last executing test programs:

38.483529579s ago: executing program 2 (id=1821):
syz_open_dev$tty1(0xc, 0x4, 0x1)
write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0)
creat(&(0x7f0000000280)='./file0\x00', 0x0)
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000100)={0x0, 0x7}, 0x8)
setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f00000004c0)={0x0, 0x465f}, 0x8)
r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000001080)={{0x12, 0x1, 0x0, 0xff, 0x0, 0x0, 0x40, 0x572, 0xcb01, 0x2665, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xaa, 0x75, 0xb7}}]}}]}}, 0x0)
syz_usb_control_io(r1, &(0x7f0000000a80)={0x2c, 0x0, &(0x7f0000000980)={0x0, 0x3, 0x4, @lang_id={0x4}}, 0x0, 0x0, 0x0}, 0x0)
syz_usb_control_io$cdc_ecm(r1, &(0x7f0000000100)={0x14, 0x0, &(0x7f00000000c0)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0)
syz_usb_control_io$cdc_ecm(r1, &(0x7f0000000380)={0x14, 0x0, &(0x7f0000000340)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0)
r2 = socket$inet6_sctp(0xa, 0x5, 0x84)
bind$inet6(r2, &(0x7f00000002c0)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
sendmmsg$inet6(r0, &(0x7f0000000200)=[{{&(0x7f00000000c0)={0xa, 0x4e23, 0x0, @loopback}, 0x1c, &(0x7f0000000580)=[{&(0x7f0000000180)='i', 0x1}], 0x1}}], 0x1, 0x0)
setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x79, &(0x7f0000000280)=ANY=[], 0x8)
bind$pptp(0xffffffffffffffff, 0x0, 0x0)
keyctl$KEYCTL_CAPABILITIES(0x1f, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001)
r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0)
fsetxattr$trusted_overlay_origin(r3, &(0x7f0000000100), &(0x7f00000001c0), 0x2, 0x2)
preadv(r3, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0)
keyctl$KEYCTL_PKEY_QUERY(0x18, 0x0, 0x0, &(0x7f0000000140)=':-.\x00', &(0x7f0000000180))
r4 = socket$nl_route(0x10, 0x3, 0x0)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
r6 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff)
ioctl$ifreq_SIOCGIFINDEX_wireguard(r4, 0x8933, &(0x7f00000002c0)={'wg2\x00', <r7=>0x0})
sendmsg$WG_CMD_SET_DEVICE(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000840)=ANY=[@ANYBLOB="e0100000", @ANYRES16=r6, @ANYBLOB="0500000000000000000001000000060006004e240000901008809005008024000100d1732899f611cd8994034d7f413dc957630e5493c285aca40065cb6311be696b24000100000000000000000000000000000000000000000000100000000000000000000024000200fcbefe9641719404cc5c9ab2766dd4793e367b0ea55e65e2e3416ac9d4e68841240002001171ee8da334a5099295af229a5d237a7f4102f01f28b34347d6cbbe135d83ec24000100975c9d81c983c8209ee781254b899f8ed925ae9f0923c23c62f53c57cdbf691cb40409807c000080060001000a00000014000200000000000000000000000000000000010500030002000000060001000200000008000200ac1414aa0500030001000000060001000a00000014000200ff0100000000000000000000000000010500030001000000060001000200000008000200e00000010500030000000000f4000080060001000a00000014000200fc0000000000000000000000000000000500030001000000060001000a00000014000200fc0200000000000000000000000000010500030000000000060001000200000008000200e00000020500030003000000060001000200000008000200000000000500030000000000060001000200000008000200ac1414bb0500030001000000060001000200000008000200ac1414bb0500030000000000060001000a00000014000200000000000000000000000000000000010500030002000000060001000a00000014000200fc0200000000000000000000000000000500030003000000340000800600010002000000080002000a0101010500030004000000060001000200000008000200ac1414aa050003000300000064000080060001000a00000014000200200100000000000000000000000000000500030002000000060001000200000008000200ac1414aa0500030001000000060001000a00000014000200ff010000000000000000000000000001050003000200000094000080060001000200000008000200ac1e00010500030002000000060001000200000008000200e00000010500030002000000060001000a00000014000200fc0000000000000000000000000000000500030002000000060001000200000008000200000000000500030003000000060001000a00000014000200fe80000000000000000000000000000e050003000000000040000080060001000a00000014000200fc0200000000000000000000000000000500030002000000060001000200000008000200ac1414aa050003000000000064000080060001000a00000014000200200100000000000000000000000000020500030001000000060001000a00000014000200fc02000000000000000000000000000105000300020000000600010002000000080002000a010100050003000200000070000080060001000a00000014000200ff0200000000000000000000000000010500030000000000060001000a00000014000200000000000000000000000000000000000500030002000000060001000a0000001400020000000000000000000000000000000001050003000000000000010080060001000a00000014000200ff0200000000000000000000000000010500030000000000060001000200000008000200000000000500030003000000060001000200000008000200640101000500030002000000060001000200000008000200640101010500030001000000060001000200000008000200ac1414aa0500030002000000060001000a00000014000200fe8000000000000000000000000000bb05000300020000000600010002000000080002007f0000010500030002000000060001000a00000014000200fc0200000000000000000000000000010500030003000000060001000200000008000200640101010500030001000000240002005da952055e5857d673cddd36909746c80efa3ff95c317de1063db32bc80a0b3e1803008024000100f44da367a88ee6564f020211456727082f5cebee8b1bf5eb7337341b459b39220600050005000000e802098058000080060001000200000008000200ac1e00010500030001000000060001000a00000014000200000000000000000000000000000000010500030000000000060001000200000008000200ffffffff05000300010000007c000080060001000a00000014000200000000000000000000000000000000010500030002000000060001000200000008000200ac1414bb0500030002000000060001000a000000140002000000000000000000000000000000000105000300020000000600010002000000080002000a0101010500030003000000f4000080060001000a0000001400020000000000000000000000ffffac1414aa0500030003000000060001000200000008000200ac1414aa05000300000000000600010002000000080002000a01010205000300020000000600010002000000080002007f00000105000300000000000600010002000000080002000a0101010500030003000000060001000200000008000200e00000010500030003000000060001000a00000014000200fc01000000000000000000000000000005000300010000000600010002000000080002000a0101000500030000000000060001000200000008000200ac1e0101050003000200000094000080060001000a00000014000200fc0200000000000000000000000000010500030002000000060001000a00000014000200ff0100000000000000000000000000010500030001000000060001000200000008000200e00000010500030002000000060001000200000008000200ac1414bb0500030001000000060001000200000008000200ffffffff050003000200000088000080060001000a00000014000200fe8000000000000000000000000000aa0500030001000000060001000200000008000200ac1414aa0500030002000000060001000a00000014000200fe8800000000000000000000000001010500030002000000060001000a00000014000200ff02000000000000000000000000000105000300020000007c000080200004000a004e2100000006fc0100000000000000000000000000010400000008000a000100000024000100f44da367a88ee6564f020211456727082f5cebee8b1bf5eb7337341b459b3922080003000300000024000200379aa288b2244a5b504ba04bea45625d328fb93b62e607a1b2e4da2f7f76a549780000800800030001000000080003000400000024000100f44da367a88ee6564f020211456727082f5cebee8b1bf5eb7337341b459b3922080003000000000024000100d1732899f611cd8994034d7f413dc957630e5493c285aca40065cb6311be696b1400040002004e22000000000000000000000000e4060080dc020980f4000080060001000a00000014000200000000000000000000000000000000000500030002000000060001000a00000014000200fc0000000000000000000000000000000500030001000000060001000200000008000200ffffffff0500030001000000060001000200000008000200ac1e00010500030001000000060001000200000008000200e000000105000300020000000600010002000000080002007f0000010500030002000000060001000a00000014000200000000000000000000000000000000010500030001000000060001000a00000014000200fc010000000000000000000000000001050003000300000034000080060001000200000008000200640101000500030001000000060001000200000008000200ac1414bb050003000200000000010080060001000a00000014000200200100000000000000000000000000010500030000000000060001000200000008000200e000000205000300020000000600010002000000080002006401010005000300020000000600010002000000080002007f00000105000300010000000600010002000000080002007f0000010500030001000000060001000a00000014000200fe8000000000000000000000000000bb0500030000000000060001000200000008000200ffffffff0500030000000000060001000200000008000200e00000010500030003000000060001000a00000014000200fc0100000000000000000000000000010500030000000000940000800600010002000000080002006401010005000300010000000600010002000000080002006401010205000300000000000600010002000000080002007f0000010500030003000000060001000200000008000200e00000020500030003000000060001000200000008000200ac1414120500030002000000060001000200000008000200ac14142d05000300020000001c000080060001000200000008000200ffffffff05000300030000000800030002000000200004000a004e2000000005fc010000000000000000000000000001000000009403098094000080060001000a0000001400020000000000000000000000ffffac1414bb0500030003000000060001000a00000014000200fe8800000000000000000000000000010500030002000000060001000a00000014000200ff0100000000000000000000000000010500030003000000060001000a00000014000200fe880000000000000000000000000101050003000100000064000080060001000a00000014000200fe8000000000000000000000000000bb0500030000000000060001000200000008000200ac1414bb0500030001000000060001000a0000001400020000000000000000000000ffffe00000020500030003000000f4000080060001000200000008000200000000000500030001000000060001000a00000014000200000000000000000000000000000000010500030003000000060001000200000008000200ac1414aa0500030001000000060001000a00000014000200fe80000000000000000000000000003e05000300010000000600010002000000080002007f0000010500030001000000060001000a00000014000200ff0200000000000000000000000000010500030001000000060001000a00000014000200000000000000000000000000000000010500030000000000060001000200000008000200e0000001050003000000000058000080060001000a00000014000200fe8000000000000000000000000000bb0500030000000000060001000200000008000200ac1414410500030010000000060001000200000008000200ac1e00010500030001000000f4000080060001000200000008000200640101000500030002000000060001000a00000014000200200100000000000000000000000000000500030000000000060001000a00000014000200fc0200000000000000000000000000010500030003000000060001000a00000014000200fe8000000000000000000000000000aa0500030003000000060001000200000008000200ac1414aa0500030000000000060001000200000008000200000000000500030000000000060001000200000008000200ac1414270500030000000000060001000a0000001400020020010000000000000000000000000002050003000100000058000080060001000200000008000200ac1414aa0500030001000000060001000a00000014000200fe8000000000000000000000000000140500030000000000060001000200000008000200e0000001050003000000000024000100d1732899f611cd8994034d7f413dc957630e5493c285aca40065cb6311be696b240002000f1b8b82264208ab1a2dce776c03b9f348f500ef8e7606466943f5ba2ae2881e0c0000800800030006000000060006004e24000008000100", @ANYRES32=r7, @ANYBLOB="240003"], 0x10e0}}, 0x0)
socket$inet6_sctp(0xa, 0x5, 0x84)

37.479856311s ago: executing program 2 (id=1826):
bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f000001aa80)={0xffffffffffffffff, 0x1, 0x18}, 0xc)
openat$mixer(0xffffffffffffff9c, &(0x7f0000003fc0), 0x0, 0x0)
fsopen(&(0x7f0000000340)='zonefs\x00', 0x0)
syz_usbip_server_init(0x5)
write(0xffffffffffffffff, &(0x7f0000000f40)="b410a1e8252ce0a1a3be3d593e8bf96f9615aea940ed08d314cbc50631fb02a0647a3c2ed4c85c8eef57d078ec90823a", 0x30)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
openat$vimc1(0xffffffffffffff9c, 0x0, 0x2, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00000001c0)=0x5)
preadv(r0, &(0x7f0000001880)=[{&(0x7f0000001a80)=""/102400, 0x19000}], 0x1, 0x0, 0x0)
madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe)
socket$inet_smc(0x2b, 0x1, 0x0)
r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f000905", @ANYRES16], 0x0)
syz_usb_control_io$hid(r1, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000800)=ANY=[@ANYBLOB="00220f000000079b4d3948019f0b6d1fa409021a79417b8958b5c44db2afb008640f2b64127e2b48a3f49904e0e20792b53a68e530d0227e942a927f4c7949602b02c6abc32cb9f4fa50c9b7d695ce1e3169d213138a93c7421e73c74b384b623e99ded329c5d486a157c10934fda1b7450beadbd8c22355bae33cc4d1d86a4e796293b21797b7abe881f69b684d283e191d8e7a6d4da2e8f86e3773169710e4395b7b0520c603a315831b173ed67daacbb75ff39d6969af9bfe48d3d150c747da18465e7015cabc48534e673bce17d7ac4ced78472052d2f932337382a4ecdc2b894eab157618b8812336348022bf75e60ed3d32d199f5764b918cf2a76287c23aec33fba9da1c5520c62dc0052b708ef208b4fdecc66e04c1fad0abdb0c08c0c4f8cfe524f31825197e3b68c1f8ece3dd9c0ca9029a8051ecbc9d30d81c5f78134b2cc5596ed58e385529c067cff9468788f5a979b143a13b3e51b64507f2fd0ce14471257ca78c4b7c40e46a438140e1d0002ae11d42233058303853b826afe4aef3515e82a951e99827245bd1811f017ba61d994b317c7b0df6f278b4ab08d12a33df6ea5f5e05b041fdd58c1339570c4cd9f1f5df7e9b4a51e84538b51a21ddb6035330545ec6816d02c46249a85111052d20f107f246"], 0x0}, 0x0)
r2 = syz_open_dev$hiddev(&(0x7f0000000d40), 0x0, 0x0)
ioctl$HIDIOCSUSAGES(r2, 0x501c4814, &(0x7f0000000d80)={{0x3, 0x200}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000, 0x101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbc6f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x8e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x401, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0xb, 0x0, 0x0, 0x0, 0x8000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa3c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]})

22.11623272s ago: executing program 1 (id=1857):
r0 = syz_open_dev$sndctrl(&(0x7f0000000040), 0x1, 0x0)
ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f0000000540)={{0x2, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4004, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000000]})
io_uring_setup(0x252f, &(0x7f0000000280)={0x0, 0x0, 0x542, 0x2, 0xfffffffe})
openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x232801)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001)
r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
preadv(r1, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0)
ioctl$KDSIGACCEPT(r1, 0x4b4e, 0x29)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, 0x0)
socket$isdn(0x22, 0x2, 0x26)
socket$inet6_sctp(0xa, 0x1, 0x84)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x4000000)
r2 = socket$inet6(0xa, 0x2, 0x0)
epoll_create(0x200)
ioctl$int_in(0xffffffffffffffff, 0x5421, &(0x7f0000000180)=0x3)
sendto$inet6(r2, 0x0, 0x0, 0x8001, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @empty}, 0x1c)
syz_emit_ethernet(0x66, &(0x7f0000000340)={@broadcast, @dev, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x2f, 0x0, @private, @multicast1}, {{0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x4, 0x88a8}, {0x0, 0x0, 0x0, 0x0, 0x11}}}}}}, 0x0)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)={0x2c, 0x3a, 0xb, 0x0, 0x0, {0x2}, [@nested={0xfffffffffffffec1, 0x0, 0x0, 0x1, [@typed={0x13, 0x3, 0x0, 0x0, @str='\r4\xd8\x02j,'}]}]}, 0x2c}}, 0x0)
r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0)
ioctl$SNDCTL_DSP_CHANNELS(r4, 0xc0045006, &(0x7f0000000100)=0x6)
ioctl$SNDCTL_DSP_SPEED(r4, 0xc0045002, &(0x7f0000000000)=0x7fffffff)
sendmsg$DEVLINK_CMD_PORT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$SNDCTL_DSP_SETFRAGMENT(r4, 0xc004500a, &(0x7f0000000040))
write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000000500)={0xa00, 0xfffffffffffffd83, 0xfa00, {0x0, 0x0}}, 0xfdbc)
r5 = syz_usb_connect(0x0, 0xaa3, &(0x7f0000008f00)=ANY=[@ANYBLOB="120110014b193508e20400141365010203010902910a020706c00509047a050a027a450909240600003e7da289052400dc0a0d240f0105000000070012993b06641aff7f0e0c2407010e00ff070400050007240600013c8e0524"], 0x0)
syz_usb_ep_write(r5, 0x2, 0xa2, &(0x7f0000000000)="14841eb9c9af084f552ca957435a1cc372b3aacef543041596ff85c89e3cd8e7e44f985e37f3ad9ef1c1d80386541b4342dc3cab9a8dc426a81ec36d092eecf4d475c290266b103cfd773dd03e8bf9f2197da1595afcb4c940b28cc81222ba6623ebf2f0065e56cf09861e132b74e85621fcd1ef9d6adf903886c6cbacaf23a5eb2f32bd6edb6eecf954fe9c8d4c8a72dd795d52d4a13d199444ecc93e5e8f88cb56")

18.790685237s ago: executing program 1 (id=1862):
r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0)
ioctl$SNDCTL_DSP_CHANNELS(r0, 0xc0045006, &(0x7f0000000100)=0x6)
ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f0000000040))
write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000500)={0xa00, 0xfffffffffffffd83, 0xfa00, {0x0, 0x0}}, 0xfdbc)

17.650357475s ago: executing program 1 (id=1863):
syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
r0 = socket$kcm(0x21, 0x2, 0x2)
sendmsg$inet(r0, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001)
r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0)
preadv(r1, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0)
io_submit(0x0, 0x11, 0x0)
mlock2(&(0x7f0000006000/0x3000)=nil, 0x3000, 0x0)
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x40b80, 0x0)
ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000040))
ioctl$TIOCSTI(r2, 0x5423, &(0x7f0000000080)=0x7)
openat$vicodec1(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
r4 = dup(r3)
ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r4, 0xc0bc5351, &(0x7f0000000200)={0x98, 0x0, 'client0\x00', 0x0, "3f1af4a740812e3a", "5a79d5ab1a5dc91bdf033940fff4267c71a6349ebc4fb5480bdf6452ae9d2a14"})
r5 = socket$kcm(0x2, 0x1000000000000002, 0x0)
r6 = socket(0x1e, 0x1, 0x0)
recvmmsg(r6, &(0x7f0000005f00)=[{{0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000780)=""/62, 0x3e}], 0x1, &(0x7f00000004c0)=""/164, 0xa4}}], 0x1, 0x0, 0x0)
sendmsg$inet(r5, &(0x7f0000000380)={&(0x7f00000001c0)={0x2, 0x4e1d, @multicast2}, 0x10, 0x0, 0x0, &(0x7f0000000000)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0x2a}, @initdev={0xac, 0x1e, 0x0, 0x0}}}}], 0x20}, 0x0)
remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0)
socket$nl_netfilter(0x10, 0x3, 0xc)
io_uring_setup(0x0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x2ed})
open(&(0x7f0000000000)='.\x00', 0x20403, 0x0)

17.459894327s ago: executing program 0 (id=1864):
r0 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="b0000000", @ANYRES16=r0, @ANYBLOB="000328bd7000fedbdf25010000000800030003000000080002000600000008000200080000002000018014000400fe8000000000000000000000000000aa050002000e000000080002000800000078000180140004000000000000000000000000000000000108000300ac1414bb050002000c00000008000300ac1414bbcf582a319b778a9e23b51774a60600010002000000140001800500020000000000050002008e00000008000200060000000800040003000000"], 0xb0}, 0x1, 0x0, 0x0, 0x4000850}, 0x20000840)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x13, r1, 0x0)
r2 = socket$inet_smc(0x2b, 0x1, 0x0)
setsockopt$inet_tcp_int(r2, 0x6, 0x5, &(0x7f00000005c0), 0x4)
syz_usb_connect(0x0, 0x36, &(0x7f0000000400)={{0x12, 0x1, 0x0, 0x77, 0xf1, 0xc9, 0x10, 0xc72, 0xc, 0xf659, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x2, 0xd3, 0x1a, 0x3a, 0x0, [], [{{0x9, 0x5, 0x1}}, {{0x9, 0x5, 0x4}}]}}]}}]}}, 0x0)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000200), 0xffffffffffffffff)
socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f0000000300)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x50, r4, 0x20, 0x70bd2d, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x7}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x24, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x80}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @rand_addr=0x64010101}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x20000010}, 0x20040890)

16.675244301s ago: executing program 0 (id=1866):
r0 = syz_usb_connect(0x3, 0x36, &(0x7f0000000500)=ANY=[@ANYRESOCT=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="953407d995e1dc62dd6a53552c8153b3d96901046c2ddaeb110a1a6d32a7", @ANYRES8, @ANYRESHEX, @ANYBLOB="8e020d1c6a46063fa58ccd583f64ebdb289e0198a95b17629f1f27782af54a7035418d85545d3bb0a0b024cec1bb4ed2cfa0f8d06fa4f5b85d2d7e77b65dd971899863e8fbda779b7e5d435f782da1632e576f21af72912aa31ba89b9389584c2d5fe67090b4002a28a2432a75efb5526686c211918b7f482f8bc31c0ed6f6a946fe9dbe739ccb3d7c0b12e1678d21f703de6730972a54dba814efa7463fc19628dfc18cecb6064bb6136dbd2a2d441d36b25431ab18e406439509fe4083f1a90c9baf724d11734c8cd3e2c5eba989", @ANYRESDEC, @ANYRES8], 0x0)
syz_open_dev$midi(&(0x7f0000000000), 0x3, 0x88c02)
r1 = syz_io_uring_setup(0x4166, &(0x7f0000000780)={0x0, 0x0, 0x10100}, &(0x7f0000000100)=<r2=>0x0, &(0x7f00000002c0)=<r3=>0x0)
syz_io_uring_submit(r2, r3, &(0x7f0000000180)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f00000004c0)})
io_uring_enter(r1, 0x567, 0x0, 0x0, 0x0, 0x0)
syz_usb_disconnect(r0)
socketpair$tipc(0x1e, 0x7, 0x0, &(0x7f0000000300))
memfd_create(&(0x7f0000000140)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xe7a\x9b\x11x\x0e\xa1\xcf\x1a\x98S7\xc9\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x04\x879\xa24\xa9am\xde\xb2\xd3\xcbZJoa\xc4\x1acB\xaa\xc1\xfb Q\xd4\xf4\x01\xa52\xe2DG\xd4\xbd{\x9f\xa9\x97\x9b@\xdb\x00b\xe1br\xb6\xea7\xe3\x10\xff\xc2\x9d\r2\x9e\x8e\x04sW\x1b\xb7\xb3\xa2\xc9&@\xca\xda\xdc\xe2/\x97X\xac\b\xb0\xc2<\x80E\x1a\xbc\xc7W\xda9VsA\xaf\xc6\xcf\xe1\xa1\xb5M\xa2\x85\xa6y\xc4J\xf1\xf7\xfcD\x95\xe3\xeb\xc7\xbc\x91\xb0\xa8\x9eo\xebF(\x9dL\x01vRk\xaacB\x04\xa7I\v\x86EZ\x96\xd5\x14OD\\\xe8R\xe4\xcd\xec\xcc\xd1\x0fre\xe86\xcd\xeb\xc4$\x98\x06J\xd6dD\x8d_U`ji{\xab\x97\xaf;l\x1f\xaf\xb38U\xcb\xfa\xb3j\x92\f\x81\xa0\xa2-g\b\x99\x0e\x8d\x8d\x16\xd9w\\\xf8\xce\xb0j\x9d\'\x93\xef\x1d\xa0H\xcd\xbd\xd9\xaf\x12$\x8d\x16%\x8b\x00', 0x0)
r4 = syz_open_dev$usbfs(&(0x7f0000003f00), 0x1ff, 0xa401)
ioctl$USBDEVFS_CONTROL(r4, 0xc0185500, &(0x7f00000001c0)={0x60, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r5 = syz_open_dev$I2C(&(0x7f0000000d80), 0x1, 0x0)
ioctl$I2C_PEC(r5, 0x708, 0x6)
ioctl$I2C_SMBUS(r5, 0x720, &(0x7f0000000080)={0x0, 0x0, 0x3, &(0x7f0000000100)={0x0, "fd5a44512b7e1b3c20ec2a3ba53b31dd77000000000400"}})
r6 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000200)=ANY=[@ANYBLOB="12010100000000105801000100000000000109022400010000002009040000010300000009210000000122dc01090589"], 0x0)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00220a0000000b7cad10f0b2a44d1b936ba1aff6"], 0x0}, 0x0)
syz_usb_control_io$hid(r6, 0x0, 0x0)
syz_emit_ethernet(0x82, &(0x7f0000000400)=ANY=[@ANYBLOB="ffffffffffff17043a73dbde082245000074006400b062696384864c0000019078ac1e0001ac1414aa05009078e00000e04600000000001882a83d47ab790d8e00000010f700000014aa00000000830300070300443c00830a010101000100000000000000000000ac1414aa80000000ac1404bb008000000000000000000000ac1414bb00000200000000"], 0x0)
syz_usb_connect$printer(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12011003000012002505a8a4f0"], 0x0)
syz_usb_control_io(r6, &(0x7f00000000c0)={0x2c, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0}, 0x0)
r7 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0)
socket$inet_udplite(0x2, 0x2, 0x88)
socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x24, 0x10, 0x3, 0x0, 0x0, {0x6, 0x0, 0x8100, 0x0, {0x0, 0x6}, {0x0, 0x7}, {0xffe0, 0x10}}}, 0x24}, 0x1, 0x0, 0x0, 0x20040000}, 0x0)
r8 = add_key$keyring(&(0x7f0000000340), &(0x7f0000000380)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe)
keyctl$restrict_keyring(0x1d, r8, 0xffffffffffffffff, &(0x7f00000003c0)='-[&[#-:\x00')
socket$inet6_mptcp(0xa, 0x1, 0x106)
r9 = socket$packet(0x11, 0x3, 0x300)
ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000040)={'syz_tun\x00'})
setsockopt$packet_int(r9, 0x107, 0x14, &(0x7f0000000000)=0xffffffff, 0x4)

16.365348956s ago: executing program 1 (id=1867):
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fc00100}]})
socket$kcm(0xa, 0x0, 0x87)
ioctl$SECCOMP_IOCTL_NOTIF_RECV(r0, 0xc0502100, &(0x7f0000000340)={<r2=>0x0})
r3 = open$dir(&(0x7f00000000c0)='./file0\x00', 0xc0800, 0x124)
fchmodat(r3, &(0x7f0000000140)='./file0/file0\x00', 0x188)
ioctl$SECCOMP_IOCTL_NOTIF_SEND(r1, 0xc0182101, &(0x7f0000000180)={r2})
ioctl$SECCOMP_IOCTL_NOTIF_RECV(r1, 0xc0502100, &(0x7f0000002780))
close(r0)
dup2(0xffffffffffffffff, 0xffffffffffffffff)
socket$nl_route(0x10, 0x3, 0x0)
socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0)
openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x0)
r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0)
mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000004000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
read$FUSE(r4, &(0x7f00000021c0)={0x2020, 0x0, <r5=>0x0}, 0x2020)
write$FUSE_INIT(r4, &(0x7f0000000600)={0x50, 0x0, r5, {0x7, 0x1f}}, 0x50)
syz_fuse_handle_req(r4, &(0x7f000000e3c0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b600", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006340)={0x20, 0x0, 0x0, {0x0, 0xf52e9750ac6908df}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0)
r6 = syz_open_dev$vim2m(&(0x7f0000000300), 0xffff, 0x2)
ioctl$vim2m_VIDIOC_QUERYCAP(r6, 0x80685600, &(0x7f00000013c0))
bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x16, 0x0, 0x4, 0xff, 0x0, 0x1}, 0x48)
r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xa, 0x5, 0x2, 0x7, 0x0, 0x1}, 0x48)
bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000640), &(0x7f0000000740), 0x75, r7}, 0x38)
bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x75, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000600)={&(0x7f00000005c0)='kfree_skb\x00', r8}, 0x10)
r9 = socket(0x10, 0x3, 0x9)
connect$netlink(r9, &(0x7f00000014c0)=@proc={0x10, 0x0, 0x25dfdbfc}, 0xc)

16.310232735s ago: executing program 4 (id=1868):
syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
r0 = socket$kcm(0x21, 0x2, 0x2)
sendmsg$inet(r0, &(0x7f0000002780)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=[@ip_retopts={{0x14, 0x110, 0xd, {[@noop]}}}, @ip_ttl={{0x14, 0x110}}], 0x30}, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001)
r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0)
preadv(r1, 0x0, 0x0, 0x0, 0x0)
io_submit(0x0, 0x11, 0x0)
mlock2(&(0x7f0000006000/0x3000)=nil, 0x3000, 0x0)
openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x40b80, 0x0)
r2 = openat$vicodec1(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r3, 0xc0bc5351, &(0x7f0000000200)={0x98, 0x0, 'client0\x00', 0x0, "3f1af4a740812e3a", "5a79d5ab1a5dc91bdf033940fff4267c71a6349ebc4fb5480bdf6452ae9d2a14"})
r4 = socket$kcm(0x2, 0x1000000000000002, 0x0)
r5 = socket(0x1e, 0x1, 0x0)
sendmsg$tipc(r5, &(0x7f0000000300)={&(0x7f0000000000)=@id, 0x10, &(0x7f0000000380)=[{&(0x7f0000000140)='\v', 0x1}], 0x1}, 0x0)
sendmsg$inet(r4, &(0x7f0000000380)={&(0x7f00000001c0)={0x2, 0x4e1d, @multicast2}, 0x10, 0x0, 0x0, &(0x7f0000000000)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0x2a}, @initdev={0xac, 0x1e, 0x0, 0x0}}}}], 0x20}, 0x0)
write$binfmt_aout(r2, &(0x7f0000000300)=ANY=[@ANYBLOB="c701080782020000b501000017330000600000000000000000000000000000001b2f7169618362ae660ca48a1d8e9db338ec9c444f4033dbfda27e7eb8efa79dd99f7b4a271e768d03d27fdbd2b8849beae1033c0cb44bd0f801a6f552dfd020753a833e04e065b86d2b8b4e46f2ddb25dbb769080e44ae165d333d16dec826cd360602e714f472844d9a5da648a4738478699a4548fe04b26bcfabd27db863bd7e37a30985406602c012c55ba2fe36a37000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007800"/1285], 0x6b1)
remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0)
socket$nl_netfilter(0x10, 0x3, 0xc)
io_uring_setup(0x0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x2ed})
open(&(0x7f0000000000)='.\x00', 0x20403, 0x0)

