last executing test programs: 27m33.022161651s ago: executing program 4 (id=156): syz_usb_connect(0x0, 0x2d, 0x0, 0x0) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x33}}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000000)=0x4, 0x4) connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @broadcast}, 0x10) sched_setscheduler(0x0, 0x1, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) creat(0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000140), 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, 0x0, 0x0) gettid() sendmmsg$inet(r0, &(0x7f0000004d00)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x30000}}], 0x300, 0xf00) r2 = socket(0xa, 0x3, 0xff) setsockopt$inet6_int(r2, 0x29, 0x21, &(0x7f0000000080)=0x8, 0x4) sendmsg$inet6(r2, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000001680)=[{&(0x7f00000002c0)}], 0x1}, 0x80090) r3 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) 27m29.962314806s ago: executing program 4 (id=161): socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000240)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r3, &(0x7f0000000240)={0xa, 0x4e21, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f00000000c0), 0x4) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_TLS_TX(r4, 0x11a, 0x1, &(0x7f0000000140)=@ccm_128={{0x304}, "430efb8ac8c740fb", "794bd25be6af5053777fd6bc7f488e28", "07bc5b3c", "12b946089a64e28a"}, 0x28) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) r5 = socket(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000300)={'vxcan1\x00'}) setsockopt$CAN_RAW_FILTER(0xffffffffffffffff, 0x65, 0x1, &(0x7f00000000c0), 0xf00) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, &(0x7f0000000180)={'vxcan1\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)=@getchain={0x24, 0x11, 0x839, 0x70bd25, 0x0, {0x0, 0x0, 0x0, r8, {0x7, 0x6}, {0xffff}, {0x1}}}, 0x24}}, 0x0) 27m25.652135563s ago: executing program 4 (id=168): r0 = openat$mixer(0xffffffffffffff9c, &(0x7f00000016c0), 0x121040, 0x0) openat$adsp1(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) ioctl$sock_inet_udp_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r4, &(0x7f0000000300)=ANY=[@ANYBLOB="1500000065ffff017f000e0800395032303030"], 0x15) r5 = dup(r4) open(&(0x7f0000000180)='./file0\x00', 0x440, 0xc2) write$FUSE_BMAP(r5, &(0x7f0000000000)={0x18, 0x0, 0x0, {0x3b9}}, 0x18) write$FUSE_DIRENTPLUS(r5, &(0x7f00000003c0)=ANY=[@ANYBLOB="b0"], 0xb0) write$FUSE_GETXATTR(r5, &(0x7f00000000c0)={0x18}, 0x18) write$FUSE_DIRENTPLUS(r5, &(0x7f00000005c0)=ANY=[@ANYBLOB="b9"], 0xb8) mount$9p_fd(0x0, &(0x7f0000000400)='./file0\x00', &(0x7f0000000080), 0x1010412, &(0x7f0000000780)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r3, @ANYBLOB=',wfdno=', @ANYRESHEX=r5]) r6 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x22) writev(r6, &(0x7f0000000000)=[{0x0}], 0x1) ioctl$SOUND_MIXER_READ_VOLUME(r0, 0x40086603, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000001c00)={0x60, 0x24, 0x1, 0x70bd26, 0x25dfdbfe, "", [@nested={0x4f, 0x0, 0x0, 0x1, [@typed={0xc, 0x1, 0x0, 0x0, @u64=0x2}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b3"]}]}, 0x60}], 0x1}, 0x0) 27m21.659306693s ago: executing program 4 (id=173): openat(0xffffffffffffff9c, &(0x7f0000000340)='./file0\x00', 0x2d41, 0xd5) setsockopt$inet6_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040)=0x2, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x2000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e020000000000000000000000000000040400000000"], 0x0, 0x37}, 0x28) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0900000004000000040000000a00000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=r3, @ANYBLOB="020000000100"/27], 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000040)={r4, 0x0, 0x0}, 0x10) 27m19.741967967s ago: executing program 4 (id=174): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x8040) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) syz_open_dev$dri(0x0, 0xd21, 0x4000) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0) r3 = epoll_create(0x3) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000000080)={0x40000002}) write$P9_RSTATu(r2, &(0x7f0000000580)=ANY=[@ANYBLOB="1e0200000400000005a80000000000000000000000008000000000000000000081030000000000000000000000000003e8001b00046e6f6465767b65766f6f7e0539c60005000037d93a8b92000000b0ff70673effeb09b5351f5bde05"], 0x21e) syz_open_dev$vbi(0x0, 0x0, 0x2) socket$nl_route(0x10, 0x3, 0x0) socket$inet_udp(0x2, 0x2, 0x0) openat$sequencer(0xffffff9c, &(0x7f0000001bc0), 0x88302, 0x0) ioctl$BLKTRACESTART(0xffffffffffffffff, 0x1274, 0x0) gettid() r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) r5 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) sendfile(r5, r4, &(0x7f0000002080)=0x64, 0x21c) 27m14.997042624s ago: executing program 4 (id=181): socket$vsock_stream(0x28, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) r2 = syz_open_dev$ptys(0xc, 0x3, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x41, 0x0) write$binfmt_aout(r3, &(0x7f00000001c0)=ANY=[], 0xff2e) ioctl$TCSETS(r3, 0x40045431, 0x0) syz_open_pts(r2, 0x38040) openat$sysfs(0xffffff9c, 0x0, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x94) r4 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r4, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(0xffffffffffffffff, 0x84, 0x8, &(0x7f0000000080)=0x5, 0x4) r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x7}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r5, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) recvmmsg(r4, &(0x7f00000057c0)=[{{0x0, 0x0, 0x0}, 0x3}, {{0x0, 0x0, &(0x7f0000002cc0)=[{0x0}, {&(0x7f00000017c0)=""/130, 0x94}], 0x2}, 0xa1}], 0x2, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) 26m39.370803776s ago: executing program 32 (id=180): r0 = syz_usb_connect(0x2, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000080)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f00000001c0)={0x1c, 0x0, 0x0, 0x0}) 26m39.12496598s ago: executing program 33 (id=178): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x8040) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) syz_open_dev$dri(0x0, 0xd21, 0x4000) syz_open_dev$usbmon(0x0, 0x0, 0x0) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r2, &(0x7f0000000080)={0x40000002}) write$P9_RSTATu(r2, &(0x7f0000000580)=ANY=[@ANYBLOB="1e0200000400000005a80000000000000000000000008000000000000000000081030000000000000000000000000003e8001b00046e6f6465767b65766f6f7e0539c60005000037d93a8b92000000b0ff70673effeb09b5351f5bde05"], 0x21e) syz_open_dev$vbi(0x0, 0x0, 0x2) socket$nl_route(0x10, 0x3, 0x0) socket$inet_udp(0x2, 0x2, 0x0) openat$sequencer(0xffffff9c, &(0x7f0000001bc0), 0x88302, 0x0) ioctl$BLKTRACESTART(0xffffffffffffffff, 0x1274, 0x0) gettid() r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) r4 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) sendfile(r4, r3, &(0x7f0000002080)=0x64, 0x21c) 26m38.936884804s ago: executing program 34 (id=186): bpf$MAP_CREATE(0x0, 0x0, 0x48) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) prlimit64(0x0, 0xe, 0x0, 0x0) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000480), 0x400034f, 0x2, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x7, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000000040000850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x1, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00', r3}, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={0x20, r5, 0x9c3fa077fa966179, 0xfffffffd, 0x0, {{0x7e}, {@void, @val={0xc, 0x99, {0x916d, 0x17}}}}}, 0x20}, 0x1, 0x3d04}, 0x4000054) 26m38.716123439s ago: executing program 35 (id=185): openat(0xffffffffffffff9c, &(0x7f0000000340)='./file0\x00', 0x2d41, 0xd5) setsockopt$inet6_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040)=0x2, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x2000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e020000000000000000000000000000040400000000"], 0x0, 0x37}, 0x28) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0900000004000000040000000a00000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=r3, @ANYBLOB="020000000100"/27], 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000040)={r4, 0x0, 0x0}, 0x10) 26m38.360955836s ago: executing program 36 (id=181): socket$vsock_stream(0x28, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) r2 = syz_open_dev$ptys(0xc, 0x3, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x41, 0x0) write$binfmt_aout(r3, &(0x7f00000001c0)=ANY=[], 0xff2e) ioctl$TCSETS(r3, 0x40045431, 0x0) syz_open_pts(r2, 0x38040) openat$sysfs(0xffffff9c, 0x0, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x94) r4 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r4, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(0xffffffffffffffff, 0x84, 0x8, &(0x7f0000000080)=0x5, 0x4) r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x7}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r5, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) recvmmsg(r4, &(0x7f00000057c0)=[{{0x0, 0x0, 0x0}, 0x3}, {{0x0, 0x0, &(0x7f0000002cc0)=[{0x0}, {&(0x7f00000017c0)=""/130, 0x94}], 0x2}, 0xa1}], 0x2, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) 11m47.838063766s ago: executing program 5 (id=621): socket$vsock_stream(0x28, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) r2 = syz_open_dev$ptys(0xc, 0x3, 0x0) ioctl$KDGKBMODE(r2, 0x4b44, &(0x7f0000000200)) r3 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x41, 0x0) write$binfmt_aout(r3, &(0x7f00000001c0)=ANY=[], 0xff2e) ioctl$TCSETS(r3, 0x40045431, 0x0) syz_open_pts(r2, 0x38040) openat$sysfs(0xffffff9c, 0x0, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x94) r4 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r4, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(0xffffffffffffffff, 0x84, 0x8, &(0x7f0000000080)=0x5, 0x4) r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x7}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r5, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) recvmmsg(r4, &(0x7f00000057c0)=[{{0x0, 0x0, 0x0}, 0x3}, {{0x0, 0x0, &(0x7f0000002cc0)=[{0x0}, {&(0x7f00000017c0)=""/130, 0x94}], 0x2}, 0xa1}], 0x2, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) 11m44.973419675s ago: executing program 5 (id=623): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x68c81, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r3, 0x0, 0x0, 0x0) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x800, 0x0) mount$overlay(0x0, &(0x7f0000001340)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) open$dir(&(0x7f0000000000)='./file0\x00', 0xcaaa256489cf7c0d, 0x10) getsockopt$bt_hci(r3, 0x84, 0x7d, &(0x7f0000000840)=""/4127, &(0x7f0000000000)=0x101f) r4 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x1) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r7 = dup(r6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r7, 0x2000) r8 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r8, &(0x7f0000002540)={0x0, 0x0, &(0x7f0000002500)={0x0}}, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$KVM_PRE_FAULT_MEMORY(r5, 0xc040aed5, &(0x7f00000000c0)={0xf000, 0x118000}) 11m39.259007265s ago: executing program 5 (id=626): bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuacct.usage_percpu_user\x00', 0x26e1, 0x0) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x4000) close(r0) rseq(&(0x7f00000006c0)={0x0, 0x0, 0x0, 0x3}, 0x20, 0x0, 0x0) syz_open_dev$dri(0x0, 0x1, 0x0) syz_usb_connect(0x0, 0x24, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) futex(&(0x7f0000000000)=0x2, 0xb, 0x2, 0x0, &(0x7f00000000c0)=0x2, 0x2) futex(&(0x7f000000cffc), 0x5, 0x4, 0x0, 0x0, 0x4ffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280), 0x80a02, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) socket$kcm(0x29, 0x5, 0x0) syz_io_uring_setup(0x81f, 0x0, &(0x7f00000002c0), 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x4e681, 0x0) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000180), 0x106, 0x2}}, 0x20) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x20000000004, 0xfffffffffffffffd, 0x0, 0x0, 0x1000001000, 0x49}, 0x0, &(0x7f00000002c0)={0x3ff, 0x8, 0xffffffffffffffff, 0x9, 0x1000000000003, 0xf, 0x80000006}, 