit(673.290:147): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17348 comm="syz.9.2792" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fa6eb58eb69 code=0x0 [ 673.505085][T11451] usb 9-1: new high-speed USB device number 37 using dummy_hcd [ 673.619868][T17309] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 673.631224][T17309] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 673.648469][T11451] usb 9-1: device descriptor read/64, error -71 [ 673.893500][T11451] usb 9-1: new high-speed USB device number 38 using dummy_hcd [ 674.046211][T11451] usb 9-1: device descriptor read/64, error -71 [ 674.156732][T11451] usb usb9-port1: attempt power cycle [ 674.261728][ T5887] dvb_usb_rtl28xxu 1-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 674.280767][ T5887] usb 1-1: USB disconnect, device number 40 [ 674.402606][T17302] vhci_hcd: connection reset by peer [ 674.435375][ T1166] vhci_hcd: stop threads [ 674.439684][ T1166] vhci_hcd: release socket [ 674.454458][ T1166] vhci_hcd: disconnect device [ 674.533095][T17366] /dev/rnullb0: Can't open blockdev [ 674.583862][T11451] usb 9-1: new high-speed USB device number 39 using dummy_hcd [ 674.622196][T11451] usb 9-1: device descriptor read/8, error -71 [ 674.896124][T11451] usb 9-1: new high-speed USB device number 40 using dummy_hcd [ 674.947894][T11451] usb 9-1: device descriptor read/8, error -71 [ 675.094307][T11451] usb usb9-port1: unable to enumerate USB device [ 675.209719][T17371] loop2: detected capacity change from 0 to 7 [ 675.235531][T17371] Dev loop2: unable to read RDB block 7 [ 675.248092][T17371] loop2: unable to read partition table [ 675.256415][T17371] loop2: partition table beyond EOD, truncated [ 675.269813][T17371] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 675.610692][T17378] cgroup: Unknown subsys name 'context' [ 675.620278][T17378] overlayfs: missing 'workdir' [ 675.731505][T17382] /dev/rnullb0: Can't open blockdev [ 676.895079][T15173] vhci_hcd: vhci_device speed not set [ 677.031019][T17403] loop2: detected capacity change from 0 to 7 [ 677.047612][T17403] Dev loop2: unable to read RDB block 7 [ 677.053846][T17403] loop2: unable to read partition table [ 677.059836][T17403] loop2: partition table beyond EOD, truncated [ 677.070113][T17403] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 677.281997][ T30] audit: type=1800 audit(677.230:148): pid=17409 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.8.2810" name="file1" dev="overlay" ino=1016 res=0 errno=0 [ 677.358438][T17411] netlink: 256 bytes leftover after parsing attributes in process `syz.9.2811'. [ 677.693740][T13857] usb 9-1: new full-speed USB device number 41 using dummy_hcd [ 677.805972][T17420] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2815'. [ 677.865133][T13857] usb 9-1: config index 0 descriptor too short (expected 8228, got 36) [ 677.883551][T13857] usb 9-1: config 0 interface 0 altsetting 32 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 677.906524][T13857] usb 9-1: config 0 interface 0 altsetting 32 endpoint 0x81 has invalid wMaxPacketSize 0 [ 677.917050][T13857] usb 9-1: config 0 interface 0 has no altsetting 0 [ 677.924073][T13857] usb 9-1: New USB device found, idVendor=1e7d, idProduct=2dbe, bcdDevice= 0.00 [ 677.933760][T13857] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 677.972457][T13857] usb 9-1: config 0 descriptor?? [ 678.006821][T17429] loop2: detected capacity change from 0 to 7 [ 678.019136][T13132] Dev loop2: unable to read RDB block 7 [ 678.025553][T13132] loop2: unable to read partition table [ 678.031612][T13132] loop2: partition table beyond EOD, truncated [ 678.040622][T17429] Dev loop2: unable to read RDB block 7 [ 678.046462][T17429] loop2: unable to read partition table [ 678.052488][T17429] loop2: partition table beyond EOD, truncated [ 678.062440][T17429] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 678.110074][T17430] /dev/rnullb0: Can't open blockdev [ 678.224178][T13857] usbhid 9-1:0.0: can't add hid device: -71 [ 678.230834][T13857] usbhid 9-1:0.0: probe with driver usbhid failed with error -71 [ 678.267426][T13857] usb 9-1: USB disconnect, device number 41 [ 678.793937][T11395] usb 9-1: new full-speed USB device number 42 using dummy_hcd [ 678.913658][ T30] audit: type=1800 audit(678.850:149): pid=17461 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.7.2826" name="file1" dev="overlay" ino=1314 res=0 errno=0 [ 678.944401][T11395] usb 9-1: device descriptor read/64, error -71 [ 679.048154][T17466] loop2: detected capacity change from 0 to 7 [ 679.057644][T17466] Dev loop2: unable to read RDB block 7 [ 679.063280][T17466] loop2: unable to read partition table [ 679.072703][T17466] loop2: partition table beyond EOD, truncated [ 679.082355][T17466] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 679.190858][T17469] /dev/rnullb0: Can't open blockdev [ 679.524765][T11395] usb 9-1: new full-speed USB device number 43 using dummy_hcd [ 679.693520][ T5846] usb 1-1: new high-speed USB device number 41 using dummy_hcd [ 679.701439][T11395] usb 9-1: device descriptor read/64, error -71 [ 679.834840][T11395] usb usb9-port1: attempt power cycle [ 679.885799][ T5846] usb 1-1: config 17 has an invalid descriptor of length 222, skipping remainder of the config [ 679.916577][ T5846] usb 1-1: config 17 interface 0 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 679.958180][ T5846] usb 1-1: config 17 interface 0 has no altsetting 0 [ 679.985542][ T5846] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 680.008206][ T5846] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 680.025862][ T5846] usb 1-1: Product: syz [ 680.050973][ T5846] usb 1-1: Manufacturer: syz [ 680.063455][ T5846] usb 1-1: SerialNumber: syz [ 680.203621][T11395] usb 9-1: new full-speed USB device number 44 using dummy_hcd [ 680.250417][T11395] usb 9-1: device descriptor read/8, error -71 [ 680.503631][T11395] usb 9-1: new full-speed USB device number 45 using dummy_hcd [ 680.538180][T11395] usb 9-1: device descriptor read/8, error -71 [ 680.654078][T11395] usb usb9-port1: unable to enumerate USB device [ 680.739482][T17492] /dev/rnullb0: Can't open blockdev [ 680.822249][T17497] /dev/rnullb0: Can't open blockdev [ 681.113873][T17489] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 681.123302][T17489] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 681.145182][T17506] syzkaller1: entered promiscuous mode [ 681.150711][T17506] syzkaller1: entered allmulticast mode [ 681.160621][T17506] /dev/rnullb0: Can't open blockdev [ 681.353178][T17514] loop2: detected capacity change from 0 to 7 [ 681.362730][T17514] Dev loop2: unable to read RDB block 7 [ 681.372101][T17514] loop2: unable to read partition table [ 681.378449][T17514] loop2: partition table beyond EOD, truncated [ 681.385493][T17514] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 681.653009][T17523] netlink: 24 bytes leftover after parsing attributes in process `syz.8.2840'. [ 681.667120][T17523] netlink: 80 bytes leftover after parsing attributes in process `syz.8.2840'. [ 681.759658][T11395] usb 10-1: new high-speed USB device number 25 using dummy_hcd [ 681.780837][T17525] /dev/rnullb0: Can't open blockdev [ 681.903499][T11395] usb 10-1: device descriptor read/64, error -71 [ 682.001604][T17532] overlayfs: workdir and upperdir must