15.897717241s ago: executing program 4 (id=1869):
syz_emit_ethernet(0xfdef, &(0x7f0000000440)={@broadcast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0xfffffffffffffdaa, 0x0, 0x0, 0x0, 0x88, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @parameter_prob={0xc, 0x0, 0x0, 0x0, 0x0, 0x3, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @multicast2}}}}}}, 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0)
sendmsg$NFT_BATCH(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a6c000000060a0b04000000000000000002000000400004803c0001800b00010065787468647200002c0002800800044000000000080007400000a80008000640000000d35ba8cc000000000008000340000003000900010073797a30000000000900020073797a32"], 0x94}}, 0x0)
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x275a, 0x0)
write$binfmt_script(r2, &(0x7f0000000380), 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x13, r2, 0x0)
write$cgroup_devices(r0, &(0x7f00000000c0)=ANY=[], 0xffdd)

15.215876697s ago: executing program 4 (id=1871):
openat$capi20(0xffffffffffffff9c, &(0x7f0000000140), 0x20000, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0)
mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1/file2\x00', 0x0, 0x0)
r0 = landlock_create_ruleset(&(0x7f00000002c0)={0x2001}, 0x10, 0x0)
landlock_restrict_self(r0, 0x0)
open(&(0x7f0000000000)='./file1\x00', 0x0, 0x0)
r1 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0)
ioctl$DRM_IOCTL_SET_CLIENT_CAP(r1, 0x4010640d, &(0x7f0000000000)={0x3, 0x2})
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r1, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000100)=[<r2=>0x0], 0x1})
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000600)={0x0, 0x0, 0xffffff7f})
ioctl$DRM_IOCTL_MODE_GET_LEASE(r1, 0xc01064c8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)})
r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0)
ioctl$DRM_IOCTL_MODE_GETRESOURCES(r3, 0xc04064a0, &(0x7f0000000040)={0x0, &(0x7f00000002c0)=[0x0], 0x0, 0x0, 0xfffffd52, 0x1})
ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r1, 0xc02064b9, &(0x7f0000000dc0)={&(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000200), 0x4, r2})
socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000040), 0x4)
ioctl$vim2m_VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, &(0x7f0000000200)={0xffffb4e8, 0x4, 0x0, "b67bdbbf81e27c6d6263184725ac744194a3e05bfb992060c919a194da98e794", 0x4745504d})
r4 = socket$nl_xfrm(0x10, 0x3, 0x6)
ioctl$FS_IOC_GETFSLABEL(r3, 0x81009431, &(0x7f0000000380))
sendmsg$nl_xfrm(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=ANY=[@ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000010000000032000000ac1414aa00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000000000000000000048000200656362286369706865725f6e756c6c29000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c0015005c07350000"], 0x144}}, 0x0)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000001680)={&(0x7f0000001740)=ANY=[@ANYBLOB="54010000100001000000000000000000ac1414aa000000000000000000000000fc0100"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000ffffac141400000000006c000000ac1e000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000480003006465666c617465"], 0x154}}, 0x0)

15.087033422s ago: executing program 1 (id=1872):
bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000001fd8)=ANY=[@ANYBLOB="04000000000000004e00000000000013bf30000000000000950000000000ffff"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xb579, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xe}, 0x23)

14.931600724s ago: executing program 4 (id=1873):
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$TIPC_NL_KEY_SET(0xffffffffffffffff, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001)
socket(0x10, 0x3, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0)
preadv(r0, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0)
r1 = socket$inet6(0xa, 0x0, 0x0)
setsockopt$inet6_mtu(r1, 0x29, 0x17, &(0x7f0000000080)=0x5, 0x4)
r2 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000011c0)=ANY=[@ANYBLOB="12010001090003206d0414c340000000000109022400010000a0000904000001030101000921000800012203000905", @ANYRES64], 0x0)
syz_usb_control_io$hid(r2, 0x0, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000000c0)={'wlan1\x00'})
fanotify_init(0x200, 0x0)
r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='fdinfo/3\x00')
read$FUSE(r5, &(0x7f00000020c0)={0x2020}, 0x2020)
ioctl$RTC_WKALM_RD(r0, 0x80287010, &(0x7f0000000300))
sendmsg$NL80211_CMD_CONNECT(r3, 0x0, 0x0)
r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff)
ioctl$SOUND_MIXER_READ_VOLUME(0xffffffffffffffff, 0x80044d17, &(0x7f0000000980))
sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r0, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000004100)={0x9e4, r4, 0x100, 0x70bd2b, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_TX_RATES={0xe0, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x48, 0x1, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5, 0x4, 0x3}, @NL80211_TXRATE_HT={0x3c, 0x2, [{0x7, 0xa}, {0x2, 0x9}, {0x1, 0x7}, {0x6, 0x8}, {0x6, 0x8}, {0x7, 0xa}, {0x6, 0x7}, {0x0, 0x2}, {0x0, 0x6}, {0x2, 0x9}, {0x2}, {0x7, 0x5}, {0x4, 0x2}, {0x1, 0x6}, {0x1, 0xa}, {0x6, 0x4}, {0x2, 0x7}, {0x1, 0x6}, {0x3, 0x5}, {0x6, 0xa}, {0x3, 0x2}, {0x7, 0x3}, {0x4, 0x4}, {0x2}, {0x6, 0x9}, {0x7, 0x8}, {0x4, 0x5}, {0x5, 0x5}, {0x0, 0x7}, {0x7, 0x5}, {0x0, 0x1}, {0x2, 0x7}, {0x5, 0x5}, {0x6, 0x5}, {0x1, 0x9}, {0x0, 0x5}, {0x2, 0x1}, {0x1, 0x9}, {0x4, 0xa}, {0x4}, {0x4, 0x2}, {0x4}, {0x2, 0x3}, {0x6, 0x5}, {0x3, 0x1}, {0x1, 0x5}, {0x1, 0x7}, {0x2, 0x4}, {0x0, 0x9}, {0x2, 0xa}, {0x0, 0x5}, {0x0, 0xa}, {0x5, 0xa}, {}, {0x1, 0x5}, {0x6, 0x1}]}]}, @NL80211_BAND_60GHZ={0x80, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x351, 0x6, 0x5, 0x20e7, 0x7, 0x200, 0x7, 0xf019]}}, @NL80211_TXRATE_LEGACY={0x6, 0x1, [0x6c, 0x0]}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_HT={0x46, 0x2, [{0x5, 0x6}, {0x0, 0x9}, {0x0, 0xa}, {0x6, 0x5}, {0x3, 0x6}, {0x3, 0xa}, {0x1, 0x1}, {0x2, 0x2}, {0x5, 0x3}, {0x4, 0x2}, {0x4, 0x7}, {0x1, 0x5}, {0x7}, {0x6, 0x8}, {0x5, 0xa}, {0x3, 0xa}, {0x0, 0x7}, {0x7, 0x9}, {0x4, 0x2}, {0x7, 0x8}, {0x3, 0x2}, {0x5, 0x2}, {0x6, 0x4}, {0x1, 0x9}, {0x6}, {0x1, 0x2}, {0x4, 0x9}, {0x4, 0x1}, {0x6, 0x9}, {0x4, 0x4}, {0x6, 0x1}, {0x1, 0x6}, {0x7, 0x8}, {0x1, 0x4}, {0x7, 0xa}, {0x1, 0x5}, {0x0, 0x7}, {0x1, 0x8}, {0x3, 0x2}, {0x1, 0x5}, {0x7, 0x5}, {0x1, 0x9}, {0x5, 0x6}, {0x0, 0x7}, {0x2, 0x5}, {0x3, 0x3}, {0x6, 0x5}, {0x2, 0x7}, {0x2, 0x1b}, {0x1, 0x4}, {0x6, 0xa}, {0x3, 0xa}, {0x7, 0x7}, {0x1}, {0x5, 0x6}, {0x3}, {0x1, 0x2}, {0x2, 0x8}, {0x1, 0x3}, {0x4, 0x9}, {0x2, 0x1}, {0x7, 0x3}, {0x3, 0xa}, {0x7, 0x7}, {0x4, 0x2}, {0x2, 0x3}]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}]}, @NL80211_BAND_2GHZ={0x14, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_GI={0x5}]}]}, @NL80211_ATTR_TX_RATES={0x33c, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x4c, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HT={0x32, 0x2, [{0x3}, {0x6, 0x8}, {0x2, 0x6}, {0x5, 0x8}, {0x2, 0x2}, {0x3}, {0x5, 0x9}, {0x4, 0x3}, {0x4, 0x8}, {0x6, 0x3}, {0x3, 0x9}, {0x7, 0x8}, {0x7, 0x1}, {0x7, 0x2}, {0x0, 0x2}, {0x0, 0x8}, {0x6, 0x5}, {0x2}, {0x6, 0x1}, {0x4, 0xa}, {0x0, 0x1}, {0x1, 0x1}, {0x7, 0x8}, {0x7, 0x2}, {0x5, 0x8}, {0x1, 0x6}, {0x4}, {0x0, 0x8}, {0x6, 0x7}, {0x2, 0xa}, {0x6, 0xa}, {0x5, 0x9}, {0x1, 0xa}, {0x2, 0x7}, {0x4, 0x4}, {0x5, 0x8}, {0x7, 0x9}, {0x2}, {0x4}, {0x2, 0x4}, {0x6}, {0x7, 0x4}, {0x4, 0x1}, {0x2, 0x8}, {0x7, 0x4}, {0x5, 0x6}]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0xf84, 0x9, 0xfff8, 0xfffa, 0x4, 0x4000, 0x7d77, 0x9]}}]}, @NL80211_BAND_5GHZ={0x34, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_LEGACY={0x12, 0x1, [0xb, 0x60, 0x3, 0x18, 0x2, 0xd, 0x1b, 0x36, 0x1, 0x1e, 0x12, 0x1b, 0x1, 0x12]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x7ff, 0x2, 0x600, 0x5, 0xa, 0x8183, 0x3, 0xde]}}]}, @NL80211_BAND_60GHZ={0x3c, 0x2, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x1a, 0x1, [0x3, 0x1b, 0x2, 0x36, 0x1b, 0x18, 0x18, 0x30, 0x1b, 0x36, 0x24, 0x1, 0x12, 0x30, 0x4, 0x3, 0x36, 0x6c, 0x3, 0x24, 0x18, 0x0]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x80, 0x7, 0x7, 0x9, 0xff, 0x200, 0x5, 0x280e]}}, @NL80211_TXRATE_LEGACY={0x5, 0x1, [0x24]}]}, @NL80211_BAND_60GHZ={0x28, 0x2, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0xfff8, 0x3, 0x4, 0x9, 0x4, 0x1, 0x2a, 0x10]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}]}, @NL80211_BAND_6GHZ={0x10c, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HT={0x4c, 0x2, [{0x4, 0x6}, {0x4, 0x5}, {0x4, 0x4}, {0x2, 0x9}, {0x0, 0x5}, {0x4, 0x2}, {0x2, 0x3}, {0x3, 0x4}, {0x1, 0x5}, {0x6, 0x8}, {0x4, 0x4}, {0x2, 0x9}, {0x5, 0xa}, {0x3, 0x1}, {0x4, 0x8}, {0x2, 0x2}, {0x6, 0x5}, {0x7, 0x9}, {0x1, 0x8}, {0x5, 0xa}, {0x1, 0x9}, {0x6, 0x9}, {0x2, 0x7}, {0x7}, {0x5}, {0x6, 0x4}, {0x0, 0x2}, {0x0, 0x7}, {0x2, 0xa}, {0x1, 0x1}, {0x6, 0x9}, {0x7, 0x2}, {0x4, 0x3}, {0x6, 0x3}, {0x5}, {0x6}, {0x7, 0x1}, {0x1, 0x4}, {0x5}, {0x0, 0x3}, {0x4, 0x6}, {0x3, 0x3}, {0x6, 0x9}, {0x0, 0x8}, {0x0, 0x8}, {0x4, 0x6}, {0x2, 0x5}, {0x6, 0x8}, {0x1, 0x2}, {0x2, 0x8}, {0x6, 0x5}, {0x5, 0x4}, {0x3}, {0x3, 0x4}, {0x6, 0x7}, {0x4, 0x5}, {0x1, 0x3}, {0x1}, {0x3, 0x2}, {0x2, 0x8}, {0x7, 0xa}, {0x5, 0x9}, {0x0, 0x5}, {0x4, 0x7}, {0x0, 0x9}, {0x1, 0x4}, {0x7}, {0x1, 0x1}, {0x0, 0x8}, {0x5, 0x8}, {0x4, 0x9}, {0x0, 0x2}]}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_LEGACY={0x1f, 0x1, [0x60, 0xb, 0x1b, 0x9, 0x9, 0x30, 0x12, 0x30, 0x24, 0xc, 0x60, 0x9, 0x6, 0xb, 0xc, 0x30, 0x6, 0x2, 0x60, 0x4, 0x18, 0x1b, 0x24, 0x31, 0x30, 0x30, 0x2]}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_LEGACY={0x15, 0x1, [0x24, 0x2, 0x6, 0x1b, 0x16, 0x12, 0xb, 0x9, 0x6, 0x3, 0x30, 0x12, 0x12, 0x6c, 0x5, 0x60, 0x48]}, @NL80211_TXRATE_HT={0x26, 0x2, [{0x1, 0x5}, {0x7, 0xa}, {0x7, 0x7}, {0x1, 0x9}, {0x4, 0x4}, {0x0, 0x7}, {0x5, 0x3}, {0x5, 0xa}, {0x7, 0x4}, {0x1, 0x1}, {0x7, 0x9}, {0x7, 0x7}, {0x4, 0xe}, {0x0, 0x7}, {0x2, 0xa}, {0x5, 0xa}, {0x3}, {0x7, 0x6}, {0x5, 0xa}, {0x0, 0x1}, {0x2, 0x2}, {0x3}, {0x0, 0x5}, {0x2, 0x1}, {0x1, 0x6}, {0x1, 0x3}, {0x1, 0x2}, {0x0, 0x7}, {0x2, 0x6}, {0x1, 0x7}, {0x2}, {0x2, 0xa}, {0x4, 0x5}, {0x6, 0x9}]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_HT={0x8, 0x2, [{0x2}, {0x4, 0x1}, {0x4}, {0x6, 0x1}]}, @NL80211_TXRATE_HT={0x33, 0x2, [{0x6, 0x2}, {0x0, 0x3}, {0x7, 0x6}, {0x2, 0x8}, {0x0, 0x6}, {0x3}, {0x0, 0x5}, {0x4, 0x5}, {0x4, 0xa}, {0x0, 0x8}, {0x6, 0xa}, {0x6, 0x9}, {0x7, 0x7}, {0x1, 0x1}, {0x1, 0x6}, {}, {0x1, 0x7}, {0x1, 0x5}, {0x2, 0x9}, {0x6, 0x4}, {0x3, 0x4}, {0x1}, {0x5}, {0x0, 0x4}, {0x2, 0x8}, {0x4, 0x7}, {0x1, 0x5}, {0x6, 0xa}, {0x6, 0x6}, {0x0, 0x2}, {0x3}, {0x2, 0x9}, {0x4, 0x6}, {0x1, 0x5}, {0x3, 0x6}, {0x0, 0x9}, {0x2, 0xa}, {0x2, 0x4}, {0x6, 0x4}, {0x6, 0x6}, {0x6, 0x2}, {0x2, 0xa}, {0x1}, {0x1, 0x2}, {0x4, 0x1}, {0x5, 0x9}, {0x0, 0x5}]}]}, @NL80211_BAND_2GHZ={0x70, 0x0, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0xe, 0x5, 0x8001, 0x6, 0x5, 0xcf9, 0x1, 0x6]}}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HT={0x2e, 0x2, [{0x5, 0x2}, {0x0, 0x7}, {0x7, 0x3}, {0x0, 0x8}, {0x0, 0x6}, {0x0, 0x3}, {0x1, 0x1}, {0x0, 0x3}, {0x5, 0x3}, {0x0, 0x3}, {0x0, 0x3}, {0x2}, {0x3, 0x6}, {0x1, 0x2}, {0x0, 0x1}, {0x6, 0x4}, {0x1, 0x3}, {0x2, 0x5}, {0x2, 0x7}, {0x3, 0x3}, {0x5, 0xa}, {0x0, 0x3}, {0x6, 0x4}, {0x6}, {0x3, 0x8}, {0x0, 0x7}, {0x7, 0xa}, {0x1, 0x6}, {0x2}, {0x4}, {0x2, 0xa}, {0x3}, {0x0, 0x7}, {0x3, 0x3}, {0x2, 0x4}, {0x7, 0x6}, {0x0, 0x4}, {0x4, 0x7}, {0x6, 0x4}, {0x0, 0x1}, {0x2, 0x7}, {0x2, 0x7}]}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HE_GI={0x5}]}, @NL80211_BAND_2GHZ={0x80, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_HT={0x4f, 0x2, [{0x2, 0x8}, {}, {0x7, 0x7}, {0x4, 0xa}, {0x0, 0x1}, {0x3, 0x3}, {0x5, 0x4}, {0x4}, {0x6, 0x6}, {0x5, 0xa}, {0x7, 0xa}, {0x2}, {0x3, 0x8}, {0x1}, {0x3, 0x4}, {0x7, 0x2}, {0x7, 0x2}, {0x2, 0x2}, {0x7, 0x3}, {0x1, 0x9}, {0x7, 0x7}, {0x7, 0x3}, {0x2, 0x2}, {0x5, 0x8}, {0x6, 0x6}, {0x4}, {0x0, 0x2}, {0x0, 0x6}, {0x7, 0x2}, {0x6, 0x6}, {0x6, 0x5}, {0x2, 0x8}, {0x2, 0x8}, {0x3}, {0x4, 0x1}, {0x4, 0x5}, {0x0, 0x1}, {0x3, 0x5}, {}, {0x3, 0x7}, {0x2, 0x8}, {0x0, 0x6}, {0x0, 0x5}, {0x1, 0x3}, {0x0, 0x7}, {0x5, 0x6}, {0x2, 0x4}, {0x1, 0x5}, {0x4}, {0x2, 0x7}, {0x4, 0x9}, {0x1, 0x2}, {0x1, 0xa}, {0x3, 0x2}, {0x5, 0x6}, {0x2, 0x7}, {0x5, 0x4}, {0x7, 0x1e}, {0x0, 0x1}, {0x4, 0x6}, {0x0, 0x8}, {0x6}, {0x2, 0x6}, {0x5, 0x2}, {0x3, 0x5}, {0x1, 0x3}, {0x7, 0x3}, {0x5, 0x2}, {0x7}, {0x1, 0x7}, {0x1}, {0x6, 0xa}, {0x4, 0x2}, {0x0, 0x3}, {0x2, 0x7}]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x2, 0x1, 0x0, 0xb2f7, 0x0, 0x8, 0x200]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_HE_LTF={0x5}]}, @NL80211_BAND_6GHZ={0x14, 0x3, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_HE_LTF={0x5}]}, @NL80211_BAND_60GHZ={0x44, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x7, 0x0, 0x4, 0x40, 0x2, 0x9, 0x9, 0x7]}}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0xd22, 0x40, 0xfffa, 0x1, 0x7, 0x10, 0x8, 0x6]}}]}]}, @NL80211_ATTR_TX_RATES={0x1c0, 0x5a, 0x0, 0x1, [@NL80211_BAND_2GHZ={0x18, 0x0, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x2, 0x1, 0x7fff, 0x4, 0x875e, 0x0, 0x3, 0x4]}}]}, @NL80211_BAND_60GHZ={0x3c, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_LEGACY={0x1f, 0x1, [0xb, 0x1, 0xb, 0x6c, 0x9, 0x12, 0x18, 0x8e11941989ff1b5f, 0x12, 0x2efff1836ddd1fa8, 0x6c, 0x2, 0x36, 0x4, 0x5, 0x5, 0x48, 0x28, 0x18, 0x60, 0x18, 0x6, 0x1b, 0x16, 0x16, 0x18, 0x24]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}]}, @NL80211_BAND_60GHZ={0xc, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}]}, @NL80211_BAND_2GHZ={0x88, 0x0, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x22, 0x1, [0x48, 0x48, 0x5, 0x6, 0x1, 0x22, 0x1b, 0x1b, 0x6, 0x4, 0xb, 0x1, 0x18, 0x4, 0x1b, 0x3, 0x2, 0x0, 0x3, 0x48, 0x16, 0x33, 0x48, 0x0, 0x18, 0x6, 0x2d, 0x36, 0x0, 0x1b]}, @NL80211_TXRATE_LEGACY={0x18, 0x1, [0x30, 0x36, 0x36, 0x6, 0x6, 0x6, 0x6, 0x16, 0x5, 0x1b, 0x48, 0x16, 0x2, 0x1b, 0xb, 0x6c, 0x18, 0x30, 0x16, 0x0]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x8, 0x8, 0x3ff, 0x0, 0x65b, 0xfecf, 0xfffa, 0xd]}}, @NL80211_TXRATE_LEGACY={0xf, 0x1, [0x0, 0x36, 0x3, 0x0, 0x1b, 0x18, 0x1b, 0x2, 0x5, 0x6, 0x30]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0xfffd, 0x100, 0xad4, 0xc, 0x9, 0x1ff, 0x3, 0x8]}}]}, @NL80211_BAND_6GHZ={0x4c, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x8000, 0x8, 0x4, 0x5b11, 0x401, 0x6, 0x3, 0x1]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x4, 0x8, 0x5cf7, 0xffff, 0x101, 0x8, 0x36ab, 0x2]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}]}, @NL80211_BAND_60GHZ={0x40, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x148, 0x1, 0x2, 0x80, 0x5, 0x8, 0x90]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x9, 0x9, 0xfffc, 0x1, 0x7, 0x5, 0x3, 0x5]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x1, 0xff7f, 0x7, 0xa, 0x9, 0x4, 0x7]}}]}, @NL80211_BAND_2GHZ={0x48, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HT={0x25, 0x2, [{0x1}, {0x5, 0x3}, {0x1, 0x8}, {0x4, 0x9}, {0x7, 0x3}, {0x1, 0x3}, {0x0, 0x9}, {0x6}, {0x3, 0x9}, {0x7, 0x3}, {0x6, 0x9}, {0x7, 0x4}, {0x3, 0x3}, {0x0, 0x7}, {0x2}, {0x5, 0x8}, {0x3, 0x4}, {0x3}, {0x5, 0x1}, {0x7, 0x1}, {0x1, 0x9}, {0x0, 0x1}, {0x2, 0x3}, {0x2, 0x6}, {0x1}, {0x5, 0xa}, {0x0, 0x2}, {0x6, 0x6}, {0x3, 0x6}, {0x4}, {0x4, 0x7}, {0x2, 0x9}, {0x4}]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0xfffe, 0x6, 0x8, 0xb, 0x2, 0x9, 0x6]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}]}]}, @NL80211_ATTR_TX_RATES={0x9c, 0x5a, 0x0, 0x1, [@NL80211_BAND_2GHZ={0x60, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_LEGACY={0x18, 0x1, [0x9, 0xb, 0x4, 0x60, 0x0, 0x30, 0x16, 0x6, 0x1, 0x3, 0x24, 0x4, 0x48, 0x4, 0x4, 0x3, 0x30, 0x1b, 0x30, 0x48]}, @NL80211_TXRATE_LEGACY={0x8, 0x1, [0x1b, 0x9, 0x6c, 0x24]}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x7fff, 0x7, 0xf20, 0x5, 0xffff, 0x3, 0x8cf7, 0x4]}}]}, @NL80211_BAND_6GHZ={0x38, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x28, 0x3, 0x3ff, 0x7, 0xfc00, 0x800, 0x9, 0xfffb]}}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}]}]}, @NL80211_ATTR_TX_RATES={0x94, 0x5a, 0x0, 0x1, [@NL80211_BAND_60GHZ={0x90, 0x2, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0xe, 0x1, [0x12, 0xb, 0x6c, 0x3, 0x2, 0x30, 0x1b, 0x60, 0x3, 0x6c]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x8, 0x8000, 0x630, 0xa3e6, 0x9634, 0x7, 0x710, 0xffff]}}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_LEGACY={0x16, 0x1, [0x32, 0x238fb9ac2c523858, 0x6, 0x16, 0xb, 0x60, 0x16, 0x3, 0x5, 0x16, 0xc, 0x5, 0x9, 0x3, 0x6c, 0xb, 0x36, 0x29]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x40, 0x6e94, 0x40, 0xe7, 0x1, 0xff, 0xac, 0x5]}}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x5, 0xfff7, 0xe, 0x3, 0xfff, 0x3, 0x7, 0x1]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HE_LTF={0x5}]}]}, @NL80211_ATTR_TX_RATES={0x4}, @NL80211_ATTR_TX_RATES={0x4c, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x48, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HT={0x8, 0x2, [{0x4, 0x9}, {0x0, 0x1}, {0x2, 0x6}, {0x1, 0x4}]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x1, 0x8, 0x8001, 0x1ff, 0x7ff, 0xfffa, 0x4, 0x1]}}, @NL80211_TXRATE_HT={0xf, 0x2, [{0x7, 0x3}, {0x0, 0x5}, {0x7, 0x4}, {0x6, 0x3}, {0x5, 0x3}, {0x7, 0x9}, {0x5, 0x1}, {0x4, 0x3}, {0x1, 0x3}, {0x5}, {0x1, 0x3}]}, @NL80211_TXRATE_LEGACY={0x15, 0x1, [0x48, 0x60, 0x4, 0x6, 0x3c, 0x48, 0x3, 0x6, 0x18, 0x1b, 0x2, 0x60, 0xc, 0xc, 0x14, 0x30, 0xb]}]}]}, @NL80211_ATTR_TX_RATES={0x274, 0x5a, 0x0, 0x1, [@NL80211_BAND_2GHZ={0x18, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x3, 0x5, 0x17b, 0x401, 0xf53c, 0x2, 0x4, 0x80]}}]}, @NL80211_BAND_60GHZ={0x98, 0x2, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HT={0x23, 0x2, [{0x2, 0x4}, {0x3, 0x3}, {0x3, 0x8}, {0x2, 0x3}, {0x6, 0xa}, {0x5, 0x6}, {0x7, 0x4}, {0x1, 0xa}, {0x3, 0x5}, {0x1, 0x5}, {0x2, 0x3}, {0x1, 0x2}, {0x0, 0x7}, {0x1, 0x4}, {0x5, 0x3}, {0x6, 0x8}, {0x2, 0x7}, {0x2, 0x7}, {0x1, 0x3}, {0x7, 0xa}, {0x6, 0x4}, {0x5, 0x9}, {0x4, 0x7}, {0x0, 0x6}, {0x7, 0x6}, {0x0, 0x2}, {0x0, 0xa}, {0x5, 0x7}, {0x3, 0x1}, {}, {0x1, 0x6}]}, @NL80211_TXRATE_HT={0x50, 0x2, [{0x0, 0x6}, {0x7, 0x9}, {0x3, 0x5}, {0x5, 0x9}, {0x0, 0x5}, {0x4, 0x7}, {0x7, 0x8}, {0x2, 0x7}, {0x1, 0x3}, {0x0, 0x5}, {0x0, 0x6}, {0x0, 0x5}, {0x7}, {0x4, 0x1}, {0x6, 0x2}, {0x1, 0x5}, {0x2, 0x6}, {0x0, 0x5}, {0x0, 0xa}, {0x1, 0x8}, {0x0, 0x1}, {0x2, 0x2}, {0x6, 0x8}, {0x3, 0xa}, {0x1, 0x5}, {0x6, 0x7}, {0x4, 0x3}, {0x0, 0x2}, {0x1, 0x3}, {0x4, 0x8}, {0x5, 0x9}, {0x0, 0x4}, {0x2, 0x2}, {0x1, 0x9}, {0x3, 0x8}, {0x5, 0x7}, {0x2}, {0x3, 0x9}, {0x4, 0x1}, {0x2, 0x2}, {0x2, 0x2}, {0x2, 0x4}, {0x7, 0x2}, {0x1, 0x1}, {0x2, 0x6}, {0x4, 0x8}, {0x3, 0x9}, {0x6, 0x8}, {0x0, 0xa}, {0x0, 0x9}, {0x2, 0x4}, {0x1}, {0x7, 0x6}, {0x6, 0x1}, {0x7, 0x5}, {0x1, 0x5}, {0x0, 0x3}, {0x1, 0x3}, {0x2, 0x8}, {0x2, 0x8}, {0x7, 0x1}, {0x7, 0x8}, {0x0, 0xa}, {0x0, 0x1}, {0x0, 0x2}, {0x5, 0x7}, {0x5, 0x5}, {0x5, 0x9}, {0x4, 0x1}, {0x2, 0x3}, {0x7, 0x4}, {0x4, 0x7}, {0x6, 0x5}, {0x0, 0x6}, {0x2, 0x9}, {0x5, 0x5}]}, @NL80211_TXRATE_GI={0x5}]}, @NL80211_BAND_5GHZ={0x20, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x0, 0x0, 0x8, 0x7f, 0x5, 0x5, 0xfff9, 0x7fff]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}]}, @NL80211_BAND_5GHZ={0x24, 0x1, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}]}, @NL80211_BAND_5GHZ={0x88, 0x1, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x800, 0x0, 0xfad8, 0x7, 0x7eb, 0x7, 0x24, 0x2b3d]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x8116, 0x7, 0x0, 0x3, 0x5, 0x0, 0x7, 0x43]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x45, 0x8, 0x5, 0x5, 0x9, 0x2, 0x0, 0xe]}}, @NL80211_TXRATE_HT={0x35, 0x2, [{0x1, 0x9}, {0x3}, {0x2, 0x2}, {0x4}, {0x7}, {0x2, 0x8}, {0x6, 0x1}, {0x6, 0x9}, {0x0, 0x6}, {0x0, 0x9}, {0x0, 0xa}, {0x6, 0x3}, {0x0, 0x3}, {0x3, 0x1}, {0x2, 0x7}, {0x0, 0x8}, {0x4, 0x3}, {}, {0x2, 0x5}, {0x3}, {0x5, 0xa}, {0x4, 0x5}, {0x3, 0x3}, {0x4, 0x9}, {0x3, 0x1}, {0x0, 0x3}, {0x1, 0x6}, {0x2, 0x4}, {0x1}, {0x3, 0x2}, {0x5}, {0x1, 0x7}, {0x6, 0x1}, {0x2, 0x4}, {0x2}, {0x1, 0x2}, {0x3, 0x6}, {0x1, 0x1}, {0x5, 0x3}, {0x1, 0x9}, {0x2, 0xa}, {0x5, 0x9}, {0x4, 0x6}, {0x1, 0x7}, {0x6, 0x1}, {0x5, 0x6}, {0x1, 0x2}, {0x5, 0x6}, {0x7, 0x1}]}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_HE_GI={0x5}]}, @NL80211_BAND_2GHZ={0xc, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5}]}, @NL80211_BAND_6GHZ={0x80, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_HE={0x14, 0x5, {[0xff, 0x3, 0x6, 0xffff, 0x100, 0xa340, 0x3ff, 0x9]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x5, 0x4, 0x4, 0x5, 0xf001, 0x8, 0x2, 0xa]}}, @NL80211_TXRATE_HT={0x49, 0x2, [{0x5, 0x8}, {0x1, 0x9}, {0x1, 0xa}, {0x3, 0x7}, {}, {0x0, 0x3}, {0x4, 0x8}, {0x4, 0x8}, {0x2, 0x1}, {0x3, 0xa}, {0x0, 0x4}, {0x7, 0x2}, {0x2, 0x5}, {0x2, 0x3}, {0x6}, {0x1, 0x5}, {0x6, 0x1}, {0x0, 0xa}, {0x7, 0x8}, {0x0, 0xa}, {0x0, 0x1}, {0x2, 0x9}, {0x1, 0x9}, {0x4, 0x4}, {0x0, 0x6}, {0x3}, {0x2, 0x2}, {0x6, 0x7}, {0x3, 0x9}, {0x3, 0x4}, {0x5, 0x8}, {0x3}, {0x0, 0x7}, {0x7, 0x4}, {0x6, 0x2}, {0x1, 0x1}, {0x5, 0x7}, {0x0, 0x9}, {0x1, 0x4}, {0x1, 0x9}, {0x7, 0x4}, {0x4, 0x3}, {}, {0x1, 0x2}, {0x3, 0x2}, {0x4, 0x8}, {0x0, 0x2}, {0x2, 0xa}, {0x1, 0x2}, {0x1, 0x5}, {0x5, 0x8}, {0x7, 0x7}, {0x1, 0x6}, {0x1, 0x9}, {0x2, 0x6}, {0x5, 0xa}, {0x4, 0x4}, {0x6, 0x2}, {}, {0x4, 0x7}, {0x6, 0xa}, {0x1, 0x3}, {0x3, 0x4}, {0x7, 0x5}, {0x7, 0x1}, {0x1, 0x9}, {0x1, 0x3}, {0x1, 0x3}, {0x4, 0x4}]}]}, @NL80211_BAND_6GHZ={0x20, 0x3, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x100, 0x4, 0xa5, 0xf388, 0x401, 0x2, 0x6, 0x8]}}]}, @NL80211_BAND_5GHZ={0x48, 0x1, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x20, 0x1, [0xc, 0x60, 0x36, 0x16, 0x1, 0x6, 0xc, 0x5, 0x30, 0x24, 0x3, 0x6c, 0x48, 0x16, 0x9, 0x9, 0x6, 0x4, 0x30, 0x12, 0x60, 0x30, 0x18, 0x6, 0x1, 0xc, 0x2, 0x5]}, @NL80211_TXRATE_LEGACY={0x5, 0x1, [0x9]}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0xfff, 0x4, 0x7ff, 0x6, 0x4, 0x2, 0xe8, 0x5]}}]}]}]}, 0x9e4}}, 0x40)
r7 = socket$nl_generic(0x10, 0x3, 0x10)
r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xe, &(0x7f00000004c0)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000001e6400000000000045040400010000001704000001000a00b7040000000100006a0af2fe00000000850000001a000000b7000000000000009500000000000000455781a5feee5e1ce784909b849d5550adf200000000000000b61d69f2ffdaa10350e11cb97c8ad51bcda0c4ee6d9674c77404ceb9971e43405d621ffbc9a4fd39b0631f6dde53a9a53608c10556e5734eb84049761471ce540c772e2d9f8004e26f7fcc059c062234d5595f6dba87b81d0806fb0289ce67a66afd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7480884bd8048a967d9b912ef9f1dcc4ff8546fee53f5b2e7b91c61ced1ebad000000000000e8122a793c080a882add4e1179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3ad198e3f3a532efa04137d452ff47d2638da3261c8362bb7c7824be6195a66d2e17e122040e11e3bd4a69fc6e8d9f7043e09b9e10dc7777bfae5884e4ba1e9cc4a2bbe99e30816127f46a1aae33d4d63d716c0975e1ce4a655362e7062ff6ab3934555c0184021b829472adefa06d3482c7b2711b98eabdca89b77efd13e6dba4a431ce47910000118093b6cabaa17a57727474e1785ee234835088445aa4a9b677d3d342640e328504aea02a2d727e62b7f097a02dbf8fe1d704765de7482040b2fc3000000000000000008947baeaaf954aff687deaa2f80492461d273ee26d8115cbca081a14cba24788779291745083fccdddc90d7af35c528df8000000d8d79c79ddca066da478c197d4a550470557bc99cca336bd88cd28a5ee651627e3a6fbf6ea53b95ddb64c69c7d8d2f4baddc239828760459564124bad68209d2a1d16ad085886c017679cfcda8b1e152ac1e2bcc5ede5b5687aa418abfa29acd7339e73b2cd185c9eb5fb34fccd20ffa155b16c0c309ed6f6663677df37de0ec0d0f548b273940be5d1fe0bae14d1a76bf741330dacd9cc19c0163bcc93059e8d2d1bfa928e2ba458ecd989cb3581a3f270ad48255ac0dad4923e3e36629589ff6b0ceb3438e4b432dd454c04be2d538aaf60c9f7a7281d32142f2fdbc3d37e5a072b5d7f0a349f1a75f01b5c203d4bdde6ff12de9a37f7fb9a16059ad97e2edefb5e0b0326bd25f6fd1d108efa9d30a9883815654486fe42cf2f676cdbb91f7582ab314be"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000340), 0xfffffffffffffe19}, 0x42)
setsockopt$sock_attach_bpf(r7, 0x1, 0x32, &(0x7f0000000200)=r8, 0x4)
sendmsg$ETHTOOL_MSG_LINKMODES_GET(r7, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000240)=ANY=[@ANYBLOB="94000000", @ANYRES16=r6, @ANYBLOB="330300000000000000001c0000005c00018008000100", @ANYRES32=0x0, @ANYBLOB="080003000000000008000300030000001400020076657468315f746f5f7465616d000000080003000000000008000300000000001400020062", @ANYRES32=0x0, @ANYBLOB="18677265300000000000ce143363c11fdbae0000200000000c00018008000300028900"], 0x94}, 0x1, 0xa60d000000000000}, 0x0)
io_uring_setup(0xc40, &(0x7f0000000100)={0x0, 0x556c, 0x0, 0x2, 0xffffffff})
ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000001300))