0x0, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) 11m32.964196739s ago: executing program 5 (id=627): socket$nl_generic(0x10, 0x3, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) getrlimit(0xc, &(0x7f0000000300)) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f0000000000), 0x0, &(0x7f00000004c0), 0x8002, &(0x7f0000000700)=ANY=[@ANYBLOB="56c78e3c733d76697274676f2c6e6f65bc33dbde548d51f5638173733d616e792c63616368653d66736361636865"]) chdir(&(0x7f0000000300)='./file0\x00') rename(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='./file1\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x54) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000340), 0x0, &(0x7f0000000180)={[{@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f0000000140)='./bus\x00') pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff}, 0x0) splice(r4, 0x0, 0xffffffffffffffff, 0x0, 0x10000000000016, 0x0) open(&(0x7f0000000300)='./bus\x00', 0x14103e, 0x18a) 11m30.026138559s ago: executing program 5 (id=630): socket$nl_route(0x10, 0x3, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) connect$l2tp6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty, 0xa, 0x4}, 0x20) openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) sendmsg$IPVS_CMD_NEW_DAEMON(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) io_uring_setup(0x5ef9, 0x0) socket$inet6(0x10, 0x3, 0x4) socketpair$unix(0x1, 0x5, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}]}) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@xino_auto}, {@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) mkdir(&(0x7f0000000040)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) chdir(&(0x7f00000003c0)='./bus\x00') openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000180)='pagemap\x00') pread64(r0, &(0x7f0000001240)=""/102400, 0x200000, 0x200000) 11m28.419903615s ago: executing program 5 (id=633): openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) msgsnd(0x0, &(0x7f0000000b40)=ANY=[], 0xfffffece, 0x0) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000300)={0x57, 0x0, 0x8, {0x0, 0x1}, {0x74, 0x2}, @rumble={0x1, 0x8}}) r2 = syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x822b01) ioctl$EVIOCSMASK(r2, 0x40104593, &(0x7f0000000000)={0x1, 0x0, 0x0}) write$char_usb(r2, &(0x7f0000000040)="e2", 0xff0f) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f0000530000/0x3000)=nil) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='devtmpfs\x00', 0x800, 0x0) r3 = syz_open_pts(0xffffffffffffffff, 0x80) dup3(r3, 0xffffffffffffffff, 0x80000) mount$overlay(0x0, &(0x7f0000001340)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r4 = openat2$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080), 0x18) getdents64(r4, &(0x7f0000000300)=""/152, 0x98) 11m12.612478427s ago: executing program 37 (id=633): openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) msgsnd(0x0, &(0x7f0000000b40)=ANY=[], 0xfffffece, 0x0) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000300)={0x57, 0x0, 0x8, {0x0, 0x1}, {0x74, 0x2}, @rumble={0x1, 0x8}}) r2 = syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x822b01) ioctl$EVIOCSMASK(r2, 0x40104593, &(0x7f0000000000)={0x1, 0x0, 0x0}) write$char_usb(r2, &(0x7f0000000040)="e2", 0xff0f) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f0000530000/0x3000)=nil) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='devtmpfs\x00', 0x800, 0x0) r3 = syz_open_pts(0xffffffffffffffff, 0x80) dup3(r3, 0xffffffffffffffff, 0x80000) mount$overlay(0x0, &(0x7f0000001340)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r4 = openat2$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080), 0x18) getdents64(r4, &(0x7f0000000300)=""/152, 0x98) 8m12.733041195s ago: executing program 9 (id=776): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$kcm(0x2, 0x200000000000001, 0x0) syz_open_dev$media(0x0, 0x0, 0x101580) sendmsg$inet(r0, &(0x7f0000000080)={&(0x7f0000000340)={0x2, 0x4001, @dev={0xac, 0x14, 0x14, 0xb}}, 0x10, 0x0}, 0x3000c085) prctl$PR_SET_MM(0x23, 0x5, &(0x7f0000006000/0x4000)=nil) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000380)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$inet(r0, &(0x7f0000000040)={0x0, 0xeafbff3, &(0x7f0000000000)=[{&(0x7f0000000300)="b8", 0xfffffdef}], 0x1, 0x0, 0x0, 0x10000000}, 0x52cc) 8m11.601512788s ago: executing program 9 (id=777): syz_usb_connect(0x0, 0x2d, 0x0, 0x0) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x33}}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000000)=0x4, 0x4) connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @broadcast}, 0x10) sched_setscheduler(0x0, 0x1, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) creat(0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, 0x0, 0x0) gettid() sendmmsg$inet(r0, &(0x7f0000004d00)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x30000}}], 0x300, 0xf00) r2 = socket(0xa, 0x3, 0xff) setsockopt$inet6_int(r2, 0x29, 0x21, &(0x7f0000000080)=0x8, 0x4) sendmsg$inet6(r2, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000001680)=[{&(0x7f00000002c0)="5665702f5e5648f3dab42167388ebf5ed679d647b515d24e4890314545f8", 0x1e}], 0x1}, 0x80090) r3 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) 8m6.036206066s ago: executing program 9 (id=788): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$kcm(0x2, 0x200000000000001, 0x0) syz_open_dev$media(0x0, 0x0, 0x101580) sendmsg$inet(r0, &(0x7f0000000080)={&(0x7f0000000340)={0x2, 0x4001, @dev={0xac, 0x14, 0x14, 0xb}}, 0x10, 0x0}, 0x3000c085) prctl$PR_SET_MM(0x23, 0x5, &(0x7f0000006000/0x4000)=nil) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000380)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$inet(r0, &(0x7f0000000040)={0x0, 0xeafbff3, &(0x7f0000000000)=[{&(0x7f0000000300)="b8", 0xfffffdef}], 0x1, 0x0, 0x0, 0x10000000}, 0x52cc) 8m4.677167026s ago: executing program 9 (id=789): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000c80)={'lo\x00'}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) io_setup(0x5, &(0x7f0000000000)) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) ioctl$TIOCSSOFTCAR(r0, 0x5453, 0x0) ioctl$TIOCMGET(r0, 0x5415, 0x0) 8m1.145166577s ago: executing program 9 (id=794): r0 = syz_usb_connect(0x0, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f00000004c0)={0x1c, &(0x7f0000000540)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000380)={0x24, &(0x7f0000000680)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000440)={0x44, &(0x7f0000000080)={0x60, 0x5, 0x1, '#'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 7m56.399941204s ago: executing program 9 (id=797): openat$mixer(0xffffffffffffff9c, &(0x7f00000016c0), 0x121040, 0x0) openat$adsp1(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_io_uring_setup(0x83, &(0x7f0000000580)={0x0, 0xe7b5, 0x13500, 0x0, 0x352}, 0x0, 0x0) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r3, &(0x7f0000000300)=ANY=[@ANYBLOB="1500000065ffff017f000e0800395032303030"], 0x15) r4 = dup(r3) open(&(0x7f0000000180)='./file0\x00', 0x440, 0xc2) write$FUSE_BMAP(r4, &(0x7f0000000000)={0x18, 0x0, 0x0, {0x3b9}}, 0x18) write$FUSE_DIRENTPLUS(r4, &(0x7f00000003c0)=ANY=[@ANYBLOB="b0"], 0xb0) write$FUSE_GETXATTR(r4, &(0x7f00000000c0)={0x18}, 0x18) write$FUSE_DIRENTPLUS(r4, &(0x7f00000005c0)=ANY=[@ANYBLOB="b9"], 0xb8) mount$9p_fd(0x0, &(0x7f0000000400)='./file0\x00', &(0x7f0000000080), 0x1010412, &(0x7f0000000780)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r2, @ANYBLOB=',wfdno=', @ANYRESHEX=r4]) r5 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x22) writev(r5, &(0x7f0000000000)=[{&(0x7f00000006c0)='\t', 0x2003f}], 0x1) 7m41.11332806s ago: executing program 38 (id=797): openat$mixer(0xffffffffffffff9c, &(0x7f00000016c0), 0x121040, 0x0) openat$adsp1(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_io_uring_setup(0x83, &(0x7f0000000580)={0x0, 0xe7b5, 0x13500, 0x0, 0x352}, 0x0, 0x0) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r3, &(0x7f0000000300)=ANY=[@ANYBLOB="1500000065ffff017f000e0800395032303030"], 0x15) r4 = dup(r3) open(&(0x7f0000000180)='./file0\x00', 0x440, 0xc2) write$FUSE_BMAP(r4, &(0x7f0000000000)={0x18, 0x0, 0x0, {0x3b9}}, 0x18) write$FUSE_DIRENTPLUS(r4, &(0x7f00000003c0)=ANY=[@ANYBLOB="b0"], 0xb0) write$FUSE_GETXATTR(r4, &(0x7f00000000c0)={0x18}, 0x18) write$FUSE_DIRENTPLUS(r4, &(0x7f00000005c0)=ANY=[@ANYBLOB="b9"], 0xb8) mount$9p_fd(0x0, &(0x7f0000000400)='./file0\x00', &(0x7f0000000080), 0x1010412, &(0x7f0000000780)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r2, @ANYBLOB=',wfdno=', @ANYRESHEX=r4]) r5 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x22) writev(r5, &(0x7f0000000000)=[{&(0x7f00000006c0)='\t', 0x2003f}], 0x1) 5m27.968059794s ago: executing program 6 (id=962): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000000000066000000004b64ffec850000006d000000c50000000500000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000580)=ANY=[], 0xfffffeb7) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000380)=0x5) r1 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x0, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) futex(0x0, 0xc, 0x1, 0x0, 0x0, 0x0) r4 = socket$kcm(0x2d, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r4, 0x89e2, &(0x7f0000000340)={r4}) syz_open_dev$dri(&(0x7f0000000a40), 0x1, 0x0) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r5, 0xffffffffffffffff, 0x0) 5m26.721650642s ago: executing program 6 (id=965): r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) r1 = fanotify_init(0x18, 0x0) fanotify_mark(r1, 0x105, 0x4800003a, r0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) open(&(0x7f0000000080)='./file0\x00', 0x80ff, 0x7) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x801, 0x0) ioctl$UI_DEV_SETUP(r2, 0x405c5503, &(0x7f0000000380)={{0x4000, 0x6, 0x4b, 0x9}, 'syz1\x00', 0x11}) ioctl$UI_DEV_SETUP(r2, 0x5501, 0x0) r3 = syz_io_uring_setup(0x234, &(0x7f0000000580)={0x0, 0x0, 0x10100}, &(0x7f0000000000)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r4, r5, &(0x7f00000009c0)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0xffffffffffffff31}) io_uring_enter(r3, 0x207a98, 0x0, 0x0, 0x0, 0x0) rmdir(&(0x7f0000000240)='./file0\x00') 5m23.250792989s ago: executing program 6 (id=969): setsockopt$inet6_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040)=0x2, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x2000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="07000000040000000802000074"], 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x11, 0x8, &(0x7f0000000740)=ANY=[@ANYBLOB, @ANYRES32=r3, @ANYBLOB], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000080)='sched_switch\x00', r4}, 0x18) r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000404000000002e"], 0x0, 0x37}, 0x20) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0900000004000000040000000a00000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=r5, @ANYBLOB="020000000100"/27], 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000040)={r6, 0x0, 0x0}, 0x10) 5m21.771402779s ago: executing program 6 (id=973): semget$private(0x0, 0x1, 0x82) prlimit64(0x0, 0xe, &(0x7f0000000340)={0xd, 0x200200090}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = syz_io_uring_setup(0x2515, &(0x7f0000000280)={0x0, 0x100002, 0x10100}, &(0x7f0000000000), &(0x7f0000000140)) unshare(0x22020600) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, &(0x7f0000000080)=r0, 0x1) r1 = getpid() sched_setscheduler(r1, 0x3, &(0x7f0000000040)=0x7) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) write(r2, &(0x7f0000000340)="07000000010000", 0x7) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) dup3(r3, r2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f00000000c0)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$lock(r6, 0x6, &(0x7f0000002000)={0x1, 0x0, 0x200, 0x2}) fcntl$lock(r6, 0x6, &(0x7f00000031c0)={0x1, 0x0, 0x0, 0x5}) fcntl$lock(r6, 0x7, &(0x7f0000000300)={0x1, 0x0, 0x10000000000000, 0x3}) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r7 = socket$inet_tcp(0x2, 0x1, 0x0) write$binfmt_register(0xffffffffffffffff, &(0x7f0000000500)={0x3a, 'syz3', 0x3a, 'E', 0x3a, 0x6, 0x3a, '@', 0x3a, '\\\x9e\xbd\x1d\r6\xea\x12+(\x03z', 0x3a, './file0'}, 0x34) r8 = epoll_create1(0x80000) r9 = fcntl$dupfd(r2, 0x0, r8) epoll_ctl$EPOLL_CTL_ADD(r8, 0x1, r9, &(0x7f0000000000)) epoll_ctl$EPOLL_CTL_ADD(r8, 0x1, r7, &(0x7f00000001c0)={0x10000014}) getpid() 5m20.742295364s ago: executing program 6 (id=974): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mkdir(&(0x7f0000000200)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000140)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') r3 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) r4 = open(&(0x7f00000000c0)='.