reside under the same mount [ 682.026346][T17532] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 682.153522][T11395] usb 10-1: new high-speed USB device number 26 using dummy_hcd [ 682.315898][T11395] usb 10-1: device descriptor read/64, error -71 [ 682.320059][T17540] netlink: 4 bytes leftover after parsing attributes in process `syz.8.2846'. [ 682.345659][T17541] loop2: detected capacity change from 0 to 7 [ 682.353912][T17540] netlink: 196 bytes leftover after parsing attributes in process `syz.8.2846'. [ 682.365643][T17541] Dev loop2: unable to read RDB block 7 [ 682.376991][T17541] loop2: unable to read partition table [ 682.384361][T17541] loop2: partition table beyond EOD, truncated [ 682.391749][T17541] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 682.444003][T11395] usb usb10-port1: attempt power cycle [ 682.558300][ T5846] usb 1-1: USB disconnect, device number 41 [ 682.833297][T17554] befs: (nullb0): invalid magic header [ 682.845945][T17554] QAT: Invalid ioctl -1070033885 [ 682.873561][T11395] usb 10-1: new high-speed USB device number 27 using dummy_hcd [ 682.900953][T17556] /dev/rnullb0: Can't open blockdev [ 682.908654][T11395] usb 10-1: device descriptor read/8, error -71 [ 682.981696][T17558] netlink: 112 bytes leftover after parsing attributes in process `syz.8.2854'. [ 683.153992][T11395] usb 10-1: new high-speed USB device number 28 using dummy_hcd [ 683.204588][T11395] usb 10-1: device descriptor read/8, error -71 [ 683.244103][T17567] loop2: detected capacity change from 0 to 7 [ 683.253767][T17567] Dev loop2: unable to read RDB block 7 [ 683.259401][T17567] loop2: unable to read partition table [ 683.265752][T17567] loop2: partition table beyond EOD, truncated [ 683.283531][T17567] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 683.313984][T11395] usb usb10-port1: unable to enumerate USB device [ 683.413156][T17575] /dev/rnullb0: Can't open blockdev [ 684.287429][T17605] batadv_slave_0: entered promiscuous mode [ 684.570611][T17610] netlink: 248 bytes leftover after parsing attributes in process `syz.9.2870'. [ 685.047101][ T5846] usb 10-1: new high-speed USB device number 29 using dummy_hcd [ 685.083515][T17604] batadv_slave_0: left promiscuous mode [ 685.200215][ T5846] usb 10-1: device descriptor read/64, error -71 [ 685.435575][T17629] /dev/rnullb0: Can't open blockdev [ 685.463749][ T5846] usb 10-1: new high-speed USB device number 30 using dummy_hcd [ 685.533593][T17635] dlm: non-version read from control device 239 [ 685.613893][ T5846] usb 10-1: device descriptor read/64, error -71 [ 685.764386][ T5846] usb usb10-port1: attempt power cycle [ 685.793659][ T1306] ieee802154 phy0 wpan0: encryption failed: -22 [ 686.123968][ T5846] usb 10-1: new high-speed USB device number 31 using dummy_hcd [ 686.133524][T15173] usb 9-1: new high-speed USB device number 46 using dummy_hcd [ 686.144144][ T5846] usb 10-1: device descriptor read/8, error -71 [ 686.285961][T15173] usb 9-1: New USB device found, idVendor=0471, idProduct=0329, bcdDevice=db.da [ 686.296370][T15173] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 686.309603][T15173] usb 9-1: config 0 descriptor?? [ 686.320345][T15173] pwc: Philips SPC 900NC USB webcam detected. [ 686.393649][ T5846] usb 10-1: new high-speed USB device number 32 using dummy_hcd [ 686.419527][ T5846] usb 10-1: device descriptor read/8, error -71 [ 686.488381][T17659] syz.0.2881: attempt to access beyond end of device [ 686.488381][T17659] nbd0: rw=0, sector=64, nr_sectors = 1 limit=0 [ 686.503899][T17659] syz.0.2881: attempt to access beyond end of device [ 686.503899][T17659] nbd0: rw=0, sector=256, nr_sectors = 1 limit=0 [ 686.521172][T17659] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=256, location=256 [ 686.535195][ T5846] usb usb10-port1: unable to enumerate USB device [ 686.542458][T17659] syz.0.2881: attempt to access beyond end of device [ 686.542458][T17659] nbd0: rw=0, sector=512, nr_sectors = 1 limit=0 [ 686.558501][T17659] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=512, location=512 [ 686.571328][T17659] syz.0.2881: attempt to access beyond end of device [ 686.571328][T17659] nbd0: rw=0, sector=64, nr_sectors = 2 limit=0 [ 686.586715][T17659] syz.0.2881: attempt to access beyond end of device [ 686.586715][T17659] nbd0: rw=0, sector=512, nr_sectors = 2 limit=0 [ 686.600472][T17659] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=256, location=256 [ 686.610778][T17659] syz.0.2881: attempt to access beyond end of device [ 686.610778][T17659] nbd0: rw=0, sector=1024, nr_sectors = 2 limit=0 [ 686.626689][T17659] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=512, location=512 [ 686.640707][T17659] syz.0.2881: attempt to access beyond end of device [ 686.640707][T17659] nbd0: rw=0, sector=64, nr_sectors = 4 limit=0 [ 686.658717][T17659] syz.0.2881: attempt to access beyond end of device [ 686.658717][T17659] nbd0: rw=0, sector=1024, nr_sectors = 4 limit=0 [ 686.674465][T17659] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=256, location=256 [ 686.688030][T17659] syz.0.2881: attempt to access beyond end of device [ 686.688030][T17659] nbd0: rw=0, sector=2048, nr_sectors = 4 limit=0 [ 686.703331][T17659] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=512, location=512 [ 686.718805][T17659] syz.0.2881: attempt to access beyond end of device [ 686.718805][T17659] nbd0: rw=0, sector=64, nr_sectors = 8 limit=0 [ 686.732552][T17659] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=256, location=256 [ 686.752369][T17659] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=512, location=512 [ 686.763998][T17659] UDF-fs: warning (device nbd0): udf_fill_super: No partition found (1) [ 687.961984][T17666] /dev/rnullb0: Can't open blockdev [ 688.713191][T15173] pwc: Failed to set LED on/off time (-71) [ 688.720042][T15173] pwc: send_video_command error -71 [ 688.729884][T15173] pwc: Failed to set video mode VGA@30 fps; return code = -71 [ 688.744617][T15173] Philips webcam 9-1:0.0: probe with driver Philips webcam failed with error -71 [ 688.765702][T15173] usb 9-1: USB disconnect, device number 46 [ 688.880859][T11451] hid-generic 0000:0000:0000.001D: unknown main item tag 0x0 [ 688.920129][T11451] hid-generic 0000:0000:0000.001D: hidraw0: HID v0.00 Device [syz1] on syz0 [ 689.682318][T17699] /dev/rnullb0: Can't open blockdev [ 689.684743][T17702] /dev/rnullb0: Can't open blockdev [ 689.708684][T17700] /dev/rnullb0: Can't open blockdev [ 690.284597][T17717] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 690.313296][T17717] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 691.313944][T15173] usb 9-1: new high-speed USB device number 47 using dummy_hcd [ 691.398017][T17754] netlink: 'syz.0.2909': attribute type 29 has an invalid length. [ 691.419979][T17754] XFS (nbd0): SB validate failed with error -5. [ 691.463858][T15173] usb 9-1: Using ep0 maxpacket: 32 [ 691.493307][T15173] usb 9-1: unable to get BOS descriptor or descriptor too short [ 691.518048][T15173] usb 9-1: config 4 has an invalid interface number: 101 but max is 0 [ 691.539700][T15173] usb 9-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 691.553055][T15173] usb 9-1: config 4 has no interface number 0 [ 691.566599][T15173] usb 9-1: New USB device found, idVendor=0b48, idProduct=2003, bcdDevice=a5.52 [ 