13.77315004s ago: executing program 1 (id=1874):
openat$rfkill(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0)
syz_open_procfs(0x0, &(0x7f00000011c0)='net/udp\x00')
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.idle_time\x00', 0x26e1, 0x0)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff)
sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000200)={0x0, 0x54, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r1, 0x701, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8}]}, 0x1c}}, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xb, 0x8, 0xc, 0xffffffff, 0x1, 0x1}, 0x48)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x90)
bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000011c0), &(0x7f00000013c0), 0x5}, 0x38)
r2 = gettid()
r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
read(r3, &(0x7f0000000200)=""/209, 0xd1)
ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r3, 0x4040534e, &(0x7f0000000080)={0x335, @time})
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, &(0x7f0000000180)={0x0, 0x0, {0x3, 0x1, 0x0, 0x2, 0x3d000}, 0x7f})
r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x0)
ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r4, 0xc08c5332, &(0x7f00000001c0)={0x0, 0x0, 0x0, 'queue0\x00'})
tkill(r2, 0x7)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r3, 0x404c534a, &(0x7f0000000380))
r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/seq/timer\x00', 0x0, 0x0)
read$char_usb(r5, &(0x7f00000001c0)=""/4068, 0xfe4)

12.707577816s ago: executing program 0 (id=1876):
r0 = syz_usb_connect$uac1(0x2, 0x71, &(0x7f0000000240)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x20, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5f, 0x3, 0x1, 0x2, 0x90, 0x7f, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0xe2, 0x8c}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x10, 0x10, 0x4, 0xc, {0x7, 0x25, 0x1, 0x2, 0x8, 0x9}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x420, 0x8, 0x3, 0x7, {0x7, 0x25, 0x1, 0x80, 0x6, 0x2}}}}}}}]}}, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$uac1(r0, &(0x7f0000000800)={0x14, 0x0, &(0x7f0000000b40)=ANY=[@ANYBLOB="0003e2000000e20353dc"]}, 0x0)
r1 = socket$inet_smc(0x2b, 0x1, 0x0)
setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0xb, &(0x7f0000000880)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x90)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setaffinity(0x0, 0xffffffffffffffca, &(0x7f0000000040)=0x10001)
r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0)
preadv(r2, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0)
fanotify_init(0x0, 0x81802)
socket$nl_route(0x10, 0x3, 0x0)
madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe)
bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0)
r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
close(r3)
r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0)
r5 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0)
flock(r5, 0x2)
r6 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0)
flock(r6, 0x2)
r7 = socket(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, <r8=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000000)={'lo\x00', <r9=>0x0})
sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000140)=@newqdisc={0x40, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, r9, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0xc, 0x2, [@TCA_FQ_CODEL_INTERVAL={0x8}]}}]}, 0x40}}, 0x0)
r10 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0)
flock(r10, 0x2)
flock(r10, 0x2)
flock(r10, 0x0)
close_range(r4, 0xffffffffffffffff, 0x0)
fsopen(&(0x7f0000000000)='tmpfs\x00', 0x0)

11.263655358s ago: executing program 4 (id=1878):
ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000000)={'sit0\x00', &(0x7f00000002c0)={'syztnl1\x00', 0x0, 0x0, 0x0, 0x0, 0x0, {{0x32, 0x4, 0x0, 0x0, 0xc8, 0x0, 0x0, 0x0, 0x29, 0x0, @broadcast, @remote, {[@timestamp={0x44, 0x18, 0x0, 0x0, 0x9, [0x401, 0x5, 0x0, 0x0, 0x4]}, @timestamp_prespec={0x44, 0x44, 0xc0, 0x3, 0x1, [{@private=0xa010100}, {@multicast1, 0x40005}, {@remote, 0x8}, {@dev={0xac, 0x14, 0x14, 0x32}, 0x659}, {@broadcast}, {@empty}, {@multicast2, 0xffd200}, {@private=0xa010100, 0x7}]}, @timestamp_prespec={0x44, 0x3c, 0x0, 0x3, 0x8, [{@dev={0xac, 0x14, 0x14, 0x40}}, {@remote}, {@multicast2}, {@private=0xa010101}, {@rand_addr=0x64010101}, {@broadcast, 0x52b1}, {@multicast2}]}, @noop, @noop, @noop, @rr={0x7, 0x17, 0x0, [@dev, @remote, @multicast1, @private=0xa010102, @remote]}]}}}}})
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0)
write$binfmt_script(r2, &(0x7f0000000240), 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x280000b, 0x28011, r2, 0x0)
r3 = dup(r1)
r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000300)=[@text64={0x40, 0x0}], 0xffff, 0x0, 0x0, 0x0)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0xd000})
ioctl$KVM_NMI(r4, 0xae9a)
ioctl$KVM_RUN(r4, 0xae80, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)

10.907406151s ago: executing program 3 (id=1879):
bpf$PROG_LOAD(0x5, 0x0, 0x0)
mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff)
openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
getsockopt$inet_sctp6_SCTP_RECVNXTINFO(0xffffffffffffffff, 0x84, 0x21, &(0x7f0000000340), 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0)
preadv(r0, &(0x7f0000000240), 0x0, 0x0, 0x0)
r1 = socket$inet6(0xa, 0x8000000000080001, 0x0)
setsockopt$inet6_group_source_req(r1, 0x29, 0x2e, &(0x7f00000000c0)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @rand_addr=' \x01\x00'}}}, 0x108)
r2 = syz_open_procfs(0x0, &(0x7f0000000200)='net/netstat\x00')
socket$nl_netfilter(0x10, 0x3, 0xc)
read$FUSE(r2, &(0x7f0000006480)={0x2020}, 0x2020)
preadv(r2, &(0x7f0000001680)=[{&(0x7f0000000000)=""/64, 0x40}], 0x1, 0x0, 0x0)
read$FUSE(r2, &(0x7f00000016c0)={0x2020}, 0x2020)
ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0)
ioctl$VHOST_SET_VRING_KICK(0xffffffffffffffff, 0x4008af20, 0x0)
unshare(0x0)
syz_usb_connect(0x0, 0x408, &(0x7f0000000a40)=ANY=[@ANYBLOB="1201510223637c10080970004942010203010902f60301000000000904d3000a96d3810009050c00ff03022702090503000004060102970ad058ec77d3f81475fc530105983f6917c9c578428e753fb76e602c71735d1ae9cf0f7b55aa87a8a4875bc18692a023767bf7b31d75cf2d56cf253f87a5570f2b2660f0a574d1bbd48d69cb8c18d732679c2f3215d1bbbfa7ba625ad62758f87e874cd208ed36b63fbd81aa7094a866330c7947ef411bea25202052ccd623ac7c7becc4d7cced81c71eb1d089ff84770a457031008e090501030004ac100007250180ae0000072501000009000905cf140004d309023822be0e5d1ed978a0d1131288e36b06d372f2a1be76e40f72b36327055a02871dc460df92d95d7cb39f72a4386d86c7c2c4449522ce8d8364022cb0dc6bda819701f7c19b8f73998b550ad92d04737373f38b445f8959662df11ff4b609144a9b2eacbeafbc91d125762b419221b8415df79d568e55e35ec6baa3d43ecf492ca2af81b96d390c13c238412a16aa4edc5d215d60d0b62b176c21560609050610ff0305cc20c410fa4c15a9dec3a00d82fe83bbf7a3fd3e1db4856de0691072b45e3a0e20d9cdf8e7fc3fe6db5ef095df89563c2c6e89904dd5bbbae3220338158d7b167afc80fd77af962ade1eb87777564a1a3004d26003d3c2cb98052812fb987e99d1ffed5ba65b8304655f398c8cb4ec5797ce3457be5aef4022db45a1798bc018eb85ef72cc1735c5e7621de4089bf2786b02a1566f0c0a19d72967177152593b2aa855a9f264ac09b1d389cb5d7b1461d4c5155e54eec76f00c972810d6004b84a0dc493ed6b578c147c1c5d530b0905060c00048109800725010107440b0725010140010109050d047aeb0708010725018005080009050a004000fa7f00780431756d1c7cb9b04da31272fab5b6a7acf88f6d01c805464c74ec7e61d6616a2d56bbfe197dc6052873336de9abb087e3ca11c4fd73982f1d6cb7a8412b80610d1cfa4444684c800d8b04cb334981607378cffc932be3991a9dc7985bff88f010e9976bfac018a9fa3da8940dc636e23982f8672236210905050000040a0658072501010281000725018105070009050d00ff03ff01810725010209ff7fe321de33bb35a8705b487a6c4e8fd7f94e9e683e46f581b34a5023cb3e5bd9f002f85e575fe1ddede6dd38363e7c7fbe4d9dee7d108ab68ddc5d039baa2ab5ea507a4119db07689fffaaa3a2d90dc1775c6201"], 0x0)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f0000000100)={0x0, 0x0}, 0x10)
r4 = syz_open_dev$video(&(0x7f0000000080), 0x0, 0x0)
ioctl$VIDIOC_G_FMT(r4, 0xc0d05604, &(0x7f0000000500)={0xa})
r5 = socket$igmp(0x2, 0x3, 0x2)
setsockopt$EBT_SO_SET_ENTRIES(r5, 0x0, 0x80, &(0x7f0000001200)=@broute={'broute\x00', 0x5e04, 0x0, 0x90, [0x0, 0x0, 0x20000000], 0x2, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="00cfd66c84c5a137666bfe6b5525c0be5a00000000000000000000000000000000000000800000000000000000000000000000400000000000000000000000000000000000000000000000000000000034d40000000000ebbd3bf52f627700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000048b165efd0d5ae3fe83d561c5eda469d41ece0815a892b4d2326ebfac7b4e4763914644ddbd9c993dfd36d8556b82548416acf55b9ffdbe4a694301bbc0e140c21f4cd4879e0c8bfe42c834961af1a620d90768a25205c90485bfac063c7c52d0e8a4162c24afdd41023a796596ec2f77efb91751acb273a71848b0a0d6ee4f74fd9607e2e8ff33bb21f676e99bf5b9eb9ab432b630429c8664f85ddb0059429ff43a2ae548312c780da422342e346b039"]}, 0x1cc)
socket$inet6(0xa, 0x3, 0x8000000003c)

9.380090047s ago: executing program 4 (id=1880):
prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680))
open(&(0x7f0000000100)='./file0\x00', 0xc2942, 0x10a)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
socket$nl_route(0x10, 0x3, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001)
r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0)
preadv(r1, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0)
sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0)
r2 = syz_open_procfs$pagemap(0x0, 0x0)
write$FUSE_LK(0xffffffffffffffff, 0x0, 0x0)
ioctl$FS_IOC_SETFLAGS(r2, 0xc0606610, &(0x7f0000000040)=0x60)
fsopen(0x0, 0x0)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0)
socket$unix(0x1, 0x1, 0x0)
r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000003c0)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x20, 0x60b, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x5}}}}]}}]}}, 0x0)
syz_usb_control_io(r3, 0x0, 0x0)
syz_usb_control_io(r3, &(0x7f0000000080)={0x2c, &(0x7f0000000040)={0x0, 0x0, 0x2, {0x2}}, 0x0, 0x0, 0x0, 0x0}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r4 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000380)={0xc, 0x0, <r5=>0x0})
ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r4, 0x3ba0, &(0x7f0000000200)={0x48, 0x2, r5, 0x0, 0x0, 0x0, <r6=>0x0})
ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000140)={0xc, 0x0, <r7=>0x0})
ioctl$IOMMU_HWPT_ALLOC$TEST(r4, 0x3b89, &(0x7f00000002c0)={0x18, 0x0, r6, r7, 0x0, 0x0, 0xdead, 0x4, &(0x7f0000000280)})
r8 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0xa2602, 0x0)
write$USERIO_CMD_SET_PORT_TYPE(r8, &(0x7f0000000040)={0x1, 0x5}, 0x2)
write$USERIO_CMD_REGISTER(r8, &(0x7f0000000100), 0x2)
write$USERIO_CMD_SET_PORT_TYPE(r8, &(0x7f00000001c0), 0x2)

8.190035393s ago: executing program 2 (id=1828):
openat$adsp1(0xffffffffffffff9c, 0x0, 0x101100, 0x0)
r0 = syz_open_dev$sg(0x0, 0x0, 0x0)
pipe(&(0x7f00000000c0)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udplite(0x2, 0x2, 0x88)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x9)
r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x80300, 0x0)
preadv(r3, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0x9569a2dc}], 0x1, 0x0, 0x0)
socket$inet(0x2, 0x4000000000000001, 0x0)
r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000340), 0x200, 0x0)
r5 = syz_open_dev$video(&(0x7f0000000380), 0xd425, 0x40)
ioctl$FIDEDUPERANGE(r1, 0xc0189436, &(0x7f0000000480)=ANY=[@ANYBLOB="0300002200000000060000000000000005000000000000001da99fe831f01e97d79c0230fe0ef276792622c0693684cd124e7d65e049f233ad769b7b7063f5bb0322aa1dd55cd82a69af54bc5b15333e547a3e18ff2791a415788dfe92edae14bbc9af943a8a86cdc1f5fecc9acafdc8ed3421c8203415570e5b03ba3eeb924e", @ANYRES32=r4, @ANYBLOB='\x00\x00\x00\x00/\x00'/28, @ANYRES32=r5, @ANYBLOB="00000000560600"/28, @ANYRES32=r0, @ANYBLOB='\x00\x00\x00\x00\a\x00'/28, @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\a\x00'/28, @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\t\x00'/28])
sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0)
bind$inet(0xffffffffffffffff, 0x0, 0x0)
writev(0xffffffffffffffff, &(0x7f00000002c0)=[{&(0x7f0000000280)='0', 0x1}], 0x1)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000001000), 0x169802, 0x0)
r7 = dup(r6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000006, 0x13, r7, 0x2d0b000)
r8 = syz_open_dev$vim2m(&(0x7f0000000080), 0x7f, 0x2)
ioctl$vim2m_VIDIOC_S_FMT(r8, 0xc0d05605, &(0x7f00000000c0)={0x1, @pix_mp={0x0, 0x0, 0x33524742}})
arch_prctl$ARCH_GET_XCOMP_SUPP(0x1021, &(0x7f00000001c0))
r9 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000300), 0x4c142, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0)
r10 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0)
sync_file_range(r10, 0x2000000, 0x0, 0x5)
ioctl$UFFDIO_API(r10, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x2})
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbeeb, 0x8031, 0xffffffffffffffff, 0x40000000)
preadv2(r9, &(0x7f0000000080)=[{&(0x7f0000001200)=""/4096, 0x4000000}], 0x1, 0x0, 0x0, 0x0)
syz_usb_connect(0x0, 0x3f, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000d0918108ac051582588f0000000109022d00010000000009040000030b08000009058d67c8002a0000090505020000"], 0x0)

7.987835048s ago: executing program 0 (id=1881):
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a70000000060a01040000000000000000020000004400048040000180"], 0x98}}, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', <r1=>0x0})
r2 = socket(0x10, 0x80002, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0xd06e909224c21f8c, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3400000013000100000000000000000007000000", @ANYRES32=r1, @ANYBLOB="0000000000000f0014001a80100004800c00058008"], 0x34}}, 0x0) (fail_nth: 9)

7.612963286s ago: executing program 3 (id=1882):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100))
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0})
r2 = dup3(r1, r0, 0x0)
r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000005c0)='./binderfs/binder0\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040))
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000800)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000280)={@flat=@weak_binder={0x77622a85, 0x1001, 0x1}, @ptr={0x70742a85, 0x0, 0x0}, @fd}, &(0x7f0000000240)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0})
r4 = socket$inet6_sctp(0xa, 0x1, 0x84)
bind$inet6(r4, &(0x7f00000002c0)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
r5 = syz_open_dev$loop(&(0x7f0000000000), 0x0, 0x1)
ioctl$LOOP_SET_STATUS64(r5, 0x4c04, 0x0)
listen(r4, 0x4)
r6 = socket$inet6_sctp(0xa, 0x1, 0x84)
sendto$inet6(r6, &(0x7f0000847fff)='X', 0xfee4, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000005e00)={0xffffffffffffffff, <r7=>0xffffffffffffffff})
ioctl$F2FS_IOC_MOVE_RANGE(r7, 0x541b, &(0x7f0000000000)={<r8=>0xffffffffffffffff})
close_range(r8, 0xffffffffffffffff, 0x0)

6.781453039s ago: executing program 0 (id=1883):
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x0, 0x5, 0x0, 0x0}, 0x90)
r1 = syz_usb_connect$cdc_ncm(0x2, 0x6e, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090000082502000000000000000109025c00020100f92a0904000001020900000524060001053408fa6e0d240f0100000000000d000a0006471a010000190581"], 0x0)
syz_usb_disconnect(r1)
syz_usb_connect(0x1, 0x36, &(0x7f0000000040)=ANY=[], 0x0)
r2 = dup(r0)
write$UHID_INPUT(r2, &(0x7f0000001040)={0xfc, {"a2e3ad0e090d07f91b5e1a1887f70706d038e7ff7fc6e5539b0d3c0a8b089b3f3b3868030890e0879b0af8c6e70a9b334a959b669a240d0a0af3988f7ef319520100ffe8d178708c523c921b1b5b31070d0773090acd3b78130daa61d8e8040000005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0xffffffffffffff34}}, 0x1006)

6.578305568s ago: executing program 3 (id=1884):
syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
r0 = socket$kcm(0x21, 0x2, 0x2)
sendmsg$inet(r0, &(0x7f0000002780)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=[@ip_retopts={{0x14, 0x110, 0xd, {[@noop]}}}, @ip_ttl={{0x14, 0x110}}], 0x30}, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001)
r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0)
preadv(r1, &(0x7f0000000240), 0x0, 0x0, 0x0)
io_submit(0x0, 0x11, 0x0)
mlock2(&(0x7f0000006000/0x3000)=nil, 0x3000, 0x0)
openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x40b80, 0x0)
r2 = openat$vicodec1(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r3, 0xc0bc5351, &(0x7f0000000200)={0x98, 0x0, 'client0\x00', 0x0, "3f1af4a740812e3a", "5a79d5ab1a5dc91bdf033940fff4267c71a6349ebc4fb5480bdf6452ae9d2a14"})
r4 = socket$kcm(0x2, 0x1000000000000002, 0x0)
r5 = socket(0x1e, 0x1, 0x0)
sendmsg$tipc(r5, &(0x7f0000000300)={&(0x7f0000000000)=@id, 0x10, &(0x7f0000000380)=[{&(0x7f0000000140)='\v', 0x1}], 0x1}, 0x0)
sendmsg$inet(r4, &(0x7f0000000380)={&(0x7f00000001c0)={0x2, 0x4e1d, @multicast2}, 0x10, 0x0, 0x0, &(0x7f0000000000)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0x2a}, @initdev={0xac, 0x1e, 0x0, 0x0}}}}], 0x20}, 0x0)
write$binfmt_aout(r2, &(0x7f0000000300)=ANY=[@ANYBLOB="c701080782020000b501000017330000600000000000000000000000000000001b2f7169618362ae660ca48a1d8e9db338ec9c444f4033dbfda27e7eb8efa79dd99f7b4a271e768d03d27fdbd2b8849beae1033c0cb44bd0f801a6f552dfd020753a833e04e065b86d2b8b4e46f2ddb25dbb769080e44ae165d333d16dec826cd360602e714f472844d9a5da648a4738478699a4548fe04b26bcfabd27db863bd7e37a30985406602c012c55ba2fe36a37000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007800"/1285], 0x6b1)
remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0)
socket$nl_netfilter(0x10, 0x3, 0xc)
io_uring_setup(0x0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x2ed})
open(&(0x7f0000000000)='.\x00', 0x20403, 0x0)