\x00', 0x101800, 0x40) symlinkat(&(0x7f00000000c0)='./file1\x00', r4, &(0x7f0000000100)='./file0\x00') ioctl$AUTOFS_IOC_PROTOSUBVER(r3, 0xc0049364, 0x0) 5m19.695679092s ago: executing program 6 (id=976): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000004b40)={0x1, &(0x7f0000000000)=[{0x7, 0x0, 0x0, 0xfffffffb}]}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c0008001800"], 0x1c}, 0x1, 0x0, 0x0, 0x20040040}, 0x6080) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000000)={0x0, &(0x7f0000000300)}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x6) io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) syz_clone(0x40280000, &(0x7f0000000140)="55f89807fd56b876778bfb46d855de50df8dea2a044342af32181611f860e5ab7664ea3c0c501e94b7da601efe689952fcd86a22fccc7942a5f999c9dad411d0af55e0bc251a65f50e3c6d579a67576155eb738fd35b0a7aa5aef885c1a05d81ec0ee7723f5eff97fbcae3639c7e893573d2a40797a1719e6929b6f17feef75ab487c613efe59cf16d16bc3f7a75d46338348d0fa6099c894d017e8e91bc84245acbf253e6c1a47f6c28b5376d3bce08f1047ab0b4217e527c79c7fd57c0296742edb0f80c36bd183eb757d203f81434c8529c2e0c0abdda2ade274799ead53794f9856efb2b2b6cb12fbd37063dced6e12fca8d5ac1997e16a11f3e7ca20c4691c94ca61128a6f70c6410a1b6b3cb8c9dbf0e6393e43c3ea2757aff16e4c7030fbfa205ef745633df848d3e2f698f2c2ff8a7c2b6a96a36a360441e90c18b244f24e86d229f4402a18802a422f9b45d21c1de8c068f4ecdce3026cea666b909203f3c7399b6101f5777d5fa6fc98ba68ef2c3466f8c9f940267dd86a5c13070f35b5248065969169908cee6790e816450c6ca705a7beebdae2794174cce6e8aa1cb061e41c41c9c4a78b7d1eb928b0989c6c2eb3d4ef181837aef8b2da22ab2342d2da5ef750b5e49a8b2f44edfde84944a41cd117e457c55706a79335e91926b73eba60e137663785771bfb8d142f9ca1b1dc6b693ae2d3b68ddac28578c2751d8fa21b19837a74b25e61df88ac6aa6e2ac9adac0c0b4a92315f54cf1fbe9e3faba6531e01715e7f9f818563638776092d60ee01b01065befdd6fa6b291f4f18c96820cdb2416bdf804ee0ac5918c4046029745752bd568538c03bd84d300a55bac8dbe3bf06c558c977fe2485b798960b6a41b6db6543386e88cd5b5575010b782fcf978e21576f6385dcee3e132c495e7e4e14809b0f1033d1a9ba8ade31ba3082f08bc071fcf91b7e2e7fa430c375145ada7a4c3ec14a43fd787148137817703802493ce5ec4c67dd8b0ab6d89e84d934c44760137488009932e34539930b5b5d31b3ae70b29312b0e5ef07c2c9c6f98392afaa9cc364f6e5027b3cf59cc5bd6e04875b131a56f19f4ae8f65f7d2ccb89ae432feab42013223edd21f208971f22d5e46a254a02ea04624de35387f1dbdab35ddbdc9c3da7e61a6f389a1c708f9b5b192c1dc2957b34dd383900017fe256c3e16730580dfebecb83b8a0a98d51063b9cfe4acaba96d977eea3d9cdca641d5cc01ffea83ad3c88ee3eb88c65839115ab60d0f44c7c6acb837ea81a4f9b23be57802c4c5b7b481169d7963635131cca1ed59823d9813d7f4a36fe700f399bd897fd98d3f2d1fea259538ad5003b288f3908a6c9639203d6d42fcefa16adab7a88ee9d1e85429ed834c3a26ccfad6213b1eb177ad7d56e6134165aa8a5ad6cbb8ada26b1ed9272afcb35d916395cd17c556cc47e73c1bc8d09407457f6388a8ab5279dc9795457cccec13a994ab597178234e8e345cd308701dbca68753d9ed335429e67bba6d6437c1df76befbdd82e8c6d43f54f3ae679eebb23265378d5552efc75a582b72285c34c46151da7904085b180e7c7df41cb75549630ed356feb248a849ddfb1aeba996ad42197971b73b5d327e7e47bc582bf16b6291f4b827120ac772cd429dc017e2563a996e62d20997ba6ea34506942e6fb63e67c37aa624f4abaf0876584eb041d37a3dbbbc74a148859ee608a51e0eaa4cd1445c6ef43fcff6cda405c1ee98c2b7fefb1a9aaa4f36b040414bda06dcc16067702b782535bbb9c087e04f00a19d209664bbdcc657781e9f653a5856a9a0e3210778f0a79111958e912a3a943919a87f5df09c8af2e8386628fe73d18783c5b12d6ddf1eb8d937c31634f605ebb65750b2e2b00aa1e2c4db7a8e6b52533e84a93db77e6f32936298a34ad9b1e2dbe14ff822a692ddad03e2b049cabd115394418d1d6427473846cd2e909f33fad94752fa2df62be21c6df24cc7007d388cea3533f45424141739cebb252dd6c8638c87d2209014403f278a0849767bf851e258b97cc525b470c8127ca204d117e71060cbb9c9b543233e766a9e4fd03d541ba145a1d81835c1462ed9bad03302fa3313297d6dc8aa4cde3b956ab17a2583445bf7ad567f2351fb76f8f5cdf0a45624c3b8a2f81a138e3ef7599bb843a31185218afd79654630065dcc84257debe24e3425b900e4381c7d2cc7b267a8d636094aea38a84419dbba20ba52ecf61ec1a991ab048e1b3c6950e4416d1b0a475060e1ab88ae69b7434de3b5a2b86805b1d0e83e0acf43c6feda4ad4bf13aa46ea2160b380ca51e5568a9a77f6c697aa24fc28ece78edc4b96c77a2902991050b780cea6d41b2a800b03e9adb92b373f1703a93010773ceae9578dc26a8dccc27b96f1bf6076e304089980b57b72d3afbdb234323280cd81cc7e459071bebc26614a1e3421b77cfdeb6c1b728489f867ea96341ab6591475673fc4759512fb246d5cc407e2a580d372bfac7d332ac95c7cbdddca5a806017dec09ebbfe8afb5f5a948c8733481c0ebf3e466db2e96885768cc2dc46721aaecbcfed6571a3332738b3929094ae3fb42eea213188a0006b8e34046584e2f77bca1cfb6b9458c8b77e291abc242ac4d7f62ad7c5906dbda767e7c59c874f05e2d6e2b21e0df86209e9d3d7602eb260555c8c6c740e534cc4ee697e514f0bbc3a1dbdb399eac84d1a6fd52a96cc0546b6835adeaf200885c6a70832b157debc0c44e77e77180c7f76c3c14060af80a9d04d81fad89b1c70a8a4ca8e1365f2539007ea4ac98038832644ff4051965ac806c799add62fa4b9956eb4444c2a4d9a996bddb9e37202c285511fc9296edb6e2caf36fbeaa36cdb5fb0f52ee598f6e6bffbfcc7f6f3ae231a3fd576598f7f35d0e0f03c40bfcfa2e270ba5f4551e98b3f4d35a9e4bd8226bca018d164b55ea7dbf4f9a9a735a5a52e5a4bdd10fe5c588c92697f8ce303c683afea2cb2bb040649764014f13984fd1edc42e1bcb43e3d5315ed83727dd410ce2d8872c315ed9536e833af37438ae345571df8916012ea7dd389531edcb62a83cd3853b7f9932498f43e770685e1e60fc401812f24e842af06679b4cca2a4fd62789b3bb5fc096ff59289c203080123046abff4b2ff346a7aa9755b9eb46625ac9057d0edeb7d8aa1ba262419017e2a7226cec27df73a65fcd41c3b06f40f470163d5a186754cea69d558a730ea941da88fa50daa0abc657833df86677702f56f5a1b58e5c7bfbef597bb14368c65ee1cd7308a9da5d00014f2680adff7cf6042c8fef81fdcee776ac68a72e6eb6e91152d53387bdc9d40e1ab96f3eba31c9138a1f53bfb67e30cb4b3fe6b2b6ac5f43418db486331b1be40914fb137b34e457b268c91504d14dfd915c5b365ce55a875af065b835309c6005d69821db77b21bf9eaad8c40a0c61967f4badcbfdc21b8b8d29ed79af00feeb4f0aa0c5f4d996438debea559e9bf38dade2c2bb987d2b7bdec253b0a65a26ce10c46a9189389fb031e0b2efd9049a333160c640d380a50c34856cd199bf2f667cf3b4c09dd32527d4d03b92d262929b9acf0e4b8f4079c7848eeb1f72361128d1bcca37f8d1f049bc95b005a4a7b13d87d159482e718d32184b51b81af0c02d9a445317beceda2e00dc49f03a263c89bfdfcb051b81164b871db19cf97675254664b1930313b3b301cfea2622cf6834516a312ab95917a09b805ebb69d3e2bc71335da61dac69e18b7e7440668ecfcd54655bbe31d16541211ae1bfe90119a323b4118b882a2fba02b551a16dc0b905aae7dcec681a50d67d6faabe9982d5983e7809ddf8560d1a3e48559dba03a852fc8e1e3915c6b75a71a9b73e4973cd5265d50a900ca5600402faf3b299f9b8ba090448934fcd8e118fcb06c41e80d1c2c8735e81b38bbd88917ff4f613e33e734dfd6c12eefecf753ff7c27a170d5309054f8bb0f07ca2e252c044e728e23bb3a293cfd2391bd66b09a148bf4a1f126ab2e3701dbe441e1d99e9293d35a5a28a43be6d5495e940f0fcc35a312a901310a5fad6cf1462927a2138a436e9d3d05a7dfd95ac3710bc43581f79e4d288379c03e7c1a82dbec861cbe476167b18c98a779569ea1bfbb93112060c1a1076a3c2256f45537d92143e30193abe9e507be03da69afcea294f5d0d3b313e4ebeb2649c9ed370090942f2cba96b02a196478996999374a3ec8a15e576bb875f784449a2bdc5c1775b41ede712fa0443294ce318293ad8f5a52b0f1a5e8e56bc500a06138b11f01e617d1cbc689f00d07027511e763f4c53df174ab27ee9a40702de7d7dfeb350ec75425d611a5d51161a8b00ebd80b243e2bf881b4b670eb314fb05c781d35490ad8cc185bcc9121b3d45253cb792453ae635052a306bac2ec550c1f7e088f0b37cb1115d128563c93cd3bbdefb446660f8e3a27090c48167cfb0cb21748258e7e376a68d908152e8c93c5bf7d6d2fe029aaf0d0ad2d9c91173b4653cecabd28a8e619ca1d6bf646305cf063a1f06460e493edab4bf1a624351385b244ef399e10addc411ce75163fda6e313deddc99cd910a9ee832a64d4d69442b8bcf44fa1211dde159459b722162f45a8aefe7bf7a2ecac6308d8c2d3056ccc709739a4c303255f2dc46c0ffc277555b4fde0777a0a6f37ea8c57272893a61855c9285427a260e94583081ca3a7bf55cb0b8c27c927a3dfc3f71848a6c4d36cf0d5f67817d99e2ffb8ca8790ae4fa09b950c0b0750698ea5bd36290afa295971ac71a0ad7df6bebf1c2a80cceb61ac85a1cda2b6dfa0730411d93a26d39f6d6410d6b6536e2b2709ce75df37108a8aebf45d72a5eaa54a2641a21c75f3daefe8892fd8aee3447c88ac9d65ac236c9b59a123c2f4301e9e7168d77ad20e6537d965e78bf78d3771e0ed3e0389008156e03bfda8b70becce1346096dc33fc2542f6fb9085e74b918275c30940dfeda01eca4e26de5bacea5ef01ba063d798b9f17b07f451f999b72aec7c33975133714cfa1732369eec42725c69059a4eaae9e9f243c16080835d620393e769d8cedb3fbeff6cacf8043c76decc4e9f7c2bfbf8f878c15daf246981b6d6e11c9bc011c6851a10cf7dbcf4ad3a4a0b0f355afef01d4472b0cee683b596b46263612fc9e6a590f6665ea6f6a6ae70bc4c03d184984648c03b17e34c54916b6ae4b877c4f7b219188fa362db342553584924b0b8f526cc7b203527766cfe20bb437b239002b9f1c741294194aa7b8184a9472742e933a2a137571e130fb83ee3a430fe12015d4aa4debf070dae271b2c06a59b04c7855bd56909a81935ca4c75b568c7b1e4b0642b80af924c723f936f9a681b33f3ed84fb4f8731c6a46c5c01e6a424991d936b6c65368d776266ee2267cc74b93391e950c0474cc8939f43ba6987e59dfdb8d01d6e39913d3bf53e08bc406d1193eca33f0dce05e2421b288360a5ab6194a7f6e4b8f08bd0cc9a9fa9c421f89c826dbecee3d2931c2261a659f726bab0a3fe0dbbfccb3e2e7e41fdeb9b0717482fafdde52e08cf904c39a69d5fe3c3275f93c2709952cbb3104ba9b401b99be4c5dda89120693192c6c0ddcc532e1eba6255e78cf036de11c24050b15af600cabad9d40c9f20953d966d138e535f51ff9cf60dce0f315e4e642d4be140ee37c4530ec8bfdbc171779a85750e9d1f5e39b41d5c7634135e5a7d5fec03d4f317b63a87bdff09c4f76ac73c05fe31d121c0ce1619b44e417128dd21e3f922c", 0x1000, &(0x7f0000001140), &(0x7f0000001180), &(0x7f00000011c0)="c1ae538bdab86365716b26fe1d2bce37c74c18f042dfcf4262fee55bd2884e95955f4a9db23a30efe7ed8a9e07bdbe213818abab864d25dbb9c5b095f9cdc9c9c48de42b7b6cd48ce270af7a34596999ff55dd01505788b673098920094b2f7cf7e4c7028a022123957b459e246f71f1c7aed3245466f087836097befbc2fc865201fbdbc5d79e73cc64fd1db5279dffe680eed5deedd10dbdcf1be1d1ed7a6d8a84bd6ba83a886a2c4227acff7704bc04a6b46273bdc07195f9224d3fa35e5b") r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='smaps_rollup\x00') madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) read$FUSE(r1, &(0x7f00000007c0)={0x2020}, 0x20) write$binfmt_misc(r0, &(0x7f0000000000), 0xd) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) bind$bt_hci(0xffffffffffffffff, 0x0, 0x0) setresuid(0xee00, 0x0, 0x0) recvmmsg(r0, &(0x7f0000004a00)=[{{0x0, 0x0, &(0x7f0000002480)=[{&(0x7f0000001280)=""/4096, 0x1000}, {&(0x7f0000002280)=""/206, 0xce}, {&(0x7f0000002380)=""/227, 0xe3}], 0x3, &(0x7f00000024c0)=""/54, 0x36}, 0x1}, {{0x0, 0x0, &(0x7f0000002600)=[{&(0x7f0000002500)=""/248, 0xf8}], 0x1, &(0x7f0000002640)=""/167, 0xa7}, 0x7fffffff}, {{&(0x7f0000002700)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @initdev}}}, 0x80, &(0x7f00000039c0)=[{&(0x7f0000002780)=""/176, 0xb0}, {&(0x7f0000002840)=""/116, 0x74}, {&(0x7f00000028c0)=""/198, 0xc6}, {&(0x7f00000029c0)=""/4096, 0x1000}], 0x4, &(0x7f0000003a00)=""/4096, 0x1000}, 0x7}], 0x3, 0x2000, &(0x7f0000004ac0)) syz_emit_ethernet(0x1de, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa86dd606410a601a80000fc020000000000000000000000000000fe8000000000000000000000000000aa223405"], 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$AUTOFS_IOC_SETTIMEOUT(r3, 0x80049367, &(0x7f0000000040)=0x6) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000080)=0xf) bpf$PROG_BIND_MAP(0x23, &(0x7f0000004b00)={r1, r1}, 0xc) ioctl$TCFLSH(r3, 0x400455c8, 0x0) syz_usb_connect$uac1(0x0, 0xa4, 0x0, 0x0) close_range(r2, 0xffffffffffffffff, 0x0) 5m4.199065472s ago: executing program 39 (id=976): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000004b40)={0x1, &(0x7f0000000000)=[{0x7, 0x0, 0x0, 0xfffffffb}]}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c0008001800"], 0x1c}, 0x1, 0x0, 0x0, 0x20040040}, 