691.578974][T15173] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 691.587371][T15173] usb 9-1: Product: syz [ 691.591610][T15173] usb 9-1: Manufacturer: syz [ 691.596369][T15173] usb 9-1: SerialNumber: syz [ 691.818404][T17750] /dev/rnullb0: Can't open blockdev [ 691.836958][T15173] ttusbir 9-1:4.101: cannot find expected altsetting [ 691.856915][T15173] usb 9-1: USB disconnect, device number 47 [ 691.941493][T17776] netlink: 830 bytes leftover after parsing attributes in process `syz.9.2915'. [ 692.523576][ T44] usb 1-1: new high-speed USB device number 42 using dummy_hcd [ 693.343626][T15173] usb 10-1: new high-speed USB device number 33 using dummy_hcd [ 693.509713][T15173] usb 10-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 693.525054][T15173] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 693.535793][T15173] usb 10-1: Product: syz [ 693.540143][T15173] usb 10-1: Manufacturer: syz [ 693.548986][T15173] usb 10-1: SerialNumber: syz [ 693.565083][T15173] usb 10-1: config 0 descriptor?? [ 693.598355][T15173] i2c-tiny-usb 10-1:0.0: version 6d.cc found at bus 010 address 033 [ 693.641714][ T44] usb 1-1: Using ep0 maxpacket: 32 [ 693.662724][ T44] usb 1-1: config 0 has an invalid interface number: 231 but max is 0 [ 693.672214][ T44] usb 1-1: config 0 has no interface number 0 [ 693.678614][ T44] usb 1-1: config 0 interface 231 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 693.688939][ T44] usb 1-1: config 0 interface 231 altsetting 0 endpoint 0x82 has invalid maxpacket 46088, setting to 1024 [ 693.700351][ T44] usb 1-1: config 0 interface 231 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 1024 [ 693.713471][ T44] usb 1-1: New USB device found, idVendor=067b, idProduct=27a1, bcdDevice=b0.9b [ 693.722550][ T44] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 693.735090][ T44] usb 1-1: Product: syz [ 693.741796][ T44] usb 1-1: Manufacturer: syz [ 693.746635][ T44] usb 1-1: SerialNumber: syz [ 693.764529][ T44] usb 1-1: config 0 descriptor?? [ 693.770407][T17780] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 693.778005][T17780] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 693.800775][T17792] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 693.825544][T17792] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 693.839547][ T44] plusb 1-1:0.231 usb0: register 'plusb' at usb-dummy_hcd.0-1, Prolific PL-2301/PL-2302/PL-25A1/PL-27A1, 32:80:85:e0:6c:8d [ 693.895755][T17796] /dev/rnullb0: Can't open blockdev [ 694.066371][T15173] (null): failure reading functionality [ 694.682376][T17821] Bluetooth: MGMT ver 1.23 [ 694.886647][T17825] /dev/rnullb0: Can't open blockdev [ 695.048515][T11395] usb 1-1: USB disconnect, device number 42 [ 695.076088][T11395] plusb 1-1:0.231 usb0: unregister 'plusb' usb-dummy_hcd.0-1, Prolific PL-2301/PL-2302/PL-25A1/PL-27A1 [ 695.231747][T17836] /dev/rnullb0: Can't open blockdev [ 696.106408][T15173] i2c i2c-3: failure reading functionality [ 696.141893][T15173] i2c i2c-3: connected i2c-tiny-usb device [ 696.235783][T11395] usb 10-1: USB disconnect, device number 33 [ 696.251086][T17861] /dev/rnullb0: Can't open blockdev [ 696.339632][T17868] kAFS: unable to lookup cell '' [ 698.385770][T17901] sit0: entered promiscuous mode [ 698.406029][T17901] netlink: 'syz.9.2946': attribute type 1 has an invalid length. [ 698.444576][T17901] netlink: 1 bytes leftover after parsing attributes in process `syz.9.2946'. [ 698.497020][T17905] Bluetooth: MGMT ver 1.23 [ 698.764148][T15173] usb 9-1: new high-speed USB device number 48 using dummy_hcd [ 698.793727][ T5887] usb 10-1: new high-speed USB device number 34 using dummy_hcd [ 698.883826][T13857] kernel write not supported for file /258/clear_refs (pid: 13857 comm: kworker/0:6) [ 698.913701][T15173] usb 9-1: Using ep0 maxpacket: 16 [ 698.921097][T15173] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 698.932581][T15173] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 698.943705][T15173] usb 9-1: New USB device found, idVendor=28bd, idProduct=0074, bcdDevice= 0.00 [ 698.952862][T15173] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 698.969594][T15173] usb 9-1: config 0 descriptor?? [ 698.976895][ T5887] usb 10-1: config 220 has an invalid interface number: 76 but max is 2 [ 699.006363][ T5887] usb 10-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 699.028863][ T5887] usb 10-1: config 220 has no interface number 2 [ 699.047981][ T5887] usb 10-1: config 220 interface 1 altsetting 5 has an endpoint descriptor with address 0x6F, changing to 0xF [ 699.060467][ T5887] usb 10-1: config 220 interface 1 altsetting 5 endpoint 0xF has an invalid bInterval 104, changing to 10 [ 699.072456][ T5887] usb 10-1: config 220 interface 1 altsetting 5 endpoint 0xF has invalid maxpacket 41325, setting to 1024 [ 699.097956][ T5887] usb 10-1: config 220 interface 1 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 12 [ 699.111969][ T5887] usb 10-1: config 220 interface 0 has no altsetting 0 [ 699.123358][ T5887] usb 10-1: config 220 interface 76 has no altsetting 0 [ 699.131031][ T5887] usb 10-1: config 220 interface 1 has no altsetting 0 [ 699.145452][ T5887] usb 10-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 699.161733][ T5887] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 699.164173][T17924] /dev/rnullb0: Can't open blockdev [ 699.170511][ T5887] usb 10-1: Product: syz [ 699.186387][ T5887] usb 10-1: Manufacturer: syz [ 699.191214][ T5887] usb 10-1: SerialNumber: syz [ 699.342212][T17931] loop2: detected capacity change from 0 to 7 [ 699.350860][T13132] Dev loop2: unable to read RDB block 7 [ 699.357258][T13132] loop2: unable to read partition table [ 699.363279][T13132] loop2: partition table beyond EOD, truncated [ 699.375255][T17931] Dev loop2: unable to read RDB block 7 [ 699.385600][T17931] loop2: unable to read partition table [ 699.391544][T17931] loop2: partition table beyond EOD, truncated [ 699.391844][T15173] uclogic 0003:28BD:0074.001E: interface is invalid, ignoring [ 699.398340][T17931] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 699.450204][T17901] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 699.459280][T17901] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 699.494145][T11395] usb 1-1: new full-speed USB device number 43 using dummy_hcd [ 699.614598][T15173] usb 9-1: USB disconnect, device number 48 [ 699.654881][T11395] usb 1-1: device descriptor read/64, error -71 [ 699.896903][T11395] usb 1-1: new full-speed USB device number 44 using dummy_hcd [ 700.043694][T11395] usb 1-1: device descriptor read/64, error -71 [ 700.155083][T11395] usb usb1-port1: attempt power cycle [ 700.534895][T11395] usb 1-1: new full-speed USB device number 45 using dummy_hcd [ 700.594426][T11395] usb 1-1: device descriptor read/8, error -71 [ 700.835569][T11395] usb 1-1: new full-speed USB device number 46 using dummy_hcd [ 700.878074][T11395] usb 1-1: device descriptor read/8, error -71 [ 700.993950][T11395] usb usb1-port1: unable to enumerate USB device [ 701.469813][ T5887] usb 10-1: selecting invalid altsetting 0 [ 701.508172][ T5887] usb 10-1: Found UVC 7.01 device syz (8086:0b07) [ 701.522692][ T5887] usb 10-1: No valid video chain found. [ 701.573552][ T5887] usb 10-1: selecting invalid altsetting 0 [ 701.591558][ T5887] usbtest 10-1:220.1: probe with driver usbtest failed