5.875366545s ago: executing program 3 (id=1885):
r0 = syz_open_dev$sndctrl(&(0x7f0000000040), 0x1, 0x0)
ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f0000000540)={{0x2, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4004, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000000]})
io_uring_setup(0x252f, &(0x7f0000000280)={0x0, 0x0, 0x542, 0x2, 0xfffffffe})
r1 = openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x232801)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001)
r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
preadv(r2, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0)
ioctl$KDSIGACCEPT(r2, 0x4b4e, 0x29)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, 0x0)
socket$isdn(0x22, 0x2, 0x26)
socket$inet6_sctp(0xa, 0x1, 0x84)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x4000000)
r3 = socket$inet6(0xa, 0x2, 0x0)
epoll_create(0x200)
ioctl$int_in(0xffffffffffffffff, 0x5421, &(0x7f0000000180)=0x3)
sendto$inet6(r3, 0x0, 0x0, 0x8001, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @empty}, 0x1c)
syz_emit_ethernet(0x66, &(0x7f0000000340)={@broadcast, @dev, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x2f, 0x0, @private, @multicast1}, {{0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x4, 0x88a8}, {0x0, 0x0, 0x0, 0x0, 0x11}}}}}}, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
write$binfmt_misc(r3, &(0x7f0000000200)=ANY=[@ANYRES32=r1, @ANYRESOCT=r1, @ANYRESHEX, @ANYRES8=r2, @ANYRESHEX], 0xffdc)
r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0)
ioctl$SNDCTL_DSP_CHANNELS(r4, 0xc0045006, &(0x7f0000000100)=0x6)
ioctl$SNDCTL_DSP_SPEED(r4, 0xc0045002, &(0x7f0000000000)=0x7fffffff)
sendmsg$DEVLINK_CMD_PORT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$SNDCTL_DSP_SETFRAGMENT(r4, 0xc004500a, &(0x7f0000000040))
write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000000500)={0xa00, 0xfffffffffffffd83, 0xfa00, {0x0, 0x0}}, 0xfdbc)
r5 = syz_usb_connect(0x0, 0xaa3, &(0x7f0000008f00)=ANY=[@ANYBLOB="120110014b193508e20400141365010203010902910a020706c00509047a050a027a450909240600003e7da289052400dc0a0d240f0105000000070012993b06641aff7f0e0c2407010e00ff070400050007240600013c8e0524"], 0x0)
syz_usb_ep_write(r5, 0x2, 0xa2, &(0x7f0000000000)="14841eb9c9af084f552ca957435a1cc372b3aacef543041596ff85c89e3cd8e7e44f985e37f3ad9ef1c1d80386541b4342dc3cab9a8dc426a81ec36d092eecf4d475c290266b103cfd773dd03e8bf9f2197da1595afcb4c940b28cc81222ba6623ebf2f0065e56cf09861e132b74e85621fcd1ef9d6adf903886c6cbacaf23a5eb2f32bd6edb6eecf954fe9c8d4c8a72dd795d52d4a13d199444ecc93e5e8f88cb56")

3.467530906s ago: executing program 2 (id=1886):
r0 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x802)
write$evdev(r0, &(0x7f0000000000), 0x100000008)
prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x0, 0x0)
prlimit64(0x0, 0x0, 0x0, 0x0)
mmap(&(0x7f0000a38000/0x1000)=nil, 0x1000, 0xb635773f06ebbeef, 0x1010, 0xffffffffffffffff, 0xfffff000)
connect$unix(0xffffffffffffffff, 0x0, 0x0)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0xfe37)
socket$nl_xfrm(0x10, 0x3, 0x6)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001)
r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
preadv(r1, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0)
sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
socket$inet_udplite(0x2, 0x2, 0x88)
r2 = gettid()
timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc))
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0)
fcntl$setlease(r3, 0x400, 0x1)
truncate(&(0x7f0000000000)='./file1\x00', 0x8501)
ioctl$F2FS_IOC_GARBAGE_COLLECT(r0, 0x80004506, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0)
r4 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$DEVLINK_CMD_TRAP_POLICER_GET(r4, &(0x7f00000002c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={0x0}}, 0x0)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'xfrm0\x00', <r5=>0x0})
r6 = socket$nl_rdma(0x10, 0x3, 0x14)
ioctl$ifreq_SIOCGIFINDEX_team(r6, 0x8933, &(0x7f00000000c0)={'team0\x00', <r7=>0x0})
sendmsg$nl_route(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000240)=ANY=[@ANYBLOB="48000000100005ff00000000000000000000004a", @ANYRES32=0x0, @ANYBLOB="0000000004000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r7], 0x48}}, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="3000000010000100000000000000000000000000ad6c90208bdf8715e970b2bb4c437592e5c5e5bb28f78510333a90a804fea29cd365c10a2ab92b0c4151cb16666cf9a2a77c0a4eb13d2ad1917d825803348e669bfcf9d4c8157c23fedf4855c4d896d63043f3b6b90c8d6cd42be904109778e1f00184faa6a5b1a6b0ee535814cb631a9ede2c27864bd510548591dbe294d14d9439b5ce93a1ac715cdd3fb11ec42ead9d761b9f8733af8122cc520bbce84252702a389b2c1ea2176cc5d7bb9e62cfb6fc81302f6d1d237182773d00000000000000033d031e76f757a742a62dc9d72b594d25fe618cb0e3c9e56b924794545c2d8d4c60703386a020027db1bc00dbb2ac3055e5102105badb5e2cd3e9180aee52df522be3fbbe70feb0867f372c1262a70f96f3148020ddc21f83c9f9c7e9f3b8f852da05d6dd6e6c9f357297718340e123b6f44043fb597d9080f7ca374b0fc5", @ANYRES32=r5, @ANYBLOB="4010020000000000080016800400018008001b0000000000"], 0x30}}, 0x20000000)

2.875236388s ago: executing program 0 (id=1887):
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r0=>0xffffffffffffffff})
connect$unix(r0, 0x0, 0x0)
recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r1, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0)
r2 = socket(0x10, 0x2, 0x0)
ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f00000000c0)={'ip6_vti0\x00', &(0x7f0000000000)={'syztnl1\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @dev, @dev}})
ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r2, 0x89f3, &(0x7f0000000080)={'syztnl1\x00', 0x0})

2.614050147s ago: executing program 3 (id=1888):
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x3a0ffffffff) (async)
bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@base={0xa, 0x4, 0x7, 0x1000000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x5}, 0x48) (async)
r1 = bpf$MAP_CREATE(0x0, 0x0, 0x0) (async, rerun: 32)
bpf$MAP_GET_NEXT_KEY(0x2, 0x0, 0x0) (rerun: 32)
r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x0, 0xc, &(0x7f0000000040)=ANY=[@ANYRES32=r1, @ANYRES64=r0, @ANYRES32=r0, @ANYRESHEX=r0, @ANYRES64=r1], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, r0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$BPF_GET_BTF_INFO(0xf, 0x0, 0x0) (async)
bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x14, &(0x7f0000000b40)=ANY=[@ANYBLOB="611852fba1130af1a26ba5ea37323a751796b78f435b0ba73a123e8da00d090f380ecfd55b5b6a6a6cbaa741b34a9b8b7863b36c1eba484b66dd3a1cf502954d058e5cd63fc7e76402523f8c6ea8264d0a0f14157a6e04b165bc01ef150a78216838a2db8706b1046414257862aab89b389e3086b929906e78a18baf1f80ba7220f00d778a700f4b772b16ae2ab5e4a2e9a8d12fe0c290038694b8ae1645cb743defd654b68288f22082954888dd6c7b8b807441a93264074ef3345fba4de810f2d994c2a38f0505f67b5085ada33c96ecee41000000000000000000000000000000000728591fcf42fd49a0ec6db513c357d23b1a558589444d6b0d5d24336368143861aeb0ad1b0f7734f0fbba7a40bccc2945d16c6d6398ac223536596c0386b1a6b0f12523fcde66337f5ed04c179d77a51c69ada8274fb02ebd6dc1bd8790d0a5272b20549d138242", @ANYRESOCT=r2, @ANYRES32=r0], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x90) (async, rerun: 32)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000580)=@bpf_lsm={0x5, 0x0, 0x0, 0x0}, 0x90) (async, rerun: 32)
syz_genetlink_get_family_id$wireguard(&(0x7f0000000080), 0xffffffffffffffff) (async)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f0000000d00)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000740)=ANY=[], 0x21c}, 0x1, 0x0, 0x0, 0x4004080}, 0x0) (async)
r4 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x400, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x5}, 0x48)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x8, &(0x7f0000000740)=ANY=[@ANYBLOB="180009cee3b69a0000000000000000000000000ccf173d58f0d16900eaf89d52ee01e1937f236bf8fe10533a8cf136d98ce3a18f35d46ba282f5b26da18e62e8c877da04d8f892d308ba7e39682227ea1c06bf62b1a75adad97446a596e2292c2ff0fc0c5338f7af91e4dab8c376ae53288e9cd6f4efcbbbe2e4c455b59dfca89cfd56462abc6ac02437c9fadccf325250b01013c436d68ab305975c63983e8c8ca0a7256126424f53ef506347f0b8a79a9038e598133ce6044a3f7be9d43b87d13c4f4b0837337695b74f5577c584a84e773c337caf49763a7958b370971d0413902394aa1b568759f0a5052e42971200b8430a34fb29961f09032e50f0da7ac24a8f1c104edc63175cfeaafe799eda1c4d0ef2d8782668e52a25b5c0ed2e7106a17b45a030964026f1c9cff72d1f8227779beb7c803401a9a15589c9eab64d6e951a2676d0d52433af70b3c5c217838cbb791f70b84b02aa67625d67fa484d9b9ae3c31e852ffb098000", @ANYRES32=r4, @ANYBLOB="0000000000000000b70200000000000085000000860000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={<r5=>0xffffffffffffffff, <r6=>0xffffffffffffffff})
close(r6) (async)
recvmsg$unix(r5, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) (async, rerun: 64)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) (async, rerun: 64)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) (async)
r7 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) (async)
sched_setscheduler(r7, 0x2, &(0x7f0000000200)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r8=>0xffffffffffffffff, <r9=>0xffffffffffffffff})
connect$unix(r8, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) (async)
sendmmsg$unix(r9, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r8, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async)
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0xfff, 0x7}, 0x48)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000a40)=ANY=[@ANYBLOB="1800020000000000000000000000000018110000a0ae41bc999342029f2729f857c94099675a3fda9e224f7f87f34b98736e694784bebdb8e321eca6ec24f809071573", @ANYRES64=r2, @ANYBLOB="0000000000000000b7080000000400007b8af8ff00000000bfa200000000080007020000fcffffffb703000008000000b704fd0000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) (async, rerun: 32)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0xfffffe1c) (async, rerun: 32)
socket$inet6_icmp_raw(0xa, 0x3, 0x3a)

2.525058493s ago: executing program 2 (id=1889):
openat$rfkill(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00')
bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x20, 0x3, &(0x7f0000000040)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xe, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.idle_time\x00', 0x26e1, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xb, 0x8, 0xc, 0xffffffff, 0x1, 0x1}, 0x48)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x90)
bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000011c0)="f2629d2180e73d9fc6321d9959c035a27110ccae0155a4156ab49f998f2afc10c50858bb9a0813b7746e131d3baf6431887f2e76671367bab42900f633b6f7d0b0523a3580f6c38440ee1dc54fc7f692f3dfb7f75ed5c90f6904e9306c3bd1429ea12115eb2cc58533ea752a3a8ed24fa554bc907738b707b54858f47b651cf4da8e75810b41dc5facb029b1496843fa710caa3dcde00571ba80e88443ca2549db9e24ef73b0664281fe453e0265d5a47230bdafffad9a44fe1133fba8d05c6ca3ffc4d2bfe7296b5efb2601d5b5071181999ec60afa864dfa8ea1db76d89f8f67a0ac70406789b4294f2bf42013dc127e605e6f66af66a5ed326fc79e9c4ee53861fa4baa7036abe4032b233195e8424a73138ace589e1b112eac80c3c62b71d421c6405d1afda38de4950a3244669ac9402c4059ef439c962bc0138a0071c3ed52b61fb77aed9fd6b937c7f4a382cdb5126e2770ac62b19f4731388f0ecd4ea14ffff044a7206f3e2fd46e79b3262c8befdf0d66bbd95beb88b2da0ff8025395a31ba3a722cbba777f1617508a64942780fd01fc4f8f1bf7f2d4e1e14c3d64e6b7e98288463b36ff7ce2f0786386f5957490a647073224167478b5d72bd76f1f25fbb252d2742fc20ffe5db9e0017568567bdb4ea06570376e8644c82e2443ed73c5fb4482a68c736c895727d1d228b7d5c1d061335660088df8d53b8c02", &(0x7f00000013c0), 0x5}, 0x38)
r1 = gettid()
r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
read(r2, &(0x7f0000000200)=""/209, 0xd1)
ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r2, 0x4040534e, &(0x7f0000000080)={0x335, @time})
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r2, 0x40605346, &(0x7f0000000180)={0x0, 0x0, {0x3, 0x1, 0x0, 0x2, 0x3d000}, 0x7f})
r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x0)
ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r3, 0xc08c5332, &(0x7f00000001c0)={0x0, 0x0, 0x0, 'queue0\x00'})
tkill(r1, 0x7)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r2, 0x404c534a, &(0x7f0000000380))
r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/seq/timer\x00', 0x0, 0x0)
read$char_usb(r4, &(0x7f00000001c0)=""/4068, 0xfe4)
r5 = epoll_create1(0x0)
epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r0, &(0x7f0000000040))
openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x5400, 0x0)
setsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x28, &(0x7f0000000200)={@private, @local, @broadcast}, 0xc)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001)
r6 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0)
preadv(r6, 0x0, 0x0, 0x0, 0x0)
syz_emit_ethernet(0x7c, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES32=0x0, @ANYRES32, @ANYRES16, @ANYRES64, @ANYRES32=r6, @ANYRESDEC], 0x0)
syz_open_dev$usbmon(&(0x7f00000005c0), 0x0, 0x0)
syz_open_dev$usbfs(&(0x7f0000000040), 0x20000007d, 0x0)
socket$kcm(0x10, 0x2, 0x10)

1.846502867s ago: executing program 2 (id=1890):
add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff)
add_key$fscrypt_v1(0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, 0x0, 0x0, 0x0)
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000000000406c256d0000000000000109022400010000000009040000010300000009210000000122050009058103"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x8, 0x4, 0x0, &(0x7f0000000140)='GPL\x00', 0xa, 0x95, &(0x7f0000000180)=""/149}, 0x90)
r1 = socket(0x10, 0x3, 0x0)
sendmsg$nl_generic(r1, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000001a80)=@base={0x1, 0x4, 0x8}, 0x48)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
r2 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', <r3=>0x0})
r4 = socket(0x10, 0x80002, 0x0)
sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001240)=@bridge_setlink={0x2c, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r3}, [@IFLA_AF_SPEC={0xc, 0x1a, 0x0, 0x1, [@AF_INET={0x8, 0x4, 0x0, 0x1, {0x4, 0x3}}]}]}, 0x2c}}, 0x0)
connect$packet(r1, &(0x7f0000000040)={0x11, 0x6, r3, 0x1, 0x4, 0x6, @local}, 0x14)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0)
syz_usb_control_io(r0, &(0x7f0000000540)={0x2c, &(0x7f0000000200)={0x0, 0x0, 0x5, {0x5, 0x0, "a8c6df"}}, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000002c0)={0x24, 0x0, &(0x7f00000000c0)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0}, 0x0)
syz_usb_control_io(r0, &(0x7f0000001780)={0x2c, 0x0, &(0x7f00000014c0)={0x0, 0x3, 0x4, @lang_id={0x4}}, 0x0, 0x0, 0x0}, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000000)={0x24, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00031200000012033f007b"], 0x0, 0x0}, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)

0s ago: executing program 3 (id=1891):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r1 = socket$kcm(0x2, 0xa, 0x2)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local})
sendmmsg$inet(r1, &(0x7f0000002ac0)=[{{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000300)="2ea86ac93eb55b49b1a871a4919fc4171c13a16fe9c897c0f96ad767cc5d5d615e3cbf61ed8918865d46c52bcb65e9350c3c7db9221717a8c8cc8c50cbe9771567121f7f45717ef6101c83f9e59b3c83c251b2515256d0df6746098d04ed695d08363d00c67e89575ed9e4c71b5918cee1d27af3f0e2a432a6662b0ec63d925c18025af1e5d33178f71b2bf48e8c995e02c1ae6c510924ae6ea6e43d066e06a3814d17a9f094d2bb9841cbef", 0xac}], 0x1}}, {{0x0, 0x0, 0x0}}], 0x2, 0x48811)
write$tun(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="000086dd0500560008005400000060ec970001983a00fc000018c6ba35000000000000000700ff020000000000000000000000000001000000000000ff8c00000000000000000000000000000000860090780000000000000000000000000000ee3f000000002b036f8c006e75021d683910c3090b3188a7c747eb2278a273c1b80029442911892704"], 0xfdef)

kernel console output (not intermixed with test programs):