0x6080) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000000)={0x0, &(0x7f0000000300)}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x6) io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) syz_clone(0x40280000, &(0x7f0000000140)="55f89807fd56b876778bfb46d855de50df8dea2a044342af32181611f860e5ab7664ea3c0c501e94b7da601efe689952fcd86a22fccc7942a5f999c9dad411d0af55e0bc251a65f50e3c6d579a67576155eb738fd35b0a7aa5aef885c1a05d81ec0ee7723f5eff97fbcae3639c7e893573d2a40797a1719e6929b6f17feef75ab487c613efe59cf16d16bc3f7a75d46338348d0fa6099c894d017e8e91bc84245acbf253e6c1a47f6c28b5376d3bce08f1047ab0b4217e527c79c7fd57c0296742edb0f80c36bd183eb757d203f81434c8529c2e0c0abdda2ade274799ead53794f9856efb2b2b6cb12fbd37063dced6e12fca8d5ac1997e16a11f3e7ca20c4691c94ca61128a6f70c6410a1b6b3cb8c9dbf0e6393e43c3ea2757aff16e4c7030fbfa205ef745633df848d3e2f698f2c2ff8a7c2b6a96a36a360441e90c18b244f24e86d229f4402a18802a422f9b45d21c1de8c068f4ecdce3026cea666b909203f3c7399b6101f5777d5fa6fc98ba68ef2c3466f8c9f940267dd86a5c13070f35b5248065969169908cee6790e816450c6ca705a7beebdae2794174cce6e8aa1cb061e41c41c9c4a78b7d1eb928b0989c6c2eb3d4ef181837aef8b2da22ab2342d2da5ef750b5e49a8b2f44edfde84944a41cd117e457c55706a79335e91926b73eba60e137663785771bfb8d142f9ca1b1dc6b693ae2d3b68ddac28578c2751d8fa21b19837a74b25e61df88ac6aa6e2ac9adac0c0b4a92315f54cf1fbe9e3faba6531e01715e7f9f818563638776092d60ee01b01065befdd6fa6b291f4f18c96820cdb2416bdf804ee0ac5918c4046029745752bd568538c03bd84d300a55bac8dbe3bf06c558c977fe2485b798960b6a41b6db6543386e88cd5b5575010b782fcf978e21576f6385dcee3e132c495e7e4e14809b0f1033d1a9ba8ade31ba3082f08bc071fcf91b7e2e7fa430c375145ada7a4c3ec14a43fd787148137817703802493ce5ec4c67dd8b0ab6d89e84d934c44760137488009932e34539930b5b5d31b3ae70b29312b0e5ef07c2c9c6f98392afaa9cc364f6e5027b3cf59cc5bd6e04875b131a56f19f4ae8f65f7d2ccb89ae432feab42013223edd21f208971f22d5e46a254a02ea04624de35387f1dbdab35ddbdc9c3da7e61a6f389a1c708f9b5b192c1dc2957b34dd383900017fe256c3e16730580dfebecb83b8a0a98d51063b9cfe4acaba96d977eea3d9cdca641d5cc01ffea83ad3c88ee3eb88c65839115ab60d0f44c7c6acb837ea81a4f9b23be57802c4c5b7b481169d7963635131cca1ed59823d9813d7f4a36fe700f399bd897fd98d3f2d1fea259538ad5003b288f3908a6c9639203d6d42fcefa16adab7a88ee9d1e85429ed834c3a26ccfad6213b1eb177ad7d56e6134165aa8a5ad6cbb8ada26b1ed9272afcb35d916395cd17c556cc47e73c1bc8d09407457f6388a8ab5279dc9795457cccec13a994ab597178234e8e345cd308701dbca68753d9ed335429e67bba6d6437c1df76befbdd82e8c6d43f54f3ae679eebb23265378d5552efc75a582b72285c34c46151da7904085b180e7c7df41cb75549630ed356feb248a849ddfb1aeba996ad42197971b73b5d327e7e47bc582bf16b6291f4b827120ac772cd429dc017e2563a996e62d20997ba6ea34506942e6fb63e67c37aa624f4abaf0876584eb041d37a3dbbbc74a148859ee608a51e0eaa4cd1445c6ef43fcff6cda405c1ee98c2b7fefb1a9aaa4f36b040414bda06dcc16067702b782535bbb9c087e04f00a19d209664bbdcc657781e9f653a5856a9a0e3210778f0a79111958e912a3a943919a87f5df09c8af2e8386628fe73d18783c5b12d6ddf1eb8d937c31634f605ebb65750b2e2b00aa1e2c4db7a8e6b52533e84a93db77e6f32936298a34ad9b1e2dbe14ff822a692ddad03e2b049cabd115394418d1d6427473846cd2e909f33fad94752fa2df62be21c6df24cc7007d388cea3533f45424141739cebb252dd6c8638c87d2209014403f278a0849767bf851e258b97cc525b470c8127ca204d117e71060cbb9c9b543233e766a9e4fd03d541ba145a1d81835c1462ed9bad03302fa3313297d6dc8aa4cde3b956ab17a2583445bf7ad567f2351fb76f8f5cdf0a45624c3b8a2f81a138e3ef7599bb843a31185218afd79654630065dcc84257debe24e3425b900e4381c7d2cc7b267a8d636094aea38a84419dbba20ba52ecf61ec1a991ab048e1b3c6950e4416d1b0a475060e1ab88ae69b7434de3b5a2b86805b1d0e83e0acf43c6feda4ad4bf13aa46ea2160b380ca51e5568a9a77f6c697aa24fc28ece78edc4b96c77a2902991050b780cea6d41b2a800b03e9adb92b373f1703a93010773ceae9578dc26a8dccc27b96f1bf6076e304089980b57b72d3afbdb234323280cd81cc7e459071bebc26614a1e3421b77cfdeb6c1b728489f867ea96341ab6591475673fc4759512fb246d5cc407e2a580d372bfac7d332ac95c7cbdddca5a806017dec09ebbfe8afb5f5a948c8733481c0ebf3e466db2e96885768cc2dc46721aaecbcfed6571a3332738b3929094ae3fb42eea213188a0006b8e34046584e2f77bca1cfb6b9458c8b77e291abc242ac4d7f62ad7c5906dbda767e7c59c874f05e2d6e2b21e0df86209e9d3d7602eb260555c8c6c740e534cc4ee697e514f0bbc3a1dbdb399eac84d1a6fd52a96cc0546b6835adeaf200885c6a70832b157debc0c44e77e77180c7f76c3c14060af80a9d04d81fad89b1c70a8a4ca8e1365f2539007ea4ac98038832644ff4051965ac806c799add62fa4b9956eb4444c2a4d9a996bddb9e37202c285511fc9296edb6e2caf36fbeaa36cdb5fb0f52ee598f6e6bffbfcc7f6f3ae231a3fd576598f7f35d0e0f03c40bfcfa2e270ba5f4551e98b3f4d35a9e4bd8226bca018d164b55ea7dbf4f9a9a735a5a52e5a4bdd10fe5c588c92697f8ce303c683afea2cb2bb040649764014f13984fd1edc42e1bcb43e3d5315ed83727dd410ce2d8872c315ed9536e833af37438ae345571df8916012ea7dd389531edcb62a83cd3853b7f9932498f43e770685e1e60fc401812f24e842af06679b4cca2a4fd62789b3bb5fc096ff59289c203080123046abff4b2ff346a7aa9755b9eb46625ac9057d0edeb7d8aa1ba262419017e2a7226cec27df73a65fcd41c3b06f40f470163d5a186754cea69d558a730ea941da88fa50daa0abc657833df86677702f56f5a1b58e5c7bfbef597bb14368c65ee1cd7308a9da5d00014f2680adff7cf6042c8fef81fdcee776ac68a72e6eb6e91152d53387bdc9d40e1ab96f3eba31c9138a1f53bfb67e30cb4b3fe6b2b6ac5f43418db486331b1be40914fb137b34e457b268c91504d14dfd915c5b365ce55a875af065b835309c6005d69821db77b21bf9eaad8c40a0c61967f4badcbfdc21b8b8d29ed79af00feeb4f0aa0c5f4d996438debea559e9bf38dade2c2bb987d2b7bdec253b0a65a26ce10c46a9189389fb031e0b2efd9049a333160c640d380a50c34856cd199bf2f667cf3b4c09dd32527d4d03b92d262929b9acf0e4b8f4079c7848eeb1f72361128d1bcca37f8d1f049bc95b005a4a7b13d87d159482e718d32184b51b81af0c02d9a445317beceda2e00dc49f03a263c89bfdfcb051b81164b871db19cf97675254664b1930313b3b301cfea2622cf6834516a312ab95917a09b805ebb69d3e2bc71335da61dac69e18b7e7440668ecfcd54655bbe31d16541211ae1bfe90119a323b4118b882a2fba02b551a16dc0b905aae7dcec681a50d67d6faabe9982d5983e7809ddf8560d1a3e48559dba03a852fc8e1e3915c6b75a71a9b73e4973cd5265d50a900ca5600402faf3b299f9b8ba090448934fcd8e118fcb06c41e80d1c2c8735e81b38bbd88917ff4f613e33e734dfd6c12eefecf753ff7c27a170d5309054f8bb0f07ca2e252c044e728e23bb3a293cfd2391bd66b09a148bf4a1f126ab2e3701dbe441e1d99e9293d35a5a28a43be6d5495e940f0fcc35a312a901310a5fad6cf1462927a2138a436e9d3d05a7dfd95ac3710bc43581f79e4d288379c03e7c1a82dbec861cbe476167b18c98a779569ea1bfbb93112060c1a1076a3c2256f45537d92143e30193abe9e507be03da69afcea294f5d0d3b313e4ebeb2649c9ed370090942f2cba96b02a196478996999374a3ec8a15e576bb875f784449a2bdc5c1775b41ede712fa0443294ce318293ad8f5a52b0f1a5e8e56bc500a06138b11f01e617d1cbc689f00d07027511e763f4c53df174ab27ee9a40702de7d7dfeb350ec75425d611a5d51161a8b00ebd80b243e2bf881b4b670eb314fb05c781d35490ad8cc185bcc9121b3d45253cb792453ae635052a306bac2ec550c1f7e088f0b37cb1115d128563c93cd3bbdefb446660f8e3a27090c48167cfb0cb21748258e7e376a68d908152e8c93c5bf7d6d2fe029aaf0d0ad2d9c91173b4653cecabd28a8e619ca1d6bf646305cf063a1f06460e493edab4bf1a624351385b244ef399e10addc411ce75163fda6e313deddc99cd910a9ee832a64d4d69442b8bcf44fa1211dde159459b722162f45a8aefe7bf7a2ecac6308d8c2d3056ccc709739a4c303255f2dc46c0ffc277555b4fde0777a0a6f37ea8c57272893a61855c9285427a260e94583081ca3a7bf55cb0b8c27c927a3dfc3f71848a6c4d36cf0d5f67817d99e2ffb8ca8790ae4fa09b950c0b0750698ea5bd36290afa295971ac71a0ad7df6bebf1c2a80cceb61ac85a1cda2b6dfa0730411d93a26d39f6d6410d6b6536e2b2709ce75df37108a8aebf45d72a5eaa54a2641a21c75f3daefe8892fd8aee3447c88ac9d65ac236c9b59a123c2f4301e9e7168d77ad20e6537d965e78bf78d3771e0ed3e0389008156e03bfda8b70becce1346096dc33fc2542f6fb9085e74b918275c30940dfeda01eca4e26de5bacea5ef01ba063d798b9f17b07f451f999b72aec7c33975133714cfa1732369eec42725c69059a4eaae9e9f243c16080835d620393e769d8cedb3fbeff6cacf8043c76decc4e9f7c2bfbf8f878c15daf246981b6d6e11c9bc011c6851a10cf7dbcf4ad3a4a0b0f355afef01d4472b0cee683b596b46263612fc9e6a590f6665ea6f6a6ae70bc4c03d184984648c03b17e34c54916b6ae4b877c4f7b219188fa362db342553584924b0b8f526cc7b203527766cfe20bb437b239002b9f1c741294194aa7b8184a9472742e933a2a137571e130fb83ee3a430fe12015d4aa4debf070dae271b2c06a59b04c7855bd56909a81935ca4c75b568c7b1e4b0642b80af924c723f936f9a681b33f3ed84fb4f8731c6a46c5c01e6a424991d936b6c65368d776266ee2267cc74b93391e950c0474cc8939f43ba6987e59dfdb8d01d6e39913d3bf53e08bc406d1193eca33f0dce05e2421b288360a5ab6194a7f6e4b8f08bd0cc9a9fa9c421f89c826dbecee3d2931c2261a659f726bab0a3fe0dbbfccb3e2e7e41fdeb9b0717482fafdde52e08cf904c39a69d5fe3c3275f93c2709952cbb3104ba9b401b99be4c5dda89120693192c6c0ddcc532e1eba6255e78cf036de11c24050b15af600cabad9d40c9f20953d966d138e535f51ff9cf60dce0f315e4e642d4be140ee37c4530ec8bfdbc171779a85750e9d1f5e39b41d5c7634135e5a7d5fec03d4f317b63a87bdff09c4f76ac73c05fe31d121c0ce1619b44e417128dd21e3f922c", 0x1000, &(0x7f0000001140), &(0x7f0000001180), &(0x7f00000011c0)="c1ae538bdab86365716b26fe1d2bce37c74c18f042dfcf4262fee55bd2884e95955f4a9db23a30efe7ed8a9e07bdbe213818abab864d25dbb9c5b095f9cdc9c9c48de42b7b6cd48ce270af7a34596999ff55dd01505788b673098920094b2f7cf7e4c7028a022123957b459e246f71f1c7aed3245466f087836097befbc2fc865201fbdbc5d79e73cc64fd1db5279dffe680eed5deedd10dbdcf1be1d1ed7a6d8a84bd6ba83a886a2c4227acff7704bc04a6b46273bdc07195f9224d3fa35e5b") r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='smaps_rollup\x00') madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) read$FUSE(r1, &(0x7f00000007c0)={0x2020}, 0x20) write$binfmt_misc(r0, &(0x7f0000000000), 0xd) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) bind$bt_hci(0xffffffffffffffff, 0x0, 0x0) setresuid(0xee00, 0x0, 0x0) recvmmsg(r0, &(0x7f0000004a00)=[{{0x0, 0x0, &(0x7f0000002480)=[{&(0x7f0000001280)=""/4096, 0x1000}, {&(0x7f0000002280)=""/206, 0xce}, {&(0x7f0000002380)=""/227, 0xe3}], 0x3, &(0x7f00000024c0)=""/54, 0x36}, 0x1}, {{0x0, 0x0, &(0x7f0000002600)=[{&(0x7f0000002500)=""/248, 0xf8}], 0x1, &(0x7f0000002640)=""/167, 0xa7}, 0x7fffffff}, {{&(0x7f0000002700)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @initdev}}}, 0x80, &(0x7f00000039c0)=[{&(0x7f0000002780)=""/176, 0xb0}, {&(0x7f0000002840)=""/116, 0x74}, {&(0x7f00000028c0)=""/198, 0xc6}, {&(0x7f00000029c0)=""/4096, 0x1000}], 0x4, &(0x7f0000003a00)=""/4096, 0x1000}, 0x7}], 0x3, 0x2000, &(0x7f0000004ac0)) syz_emit_ethernet(0x1de, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa86dd606410a601a80000fc020000000000000000000000000000fe8000000000000000000000000000aa223405"], 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$AUTOFS_IOC_SETTIMEOUT(r3, 0x80049367, &(0x7f0000000040)=0x6) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000080)=0xf) bpf$PROG_BIND_MAP(0x23, &(0x7f0000004b00)={r1, r1}, 0xc) ioctl$TCFLSH(r3, 0x400455c8, 0x0) syz_usb_connect$uac1(0x0, 0xa4, 0x0, 0x0) close_range(r2, 0xffffffffffffffff, 0x0) 4m47.739013747s ago: executing program 0 (id=1021): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000780)=ANY=[@ANYBLOB="1900000004000000080000000800000000000000"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000bc00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b704000000000400850000003300000095"], &(0x7f0000002640)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0x3141, 0x0, &(0x7f0000000000), 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 4m47.322411293s ago: executing program 0 (id=1025): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000040), 0x10200, 0x0) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000140)={'wlan0\x00'}) sendmsg$NL80211_CMD_GET_MESH_CONFIG(r1, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, r2, 0x20, 0x70bd25, 0x25dfdbff, {{}, {@void, @void}}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x4001) ioctl$PPPIOCGCHAN(r1, 0x80047437, &(0x7f0000000240)) r3 = accept4(r1, &(0x7f0000001700)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @mcast2}}, &(0x7f0000001780)=0x80, 0x800) recvmmsg(r3, &(0x7f0000003640)=[{{0x0, 0x0, &(0x7f0000001a40)=[{&(0x7f00000017c0)=""/196, 0xc4}, {&(0x7f00000018c0)=""/95, 0x5f}, {&(0x7f0000001940)=""/171, 0xab}, {&(0x7f0000001a00)=""/62, 0x3e}], 0x4, &(0x7f0000001a80)=""/198, 0xc6}, 0x8000}, {{&(0x7f0000001b80)=@caif, 0x80, &(0x7f0000001f80)=[{&(0x7f0000001c00)=""/84, 0x54}, {&(0x7f0000001c80)=""/121, 0x79}, {&(0x7f0000001d00)=""/87, 0x57}, {&(0x7f0000001d80)=""/205, 0xcd}, {&(0x7f0000001e80)=""/242, 0xf2}], 0x5}, 0xd}, {{&(0x7f0000002000)=@qipcrtr, 0x80, &(0x7f0000002140)=[{&(0x7f0000002080)=""/140, 0x8c}], 0x1, &(0x7f0000002180)=""/64, 0x40}}, {{0x0, 0x0, &(0x7f0000003300)=[{&(0x7f00000021c0)=""/4096, 0x1000}, {&(0x7f00000031c0)=""/121, 0x79}, {&(0x7f0000003240)=""/179, 0xb3}], 0x3}, 0x4}, {{&(0x7f0000003340)=@nfc_llcp, 0x80, &(0x7f0000003600)=[{&(0x7f00000033c0)=""/86, 0x56}, {&(0x7f0000003440)=""/176, 0xb0}, {&(0x7f0000003500)=""/211, 0xd3}], 0x3}, 0x61e7}], 0x5, 0x20, &(0x7f0000003780)) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="020000000000000010000000000000000a370000", @ANYRES32=0x0, @ANYBLOB="0000000014000500000100fe880000000000000000000000040001"], 0x44}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000180)='debugfs\x00', 0x0, 0x0) r4 = inotify_init1(0x0) inotify_add_watch(r4, &(0x7f00000000c0)='./file0\x00', 0x60004ce) r5 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000003480)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) read$FUSE(r5, &(0x7f0000005500)={0x2020}, 