with error -22 [ 701.621844][ T5887] usb 10-1: USB disconnect, device number 34 [ 702.643572][T15173] usb 1-1: new full-speed USB device number 47 using dummy_hcd [ 702.827539][T15173] usb 1-1: config 0 has an invalid interface number: 29 but max is 0 [ 702.840586][T15173] usb 1-1: config 0 has no interface number 0 [ 702.852327][T15173] usb 1-1: config 0 interface 29 has no altsetting 0 [ 702.866525][T15173] usb 1-1: New USB device found, idVendor=0c72, idProduct=0014, bcdDevice=39.ac [ 702.884232][T15173] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 702.893216][T15173] usb 1-1: Product: syz [ 702.930110][T15173] usb 1-1: Manufacturer: syz [ 702.958164][T15173] usb 1-1: SerialNumber: syz [ 702.980368][T15173] usb 1-1: config 0 descriptor?? [ 703.017243][ T5887] usb 10-1: new high-speed USB device number 35 using dummy_hcd [ 703.184501][ T5887] usb 10-1: Using ep0 maxpacket: 16 [ 703.221006][T17977] /dev/rnullb0: Can't open blockdev [ 703.244915][T15173] peak_usb 1-1:0.29 can0: unable to request usb[type=0 value=1] err=-71 [ 703.253341][T15173] peak_usb 1-1:0.29: unable to read PCAN-USB X6 firmware info (err -71) [ 703.355850][T15173] peak_usb 1-1:0.29: probe with driver peak_usb failed with error -71 [ 703.360431][ T5887] usb 10-1: New USB device found, idVendor=061d, idProduct=c020, bcdDevice=9c.15 [ 703.383463][ T5887] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 703.402001][ T5887] usb 10-1: Product: syz [ 703.404430][T15173] usb 1-1: USB disconnect, device number 47 [ 703.412201][ T5887] usb 10-1: Manufacturer: syz [ 703.422353][ T5887] usb 10-1: SerialNumber: syz [ 703.441575][ T5887] usb 10-1: config 0 descriptor?? [ 703.456164][ T5887] ssu100 10-1:0.0: Quatech SSU-100 USB to Serial Driver converter detected [ 704.009818][T17998] /dev/rnullb0: Can't open blockdev [ 704.078117][T18002] loop2: detected capacity change from 0 to 7 [ 704.105449][T18002] Dev loop2: unable to read RDB block 7 [ 704.125848][T18002] loop2: unable to read partition table [ 704.142817][T18002] loop2: partition table beyond EOD, truncated [ 704.163714][T18002] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 704.627950][T18022] /dev/rnullb0: Can't open blockdev [ 704.628148][T15173] usb 9-1: new high-speed USB device number 49 using dummy_hcd [ 704.663107][T17972] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 704.672437][T17972] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 704.691637][T17972] MTD: Attempt to mount non-MTD device "/dev/rnullb0" [ 704.703019][T17972] /dev/rnullb0: Can't open blockdev [ 704.737482][ T5887] usb 10-1: Quatech SSU-100 USB to Serial Driver converter now attached to ttyUSB0 [ 704.836216][T15173] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 704.855667][T15173] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 704.885941][T15173] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 704.903261][T18033] /dev/rnullb0: Can't open blockdev [ 704.932211][T15173] usb 9-1: New USB device found, idVendor=1e7d, idProduct=3232, bcdDevice= 0.00 [ 704.950106][T15173] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 704.973229][T15173] usb 9-1: config 0 descriptor?? [ 705.011267][ T5887] usb 10-1: USB disconnect, device number 35 [ 705.041852][ T5887] ssu100 ttyUSB0: Quatech SSU-100 USB to Serial Driver converter now disconnected from ttyUSB0 [ 705.079683][ T5887] ssu100 10-1:0.0: device disconnected [ 705.088496][T18037] loop2: detected capacity change from 0 to 7 [ 705.099798][T18037] Dev loop2: unable to read RDB block 7 [ 705.107922][T18037] loop2: unable to read partition table [ 705.116043][T18037] loop2: partition table beyond EOD, truncated [ 705.129467][T18037] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 705.364495][T18039] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 705.388662][T15173] ryos 0003:1E7D:3232.001F: unbalanced delimiter at end of report description [ 705.409275][T15173] ryos 0003:1E7D:3232.001F: parse failed [ 705.423608][T15173] ryos 0003:1E7D:3232.001F: probe with driver ryos failed with error -22 [ 705.597174][T18012] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 705.618675][T18012] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 705.643733][T18012] /dev/rnullb0: Can't open blockdev [ 705.658561][ T5887] usb 9-1: USB disconnect, device number 49 [ 705.911567][ T5887] hid-generic 0003:007F:0006.0020: item fetching failed at offset 8/43 [ 705.936300][ T5887] hid-generic 0003:007F:0006.0020: probe with driver hid-generic failed with error -22 [ 706.101118][T18066] loop2: detected capacity change from 0 to 7 [ 706.114169][T17474] Dev loop2: unable to read RDB block 7 [ 706.120064][T17474] loop2: unable to read partition table [ 706.132630][T17474] loop2: partition table beyond EOD, truncated [ 706.142503][T18066] Dev loop2: unable to read RDB block 7 [ 706.152901][T18066] loop2: unable to read partition table [ 706.175980][T18066] loop2: partition table beyond EOD, truncated [ 706.197048][T18066] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 706.325863][T18069] ubi31: attaching mtd0 [ 706.341702][T18069] ubi31 error: ubi_attach_mtd_dev: bad VID header (67104) or data offsets (67168) [ 706.724045][ T5887] usb 1-1: new high-speed USB device number 48 using dummy_hcd [ 706.773683][T11395] usb 10-1: new low-speed USB device number 36 using dummy_hcd [ 706.836678][T18082] sp0: Synchronizing with TNC [ 706.855182][T18081] [U] [ 706.874026][ T5887] usb 1-1: device descriptor read/64, error -71 [ 706.975117][T11395] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 706.986772][T11395] usb 10-1: config 0 interface 0 altsetting 6 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 706.998009][T11395] usb 10-1: config 0 interface 0 altsetting 6 endpoint 0x81 has invalid maxpacket 32, setting to 8 [ 707.008935][T11395] usb 10-1: config 0 interface 0 has no altsetting 0 [ 707.016567][T11395] usb 10-1: New USB device found, idVendor=046d, idProduct=c086, bcdDevice= 0.00 [ 707.036169][T11395] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 707.071663][T11395] usb 10-1: config 0 descriptor?? [ 707.087887][T18080] raw-gadget.3 gadget.9: fail, usb_ep_enable returned -22 [ 707.133826][ T5887] usb 1-1: new high-speed USB device number 49 using dummy_hcd [ 707.283676][ T5887] usb 1-1: device descriptor read/64, error -71 [ 707.394421][ T5887] usb usb1-port1: attempt power cycle [ 707.519908][T11395] logitech-hidpp-device 0003:046D:C086.0021: unknown main item tag 0x0 [ 707.530320][T11395] logitech-hidpp-device 0003:046D:C086.0021: unknown main item tag 0x0 [ 707.538925][T11395] logitech-hidpp-device 0003:046D:C086.0021: unknown main item tag 0x0 [ 707.549125][T11395] logitech-hidpp-device 0003:046D:C086.0021: unknown main item tag 0x0 [ 707.558383][T11395] logitech-hidpp-device 0003:046D:C086.0021: item fetching failed at offset 4/8 [ 707.568486][T11395] logitech-hidpp-device 0003:046D:C086.0021: hidpp_probe:parse failed [ 707.576886][T11395] logitech-hidpp-device 0003:046D:C086.0021: probe with driver logitech-hidpp-device failed with error -22 [ 707.728886][T18101] /dev/rnullb0: Can't open blockdev [ 707.783974][ T5887] usb 1-1: new high-speed USB device number 50 using dummy_hcd [ 707.917941][ T5887] usb 1-1: device descriptor read/8, error -71 [ 707.970706][T18104] loop2: detected capacity change from 0 to 7 [ 