batadv0: Adding interface: batadv_slave_0
[  621.731976][T13708] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  621.823597][T13708] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  621.893720][    T8] usb 1-1: device descriptor read/64, error -71
[  621.988390][   T62] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  622.025094][    T8] usb usb1-port1: attempt power cycle
[  622.057014][T13708] batman_adv: batadv0: Adding interface: batadv_slave_1
[  622.083790][T13708] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  622.110765][T13708] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  622.312903][   T62] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  622.493994][    T8] usb 1-1: new high-speed USB device number 103 using dummy_hcd
[  622.525624][    T8] usb 1-1: device descriptor read/8, error -71
[  622.558711][T13708] hsr_slave_0: entered promiscuous mode
[  622.574961][T13708] hsr_slave_1: entered promiscuous mode
[  622.588925][T13708] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  622.603667][T13708] Cannot create hsr debugfs directory
[  622.716195][   T62] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  622.814132][    T8] usb 1-1: new high-speed USB device number 104 using dummy_hcd
[  622.841519][T13771] bridge0: port 1(bridge_slave_0) entered blocking state
[  622.856661][    T8] usb 1-1: device descriptor read/8, error -71
[  622.893791][ T5243] Bluetooth: hci3: command tx timeout
[  622.900590][T13771] bridge0: port 1(bridge_slave_0) entered disabled state
[  622.933880][T13771] bridge_slave_0: entered allmulticast mode
[  622.956119][T13771] bridge_slave_0: entered promiscuous mode
[  622.973756][ T5243] Bluetooth: hci5: command tx timeout
[  622.994276][    T8] usb usb1-port1: unable to enumerate USB device
[  623.051250][T13771] bridge0: port 2(bridge_slave_1) entered blocking state
[  623.064248][T13771] bridge0: port 2(bridge_slave_1) entered disabled state
[  623.071558][T13771] bridge_slave_1: entered allmulticast mode
[  623.095078][T13771] bridge_slave_1: entered promiscuous mode
[  623.185531][T13771] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  623.218895][T13771] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  623.252607][T13587] 8021q: adding VLAN 0 to HW filter on device bond0
[  623.445669][T13771] team0: Port device team_slave_0 added
[  623.483462][T13771] team0: Port device team_slave_1 added
[  623.761019][T13771] batman_adv: batadv0: Adding interface: batadv_slave_0
[  623.778644][T13771] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  623.843649][T13771] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  623.858917][T13771] batman_adv: batadv0: Adding interface: batadv_slave_1
[  623.868738][T13771] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  623.904265][T13771] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  624.042510][   T62] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  624.192702][T13587] 8021q: adding VLAN 0 to HW filter on device team0
[  624.282025][   T62] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  624.423895][  T941] usb 1-1: new high-speed USB device number 105 using dummy_hcd
[  624.617237][   T62] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  624.655816][  T941] usb 1-1: New USB device found, idVendor=0eb1, idProduct=7007, bcdDevice= 2.00
[  624.673649][  T941] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  624.689447][  T941] usb 1-1: config 0 descriptor??
[  624.712121][T13771] hsr_slave_0: entered promiscuous mode
[  624.715738][  T941] go7007 1-1:0.0: probe with driver go7007 failed with error -12
[  624.746128][T13771] hsr_slave_1: entered promiscuous mode
[  624.765583][T13771] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  624.783698][T13771] Cannot create hsr debugfs directory
[  624.793387][ T2940] bridge0: port 1(bridge_slave_0) entered blocking state
[  624.800562][ T2940] bridge0: port 1(bridge_slave_0) entered forwarding state
[  624.818384][ T1273] ieee802154 phy0 wpan0: encryption failed: -22
[  624.828206][ T1273] ieee802154 phy1 wpan1: encryption failed: -22
[  624.840621][ T2999] bridge0: port 2(bridge_slave_1) entered blocking state
[  624.847820][ T2999] bridge0: port 2(bridge_slave_1) entered forwarding state
[  624.974060][ T5243] Bluetooth: hci3: command tx timeout
[  625.056010][   T62] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  625.067132][ T5243] Bluetooth: hci5: command tx timeout
[  625.378796][   T25] usb 1-1: USB disconnect, device number 105
[  625.615899][T13798] chnl_net:caif_netlink_parms(): no params data found
[  626.419508][   T62] team0: left allmulticast mode
[  626.424797][   T62] team_slave_0: left allmulticast mode
[  626.430804][   T62] team_slave_1: left allmulticast mode
[  626.450121][   T62] bridge0: port 3(team0) entered disabled state
[  626.482230][   T62] bridge_slave_1: left allmulticast mode
[  626.513802][   T62] bridge_slave_1: left promiscuous mode
[  626.519630][   T62] bridge0: port 2(bridge_slave_1) entered disabled state
[  626.543258][T13849] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1695'.
[  626.576186][   T62] bridge_slave_0: left allmulticast mode
[  626.581980][   T62] bridge_slave_0: left promiscuous mode
[  626.613904][   T62] bridge0: port 1(bridge_slave_0) entered disabled state
[  626.648418][   T62] team0: left allmulticast mode
[  626.653475][   T62] team_slave_0: left allmulticast mode
[  626.673771][   T62] team_slave_1: left allmulticast mode
[  626.699990][   T62] bridge0: port 3(team0) entered disabled state
[  626.757590][   T62] bridge_slave_1: left allmulticast mode
[  626.763315][   T62] bridge_slave_1: left promiscuous mode
[  626.799860][   T62] bridge0: port 2(bridge_slave_1) entered disabled state
[  626.853831][   T62] bridge_slave_0: left allmulticast mode
[  626.859638][   T62] bridge_slave_0: left promiscuous mode
[  626.900761][   T62] bridge0: port 1(bridge_slave_0) entered disabled state
[  627.053798][ T5243] Bluetooth: hci3: command tx timeout
[  627.947623][   T62] dvmrp0 (unregistering): left allmulticast mode
[  628.621613][   T62] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  628.631066][   T62] bond_slave_0: left promiscuous mode
[  628.640839][   T62] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  628.651962][   T62] bond_slave_1: left promiscuous mode
[  628.682100][   T62] bond0 (unregistering): Released all slaves
[  628.906510][   T62] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  628.935615][   T62] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  628.962198][   T62] bond0 (unregistering): Released all slaves
[  629.133929][ T5243] Bluetooth: hci3: command tx timeout
[  629.328438][T13798] bridge0: port 1(bridge_slave_0) entered blocking state
[  629.363871][T13798] bridge0: port 1(bridge_slave_0) entered disabled state
[  629.371558][T13798] bridge_slave_0: entered allmulticast mode
[  629.430607][T13798] bridge_slave_0: entered promiscuous mode
[  629.580948][T13798] bridge0: port 2(bridge_slave_1) entered blocking state
[  629.610104][T13798] bridge0: port 2(bridge_slave_1) entered disabled state
[  629.635571][T13798] bridge_slave_1: entered allmulticast mode
[  629.684470][T13798] bridge_slave_1: entered promiscuous mode
[  630.063350][T13798] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  630.150089][T13798] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  630.240395][T13587] 8021q: adding VLAN 0 to HW filter on device batadv0
[  630.624971][T13798] team0: Port device team_slave_0 added
[  630.793789][T13708] netdevsim netdevsim3 netdevsim0: renamed from eth0
[  630.857940][T13708] netdevsim netdevsim3 netdevsim1: renamed from eth1
[  630.926753][T13798] team0: Port device team_slave_1 added
[  631.248187][T13708] netdevsim netdevsim3 netdevsim2: renamed from eth2
[  631.317955][T13708] netdevsim netdevsim3 netdevsim3: renamed from eth3
[  631.438669][   T62] hsr_slave_0: left promiscuous mode
[  631.467544][   T62] hsr_slave_1: left promiscuous mode
[  631.485173][   T62] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  631.492957][   T62] batman_adv: batadv0: Removing interface: batadv_slave_0
[  631.549969][   T62] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  631.563776][   T62] batman_adv: batadv0: Removing interface: batadv_slave_1
[  631.587400][   T62] hsr_slave_0: left promiscuous mode
[  631.616503][   T62] hsr_slave_1: left promiscuous mode
[  631.626093][   T62] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  631.651554][   T62] batman_adv: batadv0: Removing interface: batadv_slave_0
[  631.704725][   T62] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  631.726274][   T62] batman_adv: batadv0: Removing interface: batadv_slave_1
[  631.852669][   T62] veth1_macvtap: left promiscuous mode
[  631.873746][   T62] veth0_macvtap: left promiscuous mode
[  631.893762][   T62] veth1_vlan: left promiscuous mode
[  631.899181][   T62] veth0_vlan: left promiscuous mode
[  631.975680][   T62] veth1_macvtap: left promiscuous mode
[  631.981311][   T62] veth0_macvtap: left promiscuous mode
[  632.004000][   T62] veth1_vlan: left promiscuous mode
[  632.004982][ T5241] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[  632.009376][   T62] veth0_vlan: left promiscuous mode
[  632.026105][ T5241] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[  632.035444][ T5241] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[  632.045237][ T5241] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[  632.053217][ T5241] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3
[  632.061581][ T5241] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[  633.821616][   T62] team_slave_1 (unregistering): left promiscuous mode
[  633.885836][   T62] team0 (unregistering): Port device team_slave_1 removed
[  633.989582][   T62] team_slave_0 (unregistering): left promiscuous mode
[  634.016248][   T62] team0 (unregistering): Port device team_slave_0 removed
[  634.103891][ T5241] Bluetooth: hci1: command tx timeout
[  636.185390][ T5241] Bluetooth: hci1: command tx timeout
[  636.355800][   T62] team_slave_1 (unregistering): left promiscuous mode
[  636.384359][   T62] team0 (unregistering): Port device team_slave_1 removed
[  636.494151][   T62] team_slave_0 (unregistering): left promiscuous mode
[  636.513309][   T62] team0 (unregistering): Port device team_slave_0 removed
[  638.125891][T13798] batman_adv: batadv0: Adding interface: batadv_slave_0
[  638.132879][T13798] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  638.205032][T13798] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  638.246486][T13798] batman_adv: batadv0: Adding interface: batadv_slave_1
[  638.253493][T13798] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  638.257233][ T5241] Bluetooth: hci1: command tx timeout
[  638.312763][T13798] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  638.594294][T13798] hsr_slave_0: entered promiscuous mode
[  638.604655][T13798] hsr_slave_1: entered promiscuous mode
[  638.623729][T13798] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  638.631302][T13798] Cannot create hsr debugfs directory
[  638.646654][T13587] veth0_vlan: entered promiscuous mode
[  638.937511][T13587] veth1_vlan: entered promiscuous mode
[  639.314535][T13771] netdevsim netdevsim1 netdevsim0: renamed from eth0
[  639.355588][T13771] netdevsim netdevsim1 netdevsim1: renamed from eth1
[  639.548630][T13771] netdevsim netdevsim1 netdevsim2: renamed from eth2
[  639.562021][T13771] netdevsim netdevsim1 netdevsim3: renamed from eth3
[  639.602039][T13587] veth0_macvtap: entered promiscuous mode
[  639.780254][T13587] veth1_macvtap: entered promiscuous mode
[  639.889447][T13708] 8021q: adding VLAN 0 to HW filter on device bond0
[  639.976202][   T62] IPVS: stop unused estimator thread 0...
[  640.235622][T13708] 8021q: adding VLAN 0 to HW filter on device team0
[  640.334567][ T5241] Bluetooth: hci1: command tx timeout
[  640.381326][T13587] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  640.413779][T13587] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  640.443622][T13587] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  640.468779][T13587] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  640.513689][T13587] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  640.533964][T13587] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  640.555576][T13587] batman_adv: batadv0: Interface activated: batadv_slave_0
[  640.691214][T13886] chnl_net:caif_netlink_parms(): no params data found
[  640.759557][   T81] bridge0: port 1(bridge_slave_0) entered blocking state
[  640.766746][   T81] bridge0: port 1(bridge_slave_0) entered forwarding state
[  640.924220][T13587] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  640.964724][T13587] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  640.993621][T13587] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  641.013900][T13587] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  641.042678][T13587] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  641.084833][T13587] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  641.110815][T13587] batman_adv: batadv0: Interface activated: batadv_slave_1
[  641.268253][   T62] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  641.429445][   T81] bridge0: port 2(bridge_slave_1) entered blocking state
[  641.436615][   T81] bridge0: port 2(bridge_slave_1) entered forwarding state
[  641.559013][T13587] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  641.593887][T13587] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  641.602733][T13587] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  641.638000][T13587] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  641.761046][   T62] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  641.885736][T13708] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[  642.026270][   T62] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  642.217825][T13886] bridge0: port 1(bridge_slave_0) entered blocking state
[  642.234040][T13886] bridge0: port 1(bridge_slave_0) entered disabled state
[  642.241524][T13886] bridge_slave_0: entered allmulticast mode
[  642.269701][T13886] bridge_slave_0: entered promiscuous mode
[  642.286811][T13886] bridge0: port 2(bridge_slave_1) entered blocking state
[  642.314146][T13886] bridge0: port 2(bridge_slave_1) entered disabled state
[  642.321472][T13886] bridge_slave_1: entered allmulticast mode
[  642.347593][T13886] bridge_slave_1: entered promiscuous mode
[  642.559023][   T62] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  642.712269][T13798] netdevsim netdevsim2 netdevsim0: renamed from eth0
[  642.765470][T13798] netdevsim netdevsim2 netdevsim1: renamed from eth1
[  642.817825][T13886] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  642.877416][T13886] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  642.932925][T13798] netdevsim netdevsim2 netdevsim2: renamed from eth2
[  643.176313][T13708] 8021q: adding VLAN 0 to HW filter on device batadv0
[  643.198571][T13798] netdevsim netdevsim2 netdevsim3: renamed from eth3
[  643.320739][T13886] team0: Port device team_slave_0 added
[  643.347811][T13886] team0: Port device team_slave_1 added
[  643.628402][T13771] 8021q: adding VLAN 0 to HW filter on device bond0
[  643.651945][T12618] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  643.656556][T13886] batman_adv: batadv0: Adding interface: batadv_slave_0
[  643.694555][T13886] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  643.695947][T12618] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  643.802851][T13886] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  643.843755][T13886] batman_adv: batadv0: Adding interface: batadv_slave_1
[  643.850835][T13886] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  643.922736][T13886] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  644.105684][   T62] team0: left allmulticast mode
[  644.110600][   T62] team_slave_0: left allmulticast mode
[  644.133194][   T62] team_slave_1: left allmulticast mode
[  644.139764][   T62] bridge0: port 3(team0) entered disabled state
[  644.167878][   T62] bridge_slave_1: left allmulticast mode
[  644.183725][   T62] bridge_slave_1: left promiscuous mode
[  644.189561][   T62] bridge0: port 2(bridge_slave_1) entered disabled state
[  644.234623][   T62] bridge_slave_0: left allmulticast mode
[  644.240341][   T62] bridge_slave_0: left promiscuous mode
[  644.258343][   T62] bridge0: port 1(bridge_slave_0) entered disabled state
[  645.554204][   T62] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  645.571777][   T62] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  645.616839][   T62] bond0 (unregistering): Released all slaves
[  645.682554][T13708] veth0_vlan: entered promiscuous mode
[  645.859440][T13708] veth1_vlan: entered promiscuous mode
[  646.038777][T13886] hsr_slave_0: entered promiscuous mode
[  646.060423][T13886] hsr_slave_1: entered promiscuous mode
[  646.074557][T13886] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  646.082136][T13886] Cannot create hsr debugfs directory
[  646.118267][ T2928] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  646.163849][ T2928] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  646.225405][T13771] 8021q: adding VLAN 0 to HW filter on device team0
[  646.517855][   T62] hsr_slave_0: left promiscuous mode
[  646.552181][   T62] hsr_slave_1: left promiscuous mode
[  646.561314][T13984] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(5)
[  646.567867][T13984] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed)
[  646.613757][   T62] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  646.621210][   T62] batman_adv: batadv0: Removing interface: batadv_slave_0
[  646.644727][T13984] vhci_hcd vhci_hcd.0: Device attached
[  646.660701][   T62] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  646.678601][   T62] batman_adv: batadv0: Removing interface: batadv_slave_1
[  646.773470][   T62] veth1_macvtap: left promiscuous mode
[  646.802248][   T62] veth0_macvtap: left promiscuous mode
[  646.811074][   T62] veth1_vlan: left promiscuous mode
[  646.823860][   T62] veth0_vlan: left promiscuous mode
[  646.953818][ T5290] usb 18-1: SetAddress Request (6) to port 0
[  646.959943][ T5290] usb 18-1: new SuperSpeed USB device number 6 using vhci_hcd
[  647.013702][   T58] usb 5-1: new high-speed USB device number 83 using dummy_hcd
[  647.196500][   T58] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F
[  647.258985][   T58] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7
[  647.303625][   T58] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0
[  647.313427][   T58] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21
[  647.334875][   T58] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00
[  647.344173][   T58] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  647.371441][   T58] usb 5-1: config 0 descriptor??
[  647.824779][   T58] plantronics 0003:047F:FFFF.0030: unknown main item tag 0x0
[  647.851621][   T58] plantronics 0003:047F:FFFF.0030: unknown main item tag 0x0
[  647.860176][   T58] plantronics 0003:047F:FFFF.0030: No inputs registered, leaving
[  647.873327][   T58] plantronics 0003:047F:FFFF.0030: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0
[  648.036289][    T9] usb 5-1: USB disconnect, device number 83
[  648.046905][T13985] vhci_hcd: connection reset by peer
[  648.062022][ T2963] vhci_hcd: stop threads
[  648.075307][ T2963] vhci_hcd: release socket
[  648.096870][ T2963] vhci_hcd: disconnect device
[  648.296107][   T62] team_slave_1 (unregistering): left promiscuous mode
[  648.334740][   T62] team0 (unregistering): Port device team_slave_1 removed
[  648.434583][   T62] team_slave_0 (unregistering): left promiscuous mode
[  648.465443][   T62] team0 (unregistering): Port device team_slave_0 removed
[  649.812695][ T2928] bridge0: port 1(bridge_slave_0) entered blocking state
[  649.819948][ T2928] bridge0: port 1(bridge_slave_0) entered forwarding state
[  649.865197][ T2928] bridge0: port 2(bridge_slave_1) entered blocking state
[  649.872369][ T2928] bridge0: port 2(bridge_slave_1) entered forwarding state
[  650.139848][T13708] veth0_macvtap: entered promiscuous mode
[  650.359786][T13708] veth1_macvtap: entered promiscuous mode
[  650.440117][T13798] 8021q: adding VLAN 0 to HW filter on device bond0
[  650.482016][T13708] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  650.504991][T13708] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  650.543638][T13708] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  650.570947][T13708] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  650.595429][T13708] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  650.611706][T13708] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  650.624783][T13708] batman_adv: batadv0: Interface activated: batadv_slave_0
[  650.744188][T13798] 8021q: adding VLAN 0 to HW filter on device team0
[  650.776737][T13708] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  650.823964][T13708] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  650.864459][T13708] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  650.891144][T13708] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  650.925100][T13708] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  650.933886][    T9] usb 5-1: new high-speed USB device number 84 using dummy_hcd
[  650.943565][T13708] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  650.982494][T13708] batman_adv: batadv0: Interface activated: batadv_slave_1
[  651.103173][T12618] bridge0: port 1(bridge_slave_0) entered blocking state
[  651.110416][T12618] bridge0: port 1(bridge_slave_0) entered forwarding state
[  651.148040][    T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  651.180702][    T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  651.203112][T13708] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  651.223785][    T9] usb 5-1: New USB device found, idVendor=1038, idProduct=12b6, bcdDevice= 0.00
[  651.234192][T13708] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  651.234622][    T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  651.242963][T13708] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  651.281915][T13708] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  651.282719][    T9] usb 5-1: config 0 descriptor??
[  651.369461][ T2999] bridge0: port 2(bridge_slave_1) entered blocking state
[  651.376710][ T2999] bridge0: port 2(bridge_slave_1) entered forwarding state
[  651.650585][T13771] 8021q: adding VLAN 0 to HW filter on device batadv0
[  651.816280][    T9] steelseries 0003:1038:12B6.0031: item fetching failed at offset 6/7
[  651.857782][    T9] steelseries 0003:1038:12B6.0031: probe with driver steelseries failed with error -22
[  652.100919][ T5287] usb 5-1: USB disconnect, device number 84
[  652.104522][ T5290] usb 18-1: device descriptor read/8, error -110
[  652.196225][   T81] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  652.214640][   T81] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  652.387844][T13771] veth0_vlan: entered promiscuous mode
[  652.494348][   T62] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  652.520443][   T62] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  652.523388][T13798] 8021q: adding VLAN 0 to HW filter on device batadv0
[  652.555227][ T5290] usb usb18-port1: attempt power cycle
[  652.565717][T13886] netdevsim netdevsim0 netdevsim0: renamed from eth0
[  652.603805][T13771] veth1_vlan: entered promiscuous mode
[  652.610536][T13886] netdevsim netdevsim0 netdevsim1: renamed from eth1
[  652.657097][T13886] netdevsim netdevsim0 netdevsim2: renamed from eth2
[  652.727096][T13886] netdevsim netdevsim0 netdevsim3: renamed from eth3
[  652.943810][T13771] veth0_macvtap: entered promiscuous mode
[  653.030546][T13771] veth1_macvtap: entered promiscuous mode
[  653.209690][T13798] veth0_vlan: entered promiscuous mode
[  653.225727][ T5290] usb usb18-port1: unable to enumerate USB device
[  653.316800][T13771] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  653.377316][T13771] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  653.390455][T13771] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  653.407195][T13771] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  653.439984][T14013] usb 4-1: new high-speed USB device number 85 using dummy_hcd
[  653.453855][T13771] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  653.493821][   T25] usb 5-1: new high-speed USB device number 85 using dummy_hcd
[  653.501620][T13771] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  653.533930][T13771] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  653.571302][T13771] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  653.625862][T13771] batman_adv: batadv0: Interface activated: batadv_slave_0
[  653.663681][T14013] usb 4-1: Using ep0 maxpacket: 16
[  653.693157][T14013] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x89 has an invalid bInterval 0, changing to 7
[  653.740859][T13771] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  653.753860][   T25] usb 5-1: Using ep0 maxpacket: 16
[  653.755919][T14013] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0
[  653.779675][T14013] usb 4-1: New USB device found, idVendor=0158, idProduct=0100, bcdDevice= 0.00
[  653.797691][T13771] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  653.816375][T14013] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  653.844716][T13771] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  653.856679][T14013] usb 4-1: config 0 descriptor??
[  653.866891][   T25] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  653.907241][   T25] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9
[  653.941729][T13771] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  653.963652][T13771] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  653.974935][   T25] usb 5-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00
[  653.978645][T13771] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  654.009697][T13771] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  654.037118][T13771] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  654.052361][   T25] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  654.099857][   T25] usb 5-1: config 0 descriptor??
[  654.135768][T13771] batman_adv: batadv0: Interface activated: batadv_slave_1
[  654.171153][T13798] veth1_vlan: entered promiscuous mode
[  654.257222][T13771] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  654.323117][T13771] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  654.386067][T13771] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  654.407027][T13771] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  655.191559][T12618] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  655.231767][T13886] 8021q: adding VLAN 0 to HW filter on device bond0
[  655.243692][T12618] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  655.337059][T13798] veth0_macvtap: entered promiscuous mode
[  655.422404][T13798] veth1_macvtap: entered promiscuous mode
[  655.701689][   T81] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  655.755169][T13886] 8021q: adding VLAN 0 to HW filter on device team0
[  655.786811][   T81] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  656.037995][ T2963] bridge0: port 1(bridge_slave_0) entered blocking state
[  656.045366][ T2963] bridge0: port 1(bridge_slave_0) entered forwarding state
[  656.235216][   T25] usbhid 5-1:0.0: can't add hid device: -71
[  656.235985][ T2928] bridge0: port 2(bridge_slave_1) entered blocking state
[  656.248383][ T2928] bridge0: port 2(bridge_slave_1) entered forwarding state
[  656.268985][   T25] usbhid 5-1:0.0: probe with driver usbhid failed with error -71
[  656.306704][   T25] usb 5-1: USB disconnect, device number 85
[  656.360034][T13798] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  656.399064][T13798] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  656.447135][T13798] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  656.485710][T13798] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  656.544747][T13798] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  656.593337][T13798] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  656.629003][T13798] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  656.656367][T13798] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  656.682220][T14055] netlink: 201392 bytes leftover after parsing attributes in process `syz.1.1687'.
[  656.695716][T13798] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  656.715349][T13798] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  656.750492][T13798] batman_adv: batadv0: Interface activated: batadv_slave_0
[  656.799890][T13798] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  656.811429][T13798] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  656.824082][T13798] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  656.837020][T13798] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  656.870276][T13798] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  656.905267][T13798] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  656.982678][T13798] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  657.093729][T13798] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  657.111503][T13798] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  657.131742][T13798] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  657.167404][T13798] batman_adv: batadv0: Interface activated: batadv_slave_1
[  657.295422][T13798] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  657.305525][T13798] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  657.323668][T13798] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  657.365473][T13798] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  657.730774][T14013] usbhid 4-1:0.0: can't add hid device: -71
[  657.753807][T14013] usbhid 4-1:0.0: probe with driver usbhid failed with error -71
[  657.823477][T14013] usb 4-1: USB disconnect, device number 85
[  657.829432][T13886] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[  658.110121][T13886] 8021q: adding VLAN 0 to HW filter on device batadv0
[  658.183801][ T2963] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  658.204935][ T2963] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  658.410489][   T81] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  658.448671][   T81] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  658.560707][T13886] veth0_vlan: entered promiscuous mode
[  658.658083][T13886] veth1_vlan: entered promiscuous mode
[  658.886460][T13886] veth0_macvtap: entered promiscuous mode
[  658.954682][T13886] veth1_macvtap: entered promiscuous mode
[  659.142511][T13886] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  659.214837][T13886] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  659.270816][T13886] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  659.291056][T13886] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  659.308787][T13886] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  659.321107][T13886] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  659.337949][T13886] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  659.353849][T13886] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  659.369619][T13886] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  659.395527][T13886] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  659.417493][T13886] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  659.435878][T13886] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  659.453439][T13886] batman_adv: batadv0: Interface activated: batadv_slave_0
[  659.483476][T13886] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  659.527089][T13886] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  659.558109][T13886] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  659.573775][    T9] usb 5-1: new high-speed USB device number 86 using dummy_hcd
[  659.589621][T13886] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  659.642841][T13886] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  659.674172][T13886] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  659.705136][T13886] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  659.769817][T13886] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  659.800329][T13886] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  659.814746][    T9] usb 5-1: Using ep0 maxpacket: 8
[  659.838559][    T9] usb 5-1: config 7 has an invalid interface number: 122 but max is 1
[  659.854596][T13886] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  659.883661][    T9] usb 5-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config
[  659.890037][T13886] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  659.939235][T13886] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  659.944028][    T9] usb 5-1: config 7 has 1 interface, different from the descriptor's value: 2