0x2020) r6 = add_key$user(&(0x7f0000000280), &(0x7f00000002c0)={'syz', 0x0}, &(0x7f0000000300)="b3106e7bee09cb983b5fe56d419fe34aaa3dfa1e7553e2297af2e9c08da55e208c059e0e6a330816554dc560df49e9e4bdb5a6734170f8967ced4efcf4bdd9ab9c95c46c6084423e77f08551f72cf23354ba201166b85af82aac30a023e284fc0a9c1c0dc4bd3f25007578939553512abc6648fb68cfb886bf3d239b5b0ff365c8d6c865f75c6a1dfbe553e607f561ae9a90defaa5210534d8e78f0ee89271d09d3737c82cb2e9ace73d88ab40947e14b0b6ad723aa9d567b878a2d37aa5153fd35a4be767e73f3d5dfd6941341e635ea7e3f497fd90d56f6ec14929b5", 0xdd, 0xffffffffffffffff) r7 = add_key(&(0x7f0000000000)='big_key\x00', &(0x7f00000000c0)={'syz', 0x1}, &(0x7f00000002c0)="1d", 0x1, 0xfffffffffffffffe) keyctl$update(0x2, r7, &(0x7f0000000140)="c4e3dec654f5b002f54b64d941f21d75", 0x10) r8 = add_key$user(&(0x7f0000000400), &(0x7f0000000440)={'syz', 0x2}, &(0x7f0000000500)="04f191cfafee640f6f23224260d86accff3cbb41bf51d4cf8f77892b0dc0e252b5ff653a4b20e1a1727e11deaf4058f4405b61184af299d3ec7514b25286fa71c3f48b01d793be2aa9fa099f8cee69eca49a301dfaebeb1385de7cd90df25245f2c87c9c977f5d6830b5316ecbb0db34dccc0a4e56143be175de1c15584eb2fa7722588106842bf366395d42a4cbc895821fddda60d5ab6979951ec8948c0e8ad6344ceb26461b39bbc0cc3b06ae0b23d90b68c6594d3399b678c4c576b32a5ec9a151f1bdb22fa320ba3d794cf42028daded57fdd85d9d10ca928644140b1cc89d53825d2693466957eccc48ca2e7e3301261f2c106583d97090ec1251b42ccb6ce2347a71a75503ba8571654cf9ed3292150f899d806b0e0368f752a4c82f47694ae409ff1ecea817d52ae5ad09360f80730c8c73cb4ca2acd719cee2452948e4a724e506620a250b97906c32e58357b50558e9e6cc038390ee9c0c063acdff7651311b175dbe2ef994b54b3781031296db5cfa31a1daf55a9b370ee22745e4d9ca12f1e487a622816cfa11e06ad3875323df9c5f7e43e262e92f3caa8533b78c5beaac3cb976642beda715d8c14ad9986ce7d874051f8f815668d169d590bc8da4e7a3e0a21adbdbdb51ce06ed7494871e44e9221747f797fdab6ce48956e7f9cb189587e5f2040cc65d3e2d90c6962230190b69d93b26745107af4afeee43ac3ee818c20782ef862fab28df6e3968256180e103e97fcff96f8b6864ff125e0bbf9c723f65a6a02c162de2adaf2f6477d5136920686b5161c15ddf60608c36b1c1e95291c4640ca0962445d3349bfeb55656dfd1d9281dd2c60146da13b5d270c1f047d027c2f5c5c5149982b2fab1bb3a7d36285456a5979c4581595cbc6308ea800ef84bc8f2e668862b14617b5baaeb5eb21b81b66d83dc922281877702d0134148d83228e392fcd1fe13495f8d5a8e3b895aede1d45be98e863b0d20776162365fce4a981ae2983323ef1d136d8d329a48e79ec978cd9d30d6a93684f6ba1f3ead2be14dbb8d6c17e8297dd178d5c77115f04e7d9b65e95fa60f164e29eae0e28d6d1d64f733480172800d2c7f0a28a47cebfba2ea7bc277066b755ac38d448d5c140e1b7b63d1044aba777cb03b63bd74dfdc867132a25a41fdba67bcb7fa324a0c66c1b34e2e0a280ddea38d6cd0fdf9c8259dd4ad9ca88609fffff8d0e9c0d88726dcd293443b5e30b75657e7705b9dd83b35c66ebd17c961b1fa53fcaf447c44f6fc6e8ac271e29a9f6c3cd6056703ca44fe65d9f02778603daa5ff2cfc0551425a6b2051448c50814ef3c18290d2814dbc5b9c22f08e828d138d5de8b9942e7091ceb690134b6074e1fb752be5c6801a94fe2b619a7255b2501fd2790347ec09dc15ae5b7bf11317ccde82a89bb8e2b7fc3b0a4bca8c27d6d256dd4b063addf76b299790cff386759ffe696c2c956828cace64d9c296b4820c9ba13e1dc852f06d77eb5cd808df3e009d1e1c22dbf636bf5b3791f4de8c4015f768b5409455ad1d083379fe087d2b44099ecd1059c13379d460455dd5516fc124fcc44f9b0014b15240458c577e43358256a61dad4b1f6f6d6422ebc904d4305521783f28b038edb61ec9cafc56891166239100864d4a0486e3fe8a1d25326c61e0ebf6808c83e519f0c0e460abd0c3c6fb659afa23e3c438988166b12e8cde7500e0870dd5fd7c18b8ee6c88b9b1392f4105bb1c1973dbea477be929e12b3a12891d2cd54b3caac265b3c44bb96c670acd88652500086fb452777ea30a8b88f9e0b7bc283c0545366bd86babc0bccea7fec0049ce9bb14b1e8307833a3587c16148cd2287a11a978f8e70b008886b9e46fcbe3ac413e88f951be69439c478d6b3f1107f4990b127731f91077756a58a353e0c69f993c86d366c9735efae20ee3b8adf5e72b9882ec08e15c86d62336b2c7860c1d5abb43580f68b5f20fd3f06d579f7bdeed2dd726ab746696717ca0340c5c4f8c25789f01e1436de9d7fd05dce6c6b5a04dba653968c4a00bfa0f6a422eefcb9202e6612ff3ba4844ffabcf51d49872226c90b1ee6ddb3749bca3f15ded059a6490895ae3038a6b03a3d95779f9354c806b893ac4976e9913d2d7ef0773e08e69799a230861682b4b4f94126737ca8db6675b7390069604ce24587e497b70893e75f861e2585c67ed39d44a2b90b855320d7a8acb42fb7bd9a78454f142f95252430e10d4da925a60b3d8a58c5e7212d0b51e543755ccb07d5b68260f14dacaeaab96471cc3fb86374d48c035ef5a1aa39704661e6436bcfad39ae07750e4435e0ff567e7c6ca781109e2bfd8f0e44f5e0ec7332fb5e87094310f710e8a797a7215ad880fb79f53f3d6867309e94cf1a4394380d37bdf4ceb151c07a4a9f61f77d4c68ec67ec699f17abc3467077d8acca7b339a1757f12c687352e26f7f246bd42dbfe151058a53c1dedf913d62c2e4a9c7e3f79acce86c28cb4407a0afabc9aca700f1dc3218bbe453f39cff369601bec5eb413c846c8d61b125a0dccd2c4b09a2b930b116c48335b03ce7e29027e5f3cf21019d0c5e4209f72038b314cd56ea6e965d1462b245d05e197de0f6ecf9d8fedd175889edd13cd1be37314c39713d825d2a6afd370ba08e36106c6d10306eff0ccb3f52ea746f41befbff5f3f6045fabb54e4edd695f5350b0f503220dbe70b96e5fcfd1cb0098c2c72fa3d491919d97c184ee1e2b0ddcbe7bb120916e147e2725ba08c716c95d2f2ac7e9afec8ae1c017e79cee3e46cd23ffbf519fde4b1057b396a8db4c6f15b16efbee139be588ea0c48092b71219a77a285c573d134eb1901a98a76ee16b8bd21057025b953c33c7f20bc19b75dbf92912640c09b095430a978e1632c85ceaf8267bebefb63024d8ea7cd108ac881eb642fa63ef531414b1a01e749b505d74c60bc84c4670fe896d513a33cc888faf6ebfcc17dcc40f8e0adfc40e03ef734f4e90abe9dd74837b2f533ddb4e92da7df821b3ea27aff6e4cb5d93db3a29412872cdd77500f78fe50d2250f5c1ce01b3f477f784a26047fe977f74acab611e4a741f2ef557550cd808e49f129327ed93e4e26a2b6a446aff1ce16519e9c877602ce8f8bea7b1aaac544e8b68eff63111e6419210353838f47de7b1d58e912e0ae9a50a395feed40773e796120ec5552d58a5ee03d72aaadbb1ac1307abfa2310c862cfe40e5e6e17328b948de69c59d2cc60b5161caf397430ffa000804cd7ac6363b1d60386fcfe3f7273e7b55a641031789e5498ba2163bef0326e0d712fdaf115b21ecfc380c3f612a598c85d3f2d06036e9b20e048d270f81e129fe553d3a71f6f77d1797b107fe701dcb9f83366dc3dc731fb9c4a7ecc5bd79a68a054002ed4fee0252152b0258c74685e7fd98e10556e0f5b04b6a0f69a3eaf37dbb531eca78cc4db9ccede4bbbd236f27bbf37b855060bef3043e9ef616e7cf3c009abdb163ea3aca7d6c82987deac158a46ad80995608ff16b0b767839175dd5f47f00de5a0d1808b22f44962c5887b83d6290a39e72b1536ea6afd60d4a2c21851819042d3371ce0f416f4008df5c879c61adbda6be6d54640e062d31815fa7c7f4c7f3b0bb3decabb3ae2aabe93e4fd2f0798688dbfbab48c782799f038aeb6b57b0ff059c812e138d2283f82e9802728aa035d7cef320e7520ee8eca048a23d9114d6d05ca206d1410d48cc9b9987bee7cf61b2b792866cc75a7fe0d44a516d33b9d5819b6e82bb12359393ce036e0cf0a431938ee434946045033f10fb8abe4af99e8a1a480498e23f230de0b37c77b23f1b8bf5988db2ad9be0fb9e62675cafdc8544ee38062bb633d1d4cbd1fce4df1cd8ef05643938c9215bd5318d566b2b96b580e67007f0bbde9c8795333ef033c68056a5331c879ca63ce1f60f989de4a38392f4e80221ef34f9c8377dabfac3673fa6e4d7b87e01108692a77ce3fd9f303d49913a87ff2952efe3c081c2b8e559e014b30ec07bf392294804d3512f808bc92a1dd9e9ecc005fbdbbfefe03d40e10edf430e2bdccfa7e3b472ee3a347e10cc3318b4d9025b7ac731ca090e3f6a581f283127969d15500748d59f6701851d0b7e12ef01564fbf82bd5b2af193714b42bbca271198f60139b973a6166bbc01ff53808a1c40d3c26f5dcb95cf7d8faa30873c294c91c0f2c10437de08bab2233612080d2f3eb9ab0cfec73de69eca73b9f963a7fcad177cf14a7a56d63ce6cd6cc6f25879653b21e9a15b188aee4d31ed957596bb72ff2582867b13ef920ffe3e4ca35fff0a6c586460501ecb8b186af4e350e7ed40bfe64be197737d45b774ca29e1ae542400998d705300204ed5a8c59dd883a59275a28c0641957541b9c4b4ed2dbcc1f0c08abe82cfbd10b3c0232a3cdb7148909c96134607e074f956450f4251121e6d4b10b0c311f98b9ce13bb78ba06d18e80888ac499071d103065d08da651dd3494b40fcf1862472587b0ba5e67abe38c8d9c95e8548469549437051df3cf93b9ebb7af968517619a00bf1d9ce46a1726e4fbcae10a66ed36091657a8c2a42fb8d9e08bf5c9ebe9def8913d5eda48f79f799398be04919ab1a57a0f55468e5620fe3aa0fc04ee962c7e01761faaa26ecdaab3f61fa9de6d7d5e7ebbb07dd792f9eb222336239f88aa1d22b8a34e53111aca54c5402c2b87a7b689eaee21c5713a47491ba16b294585d628f64d08e1ae71e465c6fbffdaa6b4ce58b28ac0edf746071112a22398086a9073a1a59214a435d96fc6bb592675af55743b61e25dd9237c4955e4ac4b2db376196ecf4190a901f7ed1a3573ff5f72acc1e8449c5286c423bf76c6cca522ab75ce772bce82698c6db758801c4d754f2e34535c3c064abf9ced5a41e752983d62b524f94ee68d50b459f2f6b578caa97b1d825f18320a3cde917ed781ab4ad3eb8b08eacb3c0e010dea65194fc05c0220d9592e8dda6e5c9b61cf7e70b3aac1c659a5bbf7c797e59101d64836764551fc8e06be285c767c09c1b9c2d8f6c6367801772f8312a0bf09073276a4141b33cc5083d92411570ca58b14b1b40a85644ee2198128a18042b2066dc356d89d13e2bce565728088022402ffecad78898b97ed2209d43c9527486f398a635291296a74687bdb92054afb6fb5dbcd45df373604b270606121e521d1076f6be42f792ac2bc0cda36e2e91b90b42f6576043cdd292bc5ccd6abbe2e5c7fead023f94e47b10d59f78a91659519af857bed58b14160d82113508f4478fe11cacfeea23da1c3b94a1a60dd6211bf6634165e2288cd36964c65f9c08ac5695607deaebb7b49bc18af4ca86092b50da98d7b96e5d3c2db37b0ca7166fbe9315a13f2ea183f08cb67998b9b7173ad30985b5f980056110a2afb183f735b67c4b2b429b63cdf4cdfba49c3b2cb8aaf94fd0c629de313c4f9bf6e222bb0d0904e4929534ecc2ade4e37600f7ed27e8d630262b1fcf50b2568dc8017d14e32b61a1299bb0af5d80a43adafe1773680496b955d29ec0cae4c1317a6deecaccf9fc0afd1f744ed85b120f2e435d19b792e3d827298b169f5a2211fc4ee88b8c75ed28ca3fa1c3ad2858fb3eca3c41cb2cf40fea382d88e99c1f956af6eabc07ad56bc508abf19cae257cc2ca8efc73fb9ddee2ce05ed9228470082faeab372c54f2bf4da3365c0df5ab58b229eecbde44a3c2022ad015a2149c0d7d731a624de5a1d9db5caf0d61418163763b71520f3d9437331769b277af43dc4b68", 0x1000, 0xfffffffffffffffa) keyctl$dh_compute(0x17, &(0x7f0000000480)={r6, r7, r8}, &(0x7f0000001500)=""/182, 0xb6, &(0x7f0000001640)={&(0x7f00000015c0)={'blake2s-128-generic\x00'}, &(0x7f0000001600)="ce6ac445f748a186a55ba7585c1b3d96514ae4cccce9013ed1e284d38907", 0x1e}) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000001680)=0x0) syz_open_procfs(r9, &(0x7f00000016c0)='attr/prev\x00') 4m46.345317045s ago: executing program 0 (id=1026): capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) 4m45.608012937s ago: executing program 0 (id=1030): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = landlock_create_ruleset(&(0x7f0000000140)={0x0, 0x2, 0x2}, 0x18, 0x0) r2 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nfc(&(0x7f0000000040), r3) ioctl$IOCTL_GET_NCIDEV_IDX(r2, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x1c, r4, 0x1, 0x70bd26, 0x25dfdbfc, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r5}]}, 0x1c}}, 0x0) write$nci(r2, &(0x7f0000000480)=@NCI_OP_CORE_CONN_CLOSE_RSP={0x0, 0x0, 0x2, 0x5, 0x1, 0x1}, 0x4) r6 = landlock_create_ruleset(&(0x7f0000000000)={0xe020, 0x0, 0x3}, 0x18, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_io_uring_setup(0x16e, &(0x7f0000000b00)={0x0, 0xfffffffd, 0x10100, 0x0, 0x4}, &(0x7f0000001240)=0x0, &(0x7f0000001340)=0x0) syz_io_uring_submit(r9, r10, &(0x7f0000000300)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, r7, 0x0, &(0x7f0000000000)="98eae2d0a38c1a46f3db5bc29fa6877058568a1657270b5809d15f95c5044c512498e626f4", 0x25, 0x102, 0x1}) sendmsg$TIPC_NL_MON_GET(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)={0x14, 0x0, 0x4, 0x70bd2c, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x4000) io_uring_enter(r8, 0x567, 0x1e, 0x0, 0x0, 0x0) landlock_restrict_self(r6, 0x0) landlock_restrict_self(r1, 0x0) r11 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000000c0), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r11, 0x40bc5311, 0x0) r12 = socket$nl_netfilter(0x10, 0x3, 0xc) r13 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x442, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) ioctl$SNDCTL_DSP_SUBDIVIDE(r13, 0xc0045009, &(0x7f0000000080)=0x2) quotactl$Q_SETQUOTA(0x0, &(0x7f0000000000)=@loop={'/dev/loop', 0x0}, 0x0, &(0x7f0000000180)={0x4, 0xffffffffffffffff, 0x306, 0x3, 0x1, 0x1400000000, 0x0, 0x36a, 0x20003f}) sendmsg$IPSET_CMD_CREATE(r12, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f00000002c0)={0x80, 0x2, 0x6, 0x5, 0x0, 0x0, {0x7}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x2}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_CIDR={0x5, 0x3, 0xfe}, @IPSET_ATTR_PROTO={0x5, 0x7, 0xc}, @IPSET_ATTR_NETMASK={0x5, 0x14, 0x9}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x14, 0x3, 'hash:ip,port,ip\x00'}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:mac\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x80}, 0x1, 0x0, 0x0, 0x40}, 0x20004000) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYRESHEX, @ANYRES16=0x0], 0x64}}, 0x8000) 4m43.762380559s ago: executing program 0 (id=1033): r0 = syz_io_uring_setup(0x7b, &(0x7f0000000540)={0x0, 0x3bce, 0x10100, 0x0, 