707.979455][T18104] Dev loop2: unable to read RDB block 7 [ 707.990467][T18104] loop2: unable to read partition table [ 707.996513][T18104] loop2: partition table beyond EOD, truncated [ 708.005032][T18104] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 708.033321][T11395] usb 10-1: USB disconnect, device number 36 [ 708.194028][ T5887] usb 1-1: new high-speed USB device number 51 using dummy_hcd [ 708.244715][ T5887] usb 1-1: device descriptor read/8, error -71 [ 708.266544][T18110] input: syz0 as /devices/virtual/input/input85 [ 708.364846][ T5887] usb usb1-port1: unable to enumerate USB device [ 708.546618][T18115] /dev/rnullb0: Can't open blockdev [ 708.612787][T11395] usb 9-1: new full-speed USB device number 50 using dummy_hcd [ 708.755763][T18121] overlayfs: unescaped trailing colons in lowerdir mount option. [ 708.776263][T11395] usb 9-1: not running at top speed; connect to a high speed hub [ 708.794691][T11395] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 708.814263][T11395] usb 9-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 708.875892][T11395] usb 9-1: New USB device found, idVendor=0b0e, idProduct=ffff, bcdDevice= 0.40 [ 708.885422][T11395] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 708.897218][T11395] usb 9-1: Product: syz [ 708.901421][T11395] usb 9-1: Manufacturer: syz [ 708.908024][T11395] usb 9-1: SerialNumber: syz [ 708.925562][T18113] raw-gadget.2 gadget.8: fail, usb_ep_enable returned -22 [ 709.043623][T13857] usb 10-1: new high-speed USB device number 37 using dummy_hcd [ 709.080444][T18125] loop2: detected capacity change from 0 to 7 [ 709.089618][T18125] Dev loop2: unable to read RDB block 7 [ 709.095846][T18125] loop2: unable to read partition table [ 709.102370][T18125] loop2: partition table beyond EOD, truncated [ 709.110861][T18125] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 709.179711][T18126] /dev/rnullb0: Can't open blockdev [ 709.204588][T13857] usb 10-1: Using ep0 maxpacket: 16 [ 709.220551][T13857] usb 10-1: config 1 interface 0 altsetting 6 bulk endpoint 0x1 has invalid maxpacket 32 [ 709.239327][T13857] usb 10-1: config 1 interface 0 altsetting 6 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 709.244343][T18128] /dev/rnullb0: Can't open blockdev [ 709.262120][T13857] usb 10-1: config 1 interface 0 has no altsetting 0 [ 709.274992][T11395] usbhid 9-1:1.0: can't add hid device: -71 [ 709.281531][T11395] usbhid 9-1:1.0: probe with driver usbhid failed with error -71 [ 709.300440][T11395] usb 9-1: USB disconnect, device number 50 [ 709.487412][T18132] /dev/rnullb0: Can't open blockdev [ 709.545945][T18134] /dev/rnullb0: Can't open blockdev [ 709.694138][T18143] /dev/rnullb0: Can't open blockdev [ 709.859768][T18149] loop2: detected capacity change from 0 to 7 [ 709.870193][T18149] Dev loop2: unable to read RDB block 7 [ 709.876303][T18149] loop2: unable to read partition table [ 709.882187][T18149] loop2: partition table beyond EOD, truncated [ 709.889108][T18149] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 709.912071][ T30] audit: type=1326 audit(709.860:150): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18146 comm="syz.0.3025" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f30fd18eb69 code=0x0 [ 710.006064][T18152] /dev/rnullb0: Can't open blockdev [ 710.015441][T18153] /dev/rnullb0: Can't open blockdev [ 710.088795][T18155] /dev/rnullb0: Can't open blockdev [ 710.786838][ T30] audit: type=1400 audit(710.740:151): apparmor="DENIED" operation="stack" class="file" info="label not found" error=-2 profile="unconfined" name=26260A3A0CCA7C2B08C9DFF78977F306B457CA93031D371D06D2E59E863E2FE54118A4EE43068DF6BA88E1B6DC3A2F2C91AE1C817D6B6014270B8BC51F73363852F4F12EE955F464599F0C485D pid=18163 comm="syz.0.3032" [ 710.879915][T18166] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 711.812823][T13857] usb 10-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 711.822681][T13857] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 711.838102][T13857] usb 10-1: Product: ᨋҝ켸⾖ꜫ萗◆莗疏輈Đ㬥巗莃⓽൭ᗐ엶ꚪ쒼ᴡ潯撌뵼漜挤珥㝦棷஘்ʨ [ 711.883322][T13857] usb 10-1: can't set config #1, error -71 [ 711.898340][T13857] usb 10-1: USB disconnect, device number 37 [ 711.965725][T18185] /dev/rnullb0: Can't open blockdev [ 713.239242][T18217] netlink: 'syz.8.3049': attribute type 29 has an invalid length. [ 714.413762][T15315] usb 9-1: new full-speed USB device number 51 using dummy_hcd [ 714.589350][T15315] usb 9-1: unable to get BOS descriptor or descriptor too short [ 714.600796][T15315] usb 9-1: not running at top speed; connect to a high speed hub [ 714.618416][T15315] usb 9-1: config 17 has an invalid interface number: 8 but max is 1 [ 714.631411][T15315] usb 9-1: config 17 has 1 interface, different from the descriptor's value: 2 [ 714.643107][T15315] usb 9-1: config 17 has no interface number 0 [ 714.652213][T15315] usb 9-1: config 17 interface 8 altsetting 6 endpoint 0x3 has an invalid bInterval 250, changing to 4 [ 714.667033][T15315] usb 9-1: config 17 interface 8 altsetting 6 endpoint 0x3 has invalid maxpacket 43516, setting to 1023 [ 714.678815][T15315] usb 9-1: config 17 interface 8 has no altsetting 0 [ 714.689819][T15315] usb 9-1: string descriptor 0 read error: -22 [ 714.696579][T15315] usb 9-1: New USB device found, idVendor=0763, idProduct=2001, bcdDevice=2c.ff [ 714.706463][T15315] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 714.731003][T15315] usb 9-1: selecting invalid altsetting 0 [ 714.747034][T15315] usb 9-1: 8:6 : no UAC_FORMAT_TYPE desc [ 714.756542][T15315] usb 9-1: selecting invalid altsetting 0 [ 714.829328][T18244] /dev/rnullb0: Can't open blockdev [ 715.039399][T18235] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 715.048400][T18235] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 715.060570][T13857] usb 9-1: USB disconnect, device number 51 [ 715.116300][T15315] usb 1-1: new high-speed USB device number 52 using dummy_hcd [ 715.284708][T15315] usb 1-1: Using ep0 maxpacket: 8 [ 715.291299][T15315] usb 1-1: descriptor type invalid, skip [ 715.299334][T15315] usb 1-1: config 0 has no interfaces? [ 715.307469][T15315] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 715.316824][T15315] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 715.325177][T15315] usb 1-1: Product: syz [ 715.329363][T15315] usb 1-1: Manufacturer: syz [ 715.334488][T15315] usb 1-1: SerialNumber: syz [ 715.341360][T15315] usb 1-1: config 0 descriptor?? [ 715.557574][T18246] IPv4: Oversized IP packet from 172.20.20.24 [ 715.565676][ C1] IPv4: Oversized IP packet from 172.20.20.24 [ 715.572128][ C1] IPv4: Oversized IP packet from 172.20.20.24 [ 715.581325][T18246] /dev/rnullb0: Can't open blockdev [ 715.599059][ T5887] usb 1-1: USB disconnect, device number 52 [ 715.740089][T18251] /dev/rnullb0: Can't open blockdev [ 716.228435][T18260] /dev/rnullb0: Can't open blockdev [ 717.185625][T18278] /dev/rnullb0: Can't open blockdev [ 717.200266][T18279] MTD: Attempt to mount non-MTD device "/dev/nbd7" [ 717.226547][T18279] cramfs: wrong magic [ 717.678531][T13857] usb 1-1: new high-speed USB device number 53 using dummy_hcd [ 717.874350][T13857] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 717.901341][T13857] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 717.922706][T13857] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 