[  659.980702][T13886] batman_adv: batadv0: Interface activated: batadv_slave_1
[  660.069762][    T9] usb 5-1: config 7 has no interface number 0
[  660.082664][T13886] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  660.106617][    T9] usb 5-1: config 7 interface 122 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 10
[  660.143794][T13886] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  660.175752][T13886] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  660.208636][    T9] usb 5-1: config 7 interface 122 has no altsetting 0
[  660.213688][T13886] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  660.288206][    T9] usb 5-1: New USB device found, idVendor=04e2, idProduct=1400, bcdDevice=65.13
[  660.351791][    T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  660.420061][    T9] usb 5-1: Product: syz
[  660.443347][    T9] usb 5-1: Manufacturer: syz
[  660.456190][    T9] usb 5-1: SerialNumber: syz
[  660.774209][ T5290] usb 4-1: new high-speed USB device number 86 using dummy_hcd
[  660.804389][ T3050] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  660.869469][ T3050] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  660.981091][ T2963] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  660.995471][ T5290] usb 4-1: New USB device found, idVendor=056e, idProduct=4010, bcdDevice=20.1c
[  661.046828][ T2963] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  661.055307][ T5290] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  661.090617][ T5290] usb 4-1: config 0 descriptor??
[  661.255123][T14121] netlink: 191384 bytes leftover after parsing attributes in process `syz.2.1716'.
[  661.409486][T14121] netlink: 'syz.2.1716': attribute type 10 has an invalid length.
[  661.473037][ T5290] pegasus 4-1:0.0: probe with driver pegasus failed with error -71
[  661.513008][ T5290] usb 4-1: USB disconnect, device number 86
[  661.604321][T14121] batman_adv: batadv0: Adding interface: team0
[  661.613226][T14121] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  661.639558][T14121] batman_adv: batadv0: Not using interface team0 (retrying later): interface not active
[  661.670802][T14125] netlink: 'syz.2.1716': attribute type 10 has an invalid length.
[  661.733382][T14125] netlink: 2 bytes leftover after parsing attributes in process `syz.2.1716'.
[  661.772260][T14125] team0: entered promiscuous mode
[  661.779625][T14125] team_slave_0: entered promiscuous mode
[  661.802322][T14125] team_slave_1: entered promiscuous mode
[  661.842782][T14125] 8021q: adding VLAN 0 to HW filter on device team0
[  661.851343][T14133] netlink: 191384 bytes leftover after parsing attributes in process `syz.1.1717'.
[  661.870679][T14125] batman_adv: batadv0: Interface activated: team0
[  661.884106][T14125] batman_adv: batadv0: Interface deactivated: team0
[  661.891268][T14125] batman_adv: batadv0: Removing interface: team0
[  661.930685][T14125] bridge0: port 3(team0) entered blocking state
[  661.948505][T14125] bridge0: port 3(team0) entered disabled state
[  661.956866][T14125] team0: entered allmulticast mode
[  661.983753][T14013] usb 1-1: new high-speed USB device number 106 using dummy_hcd
[  662.003300][T14125] team_slave_0: entered allmulticast mode
[  662.031223][T14125] team_slave_1: entered allmulticast mode
[  662.079801][T14125] bridge0: port 3(team0) entered blocking state
[  662.086302][T14125] bridge0: port 3(team0) entered forwarding state
[  662.112417][T14136] netlink: 'syz.1.1717': attribute type 10 has an invalid length.
[  662.188877][T14013] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  662.249666][T14013] usb 1-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df
[  662.253739][T14136] batman_adv: batadv0: Adding interface: team0
[  662.274482][ T5287] usb 4-1: new high-speed USB device number 87 using dummy_hcd
[  662.317213][T14013] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  662.328043][T14136] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  662.399992][T14136] batman_adv: batadv0: Not using interface team0 (retrying later): interface not active
[  662.411636][T14139] netlink: 'syz.1.1717': attribute type 10 has an invalid length.
[  662.427603][T14013] usb 1-1: config 0 descriptor??
[  662.444425][T14097] delete_channel: no stack
[  662.457327][    T9] xr_serial 5-1:7.122: skipping garbage
[  662.462944][    T9] xr_serial 5-1:7.122: More than one union descriptor, skipping ...
[  662.481188][T14013] pwc: Askey VC010 type 2 USB webcam detected.
[  662.496534][T14139] netlink: 2 bytes leftover after parsing attributes in process `syz.1.1717'.
[  662.542246][    T9] usb 5-1: USB disconnect, device number 86
[  662.563910][ T5287] usb 4-1: Using ep0 maxpacket: 16
[  662.584809][T14139] team0: entered promiscuous mode
[  662.602626][ T5287] usb 4-1: unable to get BOS descriptor or descriptor too short
[  662.644349][ T5287] usb 4-1: unable to read config index 0 descriptor/start: -71
[  662.664000][ T5287] usb 4-1: can't read configurations, error -71
[  662.695143][T14139] team_slave_0: entered promiscuous mode
[  662.698692][T14145] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1721'.
[  662.791495][T14139] team_slave_1: entered promiscuous mode
[  662.873052][T14139] 8021q: adding VLAN 0 to HW filter on device team0
[  662.932038][T14139] batman_adv: batadv0: Interface activated: team0
[  662.992599][T14139] batman_adv: batadv0: Interface deactivated: team0
[  663.033759][T14139] batman_adv: batadv0: Removing interface: team0
[  663.085499][T14139] bridge0: port 3(team0) entered blocking state
[  663.159218][T14139] bridge0: port 3(team0) entered disabled state
[  663.176972][T14139] team0: entered allmulticast mode
[  663.207193][T14139] team_slave_0: entered allmulticast mode
[  663.267790][T14139] team_slave_1: entered allmulticast mode
[  663.313720][   T58] usb 3-1: new high-speed USB device number 79 using dummy_hcd
[  663.341272][T14139] bridge0: port 3(team0) entered blocking state
[  663.347882][T14139] bridge0: port 3(team0) entered forwarding state
[  663.363867][   T25] usb 5-1: new high-speed USB device number 87 using dummy_hcd
[  663.544155][   T58] usb 3-1: Using ep0 maxpacket: 16
[  663.633837][   T25] usb 5-1: Using ep0 maxpacket: 32
[  663.660239][   T25] usb 5-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=a6.13
[  663.738215][   T25] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  663.781899][   T25] usb 5-1: Product: syz
[  663.800194][   T25] usb 5-1: Manufacturer: syz
[  663.825101][   T25] usb 5-1: SerialNumber: syz
[  663.852679][   T25] usb 5-1: config 0 descriptor??
[  663.948671][   T25] pvrusb2: Hardware description: Terratec Grabster AV400
[  663.975902][   T25] pvrusb2: **********
[  664.048063][   T25] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental.
[  664.082407][   T25] pvrusb2: Important functionality might not be entirely working.
[  664.107759][   T25] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver.
[  664.169875][   T25] pvrusb2: **********
[  664.760088][T14151] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  664.835606][T14151] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  665.036029][ T5287] usb 4-1: new high-speed USB device number 89 using dummy_hcd
[  665.194119][T14013] pwc: recv_control_msg error -71 req 02 val 2b00
[  665.208401][T14013] pwc: recv_control_msg error -71 req 02 val 2700
[  665.236031][ T2042] pvrusb2: Invalid write control endpoint
[  665.262159][   T25] usb 5-1: USB disconnect, device number 87
[  665.293788][ T5287] usb 4-1: Using ep0 maxpacket: 16
[  665.303099][T14013] pwc: recv_control_msg error -71 req 02 val 2c00
[  665.363804][T14013] pwc: recv_control_msg error -71 req 04 val 1000
[  665.467546][T14013] pwc: recv_control_msg error -71 req 04 val 1300
[  665.527917][T14013] pwc: recv_control_msg error -71 req 04 val 1400
[  665.534503][T14166] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  665.580192][T14166] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  665.621713][T14013] pwc: recv_control_msg error -71 req 02 val 2000
[  665.631811][T14013] pwc: recv_control_msg error -71 req 02 val 2100
[  665.640204][T14013] pwc: recv_control_msg error -71 req 04 val 1500
[  665.673067][T14013] pwc: recv_control_msg error -71 req 02 val 2500
[  665.681973][T14166] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  665.697355][T14013] pwc: recv_control_msg error -71 req 02 val 2400
[  665.785476][T14013] pwc: recv_control_msg error -71 req 02 val 2600
[  665.822671][ T2042] pvrusb2: Invalid write control endpoint
[  665.837819][T14013] pwc: recv_control_msg error -71 req 02 val 2900
[  665.858025][T14166] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  665.873272][ T2042] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work.
[  665.882525][T14013] pwc: recv_control_msg error -71 req 02 val 2800
[  665.906866][T14013] pwc: recv_control_msg error -71 req 04 val 1100
[  665.946616][ T2042] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device.
[  665.999660][T14013] pwc: recv_control_msg error -71 req 04 val 1200
[  666.009465][ T2042] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups.
[  666.034137][T14013] pwc: Registered as video71.
[  666.068413][T14013] input: PWC snapshot button as /devices/platform/dummy_hcd.0/usb1/1-1/input/input34
[  666.080935][   T58] usb 3-1: unable to get BOS descriptor or descriptor too short
[  666.126523][   T58] usb 3-1: unable to read config index 0 descriptor/start: -71
[  666.147214][ T2042] pvrusb2: Device being rendered inoperable
[  666.191635][T14013] usb 1-1: USB disconnect, device number 106
[  666.193483][   T58] usb 3-1: can't read configurations, error -71
[  666.204323][ T2042] cx25840 1-0044: Unable to detect h/w, assuming cx23887
[  666.259930][ T2042] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a)
[  666.363264][ T2042] pvrusb2: Attached sub-driver cx25840
[  666.425938][ T2042] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it.
[  666.463854][ T2042] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover.
[  666.723664][T14013] usb 1-1: new high-speed USB device number 107 using dummy_hcd
[  666.970499][T14013] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  666.998450][T14013] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  667.044085][T14013] usb 1-1: New USB device found, idVendor=046d, idProduct=c222, bcdDevice= 0.00
[  667.089108][T14013] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  667.145497][T14013] usb 1-1: config 0 descriptor??
[  667.627944][ T5287] usb 4-1: unable to get BOS descriptor or descriptor too short
[  667.674571][ T5287] usb 4-1: unable to read config index 0 descriptor/start: -71
[  667.682324][ T5287] usb 4-1: can't read configurations, error -71
[  667.758453][T14013] usbhid 1-1:0.0: can't add hid device: -71
[  667.793644][T14013] usbhid 1-1:0.0: probe with driver usbhid failed with error -71
[  667.829813][T14013] usb 1-1: USB disconnect, device number 107
[  668.169889][T14176] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1730'.
[  668.426659][ T5287] usb 4-1: new high-speed USB device number 90 using dummy_hcd
[  668.645991][ T5287] usb 4-1: Using ep0 maxpacket: 16
[  668.713887][ T5287] usb 4-1: unable to get BOS descriptor or descriptor too short
[  668.759526][ T5287] usb 4-1: unable to read config index 0 descriptor/start: -71
[  668.792676][ T5287] usb 4-1: can't read configurations, error -71
[  668.871862][ T5287] usb usb4-port1: attempt power cycle
[  668.883745][    T8] usb 1-1: new high-speed USB device number 108 using dummy_hcd
[  669.139734][    T8] usb 1-1: New USB device found, idVendor=0572, idProduct=cb01, bcdDevice=26.65
[  669.158325][    T8] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  669.174799][    T8] usb 1-1: Product: syz
[  669.179838][    T8] usb 1-1: Manufacturer: syz
[  669.188112][    T8] usb 1-1: SerialNumber: syz
[  669.244954][    T8] usb 1-1: config 0 descriptor??
[  669.471808][    T8] cx82310_eth 1-1:0.0: probe with driver cx82310_eth failed with error -22
[  669.875318][    T8] cxacru 1-1:0.0: usbatm_usb_probe: bind failed: -19!
[  669.886211][   T29] audit: type=1326 audit(1723527939.411:304): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14228 comm="syz.3.1743" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fe24d3799f9 code=0x0
[  669.951277][T14229] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1742'.
[  671.205989][   T58] usb 5-1: new high-speed USB device number 88 using dummy_hcd
[  671.425016][   T58] usb 5-1: Using ep0 maxpacket: 32
[  671.456586][   T58] usb 5-1: config index 0 descriptor too short (expected 164, got 36)
[  671.501301][   T58] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  671.527327][   T58] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  671.549114][   T58] usb 5-1: New USB device found, idVendor=046d, idProduct=c29c, bcdDevice= 0.00
[  671.561212][   T58] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  671.581237][   T58] usb 5-1: config 0 descriptor??
[  671.662087][    T8] usb 1-1: USB disconnect, device number 108
[  671.960241][T14251] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  671.993387][T14251] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  672.271975][   T58] logitech 0003:046D:C29C.0032: unknown main item tag 0x0
[  672.304141][    T8] usb 1-1: new high-speed USB device number 109 using dummy_hcd
[  672.309950][   T58] logitech 0003:046D:C29C.0032: unknown main item tag 0x0
[  672.356958][   T58] logitech 0003:046D:C29C.0032: unknown main item tag 0x0
[  672.374159][   T58] logitech 0003:046D:C29C.0032: unknown main item tag 0x0
[  672.381856][   T58] logitech 0003:046D:C29C.0032: unknown main item tag 0x0
[  672.396048][   T58] logitech 0003:046D:C29C.0032: hidraw0: USB HID v0.00 Device [HID 046d:c29c] on usb-dummy_hcd.4-1/input0
[  672.513716][    T8] usb 1-1: Using ep0 maxpacket: 16
[  672.595887][    T8] usb 1-1: unable to get BOS descriptor or descriptor too short
[  672.640318][ T5339] usb 3-1: new full-speed USB device number 81 using dummy_hcd
[  672.661335][    T8] usb 1-1: unable to read config index 0 descriptor/start: -71
[  672.680226][    T8] usb 1-1: can't read configurations, error -71
[  672.748664][   T58] logitech 0003:046D:C29C.0032: no inputs found
[  672.786935][   T58] usb 5-1: USB disconnect, device number 88
[  672.878416][ T5339] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  672.902825][ T5339] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2
[  672.920750][ T5339] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1
[  672.938125][ T5339] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  672.948615][ T5339] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  672.958546][ T5339] usb 3-1: Product: syz
[  672.963317][ T5339] usb 3-1: Manufacturer: syz
[  672.969059][ T5339] usb 3-1: SerialNumber: syz
[  672.999040][ T5339] cdc_ncm 3-1:1.0: skipping garbage
[  673.016958][ T5339] cdc_ncm 3-1:1.0: CDC Union missing and no IAD found
[  673.040756][ T5339] cdc_ncm 3-1:1.0: bind() failure
[  673.762565][T14266] netlink: 'syz.4.1753': attribute type 8 has an invalid length.
[  674.663853][    T8] usb 5-1: new high-speed USB device number 89 using dummy_hcd
[  674.859910][   T29] audit: type=1326 audit(1723527944.381:305): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14279 comm="syz.1.1758" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f9148d799f9 code=0x0
[  674.930012][    T8] usb 5-1: config 1 contains an unexpected descriptor of type 0x2, skipping
[  674.959658][    T8] usb 5-1: config 1 has 2 interfaces, different from the descriptor's value: 3
[  674.997234][    T8] usb 5-1: config 1 has no interface number 1
[  675.020161][    T8] usb 5-1: Duplicate descriptor for config 1 interface 0 altsetting 0, skipping
[  675.044311][   T25] usb 1-1: new high-speed USB device number 111 using dummy_hcd
[  675.060226][    T8] usb 5-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7
[  675.122749][   T58] usb 3-1: USB disconnect, device number 81
[  675.126449][    T8] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40
[  675.175902][    T8] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  675.206614][    T8] usb 5-1: Product: syz
[  675.211572][T14285] loop8: detected capacity change from 0 to 6
[  675.225027][    T8] usb 5-1: Manufacturer: syz
[  675.271799][T14285] Dev loop8: unable to read RDB block 6
[  675.283606][    T8] usb 5-1: SerialNumber: syz
[  675.294210][   T25] usb 1-1: Using ep0 maxpacket: 8
[  675.313128][   T25] usb 1-1: config 7 has an invalid interface number: 122 but max is 1
[  675.313272][T14285]  loop8: unable to read partition table
[  675.324304][   T25] usb 1-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config
[  675.366678][   T25] usb 1-1: config 7 has 1 interface, different from the descriptor's value: 2
[  675.409399][   T25] usb 1-1: config 7 has no interface number 0
[  675.446114][T14285] loop8: partition table beyond EOD, truncated
[  675.446815][   T25] usb 1-1: config 7 interface 122 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 10
[  675.493801][T14285] loop_reread_partitions: partition scan of loop8 (�被x������ڬ��dƤ����ݡ�����
[  675.493801][T14285] 
) failed (rc=-5)
[  675.560506][   T25] usb 1-1: config 7 interface 122 has no altsetting 0
[  675.601750][   T25] usb 1-1: New USB device found, idVendor=04e2, idProduct=1400, bcdDevice=65.13
[  675.632001][   T25] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  675.659231][T14269] binder: 14268:14269 ioctl c018620b 0 returned -14
[  675.723174][   T25] usb 1-1: Product: syz
[  675.733903][   T25] usb 1-1: Manufacturer: syz
[  675.738737][   T25] usb 1-1: SerialNumber: syz
[  675.776913][T14269] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  675.868408][T14269] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  675.923491][    T8] usb 5-1: 2:1 : no or invalid class specific endpoint descriptor
[  675.977388][    T8] usb 5-1: 2:1: All rates were zero
[  676.005002][    T8] usb 5-1: 2:1 : invalid channels 0
[  676.123717][ T5287] usb 3-1: new high-speed USB device number 82 using dummy_hcd
[  676.213928][    T8] usb 5-1: USB disconnect, device number 89
[  676.302051][T13887] udevd[13887]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory
[  676.414602][   T58] usb 4-1: new high-speed USB device number 92 using dummy_hcd
[  676.436729][ T5287] usb 3-1: Using ep0 maxpacket: 16
[  676.489021][ T5287] usb 3-1: unable to get BOS descriptor or descriptor too short
[  676.539943][ T5287] usb 3-1: unable to read config index 0 descriptor/start: -71
[  676.596765][ T5287] usb 3-1: can't read configurations, error -71
[  676.615416][   T58] usb 4-1: Using ep0 maxpacket: 8
[  676.638752][   T58] usb 4-1: config 0 has an invalid interface number: 255 but max is 12
[  676.661311][   T58] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 13
[  676.693793][   T58] usb 4-1: config 0 has no interface number 0
[  676.710319][   T58] usb 4-1: too many endpoints for config 0 interface 255 altsetting 255: 255, using maximum allowed: 30
[  676.758497][   T58] usb 4-1: config 0 interface 255 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 255
[  676.783390][   T58] usb 4-1: config 0 interface 255 has no altsetting 0
[  676.807126][   T58] usb 4-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58
[  676.829491][   T58] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  676.842567][   T58] usb 4-1: Product: syz
[  676.851168][   T58] usb 4-1: Manufacturer: syz
[  676.861995][   T58] usb 4-1: SerialNumber: syz
[  676.903152][   T58] usb 4-1: config 0 descriptor??
[  676.939913][   T58] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae
[  677.466801][T14307] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.1766'.
[  677.595283][   T25] xr_serial 1-1:7.122: skipping garbage
[  677.615727][   T29] audit: type=1326 audit(1723527947.141:306): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14300 comm="syz.4.1767" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f742a9799f9 code=0x0
[  677.653955][   T25] xr_serial 1-1:7.122: More than one union descriptor, skipping ...
[  677.681017][T14278] delete_channel: no stack
[  677.692904][   T25] usb 1-1: USB disconnect, device number 111
[  678.033766][ T5290] usb 3-1: new high-speed USB device number 84 using dummy_hcd
[  678.047499][T14312] netlink: 191384 bytes leftover after parsing attributes in process `syz.0.1770'.
[  678.169769][T14313] netlink: 'syz.0.1770': attribute type 10 has an invalid length.
[  678.273804][ T5290] usb 3-1: Using ep0 maxpacket: 8
[  678.287124][ T5290] usb 3-1: config index 0 descriptor too short (expected 301, got 45)
[  678.314714][T14313] batman_adv: batadv0: Adding interface: team0
[  678.323706][ T5290] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0
[  678.340772][T14313] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  678.372336][T14313] batman_adv: batadv0: Not using interface team0 (retrying later): interface not active
[  678.389295][T14314] netlink: 'syz.0.1770': attribute type 10 has an invalid length.
[  678.411363][   T58] gspca_zc3xx: reg_w_i err -71
[  678.416503][ T5290] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0
[  678.433749][ T5290] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32
[  678.445992][ T5290] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[  678.462303][ T5290] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23
[  678.472364][ T5290] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  678.482804][T14314] netlink: 2 bytes leftover after parsing attributes in process `syz.0.1770'.
[  678.538790][T14314] team0: entered promiscuous mode
[  678.557230][T14314] team_slave_0: entered promiscuous mode
[  678.655507][T14314] team_slave_1: entered promiscuous mode
[  678.696725][ T5290] usb 3-1: GET_CAPABILITIES returned 0
[  678.702888][ T5290] usbtmc 3-1:16.0: can't read capabilities
[  678.716201][T14314] 8021q: adding VLAN 0 to HW filter on device team0
[  678.722342][T14013] usb 5-1: new high-speed USB device number 90 using dummy_hcd
[  678.732518][T14314] batman_adv: batadv0: Interface activated: team0
[  678.748959][T14314] batman_adv: batadv0: Interface deactivated: team0
[  678.789815][T14314] batman_adv: batadv0: Removing interface: team0
[  678.868299][T14314] bridge0: port 3(team0) entered blocking state
[  678.906303][T14314] bridge0: port 3(team0) entered disabled state
[  678.939176][T14314] team0: entered allmulticast mode
[  678.945953][T14314] team_slave_0: entered allmulticast mode
[  678.956815][T14314] team_slave_1: entered allmulticast mode
[  678.973597][T14314] bridge0: port 3(team0) entered blocking state
[  678.980129][T14314] bridge0: port 3(team0) entered forwarding state
[  679.047184][T14325] loop8: detected capacity change from 0 to 6
[  679.072683][T14325] Dev loop8: unable to read RDB block 6
[  679.079080][   T58] gspca_zc3xx: Unknown sensor - set to TAS5130C
[  679.101460][   T58] gspca_zc3xx 4-1:0.255: probe with driver gspca_zc3xx failed with error -71
[  679.127041][T14325]  loop8: unable to read partition table
[  679.145446][   T25] usb 3-1: USB disconnect, device number 84
[  679.169425][   T58] usb 4-1: USB disconnect, device number 92
[  679.178135][T14325] loop8: partition table beyond EOD, truncated
[  679.215753][T14325] loop_reread_partitions: partition scan of loop8 (�被x������ڬ��dƤ����ݡ�����
[  679.215753][T14325] 
) failed (rc=-5)
[  679.296395][   T29] audit: type=1326 audit(1723527948.821:307): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14327 comm="syz.0.1774" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fb98d7799f9 code=0x0
[  679.782768][ T2973] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  680.031999][ T2973] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  680.272383][T14335] ALSA: mixer_oss: invalid OSS volume ''
[  680.421757][ T2973] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  680.671925][ T2973] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  680.687714][T14013] usb 1-1: new high-speed USB device number 112 using dummy_hcd
[  680.708716][ T5287] usb 5-1: new high-speed USB device number 91 using dummy_hcd
[  680.925340][T14013] usb 1-1: Using ep0 maxpacket: 32
[  680.933591][ T5287] usb 5-1: Using ep0 maxpacket: 8
[  680.943704][T14013] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0
[  680.987389][ T5287] usb 5-1: config 7 has an invalid interface number: 122 but max is 1
[  681.010525][T14013] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0
[  681.035566][ T5287] usb 5-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config
[  681.089206][T14013] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40
[  681.106178][ T5243] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[  681.142670][ T5243] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[  681.154985][ T5243] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[  681.165324][ T5287] usb 5-1: config 7 has 1 interface, different from the descriptor's value: 2
[  681.219371][ T5243] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[  681.228720][T14013] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  681.239787][ T5243] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3
[  681.246136][ T5287] usb 5-1: config 7 has no interface number 0
[  681.258497][ T5243] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[  681.275853][ T2973] bridge_slave_1: left allmulticast mode
[  681.293169][T14013] usb 1-1: Product: syz
[  681.303626][ T5287] usb 5-1: config 7 interface 122 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 10
[  681.318772][T14013] usb 1-1: Manufacturer: syz
[  681.321132][ T2973] bridge_slave_1: left promiscuous mode
[  681.324313][T14013] usb 1-1: SerialNumber: syz
[  681.342016][ T5287] usb 5-1: config 7 interface 122 has no altsetting 0
[  681.367418][ T5287] usb 5-1: New USB device found, idVendor=04e2, idProduct=1400, bcdDevice=65.13
[  681.376811][ T5287] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  681.387101][ T5287] usb 5-1: Product: syz
[  681.391501][ T5287] usb 5-1: Manufacturer: syz
[  681.413691][ T5287] usb 5-1: SerialNumber: syz
[  681.432723][ T2973] bridge0: port 2(bridge_slave_1) entered disabled state
[  681.546634][ T2973] bridge_slave_0: left allmulticast mode
[  681.587973][ T2973] bridge_slave_0: left promiscuous mode
[  681.644300][ T2973] bridge0: port 1(bridge_slave_0) entered disabled state
[  681.789500][T14013] usblp 1-1:1.0: usblp0: USB Unidirectional printer dev 112 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8
[  682.275469][T14359] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  682.326380][T14359] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  682.738506][T14369] loop8: detected capacity change from 0 to 6
[  682.773129][T14369] Dev loop8: unable to read RDB block 6
[  682.795470][T14369]  loop8: unable to read partition table
[  682.833266][T14369] loop8: partition table beyond EOD, truncated
[  682.880617][T14369] loop_reread_partitions: partition scan of loop8 (�被x������ڬ��dƤ����ݡ�����
[  682.880617][T14369] 
) failed (rc=-5)
[  683.440090][ T5287] xr_serial 5-1:7.122: skipping garbage
[  683.448163][T14339] delete_channel: no stack
[  683.457726][ T5287] xr_serial 5-1:7.122: More than one union descriptor, skipping ...
[  683.470170][ T5241] Bluetooth: hci2: command tx timeout
[  683.515393][ T5287] usb 5-1: USB disconnect, device number 91
[  683.873738][ T2973] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  683.896473][ T2973] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  683.911219][ T2973] bond0 (unregistering): Released all slaves
[  684.016179][T14353] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1784'.
[  684.055872][T14357] �: renamed from pim6reg1
[  684.451850][T14389] FAULT_INJECTION: forcing a failure.
[  684.451850][T14389] name failslab, interval 1, probability 0, space 0, times 0
[  684.509024][T14389] CPU: 1 UID: 0 PID: 14389 Comm: syz.4.1790 Not tainted 6.11.0-rc3-syzkaller-00007-gd74da846046a #0
[  684.519877][T14389] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
[  684.530075][T14389] Call Trace:
[  684.533589][T14389]  <TASK>
[  684.536583][T14389]  dump_stack_lvl+0x241/0x360
[  684.541602][T14389]  ? __pfx_dump_stack_lvl+0x10/0x10
[  684.546951][T14389]  ? __pfx__printk+0x10/0x10
[  684.552395][T14389]  ? fs_reclaim_acquire+0x93/0x140
[  684.557584][T14389]  ? __pfx___might_resched+0x10/0x10
[  684.563186][T14389]  should_fail_ex+0x3b0/0x4e0
[  684.567948][T14389]  ? tomoyo_realpath_from_path+0xcf/0x5e0
[  684.573893][T14389]  should_failslab+0xac/0x100
[  684.578894][T14389]  ? tomoyo_realpath_from_path+0xcf/0x5e0
[  684.584838][T14389]  __kmalloc_noprof+0xd8/0x400
[  684.589915][T14389]  ? kfree+0x4e/0x360
[  684.594583][T14389]  tomoyo_realpath_from_path+0xcf/0x5e0
[  684.600200][T14389]  tomoyo_path_number_perm+0x23a/0x880
[  684.605904][T14389]  ? tomoyo_path_number_perm+0x208/0x880
[  684.611589][T14389]  ? __pfx_tomoyo_path_number_perm+0x10/0x10
[  684.617657][T14389]  ? __fget_files+0x29/0x470
[  684.622481][T14389]  ? __fget_files+0x3f6/0x470
[  684.627210][T14389]  ? __fget_files+0x29/0x470
[  684.632039][T14389]  security_file_ioctl+0x75/0xb0
[  684.637175][T14389]  __se_sys_ioctl+0x47/0x170
[  684.641923][T14389]  do_syscall_64+0xf3/0x230
[  684.646475][T14389]  ? clear_bhb_loop+0x35/0x90
[  684.651520][T14389]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  684.657432][T14389] RIP: 0033:0x7f742a9799f9
[  684.662125][T14389] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  684.682041][T14389] RSP: 002b:00007f742a3de038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[  684.690566][T14389] RAX: ffffffffffffffda RBX: 00007f742ab16058 RCX: 00007f742a9799f9
[  684.698820][T14389] RDX: 0000000020000080 RSI: 000000004040534e RDI: 0000000000000006
[  684.707089][T14389] RBP: 00007f742a3de090 R08: 0000000000000000 R09: 0000000000000000
[  684.715211][T14389] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  684.723564][T14389] R13: 0000000000000001 R14: 00007f742ab16058 R15: 00007f742ac3fa38
[  684.732208][T14389]  </TASK>
[  684.735382][    C1] vkms_vblank_simulate: vblank timer overrun
[  684.747557][T14389] ERROR: Out of memory at tomoyo_realpath_from_path.
[  684.778531][ T5287] usb 1-1: USB disconnect, device number 112
[  684.852731][ T5287] usblp0: removed
[  685.201206][T14394] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  685.277423][ T2973] hsr_slave_0: left promiscuous mode
[  685.293094][T14394] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  685.328196][ T2973] hsr_slave_1: left promiscuous mode
[  685.372241][ T2973] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  685.402425][ T2973] batman_adv: batadv0: Removing interface: batadv_slave_0
[  685.427844][ T2973] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  685.427887][ T2973] batman_adv: batadv0: Removing interface: batadv_slave_1
[  685.533804][ T5241] Bluetooth: hci2: command tx timeout
[  685.552685][ T2973] veth1_macvtap: left promiscuous mode
[  685.552836][ T2973] veth0_macvtap: left promiscuous mode
[  685.555454][ T2973] veth1_vlan: left promiscuous mode
[  685.557979][ T2973] veth0_vlan: left promiscuous mode
[  685.890466][T14396] delete_channel: no stack
[  686.267272][ T1273] ieee802154 phy0 wpan0: encryption failed: -22
[  686.274932][ T1273] ieee802154 phy1 wpan1: encryption failed: -22
[  686.603761][ T5339] usb 1-1: new high-speed USB device number 113 using dummy_hcd
[  686.713740][T14013] usb 5-1: new high-speed USB device number 92 using dummy_hcd
[  686.840552][ T5339] usb 1-1: config 0 has an invalid interface number: 41 but max is 0
[  686.884078][ T5339] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  686.906923][ T5339] usb 1-1: config 0 has no interface number 0
[  686.931349][ T5339] usb 1-1: New USB device found, idVendor=04d8, idProduct=0083, bcdDevice=83.9c
[  686.940772][ T5339] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  686.957627][ T5339] usb 1-1: Product: syz
[  686.969718][ T5339] usb 1-1: Manufacturer: syz
[  686.987361][ T5339] usb 1-1: SerialNumber: syz
[  686.993886][T14013] usb 5-1: Using ep0 maxpacket: 8
[  687.003412][ T5339] usb 1-1: config 0 descriptor??
[  687.020401][T14013] usb 5-1: config 7 has an invalid interface number: 122 but max is 1
[  687.040531][T14013] usb 5-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config
[  687.093869][ T5339] ims_pcu 1-1:0.41: Missing CDC union descriptor
[  687.098318][T14013] usb 5-1: config 7 has 1 interface, different from the descriptor's value: 2
[  687.126778][ T5339] ims_pcu 1-1:0.41: probe with driver ims_pcu failed with error -22
[  687.178176][T14013] usb 5-1: config 7 has no interface number 0
[  687.209003][T14013] usb 5-1: config 7 interface 122 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 10
[  687.265121][T14013] usb 5-1: config 7 interface 122 has no altsetting 0
[  687.332479][T14013] usb 5-1: New USB device found, idVendor=04e2, idProduct=1400, bcdDevice=65.13