0x313}, &(0x7f00000005c0)=0x0, &(0x7f0000000100)=0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r1, r2, &(0x7f0000000600)=@IORING_OP_RECVMSG={0xa, 0x40, 0x0, r4, 0x0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000006c0)=[{0x0}, {&(0x7f00000002c0)=""/214, 0xd6}, {&(0x7f00000003c0)=""/22, 0x16}, {&(0x7f0000000400)=""/231, 0xe7}, {&(0x7f0000000500)=""/14, 0xe}], 0x5}, 0x0, 0x0, 0x1}) io_uring_enter(r0, 0x46f3, 0x1000000, 0x0, 0x0, 0x0) write(r3, &(0x7f0000000200)='~', 0x1) 4m43.497857585s ago: executing program 0 (id=1034): socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a00)=@delchain={0xc0, 0x65, 0x2, 0x70bd28, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0xd, 0x8}, {0x0, 0x9}, {0x6}}, [@filter_kind_options=@f_bpf={{0x8}, {0x54, 0x2, [@TCA_BPF_OPS={{0x6}, {0x4}}, @TCA_BPF_OPS={{0x6, 0x4, 0x7}, {0x3c, 0x5, [{0x80, 0x8, 0xa, 0x7fff}, {0x400, 0x10, 0x0, 0x2}, {0x400, 0xf, 0x81, 0x28e49d38}, {0x1, 0xff, 0xef, 0x5}, {0xe68, 0x7, 0x2}, {0xfff0, 0x9c, 0x30, 0xb2}, {0x8000, 0x8, 0x1, 0xa4}]}}]}}, @filter_kind_options=@f_route={{0xa}, {0x4}}, @TCA_CHAIN={0x8, 0xb, 0x101}, @filter_kind_options=@f_route={{0xa}, {0x1c, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_TO={0x8, 0x2, 0x21}, @TCA_ROUTE4_FROM={0x8, 0x3, 0x2f}]}}]}, 0xc0}, 0x1, 0x0, 0x0, 0x81}, 0x8000) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000880)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x3a1}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0x21}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000600), r1) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000400)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CONTROL_PORT_FRAME(r1, &(0x7f0000003700)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="94000000", @ANYRES16=r2, @ANYBLOB="010000020000000000008100000008000300", @ANYRES32=r3, @ANYBLOB="060066008e8800006400330050b4e500080211000000080211000000153e00c08ce7e10b0a0045c040000000000000000200000000000100030128060297002d1a00030740000000000000000b0005001a000000010013fdffff08720603030303030371070101ffff0108400a0006000802110000010000"], 0x94}}, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000005c00)={&(0x7f0000000000)=@newtaction={0xa0, 0x30, 0x9, 0xfffffffc, 0x0, {}, [{0x8c, 0x1, [@m_bpf={0x88, 0x1, 0x0, 0x0, {{0x8}, {0x60, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x7}, @TCA_ACT_BPF_OPS={0x3c, 0x4, [{}, {}, {0x6}, {}, {0x0, 0x0, 0xfe}, {0xf792}, {0x3}]}, @TCA_ACT_BPF_PARMS={0x18}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa0}}, 0x0) 4m28.387604952s ago: executing program 40 (id=1034): socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a00)=@delchain={0xc0, 0x65, 0x2, 0x70bd28, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0xd, 0x8}, {0x0, 0x9}, {0x6}}, [@filter_kind_options=@f_bpf={{0x8}, {0x54, 0x2, [@TCA_BPF_OPS={{0x6}, {0x4}}, @TCA_BPF_OPS={{0x6, 0x4, 0x7}, {0x3c, 0x5, [{0x80, 0x8, 0xa, 0x7fff}, {0x400, 0x10, 0x0, 0x2}, {0x400, 0xf, 0x81, 0x28e49d38}, {0x1, 0xff, 0xef, 0x5}, {0xe68, 0x7, 0x2}, {0xfff0, 0x9c, 0x30, 0xb2}, {0x8000, 0x8, 0x1, 0xa4}]}}]}}, @filter_kind_options=@f_route={{0xa}, {0x4}}, @TCA_CHAIN={0x8, 0xb, 0x101}, @filter_kind_options=@f_route={{0xa}, {0x1c, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_TO={0x8, 0x2, 0x21}, @TCA_ROUTE4_FROM={0x8, 0x3, 0x2f}]}}]}, 0xc0}, 0x1, 0x0, 0x0, 0x81}, 0x8000) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000880)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x3a1}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0x21}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000600), r1) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000400)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CONTROL_PORT_FRAME(r1, &(0x7f0000003700)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="94000000", @ANYRES16=r2, @ANYBLOB="010000020000000000008100000008000300", @ANYRES32=r3, @ANYBLOB="060066008e8800006400330050b4e500080211000000080211000000153e00c08ce7e10b0a0045c040000000000000000200000000000100030128060297002d1a00030740000000000000000b0005001a000000010013fdffff08720603030303030371070101ffff0108400a0006000802110000010000"], 0x94}}, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000005c00)={&(0x7f0000000000)=@newtaction={0xa0, 0x30, 0x9, 0xfffffffc, 0x0, {}, [{0x8c, 0x1, [@m_bpf={0x88, 0x1, 0x0, 0x0, {{0x8}, {0x60, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x7}, @TCA_ACT_BPF_OPS={0x3c, 0x4, [{}, {}, {0x6}, {}, {0x0, 0x0, 0xfe}, {0xf792}, {0x3}]}, @TCA_ACT_BPF_PARMS={0x18}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa0}}, 0x0) 15.526051488s ago: executing program 3 (id=1603): r0 = syz_open_dev$media(&(0x7f0000000b40), 0x2e18, 0x100) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000080)={{0x1, 0x1, 0x18, r0, {0x5}}, './file0\x00'}) write$tcp_mem(r2, &(0x7f0000000200)={0x10000, 0x20, 0x100, 0x20, 0x5}, 0x48) r3 = dup(r1) getsockname$packet(r3, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000140)=0x14) socket$tipc(0x1e, 0x2, 0x0) socket$tipc(0x1e, 0x5, 0x0) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000cc0)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a5050000000077d8f3b423cdac8d80000000000000002be16ad10a48b243ccc42606d25dfd73a015e0ca7fc2506a0f7535f7866907dc0200000000000000ae669e17fd6587d452d6453559c3421eed73d56615fe6c54c3b3ffe1b4ce25d7c983c044c03bf3a48dfe47ec9dd6c091c30b93bfae76d9ebacd3ed3e26e7a23129d6606fd28a69989d552af6bda9df2c3af36effff9af2551ce896165127cb3f011a7d06602e2fc40848228567ffb400000000003ed38ae89d24e1cebfba2f87925bfacba83109751fe6c05405d027edd68149ee99eef6a6992308a4fc0b7c70bc677d6dd4aed4af7500d7900a820b6347184e9a217b5614cd50cbe43a1ed2526814bc0000e9e086ce48e90defb6670c3df2624f56da648d28ad0a97aec7291c25447c106a99893e10db21901eb397b2f5fd71400fa7a050fbbef9e326ea27e513e96068fd1e8a43e89f9c85c822a961546ed5363c17ff1432d08806bc376e3e49ee52b59d13182e1f24ed200ada10eb1affb87ba55b2d72078e9f40b4ae7d01000000d11cd22c35d32940000088dde499000000fdffffff00000000000f000000ef0000000000000000000000000c52f4ebd2c893bb97a068bd10734a83584898eccb26f7b789cfc4cd995fa3e11a5c74c85404e2df3ad37b729ac83b0dcb4f48f3c3356b9997fc455a17690b6f7f9ccbe4b1701941b18aba6b16455a66c3b84b138efc20a546d3d5227e23b03f2a834391ade2ff3e93ee296c4082ee73e7c353312c9d75711ce1623e9c54bdff59d2a69dcb7d84c235b23a4480c2461b405cfd1a38992f295ad3adc94cd07c850d1ce6d0b2fea02c24e9280333152fb794e4ddea02017a6c139b50101caecaf2abc0847a1ff2f7fc3c2b99a96fc4275ad107274e2934a87a4ddcdb112754ca5bdec0ead14b6c0f19a43a2f05c7f0be31491eb8c9ff68236c8600040000000000000000000066e034c81c3cab64e4fc8dc55ce0ada18dcbf31c6e82893add3bee3e10fc873d1d922b0877cbcd95b839d3059d5140a1f742f6e75741e39e5cb6a193e06a1043375b0f61b5d4e17c81baa31b924d84f224baf1221c15fa12313ffbfa7c2730309f66705b71e6205e7cbf3643561eabb9a63fcd604d5cc27e1317ad94cf438d71873e540be16b6ca205081173bd03c4754fc4674812daab482fd390a1c903b5d28a1eb247b5837d7603b92495d5c569f6433c3fca5206cb0000003fdbbd3892c52c2e7612e05de32322e980a3d69931e2c9312dd517c96f2ee90362476ed853c4c9b7d4ebf13cbaa795860e92a3d7d004f2c491db38eb769f094d5d48b262cc35c40682138cf13a49aa9f27abec00002f01ba1251aaf2385416ca719300"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r8, &(0x7f0000000000), 0x651, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x11, 0x3, &(0x7f0000000740)=@framed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r9 = socket$tipc(0x1e, 0x2, 0x0) r10 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r10, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x3, 0x4}}, 0x10) bind$tipc(r10, &(0x7f0000000100)=@name={0x1e, 0x2, 0x0, {{0x42, 0x3}}}, 0x10) sendmsg$tipc(r9, &(0x7f0000000340)={&(0x7f0000000040)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x1, 0x4002}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x20044094}, 0x0) 12.974111873s ago: executing program 1 (id=1607): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0xc4) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = syz_io_uring_setup(0x8d2, &(0x7f00000000c0)={0x0, 0xd806, 0x3010, 0x0, 0x1}, &(0x7f00000001c0)=0x0, &(0x7f0000000080)=0x0) r5 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_SET(r5, 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE={0xc, 0x40, 0x0, 0x0, 0x0, 0x1}) io_uring_enter(r2, 0x47ba, 0x3e80, 0x0, 0x0, 0x0) 9.892041008s ago: executing program 8 (id=1613): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x11, &(0x7f0000000140)=0x4, 0x4) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x840}, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000000)={@remote, 0x4, 0x1, 0x0, 0x0, 0x7fff, 0x8}, 0x20) 9.36988383s ago: executing program 8 (id=1614): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000002100), 0x280449c, &(0x7f0000002140)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}) read$FUSE(r0, &(0x7f00000093c0)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000004200)={0x50, 0x0, r1, {0x7, 0x1f, 0x0, 0x2066012, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}}, 0x50) syz_fuse_handle_req(r0, &(0x7f00000042c0)="000000000000000000000000000000000000000000000000000000000000000090c400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000542d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ea8286a2fba523440000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000633956a1000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007d6ab715107fa1820000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f6ffffffffffffff0000000000000e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e1ffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f4000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000286071480000000000b13bc1e6d970884f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f3ffffffffffffff00", 0x2000, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006340)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = openat(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x40) getdents64(r3, 0x0, 0x0) lsetxattr$trusted_overlay_opaque(&(0x7f0000000000)='./file1\x00', &(0x7f00000000c0), &(0x7f0000000140), 0x2, 0x3) syz_fuse_handle_req(r0, &(0x7f00000021c0)="7b1713b4c6f02da7493fb6859f0143c68a58166f472c5078104b859bc37f9a49a8f85c9101df3b2736ff9bebcb1a3c2f570b28279b8ff7afdef7451b3d10b4578c2e81784b6e4f410800d997f0689546cee0852e9e9c64c1f95df7b136243cf7aee1b8e7a4e1d6e6fc01337370f0dfc098d975e9a6f90a08f5b845054d1e1fc81adadbf2836ff758bade0484377855b05b3556a91827599638458ad30baea03240b302638b88423ecaba6da1e40f6f1b24d60dde1652f2d5f818af43d49dd55c4eadea945e9b6aa744dca07ec2e00320bef5b045414836941469129670c4cdb953ed61efeeae2ced1b7cb3e7fa4c93cce5623a9e33c69d068b801fd1369aba759e2829c67c705853262fef6669aab956f0f733619dd361be5e1414c7e7ff6218e330156d609fa9f3244a0a4fb678a58e70b86f6dabc3331f755b786c42b4198149941a7a58c83f1f2811209025269c5ffcbe0c34ac98cc091cec2c993bca0aa8400ff9e39cc9fba8dda886f95357957bbad8bb850ab92f7aa9bebcdb0ef188749a1742e5597d199f3ccdc2d807bf757da45acc93e3e9645a1036cb041b3c38dafef367b8dae802bbbc03bacb905d40e1da78591687b416ee380103a670aa8f722c76e13f7f0e3effbb37f15a821b8315fe541e3ffc09289d96db1dfa8861e5da41c812b54ee20ca8b3180f2f46db56954791465cb572de0cce16d789d6fff216ca46977ed724dc0cc8cef7b295ebb2998a5c4662e32ae1001e59f3bfefcd72543bfe1aa6688d65c547089ec0fe1f1d9610095a5a4008b14f46775c368417376ee143856031947db71c455dc40eeeda210fbf258452781ce46e51f6df683a7918770f73d324d9401648d271cb9a7e919401567e400fec420cf363444a78eea03e73176abd6546e1657945aa88f64a21e07fc23edd74512cf89781e8ffe9bb1601ab25d31801332a6c5be9cebb6cb08207bb832106553ea9fc19b4b4f1f0cd55efc2925ffef75e9b12f06b5a7496506a274ca25f88398a1734b7013c3f78a2e49ef0d946a1aff362e37c9b5f5473de11401097722adda87944ee3eeb1bdde60e97484af4d2e5f8b0a9c63bb8bb99461b16edd824add1caf9d5247811cc4f6b48004774f1a4fe4dd125ddbfd8b69ff3ee314aeb445bee9f217a2f5a9e0e84ccd8718471f949086df6cdcbf95e568317e31dd01be1b826cf9a09373b16935fc864794a3886a2f4aacc42135db85f8921916a10aa7111a686979e2a5c9959cafc9774c416c4dfe0b9e06657feb2fbc31e7c11f6e2841680986557c1f2b1ec3c0fcc6a749a3c97a5b370550ab7110e25851b13c0b75a7fb0cd3c4659878209867659c216b467bdcf51e786a59fad084886490fc77e186ab827d844d0ac4682651fc4043f8e87b905532a53017ada44feee1f89f9bc6d2a8b144e721a479f7b90acb91033774f4c12df633548a9097c791ec7e80fa2607c86fce6e9abcae1296528b8488ccf18a4bb0fc9b50c15d294e8d380465465b4eeae26eb6800faba611785cd2ff95ca1923dfa47d5923f89e4eadb612002caceaebbe779c4e3a3833455752eae63689ab8dc03db63d82feeab7