717.946849][T13857] usb 1-1: New USB device found, idVendor=1a34, idProduct=0802, bcdDevice= 0.00 [ 717.956252][T13857] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 717.977194][T13857] usb 1-1: config 0 descriptor?? [ 718.143652][ T5887] usb 10-1: new high-speed USB device number 38 using dummy_hcd [ 718.292825][T18265] orangefs_mount: mount request failed with -4 [ 718.299203][ T5887] usb 10-1: Using ep0 maxpacket: 16 [ 718.310975][ T5887] usb 10-1: config 254 has an invalid interface number: 235 but max is 0 [ 718.320040][ T5887] usb 10-1: config 254 has no interface number 0 [ 718.330187][ T5887] usb 10-1: config 254 interface 235 altsetting 2 bulk endpoint 0x6 has invalid maxpacket 32 [ 718.340956][ T5887] usb 10-1: config 254 interface 235 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 718.355690][ T5887] usb 10-1: config 254 interface 235 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 718.366300][ T5887] usb 10-1: config 254 interface 235 has no altsetting 0 [ 718.380041][ T5887] usb 10-1: New USB device found, idVendor=0525, idProduct=a4a0, bcdDevice=2b.f1 [ 718.418507][T13857] usbhid 1-1:0.0: can't add hid device: -71 [ 718.422258][ T5887] usb 10-1: New USB device strings: Mfr=1, Product=251, SerialNumber=3 [ 718.435864][ T5887] usb 10-1: Product: syz [ 718.440205][ T5887] usb 10-1: Manufacturer: syz [ 718.446763][ T5887] usb 10-1: SerialNumber: syz [ 718.456937][T13857] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 718.477098][T18289] raw-gadget.2 gadget.9: fail, usb_ep_enable returned -22 [ 718.484900][T18294] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 718.505110][T13857] usb 1-1: USB disconnect, device number 53 [ 718.908399][ T5887] usbtest 10-1:254.235: couldn't get endpoints, -71 [ 718.922545][ T5887] usbtest 10-1:254.235: probe with driver usbtest failed with error -71 [ 718.951106][ T5887] usb 10-1: USB disconnect, device number 38 [ 719.283494][T13857] usb 9-1: new high-speed USB device number 52 using dummy_hcd [ 719.335552][T18305] /dev/rnullb0: Can't open blockdev [ 719.434052][T13857] usb 9-1: Using ep0 maxpacket: 32 [ 719.440843][T13857] usb 9-1: config 0 has an invalid interface number: 148 but max is 0 [ 719.449269][T13857] usb 9-1: config 0 has no interface number 0 [ 719.456482][T13857] usb 9-1: config 0 interface 148 has no altsetting 0 [ 719.467359][T13857] usb 9-1: New USB device found, idVendor=17cc, idProduct=1000, bcdDevice=c5.61 [ 719.479528][T13857] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 719.495392][T13857] usb 9-1: Product: syz [ 719.499675][T13857] usb 9-1: Manufacturer: syz [ 719.505865][T13857] usb 9-1: SerialNumber: syz [ 719.521767][T13857] usb 9-1: config 0 descriptor?? [ 719.739228][T13857] snd-usb-audio 9-1:0.148: probe with driver snd-usb-audio failed with error -71 [ 719.739516][T18315] netlink: 8 bytes leftover after parsing attributes in process `syz.9.3083'. [ 719.767566][T13857] usb 9-1: USB disconnect, device number 52 [ 720.014460][ T5887] usb 10-1: new high-speed USB device number 39 using dummy_hcd [ 720.193495][ T5887] usb 10-1: Using ep0 maxpacket: 8 [ 720.201011][ T5887] usb 10-1: config 179 has an invalid interface number: 65 but max is 0 [ 720.209482][ T5887] usb 10-1: config 179 has no interface number 0 [ 720.215948][ T5887] usb 10-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 720.227396][ T5887] usb 10-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 720.240168][ T5887] usb 10-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 720.253012][ T5887] usb 10-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 720.273196][ T5887] usb 10-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 720.291492][ T5887] usb 10-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 720.300828][ T5887] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 720.328814][T18315] raw-gadget.0 gadget.9: fail, usb_ep_enable returned -22 [ 720.377316][T18321] /dev/rnullb0: Can't open blockdev [ 720.756182][T18315] /dev/rnullb0: Can't open blockdev [ 720.758030][T11451] usb 10-1: USB disconnect, device number 39 [ 720.761998][ C1] xpad 10-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 720.776438][ C1] xpad 10-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 720.785663][ C1] ================================================================== [ 720.793765][ C1] BUG: KASAN: slab-use-after-free in do_raw_spin_lock+0x23d/0x290 [ 720.801612][ C1] Read of size 4 at addr ffff8880334ea85c by task syz.0.3089/18333 [ 720.809526][ C1] [ 720.811882][ C1] CPU: 1 UID: 0 PID: 18333 Comm: syz.0.3089 Not tainted 6.16.0-next-20250731-syzkaller #0 PREEMPT(full) [ 720.811919][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 720.811936][ C1] Call Trace: [ 720.811946][ C1] [ 720.811956][ C1] dump_stack_lvl+0x189/0x250 [ 720.811993][ C1] ? __kasan_check_byte+0x12/0x40 [ 720.812032][ C1] ? __pfx_dump_stack_lvl+0x10/0x10 [ 720.812063][ C1] ? lock_release+0x4b/0x3e0 [ 720.812090][ C1] ? __virt_addr_valid+0x4a5/0x5c0 [ 720.812127][ C1] print_report+0xca/0x240 [ 720.812149][ C1] ? do_raw_spin_lock+0x23d/0x290 [ 720.812180][ C1] kasan_report+0x118/0x150 [ 720.812202][ C1] ? do_raw_spin_lock+0x23d/0x290 [ 720.812236][ C1] do_raw_spin_lock+0x23d/0x290 [ 720.812267][ C1] ? __wake_up_common_lock+0x2f/0x1f0 [ 720.812301][ C1] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 720.812338][ C1] _raw_spin_lock_irqsave+0xb3/0xf0 [ 720.812371][ C1] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 720.812403][ C1] ? kcov_remote_stop+0x78/0x6d0 [ 720.812441][ C1] __wake_up_common_lock+0x2f/0x1f0 [ 720.812478][ C1] __usb_hcd_giveback_urb+0x4d7/0x690 [ 720.812510][ C1] ? usb_hcd_unlink_urb_from_ep+0x2c/0x110 [ 720.812543][ C1] ? __pfx___usb_hcd_giveback_urb+0x10/0x10 [ 720.812578][ C1] ? usb_hcd_giveback_urb+0x10e/0x420 [ 720.812609][ C1] dummy_timer+0x862/0x4550 [ 720.812636][ C1] ? trace_pelt_se_tp+0x39/0x130 [ 720.812669][ C1] ? __pfx___calc_delta+0x10/0x10 [ 720.812716][ C1] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 720.812762][ C1] ? __pfx_dummy_timer+0x10/0x10 [ 720.812794][ C1] ? __pfx_dummy_timer+0x10/0x10 [ 720.812821][ C1] ? __pfx_dummy_timer+0x10/0x10 [ 720.812847][ C1] __hrtimer_run_queues+0x529/0xc60 [ 720.812884][ C1] ? __pfx___hrtimer_run_queues+0x10/0x10 [ 720.812916][ C1] ? read_tsc+0x9/0x20 [ 720.812937][ C1] ? __pfx___local_bh_disable_ip+0x10/0x10 [ 720.812967][ C1] hrtimer_run_softirq+0x187/0x2b0 [ 720.812997][ C1] handle_softirqs+0x283/0x870 [ 720.813025][ C1] ? __irq_exit_rcu+0xca/0x1f0 [ 720.813073][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 720.813104][ C1] __irq_exit_rcu+0xca/0x1f0 [ 720.813130][ C1] ? __pfx___irq_exit_rcu+0x10/0x10 [ 720.813161][ C1] irq_exit_rcu+0x9/0x30 [ 720.813185][ C1] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 720.813218][ C1] [ 720.813225][ C1] [ 720.813234][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 720.813261][ C1] RIP: 0010:console_flush_all+0x7f7/0xc40 [ 720.813295][ C1] Code: 48 21 c3 0f 85 e9 01 00 00 e8 d5 4f 1f 00 48 8b 5c 24 20 4d 85 f6 75 07 e8 c6 4f 1f 00 eb 06 e8 bf 4f 1f 00 fb 48 8b 44 24 28 <42> 80 3c 20 00 74 08 48 89 df e8 aa ae 82 00 48 8b 1b 48 8b 44 24 [ 720.813315][ C1] RSP: 0018:ffffc900044bf460 EFLAGS: 00000293 [ 720.813336][ C1] RAX: 1ffffffff1db8c17 RBX: ffffffff8edc60b8 RCX: ffff88801cbf1e00 [ 720.813354][ C1] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 720.813367][ C1] RBP: ffffc900044bf5b0 R08: ffffffff8fe34337 R09: 1ffffffff1fc6866 [ 720.813385][ C1] R10: dffffc0000000000 R11: fffffbfff1fc6867 R12: dffffc0000000000 [ 720.813403][ C1] R13: 0000000000000001 R14: 0000000000000200 R15: ffffffff8edc6060 [ 720.813431][ C1] ? console_flush_all+0x13a/0xc40 [ 720.813467][ C1] ? __pfx_console_flush_all+0x10/0x10 [ 720.813501][ C1] ? __lock_acquire+0xab9/0xd20 [ 720.813526][ C1] ? is_printk_cpu_sync_owner+0x32/0x40 [ 720.813564][ C1] console_unlock+0xc4/0x270 [ 720.813594][ C1] ? __pfx_console_unlock+0x10/0x10 [ 720.813621][ C1] ? atomic_notifier_call_chain+0x1/0x180 [ 720.813648][ C1] ? atomic_notifier_call_chain+0x26/0x180 [ 720.813679][ C1] do_con_write+0x5117/0x5200 [ 720.813742][ C1] ? __pfx_do_con_write+0x10/0x10 [ 720.813775][ C1] ? __mutex_lock+0x335/0x1360 [ 720.813814][ C1] ? n_tty_write+0xe35/0x1200 [ 720.813840][ C1] ? n_tty_write+0x653/0x1200 [ 720.813863][ C1] ? __mutex_unlock_slowpath+0x1a1/0x760 [ 720.813901][ C1] ? __pfx___mutex_lock+0x10/0x10 [ 720.813946][ C1] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 720.813991][ C1] con_write+0x24/0x40 [ 720.814022][ C1] n_tty_write+0xd2c/0x1200 [ 720.814058][ C1] ? __pfx_n_tty_write+0x10/0x10 [ 720.814078][ C1] ? file_tty_write+0x211/0xa20 [ 720.814106][ C1] ? __pfx_woken_wake_function+0x10/0x10 [ 720.814148][ C1] ? __pfx_n_tty_write+0x10/0x10 [ 720.814172][ C1] file_tty_write+0x554/0xa20 [ 720.814207][ C1] vfs_write+0x548/0xa90 [ 720.814244][ C1] ? __pfx_tty_write+0x10/0x10 [ 720.814273][ C1] ? __pfx_vfs_write+0x10/0x10 [ 720.814300][ C1] ? __fget_files+0x2a/0x420 [ 720.814333][ C1] ksys_write+0x145/0x250 [ 720.814356][ C1] ? __pfx_ksys_write+0x10/0x10 [ 720.814380][ C1] ? do_syscall_64+0xbe/0x3b0 [ 720.814401][ C1] do_syscall_64+0xfa/0x3b0 [ 720.814420][ C1] ? lockdep_hardirqs_on+0x9c/0x150 [ 720.814451][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 720.814471][ C1] ? clear_bhb_loop+0x60/0xb0 [ 720.814490][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 720.814505][ C1] RIP: 0033:0x7f30fd18eb69 [ 720.814522][ C1] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 720.814537][ C1] RSP: 002b:00007f30fe004038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 720.814553][ C1] RAX: ffffffffffffffda RBX: 00007f30fd3b6160 RCX: 00007f30fd18eb69 [ 720.814566][ C1] RDX: 0000000000001006 RSI: 0000200000004000 RDI: 0000000000000005 [ 720.814577][ C1] RBP: 00007f30fd211df1 R08: 0000000000000000 R09: 0000000000000000 [ 720.814587][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 720.814597][ C1] R13: 0000000000000001 R14: 00007f30fd3b6160 R15: 00007ffeecc2bc78 [ 720.814615][ C1] [ 720.814621][ C1] [ 721.374798][ C1] Allocated by task 5887: [ 721.379134][ C1] kasan_save_track+0x3e/0x80 [ 721.383824][ C1] __kasan_kmalloc+0x93/0xb0 [ 721.388425][ C1] __kmalloc_cache_noprof+0x230/0x3d0 [ 721.393822][ C1] xpad_probe+0x428/0x1fc0 [ 721.398240][ C1] usb_probe_interface+0x668/0xc30 [ 721.403362][ C1] really_probe+0x26d/0x9e0 [ 721.407900][ C1] __driver_probe_device+0x18c/0x2f0 [ 721.413208][ C1] driver_probe_device+0x4f/0x430 [ 721.418256][ C1] __device_attach_driver+0x2ce/0x530 [ 721.423668][ C1] bus_for_each_drv+0x24e/0x2e0 [ 721.428552][ C1] __device_attach+0x2b8/0x400 [ 721.433328][ C1] bus_probe_device+0x185/0x260 [ 721.438194][ C1] device_add+0x7b6/0xb50 [ 721.442534][ C1] usb_set_configuration+0x1a87/0x20e0 [ 721.447999][ C1] usb_generic_driver_probe+0x8d/0x150 [ 721.453476][ C1] usb_probe_device+0x1c4/0x390 [ 721.458335][ C1] really_probe+0x26d/0x9e0 [ 721.462839][ C1] __driver_probe_device+0x18c/0x2f0 [ 721.468133][ C1] driver_probe_device+0x4f/0x430 [ 721.473164][ C1] __device_attach_driver+0x2ce/0x530 [ 721.478545][ C1] bus_for_each_drv+0x24e/0x2e0 [ 721.483537][ C1] __device_attach+0x2b8/0x400 [ 721.488329][ C1] bus_probe_device+0x185/0x260 [ 721.493193][ C1] device_add+0x7b6/0xb50 [ 721.497558][ C1] usb_new_device+0xa39/0x16f0 [ 721.502329][ C1] hub_event+0x2958/0x4a20 [ 721.506753][ C1] process_scheduled_works+0xade/0x17b0 [ 721.512307][ C1] worker_thread+0x8a0/0xda0 [ 721.516908][ C1] kthread+0x70e/0x8a0 [ 721.520992][ C1] ret_from_fork+0x3fc/0x770 [ 721.525588][ C1] ret_from_fork_asm+0x1a/0x30 [ 721.530352][ C1] [ 721.532679][ C1] Freed by task 11451: [ 721.536751][ C1] kasan_save_track+0x3e/0x80 [ 721.541443][ C1] kasan_save_free_info+0x46/0x50 [ 721.546476][ C1] __kasan_slab_free+0x5b/0x80 [ 721.551248][ C1] kfree+0x18e/0x440 [ 721.555149][ C1] xpad_disconnect+0x350/0x480 [ 721.560005][ C1] usb_unbind_interface+0x26b/0x910 [ 721.565209][ C1] device_release_driver_internal+0x4d6/0x800 [ 721.571282][ C1] bus_remove_device+0x34d/0x410 [ 721.576239][ C1] device_del+0x511/0x8e0 [ 721.580608][ C1] usb_disable_device+0x3e9/0x8a0 [ 721.585676][ C1] usb_disconnect+0x330/0x950 [ 721.590365][ C1] hub_event+0x1cf5/0x4a20 [ 721.594799][ C1] process_scheduled_works+0xade/0x17b0 [ 721.600362][ C1] worker_thread+0x8a0/0xda0 [ 721.604970][ C1] kthread+0x70e/0x8a0 [ 721.609156][ C1] ret_from_fork+0x3fc/0x770 [ 721.613769][ C1] ret_from_fork_asm+0x1a/0x30 [ 721.618543][ C1] [ 721.620870][ C1] The buggy address belongs to the object at ffff8880334ea800 [ 721.620870][ C1] which belongs to the cache kmalloc-1k of size 1024 [ 721.634938][ C1] The buggy address is located 92 bytes inside of [ 721.634938][ C1] freed 1024-byte region [ffff8880334ea800, ffff8880334eac00) [ 721.648830][ C1] [ 721.651160][ C1] The buggy address belongs to the physical page: [ 721.657585][ C1] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x334e8 [ 721.666358][ C1] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 721.674861][ C1] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 721.682409][ C1] page_type: f5(slab) [ 721.686397][ C1] raw: 00fff00000000040 ffff88801a841dc0 dead000000000100 dead000000000122 [ 721.694985][ C1] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 721.703575][ C1] head: 00fff00000000040 ffff88801a841dc0 dead000000000100 dead000000000122 [ 721.712270][ C1] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 721.720940][ C1] head: 00fff00000000003 ffffea0000cd3a01 00000000ffffffff 00000000ffffffff [ 721.729614][ C1] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 721.738289][ C1] page dumped because: kasan: bad access detected [ 721.744711][ C1] page_owner tracks the page as allocated [ 721.750424][ C1] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5590, tgid 5590 (start-stop-daem), ts 59486625375, free_ts 59223695056 [ 721.771321][ C1] post_alloc_hook+0x240/0x2a0 [ 721.776102][ C1] get_page_from_freelist+0x21e4/0x22c0 [ 721.781651][ C1] __alloc_frozen_pages_noprof+0x181/0x370 [ 721.787461][ C1] alloc_pages_mpol+0x232/0x4a0 [ 721.792338][ C1] allocate_slab+0x8a/0x370 [ 721.796863][ C1] ___slab_alloc+0xbeb/0x1410 [ 721.801544][ C1] __kmalloc_noprof+0x305/0x4f0 [ 721.806411][ C1] tomoyo_init_log+0x1a6e/0x1f70 [ 721.811357][ C1] tomoyo_supervisor+0x340/0x1480 [ 721.816386][ C1] tomoyo_find_next_domain+0x488/0x1aa0 [ 721.821951][ C1] tomoyo_bprm_check_security+0x11c/0x180 [ 721.827689][ C1] security_bprm_check+0x89/0x270 [ 721.832731][ C1] bprm_execve+0x8ee/0x1450 [ 721.837232][ C1] do_execveat_common+0x510/0x6a0 [ 721.842262][ C1] __x64_sys_execve+0x94/0xb0 [ 721.846945][ C1] do_syscall_64+0xfa/0x3b0 [ 721.851450][ C1] page last free pid 5581 