[  687.377967][T14013] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  687.427588][T14013] usb 5-1: Product: syz
[  687.438254][T14013] usb 5-1: Manufacturer: syz
[  687.451970][T14013] usb 5-1: SerialNumber: syz
[  687.614906][ T5241] Bluetooth: hci2: command tx timeout
[  688.726309][ T2973] team0 (unregistering): Port device team_slave_1 removed
[  688.907404][ T2973] team0 (unregistering): Port device team_slave_0 removed
[  689.138470][ T5339] usb 1-1: USB disconnect, device number 113
[  689.371239][T14429] delete_channel: no stack
[  689.404302][T14013] xr_serial 5-1:7.122: skipping garbage
[  689.409940][T14013] xr_serial 5-1:7.122: More than one union descriptor, skipping ...
[  689.441730][T14013] usb 5-1: USB disconnect, device number 92
[  689.495058][ T5241] Bluetooth: hci1: Unknown advertising packet type: 0x70
[  689.495160][ T5241] Bluetooth: hci1: Malformed LE Event: 0x0d
[  689.704651][ T5241] Bluetooth: hci2: command tx timeout
[  690.288117][T14453] sctp: [Deprecated]: syz.4.1804 (pid 14453) Use of struct sctp_assoc_value in delayed_ack socket option.
[  690.288117][T14453] Use struct sctp_sack_info instead
[  690.603686][T14013] usb 5-1: new high-speed USB device number 93 using dummy_hcd
[  690.818515][T14013] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1
[  690.850312][T14013] usb 5-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3
[  690.868208][T14013] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  690.905024][T14013] usb 5-1: config 0 descriptor??
[  691.710471][T14013] usb 5-1: USB disconnect, device number 93
[  691.858363][T14352] chnl_net:caif_netlink_parms(): no params data found
[  692.541408][T14352] bridge0: port 1(bridge_slave_0) entered blocking state
[  692.570751][T14352] bridge0: port 1(bridge_slave_0) entered disabled state
[  692.611531][T14487] loop8: detected capacity change from 0 to 6
[  692.641629][T14487] Dev loop8: unable to read RDB block 6
[  692.660823][T14352] bridge_slave_0: entered allmulticast mode
[  692.677716][T14487]  loop8: unable to read partition table
[  692.703244][T14487] loop8: partition table beyond EOD, truncated
[  692.711731][T14352] bridge_slave_0: entered promiscuous mode
[  692.739212][T14487] loop_reread_partitions: partition scan of loop8 (�被x������ڬ��dƤ����ݡ�����
[  692.739212][T14487] 
) failed (rc=-5)
[  692.773048][T14352] bridge0: port 2(bridge_slave_1) entered blocking state
[  692.815330][T14352] bridge0: port 2(bridge_slave_1) entered disabled state
[  692.849570][T14352] bridge_slave_1: entered allmulticast mode
[  692.875827][T14352] bridge_slave_1: entered promiscuous mode
[  693.170883][T14500] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(5)
[  693.177528][T14500] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed)
[  693.199837][ T5339] usb 5-1: new high-speed USB device number 94 using dummy_hcd
[  693.227851][T14352] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  693.270835][T14500] vhci_hcd vhci_hcd.0: Device attached
[  693.326188][T14352] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  693.436804][T14507] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1811'.
[  693.452191][ T5339] usb 5-1: Using ep0 maxpacket: 8
[  693.498083][ T5339] usb 5-1: config 7 has an invalid interface number: 122 but max is 1
[  693.540449][ T5339] usb 5-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config
[  693.578456][ T5339] usb 5-1: config 7 has 1 interface, different from the descriptor's value: 2
[  693.593855][    T9] usb 14-1: SetAddress Request (2) to port 0
[  693.624026][    T9] usb 14-1: new SuperSpeed USB device number 2 using vhci_hcd
[  693.633018][ T5339] usb 5-1: config 7 has no interface number 0
[  693.669773][T14352] team0: Port device team_slave_0 added
[  693.682942][ T5339] usb 5-1: config 7 interface 122 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 10
[  693.718718][T14352] team0: Port device team_slave_1 added
[  693.724700][   T58] usb 3-1: new high-speed USB device number 85 using dummy_hcd
[  693.752402][ T5339] usb 5-1: config 7 interface 122 has no altsetting 0
[  693.792542][ T5339] usb 5-1: New USB device found, idVendor=04e2, idProduct=1400, bcdDevice=65.13
[  693.819432][ T5339] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  693.830571][ T5339] usb 5-1: Product: syz
[  693.839685][ T5339] usb 5-1: Manufacturer: syz
[  693.850628][ T5339] usb 5-1: SerialNumber: syz
[  693.956435][   T58] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F
[  693.956665][T14352] batman_adv: batadv0: Adding interface: batadv_slave_0
[  694.029173][   T58] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7
[  694.033993][T14352] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  694.127298][   T58] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0
[  694.172054][T14352] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  694.175769][   T58] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21
[  694.256021][   T58] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00
[  694.262546][T14352] batman_adv: batadv0: Adding interface: batadv_slave_1
[  694.281453][   T58] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  694.306680][   T58] usb 3-1: config 0 descriptor??
[  694.313165][T14352] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  694.340267][    C1] vkms_vblank_simulate: vblank timer overrun
[  694.442483][T14352] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  694.580693][T14352] hsr_slave_0: entered promiscuous mode
[  694.589897][T14352] hsr_slave_1: entered promiscuous mode
[  694.622343][T14352] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  694.667991][T14352] Cannot create hsr debugfs directory
[  694.757980][   T58] usbhid 3-1:0.0: can't add hid device: -71
[  694.766142][   T58] usbhid 3-1:0.0: probe with driver usbhid failed with error -71
[  694.780313][T14502] vhci_hcd: connection reset by peer
[  694.802343][   T58] usb 3-1: USB disconnect, device number 85
[  694.892989][ T3050] vhci_hcd: stop threads
[  694.906474][ T3050] vhci_hcd: release socket
[  694.919072][ T3050] vhci_hcd: disconnect device
[  695.831955][ T5339] xr_serial 5-1:7.122: skipping garbage
[  695.846768][ T5339] xr_serial 5-1:7.122: More than one union descriptor, skipping ...
[  695.911657][ T5339] usb 5-1: USB disconnect, device number 94
[  695.928094][T14496] delete_channel: no stack
[  696.173774][ T5290] usb 3-1: new high-speed USB device number 86 using dummy_hcd
[  696.343662][T14550] FAULT_INJECTION: forcing a failure.
[  696.343662][T14550] name fail_futex, interval 1, probability 0, space 0, times 1
[  696.345570][T14553] loop8: detected capacity change from 0 to 6
[  696.393066][T14553] Dev loop8: unable to read RDB block 6
[  696.404796][T14553]  loop8: unable to read partition table
[  696.416003][T14550] CPU: 0 UID: 0 PID: 14550 Comm: syz.4.1820 Not tainted 6.11.0-rc3-syzkaller-00007-gd74da846046a #0
[  696.424068][T14553] loop8: partition table beyond EOD, 
[  696.426805][T14550] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
[  696.426827][T14550] Call Trace:
[  696.426838][T14550]  <TASK>
[  696.426849][T14550]  dump_stack_lvl+0x241/0x360
[  696.432624][T14553] truncated
[  696.442478][T14550]  ? __pfx_dump_stack_lvl+0x10/0x10
[  696.442526][T14550]  ? __pfx__printk+0x10/0x10
[  696.442556][T14550]  ? register_lock_class+0x102/0x980
[  696.442593][T14550]  ? __pfx_register_lock_class+0x10/0x10
[  696.442631][T14550]  should_fail_ex+0x3b0/0x4e0
[  696.442661][T14550]  get_futex_key+0x17c/0x1050
[  696.442696][T14550]  ? __pfx_get_futex_key+0x10/0x10
[  696.442723][T14550]  ? __lock_acquire+0x137a/0x2040
[  696.442763][T14550]  futex_wake+0x12a/0x5c0
[  696.442804][T14550]  ? __pfx_futex_wake+0x10/0x10
[  696.456606][T14553] loop_reread_partitions: partition scan of loop8 (�被x������ڬ��dƤ����ݡ�����
[  696.456606][T14553] 
) failed (rc=-5)
[  696.456819][T14550]  do_futex+0x392/0x560
[  696.526101][T14550]  ? __pfx_do_futex+0x10/0x10
[  696.530995][T14550]  ? __might_fault+0xaa/0x120
[  696.535958][T14550]  mm_release+0x193/0x430
[  696.540416][T14550]  ? exit_robust_list+0x2cf/0x2f0
[  696.545475][T14550]  ? __pfx_mm_release+0x10/0x10
[  696.550364][T14550]  ? _raw_spin_unlock_irq+0x23/0x50
[  696.555673][T14550]  ? lockdep_hardirqs_on+0x99/0x150
[  696.560994][T14550]  exit_mm+0xb0/0x310
[  696.565710][T14550]  ? __pfx_exit_mm+0x10/0x10
[  696.570414][T14550]  ? taskstats_exit+0x326/0xa60
[  696.575303][T14550]  do_exit+0x9b2/0x27f0
[  696.579658][T14550]  ? __pfx_do_exit+0x10/0x10
[  696.584519][T14550]  ? __pfx_do_raw_spin_lock+0x10/0x10
[  696.590102][T14550]  ? lockdep_hardirqs_on_prepare+0x43d/0x780
[  696.596102][T14550]  ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[  696.602443][T14550]  ? _raw_spin_lock_irq+0xdf/0x120
[  696.607580][T14550]  do_group_exit+0x207/0x2c0
[  696.612265][T14550]  ? _raw_spin_unlock_irq+0x23/0x50
[  696.617485][T14550]  ? lockdep_hardirqs_on+0x99/0x150
[  696.622700][T14550]  get_signal+0x16a1/0x1740
[  696.627608][T14550]  ? __pfx_get_signal+0x10/0x10
[  696.632583][T14550]  ? snd_seq_ioctl+0x2ce/0x400
[  696.637593][T14550]  arch_do_signal_or_restart+0x96/0x860
[  696.643200][T14550]  ? __pfx_arch_do_signal_or_restart+0x10/0x10
[  696.649464][T14550]  ? lockdep_hardirqs_on_prepare+0x43d/0x780
[  696.655565][T14550]  ? syscall_exit_to_user_mode+0xa3/0x370
[  696.661581][T14550]  syscall_exit_to_user_mode+0xc9/0x370
[  696.667414][T14550]  do_syscall_64+0x100/0x230
[  696.672144][T14550]  ? clear_bhb_loop+0x35/0x90
[  696.677104][T14550]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  696.683112][T14550] RIP: 0033:0x7f742a9799f9
[  696.687892][T14550] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  696.708002][T14550] RSP: 002b:00007f742a3de038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[  696.716520][T14550] RAX: 0000000000000000 RBX: 00007f742ab16058 RCX: 00007f742a9799f9
[  696.724605][T14550] RDX: 0000000020000080 RSI: 000000004040534e RDI: 0000000000000006
[  696.732759][T14550] RBP: 00007f742a3de090 R08: 0000000000000000 R09: 0000000000000000
[  696.741026][T14550] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  696.749028][T14550] R13: 0000000000000001 R14: 00007f742ab16058 R15: 00007f742ac3fa38
[  696.757286][T14550]  </TASK>
[  696.790338][T14557] program syz.1.1823 is using a deprecated SCSI ioctl, please convert it to SG_IO
[  697.299732][T14557] capability: warning: `syz.1.1823' uses 32-bit capabilities (legacy support in use)
[  697.667675][ T2973] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  698.010340][ T2973] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  698.286310][ T2973] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  698.623678][ T5290] usb 1-1: new high-speed USB device number 114 using dummy_hcd
[  698.734851][    T9] usb 14-1: device descriptor read/8, error -110
[  698.768336][ T2973] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  698.843701][ T5290] usb 1-1: Using ep0 maxpacket: 8
[  698.850933][ T5290] usb 1-1: config 7 has an invalid interface number: 122 but max is 1
[  698.880418][ T5290] usb 1-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config
[  698.954814][ T5290] usb 1-1: config 7 has 1 interface, different from the descriptor's value: 2
[  698.999960][ T5290] usb 1-1: config 7 has no interface number 0
[  699.045411][ T5290] usb 1-1: config 7 interface 122 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 10
[  699.095226][T14352] netdevsim netdevsim3 netdevsim0: renamed from eth0
[  699.115032][ T5290] usb 1-1: config 7 interface 122 has no altsetting 0
[  699.140479][ T5290] usb 1-1: New USB device found, idVendor=04e2, idProduct=1400, bcdDevice=65.13
[  699.154881][ T5290] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  699.163458][ T5290] usb 1-1: Product: syz
[  699.168041][ T5290] usb 1-1: Manufacturer: syz
[  699.172958][ T5290] usb 1-1: SerialNumber: syz
[  699.194881][    T9] usb usb14-port1: attempt power cycle
[  699.246415][T14352] netdevsim netdevsim3 netdevsim1: renamed from eth1
[  699.274958][ T5243] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[  699.316082][ T5243] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[  699.319463][T14352] netdevsim netdevsim3 netdevsim2: renamed from eth2
[  699.331474][ T5243] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[  699.343437][ T5243] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[  699.365287][ T5243] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3
[  699.377767][ T5243] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[  699.661306][T14596] delete_channel: no stack
[  699.666293][   T29] audit: type=1326 audit(1723527969.181:308): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14602 comm="syz.1.1834" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f9148d799f9 code=0x0
[  699.689061][T14352] netdevsim netdevsim3 netdevsim3: renamed from eth3
[  699.901260][    T9] usb usb14-port1: unable to enumerate USB device
[  700.133986][ T2973] team0: left allmulticast mode
[  700.157648][ T2973] team_slave_0: left allmulticast mode
[  700.184624][ T2973] team_slave_1: left allmulticast mode
[  700.200739][ T2973] bridge0: port 3(team0) entered disabled state
[  700.232613][ T2973] bridge_slave_1: left allmulticast mode
[  700.267907][ T2973] bridge_slave_1: left promiscuous mode
[  700.288048][ T2973] bridge0: port 2(bridge_slave_1) entered disabled state
[  700.352388][ T2973] bridge_slave_0: left allmulticast mode
[  700.372302][ T2973] bridge_slave_0: left promiscuous mode
[  700.394265][ T2973] bridge0: port 1(bridge_slave_0) entered disabled state
[  700.743026][T14618] loop8: detected capacity change from 0 to 6
[  700.763263][T14618] Dev loop8: unable to read RDB block 6
[  700.769886][T14618]  loop8: unable to read partition table
[  700.788744][T14618] loop8: partition table beyond EOD, truncated
[  700.803893][T14618] loop_reread_partitions: partition scan of loop8 (�被x������ڬ��dƤ����ݡ�����
[  700.803893][T14618] 
) failed (rc=-5)
[  701.277561][ T5290] xr_serial 1-1:7.122: skipping garbage
[  701.281016][T14585] delete_channel: no stack
[  701.319520][ T5290] xr_serial 1-1:7.122: More than one union descriptor, skipping ...
[  701.368038][ T5290] usb 1-1: USB disconnect, device number 114
[  701.399572][   T29] audit: type=1326 audit(1723527970.921:309): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14622 comm="syz.1.1838" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f9148d799f9 code=0x0
[  701.455057][ T5243] Bluetooth: hci3: command tx timeout
[  702.531036][ T2973] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  702.589016][ T2973] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  702.621035][ T2973] bond0 (unregistering): Released all slaves
[  702.824417][    T8] usb 1-1: new high-speed USB device number 115 using dummy_hcd
[  703.044529][    T8] usb 1-1: Using ep0 maxpacket: 8
[  703.064999][    T8] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  703.137715][    T8] usb 1-1: New USB device found, idVendor=05ac, idProduct=8501, bcdDevice=20.9d
[  703.147752][    T8] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=105
[  703.156961][    T8] usb 1-1: SerialNumber: syz
[  703.178306][    T8] usb 1-1: config 0 descriptor??
[  703.462376][    T8] usb 1-1: Found UVC 0.00 device <unnamed> (05ac:8501)
[  703.504468][    T8] usb 1-1: No valid video chain found.
[  703.534036][ T5243] Bluetooth: hci3: command tx timeout
[  703.539874][    T8] usb 1-1: USB disconnect, device number 115
[  703.982318][T14352] 8021q: adding VLAN 0 to HW filter on device bond0
[  704.035200][T14655] delete_channel: no stack
[  704.238429][ T2973] hsr_slave_0: left promiscuous mode
[  704.249119][ T2973] hsr_slave_1: left promiscuous mode
[  704.272474][ T2973] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  704.294527][ T2973] batman_adv: batadv0: Removing interface: batadv_slave_0
[  704.325839][ T2973] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  704.362442][ T2973] batman_adv: batadv0: Removing interface: batadv_slave_1
[  704.471219][ T2973] veth1_macvtap: left promiscuous mode
[  704.483769][   T58] usb 5-1: new high-speed USB device number 95 using dummy_hcd
[  704.497972][ T2973] veth0_macvtap: left promiscuous mode
[  704.513246][ T2973] veth1_vlan: left promiscuous mode
[  704.562701][ T2973] veth0_vlan: left promiscuous mode
[  704.727315][   T58] usb 5-1: Using ep0 maxpacket: 8
[  704.771896][   T58] usb 5-1: config 7 has an invalid interface number: 122 but max is 1
[  704.793315][T14013] usb 1-1: new high-speed USB device number 116 using dummy_hcd
[  704.861784][   T58] usb 5-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config
[  705.105633][T14013] usb 1-1: Using ep0 maxpacket: 8
[  705.180293][T14013] usb 1-1: config 7 has an invalid interface number: 122 but max is 1
[  705.192142][T14013] usb 1-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config
[  705.284939][   T58] usb 5-1: config 7 has 1 interface, different from the descriptor's value: 2
[  705.330016][T14013] usb 1-1: config 7 has 1 interface, different from the descriptor's value: 2
[  705.433242][   T58] usb 5-1: config 7 has no interface number 0
[  705.458048][   T58] usb 5-1: config 7 interface 122 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 10
[  705.613807][ T5243] Bluetooth: hci3: command tx timeout
[  706.397163][   T58] usb 5-1: config 7 interface 122 has no altsetting 0
[  706.418266][T14013] usb 1-1: config 7 has no interface number 0
[  706.444609][T14013] usb 1-1: config 7 interface 122 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 10
[  706.472666][T14013] usb 1-1: config 7 interface 122 has no altsetting 0
[  706.476767][   T58] usb 5-1: New USB device found, idVendor=04e2, idProduct=1400, bcdDevice=65.13
[  706.486884][T14013] usb 1-1: New USB device found, idVendor=04e2, idProduct=1400, bcdDevice=65.13
[  706.498224][T14013] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  706.540577][   T58] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  706.550239][T14013] usb 1-1: Product: syz
[  706.565249][T14013] usb 1-1: Manufacturer: syz
[  706.573841][   T58] usb 5-1: Product: syz
[  706.588442][T14013] usb 1-1: SerialNumber: syz
[  706.588450][   T58] usb 5-1: Manufacturer: syz
[  706.588471][   T58] usb 5-1: SerialNumber: syz
[  707.694040][ T5243] Bluetooth: hci3: command tx timeout
[  708.108263][T14013] xr_serial 1-1:7.122: skipping garbage
[  708.131313][T14680] delete_channel: no stack
[  708.160460][T14013] xr_serial 1-1:7.122: More than one union descriptor, skipping ...
[  708.254125][T14013] usb 1-1: USB disconnect, device number 116
[  708.360569][   T58] xr_serial 5-1:7.122: skipping garbage
[  708.405248][   T58] xr_serial 5-1:7.122: More than one union descriptor, skipping ...
[  708.457105][   T58] usb 5-1: USB disconnect, device number 95
[  708.983655][   T58] usb 5-1: new high-speed USB device number 96 using dummy_hcd
[  709.228872][ T2973] team_slave_1 (unregistering): left promiscuous mode
[  709.294880][ T2973] team0 (unregistering): Port device team_slave_1 removed
[  709.305505][   T58] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0
[  709.322118][   T58] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 0
[  709.333323][   T58] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0
[  709.351613][   T58] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x89 has invalid maxpacket 0
[  709.361685][   T58] usb 5-1: New USB device found, idVendor=2040, idProduct=4900, bcdDevice=4d.8b
[  709.382326][   T58] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  709.404989][   T58] usb 5-1: config 0 descriptor??
[  709.494571][ T2973] team_slave_0 (unregistering): left promiscuous mode
[  709.514924][ T2973] team0 (unregistering): Port device team_slave_0 removed
[  709.637514][T14693] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1850'.
[  710.950094][T14684] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1848'.
[  711.142995][T14694] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1849'.
[  711.186726][   T58] hdpvr 5-1:0.0: unexpected answer of status request, len -71
[  711.213474][T14352] 8021q: adding VLAN 0 to HW filter on device team0
[  711.241868][T14604] chnl_net:caif_netlink_parms(): no params data found
[  711.253742][   T58] hdpvr 5-1:0.0: device init failed
[  711.273222][ T2963] bridge0: port 1(bridge_slave_0) entered blocking state
[  711.273868][   T58] hdpvr 5-1:0.0: probe with driver hdpvr failed with error -12
[  711.280485][ T2963] bridge0: port 1(bridge_slave_0) entered forwarding state
[  711.351651][   T58] usb 5-1: USB disconnect, device number 96
[  711.647313][    C0] TCP: request_sock_TCP: Possible SYN flooding on port [::]:20002. Sending cookies.
[  711.673007][   T81] bridge0: port 2(bridge_slave_1) entered blocking state
[  711.680662][   T81] bridge0: port 2(bridge_slave_1) entered forwarding state
[  712.101274][T14604] bridge0: port 1(bridge_slave_0) entered blocking state
[  712.134473][T14604] bridge0: port 1(bridge_slave_0) entered disabled state
[  712.159825][T14604] bridge_slave_0: entered allmulticast mode
[  712.193887][T14604] bridge_slave_0: entered promiscuous mode
[  712.300710][T14604] bridge0: port 2(bridge_slave_1) entered blocking state
[  712.330519][T14604] bridge0: port 2(bridge_slave_1) entered disabled state
[  712.368110][T14604] bridge_slave_1: entered allmulticast mode
[  712.392394][T14604] bridge_slave_1: entered promiscuous mode
[  712.728385][T14604] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  712.789705][T14604] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  713.040696][T14604] team0: Port device team_slave_0 added
[  713.127301][T14604] team0: Port device team_slave_1 added
[  713.356022][T14747] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  713.368759][T14604] batman_adv: batadv0: Adding interface: batadv_slave_0
[  713.394464][T14604] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  713.481348][T14604] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  713.493007][T14747] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  713.602470][T14752] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1858'.
[  713.617806][T14604] batman_adv: batadv0: Adding interface: batadv_slave_1
[  713.637546][T14604] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  713.739253][T14604] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  713.928946][T14352] 8021q: adding VLAN 0 to HW filter on device batadv0
[  714.151261][T14765] fuse: Unknown parameter ''
[  714.211169][T14604] hsr_slave_0: entered promiscuous mode
[  714.238800][T14604] hsr_slave_1: entered promiscuous mode
[  714.282187][T14604] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  714.309640][T14604] Cannot create hsr debugfs directory
[  714.563154][T14765] netlink: 'syz.0.1859': attribute type 14 has an invalid length.
[  714.572072][T14765] netlink: 48 bytes leftover after parsing attributes in process `syz.0.1859'.
[  714.977876][T14352] veth0_vlan: entered promiscuous mode
[  714.984304][   T25] usb 5-1: new full-speed USB device number 97 using dummy_hcd
[  715.182665][T14352] veth1_vlan: entered promiscuous mode
[  715.215661][   T25] usb 5-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10
[  715.271284][   T25] usb 5-1: config 27 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 127, setting to 64
[  715.321316][   T25] usb 5-1: config 27 interface 0 altsetting 0 endpoint 0xB has invalid maxpacket 65535, setting to 64
[  715.374510][   T25] usb 5-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d
[  715.416048][   T25] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  715.470969][T14771] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22
[  715.502230][T14771] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22
[  715.557209][   T25] usb 5-1: Quirk or no altset; falling back to MIDI 1.0
[  715.605726][T14352] veth0_macvtap: entered promiscuous mode
[  715.712153][ T1188] usb 1-1: new high-speed USB device number 117 using dummy_hcd
[  715.820042][T14352] veth1_macvtap: entered promiscuous mode
[  715.831579][T14747] delete_channel: no stack
[  715.848771][T14771] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1860'.
[  715.937820][T14770] netlink: 'syz.4.1860': attribute type 2 has an invalid length.
[  715.953843][ T1188] usb 1-1: Using ep0 maxpacket: 32
[  715.990871][ T1188] usb 1-1: New USB device found, idVendor=10c4, idProduct=818a, bcdDevice=99.d3
[  716.027293][ T1188] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  716.051063][ T1188] usb 1-1: Product: syz
[  716.063351][ T1188] usb 1-1: Manufacturer: syz
[  716.074482][ T1188] usb 1-1: SerialNumber: syz
[  716.089540][ T1188] usb 1-1: config 0 descriptor??
[  716.098999][ T1188] radio-si470x 1-1:0.0: could not find interrupt in endpoint
[  716.108379][ T1188] radio-si470x 1-1:0.0: probe with driver radio-si470x failed with error -5
[  716.149235][T14352] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  716.173939][T14352] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  716.187491][ T5290] usb 5-1: USB disconnect, device number 97
[  716.208046][T14352] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  716.261478][T14352] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  716.302126][T14352] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  716.325676][ T1188] radio-raremono 1-1:0.0: this is not Thanko's Raremono.
[  716.379706][T14352] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  716.391121][ T1188] usbhid 1-1:0.0: couldn't find an input interrupt endpoint
[  716.403081][T14352] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  716.415890][ T1188] usb 1-1: USB disconnect, device number 117
[  716.426322][T14352] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  716.454146][T14352] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  716.483284][T14352] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  716.501663][T14352] batman_adv: batadv0: Interface activated: batadv_slave_0
[  716.540713][T14352] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  716.583378][T14352] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  716.606796][T14352] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  716.619533][T14352] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  716.635019][T14352] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  716.657182][T14352] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  716.677636][T14352] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  716.700687][T14352] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  716.714946][T14352] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  716.738624][T14352] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  716.769043][T14352] batman_adv: batadv0: Interface activated: batadv_slave_1
[  716.825162][T14352] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  716.843934][T14352] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  716.871967][T14352] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  716.888259][T14352] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  717.370249][T14604] netdevsim netdevsim2 netdevsim0: renamed from eth0
[  717.440980][ T2963] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  717.442743][T14604] netdevsim netdevsim2 netdevsim1: renamed from eth1
[  717.489422][T14604] netdevsim netdevsim2 netdevsim2: renamed from eth2
[  717.497099][ T2963] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  717.569419][T14604] netdevsim netdevsim2 netdevsim3: renamed from eth3
[  717.618374][   T81] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  717.642095][   T81] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  718.080300][T14604] 8021q: adding VLAN 0 to HW filter on device bond0
[  718.171674][T14604] 8021q: adding VLAN 0 to HW filter on device team0
[  718.231900][ T2973] bridge0: port 1(bridge_slave_0) entered blocking state
[  718.239313][ T2973] bridge0: port 1(bridge_slave_0) entered forwarding state
[  718.306175][   T52] bridge0: port 2(bridge_slave_1) entered blocking state
[  718.314315][   T52] bridge0: port 2(bridge_slave_1) entered forwarding state
[  718.353913][T14013] usb 4-1: new high-speed USB device number 93 using dummy_hcd
[  718.483646][ T5290] usb 1-1: new high-speed USB device number 118 using dummy_hcd
[  718.546506][T14604] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[  718.564056][T14013] usb 4-1: Using ep0 maxpacket: 16
[  718.589638][T14013] usb 4-1: unable to get BOS descriptor or descriptor too short
[  718.662653][T14013] usb 4-1: unable to read config index 0 descriptor/start: -71
[  718.675539][ T5290] usb 1-1: device descriptor read/64, error -71
[  718.713448][T14604] 8021q: adding VLAN 0 to HW filter on device batadv0
[  718.733168][T14013] usb 4-1: can't read configurations, error -71
[  718.954513][T14840] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1869'.
[  718.977661][T14604] veth0_vlan: entered promiscuous mode
[  718.994043][ T5290] usb 1-1: new high-speed USB device number 119 using dummy_hcd
[  719.044159][T14604] veth1_vlan: entered promiscuous mode
[  719.183713][ T5290] usb 1-1: device descriptor read/64, error -71
[  719.283310][T14604] veth0_macvtap: entered promiscuous mode
[  719.336803][T14604] veth1_macvtap: entered promiscuous mode
[  719.343332][ T5290] usb usb1-port1: attempt power cycle
[  719.461848][T14604] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  719.503666][T14604] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  719.529592][T14604] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  719.545943][T14604] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  719.566931][T14604] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  719.584332][T14604] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  719.595826][T14850] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1871'.
[  719.605678][T14604] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  719.666391][T14604] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  719.683635][T14604] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  719.702637][T14604] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  719.720264][T14604] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  719.747397][T14604] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  719.782853][T14604] batman_adv: batadv0: Interface activated: batadv_slave_0
[  719.799903][T14847] veth2: entered allmulticast mode
[  719.804035][ T5290] usb 1-1: new high-speed USB device number 120 using dummy_hcd
[  719.886247][ T5290] usb 1-1: device descriptor read/8, error -71
[  719.924877][T14013] usb 4-1: new high-speed USB device number 94 using dummy_hcd
[  719.940432][T14604] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  719.987975][T14604] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  720.022724][T14604] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  720.079840][T14604] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  720.120452][T14604] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  720.163608][T14013] usb 4-1: Using ep0 maxpacket: 32
[  720.168136][T14604] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  720.180226][T14013] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 254, using maximum allowed: 30
[  720.180282][T14013] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  720.180313][T14013] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  720.180340][T14013] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 254
[  720.180389][T14013] usb 4-1: New USB device found, idVendor=056a, idProduct=0315, bcdDevice= 0.00
[  720.180416][T14013] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  720.183053][T14013] usb 4-1: config 0 descriptor??
[  720.248255][   T25] usb 5-1: new high-speed USB device number 98 using dummy_hcd
[  720.264713][ T5290] usb 1-1: new high-speed USB device number 121 using dummy_hcd
[  720.301134][T14604] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  720.319016][T14604] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  720.319174][ T5290] usb 1-1: device descriptor read/8, error -71
[  720.353712][T14604] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  720.398258][T14604] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  720.417152][T14604] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  720.436502][T14604] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  720.466562][T14604] batman_adv: batadv0: Interface activated: batadv_slave_1
[  720.482842][   T25] usb 5-1: Using ep0 maxpacket: 32
[  720.506456][   T25] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F
[  720.524782][ T5290] usb usb1-port1: unable to enumerate USB device
[  720.568344][   T25] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11
[  720.597529][   T25] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024
[  720.620330][   T25] usb 5-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40