f1162eed5909b69ccd5abeb9c071da82cfc76cc692a51d99e0c4bdfa6c81c9878e893a77e1e7105e7910827ddb3353612fa8d5e547b43b5abfe50829c1eb7bfda1731db2a9a1e8f0fc298dfa7009679489f9d9323338b7e59f1e48419ca531d88170a5a1995f576aa125edae9e9ea26f6e9c4bc26323b7db0998c528a7b343ccd87ff44c77e6cfc0a324cc1d4ea79c30015f0caaeccd46e5db580aa5ce8030c2b13b37494557da58abbdc7ce9fc9afa49ce0e8a7a6fa058db210ed654203e7879cf5004ebec57522ed34481b749554b36cd7171209b0763e110096704604f2d3f28c5ddc66c877e3ab63f36137d5a67cbf872aa6af79cb3a66c9040009b5e1c7b718c1b8788156b82d6d800dbe9fc3d16c812a963c73599b79efb89aa74bdbd9b1a2dc0b8ad853f79c0867a3a45d7a1645059171877687a72dd5ed4213c0ab84ef6185e7935346a84450887bdb2b216883e907b13b03c133adc04ab3c5f60209bd90aad3d94443105f08f0ee1b2231e1a1f8cce71de74d5308b78b5d99ce4ad4573faba9fab48bc1615f14d453c67714b99f274de041512b07b885679e6f89f481c28b082084b853c9afcda31def2898284d6ca28fb124df67142821c9705e28093ded60992d9587fb466df839aa2a4973dd48f9372a55da6592646fc918e533955566a2d8dc59277308223aea4dbe0daf839f95516b8995e9eec87df1df9d38693e0824dca7423b08d553b0ae1c5c44533b918eaa02dd17b4c8ce515ae7de410970f670e17b5e3c0a207fb8464d5d442694a271d593fc23ac19619bac32ac17cc6705ce2e6262361eba24277a471602e7ca57cc614ee116e60a9e0b6ac5e3228ea2c650baf1a09e9e5c7a1b25a078d1d11a673d88f6ee33e50d036d7fe4b9c06adc70aede2e35c6738b255690ed3f7a8d2d14e36e360f3bb66978d6cfcfc41887c751c0efc9325d4485a2f561060413fe6af4ce40d87a476201f15a584fc7ba18ddfef5f1d729d5f544c2c6b06befccb444f0408451089f20b06f05ab7d6702b97819b0eff6fb090f21afb3076558e692920053702fc2348f8dade0cb2b007f38d6dcd4ed3bb42553b1bd684791743a1941e5bf2ed234f44be64a95b485a3e949538a40542f25ca4bfce44e291037ab282082f02157a96f4ca0a0c5cd39215fd07461093a4d87a7979f7aa97142bf5b9ef71db537f9acc90f22ca2ded5c1ecd1ba972d05db7f71e8466085c9b3e975fa3a948f2c4049d1a8e46f71157017a3a74ad25e215dcfe7a4c5cb0a7baea0b0ec60c5df82555c553ac60dd39174c721edc0304b836a4de539c3ee55401e13848018f889cc4a0fcd01d9f4978eb730fb1b4a94ede0283f8c95062f01c8c8a3169b2d5c50cdd4f3a248d80a26c950b4036fc6ffefaf5101269fe3594c2cc128220a1d0b5f9f23121f2b184894e129159eaa92d9a30e878839be44d20cbdff3c338cc95795c86121b2b498bd376e895c98d67f6a27eecb46a203aa9de744feedf27b6825cc17aaa098b5ca05cad6bdbe320908ed36bdc8a8f2c777eeb9b037b36c0e36019c264b3e36196501d6cc90e7b1899a72bea5c8a24a5ae62e3684a39a06208bd382cd32acfabd742c76334797fa0c09a2a2a7e1240974afe0f3d6eb44590cf171efb7602009a93bde85cea6701c765dbca7c6a879be41dd08847802d4f59e933df65f727cbb45e3a4a5019f503b6fad7e0338e653f8b2c87aa7f196444e0dc1be6d7c4f0c7ddd663d06ff1365a9c362384a33b0315adbfb2d73359c485cd5410d36d21044bd8d3771c5492803b19f7f3a1a5c3248e66786479fa4416a55855adebeb09528ff5add597790b97bddc16bb9b7b33a1f800701c4293e2c8428dc2684726cfe5539ae0a9bf89e1b6f1989fd0433cc865b308bd0c636402b4b285c290e2439b9ecf0eba156fb6b613ea7f97b04506fe28e9471343c854fdfd48945a7f564acc817e609be8f8a7fdee12e9b592fd8c5c08f51ba8cb95be12cfa497d1539a4b8217818d47ebb3cc669014261530205948fdb9983a0e5759afa9b290ce838102661750ab06d7fe65a39efa6af36c042d2dee36402a6686d58eb144b76033cab4482b8fbdd213a90170939ec98df1fdfca4b37b143a971b9b59fc351098942bba090056c20e8cfbfe8fcbe361d068c98a020f67e807b8db2e45cad83c9970907646c0049c05c1ed657d53d859f1a47bfe6f022be0689de224034d0160b1dbc878ba6dd685911288d7af22ff5eedc1634c36e25f51d0757c7b9c73d7937955da356dea68749d464a75f56c9f6ba36cc1ca8c2f3aa34beae14fba894ca705111cdb19094432c2f6caa0eac78ab09b0cee330f36b1b91a6a5d4896cd15d96c12547826559441cbf578f189f5f04526a4cf76d60144090c2386b747ad50f7962ef2950d2c6f4ff8477ad0681ab24c47ea7ded8c9accff0dfa30489f43f0f3182b88e757fd9a1d82e1c9bb4efe5215518a6e48c688b2dabbd15107c5c6245de0acfd740ea54e0ec212f405f25bc3aafc63009631a4e4749296d47c2bcf25cc95afceb0a1ddb3c6124208f5134981c30489b42eeb864b3123b03106c9b234a465d87c30ef36e00244390de36a5dd93794467ef37bd01b86387855d2ac24e05370212e845082bb22c8fcda0f0bc78ddf971b0b9d69fc50e0d907408e9c9ac4e5099f47db2d0c14d888e363ece768555362a08c408d0119c45f158aad695d455d28e223be2862c19262c9f43eff8855b5a9af4f2cede95e415e2f597bb64c8bb2d608f86b15950ffe2e6bea3cdb221cf8b7eb35e0bdf6638283b09c68cda0bf1ccb9e353a7f0afb58d806923e36b22db68615a7e4e04d0932d928afdc8af3963378ebd5e05058160ac67fadb7a7d9ec498e00f63671b84d880d196c93afb4fc823e7d6576ad824ffb4c90fc780b163a292899ccfcaed81dee2c992787a66800e206df3dfc4a6b441d54ccb1a19a587402a663d510e45a5b1aa96fc467efaf7e71cbbff087f3d2922a133466d5ae9f86b0bc39bb3093b87ac2db941b1fd9e40427402781425d6e8856a2c66cbdd274f4c689758db6dd58ec7d766b177739e8c9173f2b1946be5396aad6d7ed29d058ac231e8c2e6a9077b4a217df4580a2d72bcf0b73e4bd07465deb8798a55ee855b82f1fa7d3748a40485bd90fab94b617d92219c4b65efa022936895e51873058615a19b9d1347120c405c3254f290b4c8b99c8ea9dde3a749ec538421a29d27b48ccd83852abe1a461123e4d36e56508d1827880960362d10835df77f9d4be51f1447cac5ae2017a814de58cd99bcc0c194254b17114ea48f5a0cfe6547686088d527c65180474fd460ffea5d48767ceb65c6fa3d7d3c632591d2d9d65c6c3a35a6ae4dc56322cd84734b0e7a092a4c46c1c607afa6d0e477e8d04e4993e595ba708a0f4466cd8a89fbc06d3cd366007296a9f05b66cfdcd5b30b6745e71d513205d5dbe1e8516d9e9cf133caa994ec0ac2c543d107efd4b9a7d9ee1ee415830a6c2ea17114ea9683726f2c82741f9ad4ac1be6772f0809f18c13f4cfc82fd1b7b3bd29615336003c6784c03fbcae475a58a3c4d68099732c326dfb7643eb150f2354918077bb798b5ecf491cdd0765e3e1ed5d0a37840f1a28f7e188a021781f1896dae7153f9d6639bf66be0c7857d7eccd2a1e6c9fd0cc3594477bb005df9b29f680c966161e37bcec97fc2ef7a2c3bf64e4df5785c9b080c7f9c6d7c515408445d55da499c03ba66369a31157bb03588e84a5303c46cd393c5bd6fbbb8deed94b62d67a9351c259b263c6c4fa65a4dbdd7eee080d82cc5e478c885678edbc9cfce74169ab748d7f4a08aec3e114394fc1d5e361267b8f3fcf38a024928d58158560f7da427680e7611a9f1b8255c67e6ea6b597ebd31bed9fd6f85f9b6ee63d4374c1e50597d1c9f3c56b4266bc632ba66ebecc396f6bead40392dcc138098b4166ab7f8714bd4db0615480705dd200da92dc51ec215844d7599e0a6262e8d5dc6a9452db8994d8b8f19ad4029e0b41b5e13fd6b56230cecea57f3111fe6c78876b3e657fab112968e83a0b64ce9837b89f5dad0d5f0b8b410e3a9a56ab2e9143e90fe371a944989ee206eef777cf4a235333c647e45aab910af492bc7c2213246374251e23accf5818aa2f24823bcba12efe3658e1e2cb49a5d4ffd26453829739647eccd106605921641afe16bbe79c8739062eabeeda4d4a42cb70d84e1e1d3506c7bfba5f5135aaae85b03dc6518eb30d832175cedc5bdca95e600e04902d9eda90c1da4bdd3138ac889398c239068857103ad70b5d1d9fac27c8ccfbcfcf126d9a5441bc963bce4669047ac901a14ca7c7e76f94c77159cdbda5360e04bb539a9d5ccd16a8cc88bacaa5b952c86b163575d7f1cab58f0d612d796b570f3c5debd7d9abde7e24de2c252173f1edc93817192699bddad45eeb41ff398c1bee4d2194f38bf4d2b4ed3a8895476bc441f464753139e204ff5dee7f45ce639d7541c0d396141aeff30cbbfa7157a61993eec98a4356df98665546a1d1e8429fb0c78684000862aac50f7d9a1413e89958f4defd3f087769cafc32bcd6016e496b41b7754cfbe42b352346fd585fb19a80f4af9a19811311b5fc6ea8eb5519a3cf7dbc1a06eed41668e332224c1daa01776e0886044f5a95e5dffc8d9ccce7840eeae97e8cc916db95bdc33fb420e28030c6edb011d5281db1dbeac9bfcaf938a757e3939b025d339e69b9692c8c7352787d399f342e96096e37ca208609e5f93629e36ee442db9fb822ea236683f79875e7dc73ec97f98fe0795f9d83f473cc80a589043a7edd953473684ea4e80f698683a0fc1d8863adc44fc13c27a08921a681ca1ad76207b1a97f8fff7db247ea09b3a6407ea83d82d82d171fc80a8f5fb9f19cd7e94fe121a6a0ef9c4cff7a8689c0abf750dadcc7442c2ca5ed437af5e88e89b0a783a1164cd1eb2a33a64c919d9f08fe5aa7a775352ab6027a7b73d6fef51acebec5516c2a5f2b932b2621bbd2cdb415fce9ba1dbc3de205869fa0423adcedd5570ab0b4b64afafaa458b3840b48f018297aa46426d7893418033f00b5378eac6a70275ec860609b07851b88ecb5da05086adfb80f47c71a77301ca0f1520dfb7a800bc8421abf5eb94942ec818e3a1d45f09ff93e6549b3ef6152c6abe38231b4a82e355e27e363184df51418286d7073cf464eee02310e84b3eccabd2120fcca333130357e1967f67a69f437dcf6a20ca21797230aad086bd4c28348f58b80ec5d27626004533993b9f85897d00bc271a62ab67f92e2eed6d900000000549e8344ad90b47fb5c1ed5908bce94d03bbe98a87a1733b5031f89644c2d35d729e1375969a82f0252859219407c5c87f5d249d5eb8c17001fc7c6dc5d1825851b41e5e937f2c39d7f7196f38f83619da2cddce747bb0e906d0fc13a11fc6c2be3d140ea6da886cd5e194ca9dbff565d2a82e7e82dc5a36084bf02029ea05a9cfe1f3dc80489b426a14372232940ffad8124bd515f0a73fa85c2aa0cd51d76a0cc6e75ccc35b702a4fed4d2e2828d98939406ddc6df1048f0a22611859d6bfcbb0873d102e4b8a86b5d9af8056447f6c1552a603d9f67009fa070db73a01e1b4adbe4e841d0b9a92d148b626c386b25687817e5ec07dbbfa1d62d078578fe21d546414e3c5e29e8e086d7e542a2eb74a67127e7f171e076bbdd62767aae3db467db1df13b3121023bcee33f814d767a9ef14651f76ec89910ed33e9804df8619f69ad06bf0559b00d4efbf6f44e922d50a18ffa25d8ac58dec53a93642186c0ca81b07fe5c14c9c13397649a53ebfcec118e5bb84db053e6e505d07a09bb50f33906e7febac3c85ca337111dbfcb7b9becccaaefa3d857d48f0b3d8646d70fdcf2f1dfb89cc3ba1394cb5de24d999c88235418bc0f20d4036bd0113d298b91c44fe042d3b8e4070e3f828499972524601c4725389122c7fc3e38eb799f7b755f23bd5362880b9275e58eab2c8f42e583890cb84e17f35025d1d76dd28171bee561d21451b4b2ebf23b923221c9ea06b924815889d2b605af66539c3b0ffc30c7170a5581727f0faddb257cb6ab28b3456737d3588fa3bce0ba6a2a5c3c94301fa8a4e6db358731bd3a4a62b42181e04241010d7bc3e973b9fe428175ec8f8e6cbd4e53c8bd957621acb1e42504e6f8a7bb30c382058fc9dcd0cd0ba0b789c316cd58d7b5606cc2a66c872f10e6663346d572ecc37ad1c3d8146a137e35e54096ddc2a5e2d26765d75615fecd09b864b29adfe92763ab54272365f56feeb9b57059744e765485ee322cb879fd3c8fd8bc4727d860995c548bcd41852349f1b2227f5a1f39b24549693fb05c04ba8f190673d11eb27d0bf628489f9b8049f5f3a1e1fed97ba9881da0031ef5960b6b0af825cfae8252b931f6151cba9bf889a5c74051a176c56d3cbb8915d3f28f8f684629bd1e3f87f27909b4e8eca6b88cdd60f3b5bbe0641a469e396080fdd2feeac7a11703b758f1815f100ab2ca4403af34a655f4c35e62778c276c96bb94a3d9f58f3bbd7ae6c4f133f7c4199f18d02d66598a54769415b376bb04b520881f23b22b32685ea1ea0dc179ab2f33f07c7039d1a5eedd1905d2a8c7d3c9686758ba5aafdd74f36da7f5522aff5c40e565b50cdd92ce353c3d6c97ce87f0495bdb95d70ea52c8c26b87cd337fd2283b88d7301c32f26833451b8f7c2ee5f44eec58d9eef2a39b3021a29c8747d36a2dbca6c0c085399bb720000000000000009d67e17060abad89c7d8b8970244c2f11ad2f4ae878a3676659b77178a9b651b12cf9c21e658a32999d596af4648f636df4de8c037d1fa63b1a685e8850156bf99e00666dbc03d3e3b44018659743127f91d44c99b578b86a44f3bcf1523c8cb45accc3c5fedfd7796411eddfc3a7a6b7c57ae10fd4bd3fe9f662dc59747ac4b7cc2584ae3ce2e42a41066dd0d560f1b4c83edc57121dade5e397380bec5f40b5d0beb14aef21b2c68ccfd0eb4959b5e7f5b5779903963298e3c9a2141f145137de1d604d9124c3c4f60a4d54da38a7c32ef2632fe66a8ce8e95ee95a570e18e9fbd44884afe291550839dd61e65c952a3f5c6b61850d1c2a77e18fde734a305b407cf6dbf17afd66da6e42f0e8f66092df46c79b44711f6e8aafa831fa1188beea696672b0e94cc3cae584b30dccf053634f792c2d9f4c87e306991b407949f2870b525d123f9ca23142a0ee13d05f51ed4ff2653727ad5bf16453276b2d5e7d7a8a0a1c4847cb61ac4b08d9abee25165a120d156775a534a62f9af3a3b62726101b94ae1e14352262f017c5361b3341952d194a6a2d470e60df3fde61d343e0af8fdff36ad976af6732b732ceb69344550555174fa280153e08f74d81f4ee69c1eb44a3468e8cf78bf7c1663dae3d31553466faa207b8e9887cb54209fac0b6f6d12d9588351c76e6bad884799afe856a25b5fe737d0ba737a0f1a12b4eb3ede48a0c38e6787ab42fca1c7f2ab42fa6104d5a99aa36b73ac3622ccae122524c28a6557cb7d0a7c7eb5de795647dca0621fc2c9599441dae7cc2a8631252abb5e0f22e9355e0a156a1ab7b1641e345045e8303b5f6dda5c3c1cc2637700cea25c004460d101fc42ad78ae477739a4efbacc57272cfafae15292dc3b2800d9f42002c2062af9a1f329e11140f8317242c04ac1f11cdb45f5f9ab18877daa214c151fb9ac54e3e010b5e7944d7217442d5c4fc29956c1333cb932424096f5b6afe1128db53f7171be4372be8bae538bcb3e4a2eb29608678735a667135e0f2660956e9e2a3ed862209efe65d9ab2fbbf88e5d3384fb3362af00e1ec6b4d3ca40df442b70951026438877189c4b0ae136a9a35c131fdf19115e8dc1ee2b938bfbfdb3808aebbe7dfbbd3510c7070388f5813e8bc63be744b99116c4b84ea37d57c5da7a80cc883aa915d84a249ebfa78ceb124c63b3a0720b19483189ee50824e8581556f0520e434803204cd0f3dd09fc97c979f9a7e3f8e5eca8fccde98fc4939551338235c0c6378faade0d18f7050f29189485e01ec120239373c5478cd19ab27570921415a6680924baf9c5829f3f2115460d1fceb8a026fa1a0a0047fe1cd6fcf1861dd3784e006abfddfe79461c5001e4e32d99c5bc203c21f8c711c5ecccf8941093d95a8db73722bb7511443fb2670244cc1249492e92fc4bf7e06ec6f08c5c6931929d58232b551957b771ea5e4a932b037904b81916e662e3fe95af894e80f699e5c00ab664f381bd9c0bd41322a8b3cf367577429fa52c0f1c44ffc626c215e7103cba05bff4931d9a202c1eb9068f44983d1e0c6d9fb5fed738561651e854a3c1b362ae354a0b4a270386ed2dbef093bd82f07f25edfae31901cb86fd214576b25f769bcb215214c63026b2581a8d17779aae03ba310f3243b3631f4b01c9e3eb342c3bdb44d8e47cdc1683e3b1cfffef72e385cc8831f99425fc406575170e1c106618d5429144a436b9e92d241d8118b5cbe0dca5e8ddd86e671e13080eddcf8dee9e317d192a3a5386378de9b1ecd8cf5439cfbe9f65965e5a5f6c145627ac23fe30c2e06e623b0eca15b225b32b65ce568b656cec0e0d6752fdebffd39c7538472ad7a195b56fcad3fab80016ff006df6b01d785191e4fca143b14ce68b32571476a779515ccb14d35cf9aabd4849c03c9bf12a42cfc2a7146ed6c25892a9d1c48f95314f641142d38cd882e54534d69b3fcc18044309e6debef6dc79d7737956418b955d33737115b44360e0bac14b71e2e64f0c8aea428dce5b65e210c108f832a6041c0aab116488e5863cd1039dc8af537908be3541352bdad303de43387503d19d7c0f0390bdc5b95f1dfb0701fd0e14a22c210837cc0a1cb059de474f4476bfe9bddfe3e7977fb299e82d9eefb18111f7c4a5fbd406fca720fec69340d978f4c9832204d67f6fa5793325e04d4af84acde0b56158e4c606394286a4b3cfc04a426a665529b753e1ce2d6c613159844bd069a67b5b96cb8ec993f05a8e252ed3d8ed63d524af0845f519f9d47b85a773f37031cb91055fb963db50e6a1e368f10a82fa40ac055e0201c6d29661eadb76f8154ef9c1cc210ccf1ccb063e8c00324ed6a14fdefa0167a9abb04debbbf5e7b8a57a7772373c765947f0f67b5130d77a6ca6ab166147d4eba97b4ddf1465d25b02f4430227b5713a29fd84664bfdfa5fc450e48f5263eaca67c16033b79bf1cb819511cf16bae6ffd5d05a7d9cc93067b6f2512fea2424a9c7d178f653ffa7ce1c00924707e3817c7cd461cb2a8cc5eadc40821258eaad7720ee3976c5a60025c317480016e5e5bd884f3646651f3bdc1185ec1a4112eb24ba5b3b6f94ac66322042d4bc48cb5befabfcf950cf8a0165fba3fa019324b53fb56bbfaec7f4ec733e84c22f841c1c9c1dc51dd3ac4887e155ac4095a6b8846c8f401f3c2d48d4de18906193a9f05ed59e3b0add8bc27c0bad8418ccbb842123ce1d39fdeeaa7984dfba9ef121ab4d4d35de076262636f3815708e4bcf31e634a290b13317425b1a4a2e4ebf8537092c7e524c126faa9622bf1337168e003857805dd420a51816fea3cd37c34e483f64a2da3ab67442314ffff40727835a1bc7b9971ccb5f83183cf1a135defd468907b988d97028f904c4d9c712f7d0ed6abe4d80712a7b7e06efcbe6a5b83e32beb1556326af7a97437c35c6a706c6cf4403b98f5134547ac167fd1abcb9245ec3450202ab80e553952412032a6c3cfa64441d4aecabd1e182c50bf67801fd3b44b40648ac9926bbbd7095425a429f2a9550c2fd1267cbf6156897b705255cadf1c7f233f4effd788b3f446dba19e68bbf8b42ff6caf984a4eb51328ab5e2bc28366e8b4df4df967a166470a00", 