tgid 5581 stack trace: [ 721.857777][ C1] __free_frozen_pages+0xbc4/0xd30 [ 721.862894][ C1] __put_partials+0x156/0x1a0 [ 721.867575][ C1] put_cpu_partial+0x17c/0x250 [ 721.872351][ C1] __slab_free+0x2d5/0x3c0 [ 721.876771][ C1] qlist_free_all+0x97/0x140 [ 721.881462][ C1] kasan_quarantine_reduce+0x148/0x160 [ 721.886949][ C1] __kasan_slab_alloc+0x22/0x80 [ 721.891815][ C1] __kmalloc_noprof+0x224/0x4f0 [ 721.896684][ C1] tomoyo_realpath_from_path+0xe3/0x5d0 [ 721.902248][ C1] tomoyo_path_perm+0x213/0x4b0 [ 721.907122][ C1] security_inode_getattr+0x12f/0x330 [ 721.912504][ C1] __x64_sys_newfstat+0xfc/0x200 [ 721.917455][ C1] do_syscall_64+0xfa/0x3b0 [ 721.921996][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 721.927903][ C1] [ 721.930228][ C1] Memory state around the buggy address: [ 721.935855][ C1] ffff8880334ea700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 721.943915][ C1] ffff8880334ea780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 721.951975][ C1] >ffff8880334ea800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 721.960118][ C1] ^ [ 721.967054][ C1] ffff8880334ea880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 721.975216][ C1] ffff8880334ea900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 721.983279][ C1] ================================================================== [ 721.991356][ C1] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 721.998556][ C1] CPU: 1 UID: 0 PID: 18333 Comm: syz.0.3089 Not tainted 6.16.0-next-20250731-syzkaller #0 PREEMPT(full) [ 722.009779][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 722.019838][ C1] Call Trace: [ 722.023128][ C1] [ 722.025979][ C1] dump_stack_lvl+0x99/0x250 [ 722.030681][ C1] ? __asan_memcpy+0x40/0x70 [ 722.035280][ C1] ? __pfx_dump_stack_lvl+0x10/0x10 [ 722.040490][ C1] ? __pfx__printk+0x10/0x10 [ 722.045117][ C1] vpanic+0x281/0x750 [ 722.049112][ C1] ? __pfx_print_hex_dump+0x10/0x10 [ 722.054329][ C1] ? __pfx_vpanic+0x10/0x10 [ 722.058841][ C1] panic+0xb9/0xc0 [ 722.062570][ C1] ? __pfx_panic+0x10/0x10 [ 722.066999][ C1] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 722.072996][ C1] ? do_raw_spin_lock+0x23d/0x290 [ 722.078055][ C1] check_panic_on_warn+0x89/0xb0 [ 722.083010][ C1] ? do_raw_spin_lock+0x23d/0x290 [ 722.088066][ C1] end_report+0x78/0x160 [ 722.092323][ C1] kasan_report+0x129/0x150 [ 722.096922][ C1] ? do_raw_spin_lock+0x23d/0x290 [ 722.101961][ C1] do_raw_spin_lock+0x23d/0x290 [ 722.106918][ C1] ? __wake_up_common_lock+0x2f/0x1f0 [ 722.112306][ C1] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 722.117694][ C1] _raw_spin_lock_irqsave+0xb3/0xf0 [ 722.122925][ C1] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 722.128833][ C1] ? kcov_remote_stop+0x78/0x6d0 [ 722.133793][ C1] __wake_up_common_lock+0x2f/0x1f0 [ 722.139006][ C1] __usb_hcd_giveback_urb+0x4d7/0x690 [ 722.144388][ C1] ? usb_hcd_unlink_urb_from_ep+0x2c/0x110 [ 722.150211][ C1] ? __pfx___usb_hcd_giveback_urb+0x10/0x10 [ 722.156114][ C1] ? usb_hcd_giveback_urb+0x10e/0x420 [ 722.161496][ C1] dummy_timer+0x862/0x4550 [ 722.166018][ C1] ? trace_pelt_se_tp+0x39/0x130 [ 722.170965][ C1] ? __pfx___calc_delta+0x10/0x10 [ 722.176029][ C1] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 722.181421][ C1] ? __pfx_dummy_timer+0x10/0x10 [ 722.186372][ C1] ? __pfx_dummy_timer+0x10/0x10 [ 722.191323][ C1] ? __pfx_dummy_timer+0x10/0x10 [ 722.196272][ C1] __hrtimer_run_queues+0x529/0xc60 [ 722.201491][ C1] ? __pfx___hrtimer_run_queues+0x10/0x10 [ 722.207214][ C1] ? read_tsc+0x9/0x20 [ 722.211283][ C1] ? __pfx___local_bh_disable_ip+0x10/0x10 [ 722.217098][ C1] hrtimer_run_softirq+0x187/0x2b0 [ 722.222233][ C1] handle_softirqs+0x283/0x870 [ 722.227006][ C1] ? __irq_exit_rcu+0xca/0x1f0 [ 722.231779][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 722.237068][ C1] __irq_exit_rcu+0xca/0x1f0 [ 722.241662][ C1] ? __pfx___irq_exit_rcu+0x10/0x10 [ 722.246884][ C1] irq_exit_rcu+0x9/0x30 [ 722.251152][ C1] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 722.256828][ C1] [ 722.259765][ C1] [ 722.262701][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 722.268687][ C1] RIP: 0010:console_flush_all+0x7f7/0xc40 [ 722.274421][ C1] Code: 48 21 c3 0f 85 e9 01 00 00 e8 d5 4f 1f 00 48 8b 5c 24 20 4d 85 f6 75 07 e8 c6 4f 1f 00 eb 06 e8 bf 4f 1f 00 fb 48 8b 44 24 28 <42> 80 3c 20 00 74 08 48 89 df e8 aa ae 82 00 48 8b 1b 48 8b 44 24 [ 722.294046][ C1] RSP: 0018:ffffc900044bf460 EFLAGS: 00000293 [ 722.300122][ C1] RAX: 1ffffffff1db8c17 RBX: ffffffff8edc60b8 RCX: ffff88801cbf1e00 [ 722.308099][ C1] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 722.316068][ C1] RBP: ffffc900044bf5b0 R08: ffffffff8fe34337 R09: 1ffffffff1fc6866 [ 722.324042][ C1] R10: dffffc0000000000 R11: fffffbfff1fc6867 R12: dffffc0000000000 [ 722.332020][ C1] R13: 0000000000000001 R14: 0000000000000200 R15: ffffffff8edc6060 [ 722.340002][ C1] ? console_flush_all+0x13a/0xc40 [ 722.345129][ C1] ? __pfx_console_flush_all+0x10/0x10 [ 722.350606][ C1] ? __lock_acquire+0xab9/0xd20 [ 722.355461][ C1] ? is_printk_cpu_sync_owner+0x32/0x40 [ 722.361019][ C1] console_unlock+0xc4/0x270 [ 722.365625][ C1] ? __pfx_console_unlock+0x10/0x10 [ 722.370835][ C1] ? atomic_notifier_call_chain+0x1/0x180 [ 722.376567][ C1] ? atomic_notifier_call_chain+0x26/0x180 [ 722.382386][ C1] do_con_write+0x5117/0x5200 [ 722.387104][ C1] ? __pfx_do_con_write+0x10/0x10 [ 722.392138][ C1] ? __mutex_lock+0x335/0x1360 [ 722.396922][ C1] ? n_tty_write+0xe35/0x1200 [ 722.401613][ C1] ? n_tty_write+0x653/0x1200 [ 722.406296][ C1] ? __mutex_unlock_slowpath+0x1a1/0x760 [ 722.411947][ C1] ? __pfx___mutex_lock+0x10/0x10 [ 722.416987][ C1] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 722.422985][ C1] con_write+0x24/0x40 [ 722.427082][ C1] n_tty_write+0xd2c/0x1200 [ 722.431604][ C1] ? __pfx_n_tty_write+0x10/0x10 [ 722.436548][ C1] ? file_tty_write+0x211/0xa20 [ 722.441545][ C1] ? __pfx_woken_wake_function+0x10/0x10 [ 722.447215][ C1] ? __pfx_n_tty_write+0x10/0x10 [ 722.452256][ C1] file_tty_write+0x554/0xa20 [ 722.456963][ C1] vfs_write+0x548/0xa90 [ 722.461238][ C1] ? __pfx_tty_write+0x10/0x10 [ 722.466020][ C1] ? __pfx_vfs_write+0x10/0x10 [ 722.470799][ C1] ? __fget_files+0x2a/0x420 [ 722.475400][ C1] ksys_write+0x145/0x250 [ 722.479736][ C1] ? __pfx_ksys_write+0x10/0x10 [ 722.484604][ C1] ? do_syscall_64+0xbe/0x3b0 [ 722.489307][ C1] do_syscall_64+0xfa/0x3b0 [ 722.493820][ C1] ? lockdep_hardirqs_on+0x9c/0x150 [ 722.499032][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 722.505105][ C1] ? clear_bhb_loop+0x60/0xb0 [ 722.509798][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 722.515698][ C1] RIP: 0033:0x7f30fd18eb69 [ 722.520126][ C1] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 722.539740][ C1] RSP: 002b:00007f30fe004038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 722.548166][ C1] RAX: ffffffffffffffda RBX: 00007f30fd3b6160 RCX: 00007f30fd18eb69 [ 722.556170][ C1] RDX: 0000000000001006 RSI: 0000200000004000 RDI: 0000000000000005 [ 722.564158][ C1] RBP: 00007f30fd211df1 R08: 0000000000000000 R09: 0000000000000000 [ 722.572144][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 722.580121][ C1] R13: 0000000000000001 R14: 00007f30fd3b6160 R15: 00007ffeecc2bc78 [ 722.588111][ C1] [ 722.591491][ C1] Kernel Offset: disabled [ 722.595812][ C1] Rebooting in 86400 seconds..