[  720.646552][   T25] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  720.686594][   T25] usb 5-1: config 0 descriptor??
[  720.692756][T14855] raw-gadget.3 gadget.4: fail, usb_ep_enable returned -22
[  720.734514][   T25] hub 5-1:0.0: USB hub found
[  720.788280][T14604] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  720.844735][T14604] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  720.857461][T14604] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  720.868592][T14604] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  720.939795][T14013] wacom 0003:056A:0315.0033: unknown main item tag 0x0
[  720.984177][T14013] wacom 0003:056A:0315.0033: unknown main item tag 0x0
[  721.027007][T14013] wacom 0003:056A:0315.0033: unknown main item tag 0x0
[  721.059604][T14013] wacom 0003:056A:0315.0033: unknown main item tag 0x0
[  721.090176][T14013] wacom 0003:056A:0315.0033: unknown main item tag 0x2
[  721.110741][T14013] wacom 0003:056A:0315.0033: Unknown device_type for 'HID 056a:0315'. Assuming pen.
[  721.123030][ T2963] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  721.143333][T14855] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1873'.
[  721.192871][T14013] wacom 0003:056A:0315.0033: hidraw0: USB HID v0.00 Device [HID 056a:0315] on usb-dummy_hcd.3-1/input0
[  721.391863][T14013] input: Wacom Intuos Pro M Pen as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:056A:0315.0033/input/input35
[  721.411747][ T2963] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  721.848505][ T2963] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  722.183331][ T2963] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  722.404519][ T5287] usb 1-1: new full-speed USB device number 122 using dummy_hcd
[  722.552504][    T9] usb 4-1: USB disconnect, device number 94
[  722.640529][ T5287] usb 1-1: unable to get BOS descriptor or descriptor too short
[  722.675218][ T2940] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  722.686990][ T5287] usb 1-1: not running at top speed; connect to a high speed hub
[  722.738863][ T2940] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  722.752784][ T5287] usb 1-1: config 1 contains an unexpected descriptor of type 0x1, skipping
[  722.824732][ T5287] usb 1-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config
[  722.889955][ T5287] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3
[  722.927842][ T5287] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40
[  722.972293][ T5287] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  723.028882][ T5287] usb 1-1: Product: syz
[  723.071469][ T5287] usb 1-1: Manufacturer: syz
[  723.101545][ T5287] usb 1-1: SerialNumber: syz
[  723.130323][T10838] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1
[  723.143414][T10838] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9
[  723.153006][T10838] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9
[  723.197247][T10838] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4
[  723.209375][T10838] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3
[  723.224254][T10838] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2
[  723.234623][   T25] hub 5-1:0.0: config failed, can't read hub descriptor (err -22)
[  723.274108][ T2963] team0: left allmulticast mode
[  723.279495][ T2963] team_slave_0: left allmulticast mode
[  723.302574][ T2973] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  723.331747][ T2973] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  723.339600][ T2963] team_slave_1: left allmulticast mode
[  723.353549][   T25] usbhid 5-1:0.0: can't add hid device: -71
[  723.359649][   T25] usbhid 5-1:0.0: probe with driver usbhid failed with error -71
[  723.366809][ T2963] bridge0: port 3(team0) entered disabled state
[  723.410174][ T2963] bridge_slave_1: left allmulticast mode
[  723.440348][ T2963] bridge_slave_1: left promiscuous mode
[  723.455544][   T25] usb 5-1: USB disconnect, device number 98
[  723.472888][ T2963] bridge0: port 2(bridge_slave_1) entered disabled state
[  723.505639][ T2963] bridge_slave_0: left allmulticast mode
[  723.523155][ T2963] bridge_slave_0: left promiscuous mode
[  723.536812][ T2963] bridge0: port 1(bridge_slave_0) entered disabled state
[  724.173922][T10838] Bluetooth: hci4: command 0x0406 tx timeout
[  724.336659][  T941] usb 4-1: new high-speed USB device number 95 using dummy_hcd
[  724.573245][  T941] usb 4-1: Using ep0 maxpacket: 16
[  725.310001][ T5241] Bluetooth: hci5: command tx timeout
[  725.743641][   T25] usb 5-1: new high-speed USB device number 99 using dummy_hcd
[  725.753817][ T2963] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  725.814398][ T2963] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  725.871284][ T2963] bond0 (unregistering): Released all slaves
[  725.950277][ T2963] bond1 (unregistering): Released all slaves
[  725.957727][   T25] usb 5-1: Using ep0 maxpacket: 32
[  726.015283][   T25] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  726.066992][   T25] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  726.115540][   T25] usb 5-1: New USB device found, idVendor=060b, idProduct=0001, bcdDevice= 0.00
[  726.128424][   T25] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  726.171663][   T25] usb 5-1: config 0 descriptor??
[  726.223302][  T941] usb 4-1: unable to get BOS descriptor or descriptor too short
[  726.358832][  T941] usb 4-1: unable to read config index 0 descriptor/start: -71
[  726.425464][  T941] usb 4-1: can't read configurations, error -71
[  726.531150][ T5287] usb 1-1: 0:2 : does not exist
[  726.592391][ T5287] usb 1-1: USB disconnect, device number 122
[  726.767060][T13887] udevd[13887]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory
[  726.987482][T14888] FAULT_INJECTION: forcing a failure.
[  726.987482][T14888] name fail_usercopy, interval 1, probability 0, space 0, times 0
[  727.056768][T14888] CPU: 0 UID: 0 PID: 14888 Comm: syz.0.1881 Not tainted 6.11.0-rc3-syzkaller-00007-gd74da846046a #0
[  727.067767][T14888] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
[  727.078498][T14888] Call Trace:
[  727.081914][T14888]  <TASK>
[  727.084892][T14888]  dump_stack_lvl+0x241/0x360
[  727.089730][T14888]  ? __pfx_dump_stack_lvl+0x10/0x10
[  727.094960][T14888]  ? __pfx__printk+0x10/0x10
[  727.099609][T14888]  ? snprintf+0xda/0x120
[  727.103887][T14888]  should_fail_ex+0x3b0/0x4e0
[  727.108604][T14888]  _copy_to_user+0x2f/0xb0
[  727.113067][T14888]  simple_read_from_buffer+0xca/0x150
[  727.118503][T14888]  proc_fail_nth_read+0x1e9/0x250
[  727.123667][T14888]  ? __pfx_proc_fail_nth_read+0x10/0x10
[  727.129455][T14888]  ? rw_verify_area+0x520/0x6b0
[  727.134529][T14888]  ? __pfx_proc_fail_nth_read+0x10/0x10
[  727.140213][T14888]  vfs_read+0x204/0xbc0
[  727.144422][T14888]  ? __pfx_lock_release+0x10/0x10
[  727.149869][T14888]  ? __pfx_vfs_read+0x10/0x10
[  727.155223][T14888]  ? __fget_files+0x29/0x470
[  727.159915][T14888]  ? __fget_files+0x3f6/0x470
[  727.164770][T14888]  ksys_read+0x1a0/0x2c0
[  727.169168][T14888]  ? __pfx_ksys_read+0x10/0x10
[  727.174084][T14888]  ? do_syscall_64+0x100/0x230
[  727.179249][T14888]  ? do_syscall_64+0xb6/0x230
[  727.184847][T14888]  do_syscall_64+0xf3/0x230
[  727.189650][T14888]  ? clear_bhb_loop+0x35/0x90
[  727.194627][T14888]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  727.201669][T14888] RIP: 0033:0x7fb98d77843c
[  727.206475][T14888] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 69 8d 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 bf 8d 02 00 48
[  727.227819][T14888] RSP: 002b:00007fb98e618030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[  727.237595][T14888] RAX: ffffffffffffffda RBX: 00007fb98d915f80 RCX: 00007fb98d77843c
[  727.247080][T14888] RDX: 000000000000000f RSI: 00007fb98e6180a0 RDI: 0000000000000005
[  727.257114][T14888] RBP: 00007fb98e618090 R08: 0000000000000000 R09: 0000000000000000
[  727.266698][T14888] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  727.275612][T14888] R13: 0000000000000000 R14: 00007fb98d915f80 R15: 00007fb98da3fa38
[  727.285120][T14888]  </TASK>
[  727.310412][T14880] misc userio: Can't change port type on an already running userio instance
[  727.387377][ T5241] Bluetooth: hci5: command tx timeout
[  728.407987][ T5331] usb 1-1: new full-speed USB device number 123 using dummy_hcd
[  728.606147][ T5331] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  728.659280][ T2963] hsr_slave_0: left promiscuous mode
[  728.674987][ T5331] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 2
[  728.716179][ T5331] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 4
[  728.750881][ T2963] hsr_slave_1: left promiscuous mode
[  728.768184][   T25] usbhid 5-1:0.0: can't add hid device: -71
[  728.804170][   T25] usbhid 5-1:0.0: probe with driver usbhid failed with error -71
[  728.812614][ T2963] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  728.821977][ T5331] usb 1-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00
[  728.863135][ T2963] batman_adv: batadv0: Removing interface: batadv_slave_0
[  728.892298][ T5331] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  728.901010][   T25] usb 5-1: USB disconnect, device number 99
[  728.960988][ T5331] hub 1-1:1.0: bad descriptor, ignoring hub
[  728.967920][ T2963] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  728.999247][ T2963] batman_adv: batadv0: Removing interface: batadv_slave_1
[  729.013663][ T5331] hub 1-1:1.0: probe with driver hub failed with error -5
[  729.104307][ T2963] veth1_macvtap: left promiscuous mode
[  729.114161][ T5331] cdc_wdm 1-1:1.0: skipping garbage
[  729.125229][ T2963] veth0_macvtap: left promiscuous mode
[  729.159706][ T2963] veth1_vlan: left promiscuous mode
[  729.169396][ T5331] cdc_wdm 1-1:1.0: skipping garbage
[  729.190448][ T2963] veth0_vlan: left promiscuous mode
[  729.211540][ T5331] cdc_wdm 1-1:1.0: probe with driver cdc_wdm failed with error -22
[  729.299970][ T5331] usb 1-1: USB disconnect, device number 123
[  729.477962][ T5241] Bluetooth: hci5: command tx timeout
[  729.634370][   T25] usb 4-1: new high-speed USB device number 97 using dummy_hcd
[  729.774625][ T5290] usb 3-1: new high-speed USB device number 87 using dummy_hcd
[  729.793715][ T5331] usb 1-1: new low-speed USB device number 124 using dummy_hcd
[  729.843848][   T25] usb 4-1: Using ep0 maxpacket: 8
[  729.924242][   T25] usb 4-1: config 7 has an invalid interface number: 122 but max is 1
[  729.941186][   T25] usb 4-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config
[  729.965059][   T25] usb 4-1: config 7 has 1 interface, different from the descriptor's value: 2
[  730.019342][   T25] usb 4-1: config 7 has no interface number 0
[  730.046400][ T5290] usb 3-1: Using ep0 maxpacket: 8
[  730.058013][ T5331] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  730.073761][   T25] usb 4-1: config 7 interface 122 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 10
[  730.103632][ T5331] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 2
[  730.121334][ T5290] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  730.135975][   T25] usb 4-1: config 7 interface 122 has no altsetting 0
[  730.143081][ T5331] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 4
[  730.161737][ T5290] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8D has an invalid bInterval 42, changing to 9
[  730.173960][ T5331] usb 1-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00
[  730.184768][ T5290] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0
[  730.196541][   T25] usb 4-1: New USB device found, idVendor=04e2, idProduct=1400, bcdDevice=65.13
[  730.209019][   T25] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  730.217469][ T5331] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  730.237041][ T5290] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0
[  730.251878][   T25] usb 4-1: Product: syz
[  730.278401][ T5331] hub 1-1:1.0: bad descriptor, ignoring hub
[  730.294347][   T25] usb 4-1: Manufacturer: syz
[  730.299321][ T5290] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[  730.315458][ T5331] hub 1-1:1.0: probe with driver hub failed with error -5
[  730.328396][   T25] usb 4-1: SerialNumber: syz
[  730.338950][ T5331] cdc_wdm 1-1:1.0: skipping garbage
[  730.354437][ T5290] usb 3-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58
[  730.368437][ T5331] cdc_wdm 1-1:1.0: skipping garbage
[  730.402080][ T5331] cdc_wdm 1-1:1.0: probe with driver cdc_wdm failed with error -22
[  730.410306][ T5290] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  730.433846][ T5290] usb 3-1: config 0 descriptor??
[  730.951355][ T5331] usb 3-1: USB disconnect, device number 87
[  731.264046][ T5323] usb 1-1: USB disconnect, device number 124
[  731.533782][ T5241] Bluetooth: hci5: command tx timeout
[  731.980295][T14916] delete_channel: no stack
[  731.985804][   T25] xr_serial 4-1:7.122: skipping garbage
[  732.001137][   T25] xr_serial 4-1:7.122: More than one union descriptor, skipping ...
[  732.083347][   T25] usb 4-1: USB disconnect, device number 97
[  732.437915][ T2963] team_slave_1 (unregistering): left promiscuous mode
[  732.479691][ T2963] team0 (unregistering): Port device team_slave_1 removed
[  732.754147][ T2963] team_slave_0 (unregistering): left promiscuous mode
[  732.782424][ T2963] team0 (unregistering): Port device team_slave_0 removed
[  733.193723][ T5287] usb 3-1: new high-speed USB device number 88 using dummy_hcd
[  733.379043][ T5287] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  733.421001][ T5287] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  733.454808][ T5287] usb 3-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00
[  733.482840][ T5287] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  733.524866][ T5287] usb 3-1: config 0 descriptor??
[  733.995060][ T5287] hid (null): bogus close delimiter
[  734.201132][ T5287] usb 3-1: language id specifier not provided by device, defaulting to English
[  734.612063][ T5287] input: HID 256c:006d Pen as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:256C:006D.0034/input/input39
[  734.853422][ T5287] input: HID 256c:006d Pad as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:256C:006D.0034/input/input40
[  734.897661][   T30] INFO: task syz.1.1505:12974 blocked for more than 143 seconds.
[  734.910856][   T30]       Not tainted 6.11.0-rc3-syzkaller-00007-gd74da846046a #0
[  734.923099][   T30] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[  734.933771][ T5287] input: HID 256c:006d Touch Strip as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:256C:006D.0034/input/input41
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[  735.052082][   T30] task:syz.1.1505      state:D stack:25968 pid:12974 tgid:12973 ppid:10795  flags:0x00024004
[  735.137805][   T30] Call Trace:
[  735.153940][ T5287] input: HID 256c:006d Dial as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:256C:006D.0034/input/input42
[  735.206798][   T30]  <TASK>
[  735.242053][   T30]  __schedule+0x1800/0x4a60
[  735.269242][   T30]  ? __pfx___schedule+0x10/0x10
[  735.284470][   T30]  ? __pfx_lock_release+0x10/0x10
[  735.289781][   T30]  ? schedule+0x90/0x320
[  735.320922][   T30]  schedule+0x14b/0x320
[  735.342256][   T30]  schedule_timeout+0xb0/0x310
[  735.349910][   T30]  ? __pfx_schedule_timeout+0x10/0x10
[  735.356115][   T30]  ? lockdep_hardirqs_on_prepare+0x43d/0x780
[  735.363870][   T30]  ? wait_for_completion+0x2fe/0x620
[  735.369817][   T30]  ? wait_for_completion+0x2fe/0x620
[  735.404790][   T30]  ? _raw_spin_unlock_irq+0x23/0x50
[  735.433829][   T30]  ? lockdep_hardirqs_on+0x99/0x150
[  735.439226][   T30]  ? wait_for_completion+0x2fe/0x620
[  735.457459][ T5287] uclogic 0003:256C:006D.0034: input,hidraw0: USB HID v0.00 Keypad [HID 256c:006d] on usb-dummy_hcd.2-1/input0
[  735.481914][   T30]  wait_for_completion+0x355/0x620
[  735.503627][   T30]  ? __pfx_wait_for_completion+0x10/0x10
[  735.509874][   T30]  ? io_wq_worker_wake+0x90/0xc0
[  735.514983][   T30]  ? io_wq_put_and_exit+0x180/0x720
[  735.520346][   T30]  io_wq_put_and_exit+0x344/0x720
[  735.525727][   T30]  ? io_wq_put_and_exit+0x1b1/0x720
[  735.531102][   T30]  ? __pfx_xa_find_after+0x10/0x10
[  735.537704][   T30]  ? __pfx_io_wq_put_and_exit+0x10/0x10
[  735.543713][   T30]  ? kfree+0x149/0x360
[  735.547853][   T30]  io_uring_clean_tctx+0x168/0x1e0
[  735.553021][   T30]  ? __pfx_io_uring_clean_tctx+0x10/0x10
[  735.573564][   T30]  ? io_uring_drop_tctx_refs+0x114/0x1b0
[  735.579278][   T30]  io_uring_cancel_generic+0x76a/0x820
[  735.585232][   T30]  ? __pfx_io_uring_cancel_generic+0x10/0x10
[  735.593216][   T30]  ? lockdep_hardirqs_on_prepare+0x43d/0x780
[  735.603785][   T30]  ? __pfx_autoremove_wake_function+0x10/0x10
[  735.609957][   T30]  ? _raw_spin_unlock_irq+0x23/0x50
[  735.623890][   T30]  ? lockdep_hardirqs_on+0x99/0x150
[  735.629176][   T30]  do_exit+0x6a8/0x27f0
[  735.634044][   T30]  ? __pfx_do_exit+0x10/0x10
[  735.638661][   T30]  ? __pfx_do_raw_spin_lock+0x10/0x10
[  735.653646][   T30]  ? lockdep_hardirqs_on_prepare+0x43d/0x780
[  735.659812][   T30]  ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[  735.673563][   T30]  ? _raw_spin_lock_irq+0xdf/0x120
[  735.679001][   T30]  do_group_exit+0x207/0x2c0
[  735.684354][   T30]  ? _raw_spin_unlock_irq+0x23/0x50
[  735.704888][   T30]  ? lockdep_hardirqs_on+0x99/0x150
[  735.713808][   T30]  get_signal+0x16a1/0x1740
[  735.733632][   T30]  ? __pfx_get_signal+0x10/0x10
[  735.738545][   T30]  arch_do_signal_or_restart+0x96/0x860
[  735.753579][   T30]  ? __pfx_arch_do_signal_or_restart+0x10/0x10
[  735.759811][   T30]  ? lockdep_hardirqs_on_prepare+0x43d/0x780
[  735.766203][   T30]  ? syscall_exit_to_user_mode+0xa3/0x370
[  735.772072][   T30]  syscall_exit_to_user_mode+0xc9/0x370
[  735.777834][   T30]  do_syscall_64+0x100/0x230
[  735.783949][   T30]  ? clear_bhb_loop+0x35/0x90
[  735.788658][   T30]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  735.797228][   T30] RIP: 0033:0x7fa7dc3799f9
[  735.801697][   T30] RSP: 002b:00007fa7dd0b40e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
[  735.810337][   T30] RAX: fffffffffffffe00 RBX: 00007fa7dc515f88 RCX: 00007fa7dc3799f9
[  735.823810][   T30] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fa7dc515f88
[  735.831850][   T30] RBP: 00007fa7dc515f80 R08: 0000000000000000 R09: 0000000000000000
[  735.840063][   T30] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fa7dc515f8c
[  735.853698][   T30] R13: 0000000000000000 R14: 00007fa7dc63f950 R15: 00007fa7dc63fa38
[  735.861920][   T30]  </TASK>
[  735.865211][   T30] 
[  735.865211][   T30] Showing all locks held in the system:
[  735.873173][   T30] 4 locks held by kworker/0:1/9:
[  735.878916][   T30]  #0: ffff88801dae9948 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830
[  735.896347][   T30]  #1: ffffc900000e7d00 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830
[  735.908568][   T30]  #2: ffff888024053190 (&dev->mutex){....}-{3:3}, at: hub_event+0x1fe/0x5150
[  735.917681][   T30]  #3: ffff888024005518 (&port_dev->status_lock){+.+.}-{3:3}, at: hub_event+0x7d2/0x5150
[  735.933917][   T30] 1 lock held by ksoftirqd/0/16:
[  735.938954][   T30]  #0: ffff8880b923ea18 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0xb0/0x140
[  735.950662][ T5287] usb 3-1: reset high-speed USB device number 88 using dummy_hcd
[  735.951432][   T30] 1 lock held by khungtaskd/30:
[  735.973591][   T30]  #0: ffffffff8e9382e0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x2a0
[  735.984366][   T30] 3 locks held by kworker/u8:3/52:
[  735.993900][   T30]  #0: ffff88802a5cf148 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830
[  736.023640][   T30]  #1: ffffc90000bc7d00 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830
[  736.054028][   T30]  #2: ffffffff8fc82308 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_dad_work+0xd0/0x16f0
[  736.074438][   T30] 3 locks held by kworker/u8:5/81:
[  736.079715][   T30] 4 locks held by kworker/u8:10/2963:
[  736.088330][   T30]  #0: ffff8880166e5948 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830
[  736.110566][   T30]  #1: ffffc900099b7d00 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830
[  736.150755][   T30]  #2: ffffffff8fc75790 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0x16a/0xcc0
[  736.160531][   T30]  #3: ffffffff8fc82308 (rtnl_mutex){+.+.}-{3:3}, at: default_device_exit_batch+0xe9/0xa90
[  736.173843][   T30] 3 locks held by kworker/u8:12/2999:
[  736.179317][   T30]  #0: ffff888015889148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830
[  736.191275][   T30]  #1: ffffc90009667d00 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830
[  736.227267][   T30]  #2: ffffffff8fc82308 (rtnl_mutex){+.+.}-{3:3}, at: linkwatch_event+0xe/0x60
[  736.236725][   T30] 2 locks held by acpid/4671:
[  736.243855][   T30]  #0: ffff88802e361158 (&mousedev->mutex#2){+.+.}-{3:3}, at: mousedev_close_device+0x2e/0xe0
[  736.254724][   T30]  #1: ffff88801f7912c0 (&dev->mutex#2){+.+.}-{3:3}, at: input_close_device+0x4e/0x1d0
[  736.264843][   T30] 1 lock held by dhcpcd/4900:
[  736.274334][   T30]  #0: ffffffff8fc82308 (rtnl_mutex){+.+.}-{3:3}, at: devinet_ioctl+0x2ce/0x1bc0
[  736.284301][   T30] 2 locks held by getty/4990:
[  736.289013][   T30]  #0: ffff88802aebb0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70
[  736.299502][   T30]  #1: ffffc900031332f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x6ac/0x1e00
[  736.320361][   T30] 5 locks held by kworker/0:4/5287:
[  736.326148][   T30]  #0: ffff888015880948 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830
[  736.343757][   T30]  #1: ffffc90004067d00 ((work_completion)(&intf->reset_ws)){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830
[  736.363748][   T30]  #2: ffff8880594ed190 (&dev->mutex){....}-{3:3}, at: usb_lock_device_for_reset+0x128/0x330
[  736.374761][   T30]  #3: ffff888024005518 (&port_dev->status_lock){+.+.}-{3:3}, at: usb_reset_device+0x5c8/0xb60
[  736.394561][   T30]  #4: ffff888023f8cb68 (hcd->address0_mutex){+.+.}-{3:3}, at: usb_reset_and_verify_device+0x319/0x1440
[  736.407545][   T30] 1 lock held by iou-wrk-12974/12978:
[  736.413056][   T30]  #0: ffff88802e6d60a8 (&ctx->uring_lock){+.+.}-{3:3}, at: io_provide_buffers+0xd06/0x1010
[  736.424663][   T30] 1 lock held by iou-wrk-12974/12984:
[  736.430082][   T30]  #0: ffff88802e6d60a8 (&ctx->uring_lock){+.+.}-{3:3}, at: io_provide_buffers+0xd06/0x1010
[  736.440626][   T30] 1 lock held by iou-wrk-12974/12985:
[  736.454093][   T30]  #0: ffff88802e6d60a8 (&ctx->uring_lock){+.+.}-{3:3}, at: io_provide_buffers+0xd06/0x1010
[  736.472258][   T30] 1 lock held by iou-wrk-12974/12986:
[  736.478021][   T30]  #0: ffff88802e6d60a8 (&ctx->uring_lock){+.+.}-{3:3}, at: io_provide_buffers+0xd06/0x1010
[  736.490860][   T30] 1 lock held by iou-wrk-12974/12988:
[  736.523807][   T30]  #0: ffff88802e6d60a8 (&ctx->uring_lock){+.+.}-{3:3}, at: io_provide_buffers+0xd06/0x1010
[  736.534345][   T30] 1 lock held by iou-wrk-12974/12990:
[  736.543870][   T30]  #0: ffff88802e6d60a8 (&ctx->uring_lock){+.+.}-{3:3}, at: io_provide_buffers+0xd06/0x1010
[  736.554220][   T30] 1 lock held by iou-wrk-12974/12991:
[  736.563888][   T30]  #0: ffff88802e6d60a8 (&ctx->uring_lock){+.+.}-{3:3}, at: io_provide_buffers+0xd06/0x1010
[  736.578361][   T30] 1 lock held by iou-wrk-12974/12994:
[  736.584081][   T30] 1 lock held by udevd/13887:
[  736.593785][   T30]  #0: ffffffff8e93d6b8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x451/0x830
[  736.605152][   T30] 1 lock held by syz-executor/14865:
[  736.613038][   T30]  #0: ffffffff8fc82308 (rtnl_mutex){+.+.}-{3:3}, at: __tun_chr_ioctl+0x48f/0x2400
[  736.622668][   T30] 1 lock held by syz.4.1880/14880:
[  736.628057][   T30]  #0: ffffffff8fc82308 (rtnl_mutex){+.+.}-{3:3}, at: tun_chr_close+0x3e/0x1b0
[  736.639052][   T30] 1 lock held by syz.0.1887/14927:
[  736.644542][   T30]  #0: ffffffff8fc82308 (rtnl_mutex){+.+.}-{3:3}, at: dev_ioctl+0x86e/0x1340
[  736.663711][   T30] 1 lock held by syz.0.1887/14929:
[  736.674088][   T30]  #0: ffffffff8fc82308 (rtnl_mutex){+.+.}-{3:3}, at: dev_ioctl+0x86e/0x1340
[  736.686448][   T30] 1 lock held by syz.2.1890/14943:
[  736.691872][   T30]  #0: ffffffff8fc82308 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x6e6/0xcf0
[  736.701882][   T30] 1 lock held by syz.3.1891/14947:
[  736.707394][   T30]  #0: ffffffff8fc82308 (rtnl_mutex){+.+.}-{3:3}, at: __tun_chr_ioctl+0x48f/0x2400
[  736.728347][   T30] 1 lock held by syz.3.1891/14948:
[  736.733988][   T30]  #0: ffffffff8fc82308 (rtnl_mutex){+.+.}-{3:3}, at: devinet_ioctl+0x2ce/0x1bc0
[  736.841665][   T30] 
[  736.856415][   T30] =============================================
[  736.856415][   T30] 
[  736.933647][   T30] NMI backtrace for cpu 0
[  736.938048][   T30] CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Not tainted 6.11.0-rc3-syzkaller-00007-gd74da846046a #0
[  736.948681][   T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
[  736.958865][   T30] Call Trace:
[  736.962179][   T30]  <TASK>
[  736.965157][   T30]  dump_stack_lvl+0x241/0x360
[  736.970257][   T30]  ? __pfx_dump_stack_lvl+0x10/0x10
[  736.975530][   T30]  ? __pfx__printk+0x10/0x10
[  736.980358][   T30]  ? vprintk_emit+0x631/0x770
[  736.985080][   T30]  ? __pfx_vprintk_emit+0x10/0x10
[  736.990158][   T30]  nmi_cpu_backtrace+0x49c/0x4d0
[  736.995253][   T30]  ? __pfx_nmi_cpu_backtrace+0x10/0x10
[  737.001104][   T30]  ? _printk+0xd5/0x120
[  737.005341][   T30]  ? __pfx__printk+0x10/0x10
[  737.010059][   T30]  ? __wake_up_klogd+0xcc/0x110
[  737.014950][   T30]  ? __pfx__printk+0x10/0x10
[  737.019669][   T30]  ? __rcu_read_unlock+0xa1/0x110
[  737.024748][   T30]  ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10
[  737.030786][   T30]  nmi_trigger_cpumask_backtrace+0x198/0x320
[  737.037526][   T30]  watchdog+0xfee/0x1030
[  737.041834][   T30]  ? watchdog+0x1ea/0x1030
[  737.046307][   T30]  ? __pfx_watchdog+0x10/0x10
[  737.051032][   T30]  kthread+0x2f0/0x390
[  737.055150][   T30]  ? __pfx_watchdog+0x10/0x10
[  737.059997][   T30]  ? __pfx_kthread+0x10/0x10
[  737.064715][   T30]  ret_from_fork+0x4b/0x80
[  737.069195][   T30]  ? __pfx_kthread+0x10/0x10
[  737.073931][   T30]  ret_from_fork_asm+0x1a/0x30
[  737.078764][   T30]  </TASK>
[  737.083955][   T30] Sending NMI from CPU 0 to CPUs 1:
[  737.089347][    C1] NMI backtrace for cpu 1
[  737.089362][    C1] CPU: 1 UID: 0 PID: 13587 Comm: syz-executor Not tainted 6.11.0-rc3-syzkaller-00007-gd74da846046a #0
[  737.089385][    C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
[  737.089396][    C1] RIP: 0010:lockdep_hardirqs_on_prepare+0x60e/0x780
[  737.089432][    C1] Code: 8c 94 fa ff ff 48 c7 c7 8c fe 17 90 e8 bb 38 8b 00 48 ba 00 00 00 00 00 fc ff df e9 79 fa ff ff 48 c7 c1 c0 69 f2 94 80 e1 07 <80> c1 03 38 c1 0f 8c b8 fa ff ff 48 c7 c7 c0 69 f2 94 e8 8b 38 8b
[  737.089449][    C1] RSP: 0018:ffffc900095c75c0 EFLAGS: 00000046
[  737.089466][    C1] RAX: 0000000000000004 RBX: ffffffff9513a778 RCX: ffffffff94f26900
[  737.089480][    C1] RDX: dffffc0000000000 RSI: ffffffff8c6063e0 RDI: ffffffff8c6063a0
[  737.089494][    C1] RBP: ffffc900095c7668 R08: ffffffff9017ce2f R09: 1ffffffff202f9c5
[  737.089508][    C1] R10: dffffc0000000000 R11: fffffbfff202f9c6 R12: dffffc0000000000
[  737.089522][    C1] R13: 1ffff920012b8ed0 R14: ffffc900095c76a0 R15: 1ffff920012b8ebc
[  737.089536][    C1] FS:  0000000000000000(0000) GS:ffff8880b9300000(0000) knlGS:0000000000000000
[  737.089553][    C1] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  737.089569][    C1] CR2: 000055889715f058 CR3: 000000005464e000 CR4: 00000000003506f0
[  737.089585][    C1] Call Trace:
[  737.089593][    C1]  <NMI>
[  737.089600][    C1]  ? nmi_cpu_backtrace+0x3c2/0x4d0
[  737.089622][    C1]  ? __pfx_lock_acquire+0x10/0x10
[  737.089649][    C1]  ? __pfx_nmi_cpu_backtrace+0x10/0x10
[  737.089669][    C1]  ? nmi_handle+0x2a/0x5a0
[  737.089700][    C1]  ? nmi_cpu_backtrace_handler+0xc/0x20
[  737.089723][    C1]  ? nmi_handle+0x14f/0x5a0
[  737.089741][    C1]  ? nmi_handle+0x2a/0x5a0
[  737.089759][    C1]  ? lockdep_hardirqs_on_prepare+0x60e/0x780
[  737.089784][    C1]  ? default_do_nmi+0x63/0x160
[  737.089805][    C1]  ? exc_nmi+0x123/0x1f0
[  737.089827][    C1]  ? end_repeat_nmi+0xf/0x53
[  737.089856][    C1]  ? lockdep_hardirqs_on_prepare+0x60e/0x780
[  737.089881][    C1]  ? lockdep_hardirqs_on_prepare+0x60e/0x780
[  737.089908][    C1]  ? lockdep_hardirqs_on_prepare+0x60e/0x780
[  737.089933][    C1]  </NMI>
[  737.089939][    C1]  <TASK>
[  737.089948][    C1]  ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[  737.089979][    C1]  ? rcu_is_watching+0x15/0xb0
[  737.090007][    C1]  trace_hardirqs_on+0x28/0x40
[  737.090030][    C1]  _raw_spin_unlock_irqrestore+0x8f/0x140
[  737.090056][    C1]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  737.090088][    C1]  debug_check_no_obj_freed+0x561/0x580
[  737.090119][    C1]  ? __pfx_debug_check_no_obj_freed+0x10/0x10
[  737.090141][    C1]  ? page_ext_get+0x20/0x2a0
[  737.090174][    C1]  free_unref_page+0x38a/0xea0
[  737.090205][    C1]  vfree+0x186/0x2e0
[  737.090235][    C1]  kcov_close+0x2b/0x50
[  737.090260][    C1]  ? __pfx_kcov_close+0x10/0x10
[  737.090290][    C1]  __fput+0x24a/0x8a0
[  737.090317][    C1]  task_work_run+0x24f/0x310
[  737.090340][    C1]  ? __pfx_task_work_run+0x10/0x10
[  737.090361][    C1]  ? do_exit+0xa2a/0x27f0
[  737.090379][    C1]  ? kmem_cache_free+0x145/0x350
[  737.090402][    C1]  do_exit+0xa2f/0x27f0
[  737.090423][    C1]  ? __pfx_do_exit+0x10/0x10
[  737.090440][    C1]  ? __pfx_do_raw_spin_lock+0x10/0x10
[  737.090464][    C1]  ? lockdep_hardirqs_on_prepare+0x43d/0x780
[  737.090491][    C1]  ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[  737.090519][    C1]  ? _raw_spin_lock_irq+0xdf/0x120
[  737.090546][    C1]  do_group_exit+0x207/0x2c0
[  737.090562][    C1]  ? _raw_spin_unlock_irq+0x23/0x50
[  737.090585][    C1]  ? lockdep_hardirqs_on+0x99/0x150
[  737.090612][    C1]  get_signal+0x16a1/0x1740
[  737.090644][    C1]  ? __pfx_get_signal+0x10/0x10
[  737.090671][    C1]  arch_do_signal_or_restart+0x96/0x860
[  737.090698][    C1]  ? __pfx_arch_do_signal_or_restart+0x10/0x10
[  737.090722][    C1]  ? lockdep_hardirqs_on_prepare+0x43d/0x780
[  737.090755][    C1]  ? syscall_exit_to_user_mode+0xa3/0x370
[  737.090787][    C1]  syscall_exit_to_user_mode+0xc9/0x370
[  737.090816][    C1]  do_syscall_64+0x100/0x230
[  737.090843][    C1]  ? clear_bhb_loop+0x35/0x90
[  737.090865][    C1]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  737.090884][    C1] RIP: 0033:0x7f742a96fc57
[  737.090899][    C1] Code: Unable to access opcode bytes at 0x7f742a96fc2d.
[  737.090910][    C1] RSP: 002b:00007f742ac3fd90 EFLAGS: 00000293 ORIG_RAX: 000000000000003d
[  737.090930][    C1] RAX: fffffffffffffe00 RBX: 00000000000000aa RCX: 00007f742a96fc57
[  737.090944][    C1] RDX: 0000000040000000 RSI: 00007f742ac3fdec RDI: 00000000ffffffff
[  737.090957][    C1] RBP: 00007f742ac3fdec R08: 0000000000000000 R09: 7fffffffffffffff
[  737.090970][    C1] R10: 0000000000000000 R11: 0000000000000293 R12: 00005555940e45eb
[  737.090982][    C1] R13: 00005555940e4590 R14: 00000000000b1133 R15: 00007f742ac3fe40
[  737.091004][    C1]  </TASK>
[  737.775623][   T30] Kernel panic - not syncing: hung_task: blocked tasks
[  737.783158][   T30] CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Not tainted 6.11.0-rc3-syzkaller-00007-gd74da846046a #0
[  737.793699][   T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
[  737.803890][   T30] Call Trace:
[  737.807216][   T30]  <TASK>
[  737.810174][   T30]  dump_stack_lvl+0x241/0x360
[  737.815363][   T30]  ? __pfx_dump_stack_lvl+0x10/0x10
[  737.820708][   T30]  ? __pfx__printk+0x10/0x10
[  737.825389][   T30]  ? vscnprintf+0x5d/0x90
[  737.829767][   T30]  panic+0x349/0x860
[  737.833712][   T30]  ? nmi_trigger_cpumask_backtrace+0x244/0x320
[  737.840093][   T30]  ? __pfx_panic+0x10/0x10
[  737.844561][   T30]  ? tick_nohz_tick_stopped+0x82/0xb0
[  737.849971][   T30]  ? __irq_work_queue_local+0x137/0x410
[  737.855567][   T30]  ? preempt_schedule_thunk+0x1a/0x30
[  737.860978][   T30]  ? nmi_trigger_cpumask_backtrace+0x244/0x320
[  737.867214][   T30]  ? nmi_trigger_cpumask_backtrace+0x2d4/0x320
[  737.873407][   T30]  ? nmi_trigger_cpumask_backtrace+0x2d9/0x320
[  737.879614][   T30]  watchdog+0x102d/0x1030
[  737.883993][   T30]  ? watchdog+0x1ea/0x1030
[  737.888455][   T30]  ? __pfx_watchdog+0x10/0x10
[  737.893167][   T30]  kthread+0x2f0/0x390
[  737.897370][   T30]  ? __pfx_watchdog+0x10/0x10
[  737.902126][   T30]  ? __pfx_kthread+0x10/0x10
[  737.906853][   T30]  ret_from_fork+0x4b/0x80
[  737.911451][   T30]  ? __pfx_kthread+0x10/0x10
[  737.916088][   T30]  ret_from_fork_asm+0x1a/0x30
[  737.920915][   T30]  </TASK>
[  737.924730][   T30] Kernel Offset: disabled
[  737.929150][   T30] Rebooting in 86400 seconds..