0x2000, &(0x7f0000000800)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000001040)={0x1f, 0x0, 0x0, [{{0x200000000000, 0x0, 0xfffffffffffffffd, 0x2, 0x0, 0x0, {0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x2, 0xc000, 0xffffffff, 0x0, r2, 0x2000, 0x10000000}}, {0x0, 0x0, 0x1, 0x0, '\x00'}}]}, 0x0, 0x0, 0x0}) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=@newsa={0x138, 0x10, 0x1, 0x0, 0x0, {{@in6=@local, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x16, 0x0, 0xffffffffffffffff}, {@in=@multicast1, 0x0, 0x6c}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', {}, {}, {}, 0x0, 0x0, 0xa, 0x2, 0x0, 0x67}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}}, 0x0) 8.843235466s ago: executing program 8 (id=1615): syz_usb_connect(0x0, 0x2d, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x33}}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x3, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41100, 0x25}, 0x94) connect$inet(r1, &(0x7f0000000280)={0x2, 0x0, @broadcast}, 0x10) sched_setscheduler(0x0, 0x1, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) io_setup(0x222, 0x0) write(0xffffffffffffffff, &(0x7f0000000140)="26000000220047010500", 0xa) sendmmsg$inet(r1, &(0x7f0000004d00)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x30000}}], 0x300, 0xf00) r3 = socket(0xa, 0x3, 0xff) setsockopt$inet6_int(r3, 0x29, 0x21, &(0x7f0000000080)=0x8, 0x4) sendmsg$inet6(r3, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000001680)=[{&(0x7f00000002c0)="5665702f5e5648f3dab42167388ebf5ed679d647b515d24e4890314545f8", 0x1e}], 0x1}, 0x80090) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) 8.159930141s ago: executing program 2 (id=1616): mknodat(0xffffffffffffff9c, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) r3 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) getgroups(0x2, &(0x7f0000001080)=[0xee00, 0xffffffffffffffff]) keyctl$chown(0x4, r3, 0xee01, r4) keyctl$setperm(0x5, r3, 0x30925) keyctl$KEYCTL_MOVE(0x3, r3, 0x0, 0x0, 0x0) 7.521649703s ago: executing program 7 (id=1617): syz_usb_connect(0x0, 0x2d, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x33}}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x3, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41100, 0x25}, 0x94) setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000000)=0x4, 0x4) sched_setscheduler(0x0, 0x1, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) creat(0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000140)="26000000220047010500", 0xa) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, 0x0, 0x0) gettid() sendmmsg$inet(r1, &(0x7f0000004d00)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x30000}}], 0x300, 0xf00) r3 = socket(0xa, 0x3, 0xff) setsockopt$inet6_int(r3, 0x29, 0x21, &(0x7f0000000080)=0x8, 0x4) sendmsg$inet6(r3, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000001680)=[{&(0x7f00000002c0)="5665702f5e5648f3dab42167388ebf5ed679d647b515d24e4890314545f8", 0x1e}], 0x1}, 0x80090) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) 7.395522399s ago: executing program 3 (id=1618): mprotect(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x2000001) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x1) lsetxattr$trusted_overlay_origin(&(0x7f00000000c0)='./file0\x00', &(0x7f00000001c0), &(0x7f0000000280), 0x2, 0x2) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) socketpair(0x15, 0x800, 0x20000005, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$rds(r0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000}, 0x4000080) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) write$P9_RSTATu(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="930200007d00000005f0000000000000040000000000000000000000000000000000000000000000000000000000000000001f00206e6f6465767b6376666f7892ffffff8102000000000031ffcebc920000003800704a86ce"], 0x232) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) syz_clone3(&(0x7f0000000200)={0xc001000, 0x0, 0x0, 0x0, {0x33}, 0x0, 0x0, 0x0, 0x0}, 0x58) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000003c0)=[@text32={0x20, 0x0}], 0x1, 0x6c, 0x0, 0x0) ioctl$KVM_SET_MSRS(r6, 0x4008ae89, &(0x7f0000000240)=ANY=[@ANYBLOB="01000000000000008f04"]) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)}, 0x0) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r7, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r8, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000000)='autofs\x00', 0x0, &(0x7f0000000100)) r9 = openat$autofs(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r9, 0xc0189374, &(0x7f0000000580)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x29}}, './file1\x00'}) timer_create(0x2, 0x0, &(0x7f0000000540)=0x0) timer_settime(r10, 0x1, &(0x7f0000000600), &(0x7f0000000640)) timer_getoverrun(r10) lsetxattr$security_evm(&(0x7f0000000080)='./file0\x00', &(0x7f0000000100), &(0x7f0000000140)=ANY=[@ANYBLOB="00000000000000e130a04ee3"], 0xfffffffffffffea4, 0xf6896ac5e1486834) 6.835849663s ago: executing program 1 (id=1619): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x4000000000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x11, 0x3, &(0x7f0000000740)=@framed, &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x38, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000080)='sched_switch\x00', r3}, 0x18) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./file0\x00', 0x2c41, 0x0) flock(r4, 0x5) r5 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0) flock(r5, 0x2) (fail_nth: 1) dup3(r5, r4, 0x0) 6.797881537s ago: executing program 2 (id=1620): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c) mmap(&(0x7f0000000000/0x2000)=nil, 0x30000, 0x2, 0x11, r0, 0x0) mprotect(&(0x7f0000350000/0x2000)=nil, 0x2000, 0x1) syz_clone(0x1100, 0x0, 0x0, 0x0, 0x0, 0x0) 5.558181656s ago: executing program 2 (id=1621): pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newqdisc={0x44, 0x24, 0x2, 0x1, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0xb, 0x5}, {0xe, 0xfff2}, {0xa, 0xfff1}}, [@qdisc_kind_options=@q_codel={{0xa}, {0x14, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x7}, @TCA_CODEL_LIMIT={0x8, 0x2, 0x738}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x40000}, 0x4048084) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) signalfd(r1, &(0x7f0000000100)={[0xffffffffffffffff]}, 0x8) write$char_usb(0xffffffffffffffff, &(0x7f0000000040)="e2", 0x12d8) write$binfmt_misc(r1, &(0x7f0000000000), 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 5.063603142s ago: executing program 3 (id=1622): r0 = syz_open_dev$evdev(0x0, 0x2, 0x842) syz_emit_vhci(&(0x7f0000001800)=ANY=[@ANYBLOB="040e0cff3c20"], 0xf) ioctl$EVIOCGBITSND(r0, 0x40044591, 0x0) r1 = dup(r0) write$UHID_INPUT(r1, 0x0, 0x0) 5.042769936s ago: executing program 8 (id=1623): r0 = socket$nl_generic(0x10, 0x3, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYRES32, @ANYRESOCT=r0], 0x50) prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) gettid() timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) rseq(&(0x7f0000000240)={0x0, 0x0, 0x0, 0x4}, 0x20, 0x0, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xa}}, 0x2}}, 0x2e) r3 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r3, {}, 0x2, 0x4}}, 0x26) ioctl$PPPIOCGL2TPSTATS(r3, 0x8004745a, &(0x7f0000000ac0)) 4.569130501s ago: executing program 1 (id=1624): r0 = socket$nl_generic(0x10, 0x3, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYRES32, @ANYRESOCT=r0], 0x50) prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_emit_ethernet(0x5e, &(0x7f0000000240)={@local, @link_local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x4000005c, 0x0, 0x0, 0x0, 0x0, {[@exp_smc={0xfe, 0x6}, @mptcp=@syn={0x1e, 0x0, 0xa, 0x1, 0xff, 0xfffffffd, 0x80000001}, @nop, @mss={0x2, 0x4, 0xb}, @nop, @generic={0x8, 0xf, "890b13fda8ca286095da2b7394"}, @eol]}}}}}}}, 0x0) r1 = gettid() timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) rseq(&(0x7f0000000240)={0x0, 0x0, 0x0, 0x4}, 0x20, 0x0, 0x0) rseq(&(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x5, 0x2, 0x8, 0x4}, 0x4}, 0x20, 0x1, 0x0) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xa}}, 0x2}}, 0x2e) syz_pidfd_open(r1, 0x0) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r7, 0x29, 0x20, &(0x7f0000000180)={@remote, 0x8000000, 0x0, 0xff, 0x1, 0x66}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r7, 0x29, 0x20, &(0x7f0000000180)={@loopback={0xfec0ffff00000000}, 0x8000000, 0x2, 0x3, 0xa, 0x0, 0x9}, 0x20) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'macsec0\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newlink={0x44, 0x10, 0x1, 0x10, 0x25dfdbff, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_MACSEC_INC_SCI={0x5, 0xf, 0x1}, @IFLA_MACSEC_WINDOW={0x8, 0x5, 0x5}]}}}]}, 0x44}}, 0x0) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0, {0x50114d78da4c4ffd}}, './file0\x00'}) ioctl$TIOCMSET(r9, 0x5418, &(0x7f00000000c0)=0xbb) connect$pppl2tp(r4, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r4, {}, 0x2, 0x4}}, 0x26) r10 = socket$alg(0x26, 0x5, 0x0) bind$alg(r10, &(0x7f00000007c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(sm4)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r10, 0x117, 0x1, &(0x7f0000001280)="b7f2288a911993f08d3aaea2bc0000de", 0x10) r11 = accept$alg(r10, 0x0, 0x0) sendmmsg$alg(r11, &(0x7f0000001040)=[{0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000080)="c16a22213bc73b5c37696b90ad5bca70304193fc04574d3ca94f8bd1cfecb4c0bbc0c62d3e3b7d4578bd360ea718afacbfd6c7559a0363ec0d12576131d3c2de8be8d600ab0c76798f2675cf5d68d137fe86e1d0", 0x54}, {&(0x7f0000000100)="9f1ac09f155c1291fc8baa01adb9b575263c1a877ef8644bccc1143c6da61222f05eacf50665f3905cc2fd3e4e81e2a13e7fcca4b10085ea82589f9511a2f87ee914c9e0894139310b5457cfe7ca3ae3dade5d7a11f014f2bbdec62e2df3daf9875c79c6763fdcb8830f378346bd7c5c71ab8fffc299f6aea8ae05a727e64cbf8c3de5c36604fa3a7f43c2d51832aa29a52a9dd46c823bc89a7cc268e91fff716052173384c4e76c9921c2accb039cbf2cfb99a47371db803c3dce71aa0555a2c0fdb6c8e812ac6974d7b3d749bbc7f90a6a79dd2d20ff1637187bf9b58377bd5ae528", 0xe3}, {&(0x7f00000012c0)="8e39308f7428bb361aa0e207e2191e9248da9eac174411869ef60059a981c6a11223cca963f4b365a2419adcb920c2a14965defd6186c5bfc157b6c1c219985ea4badc7bf93f3c939e452c503f86abee100fd05e2367155747876bd524b58bf60f115d5ac1d8bcd3dc85840f8ee47f46c74a4d11f53e68baa8de704b0d9b419407f8ddf3ec6b5dffa0d41dea9381328cacda24d9a3abd058062ad7ad510b02816e20128a7dedd60e86cb5e679599faad3d09e770721f2d5db2e56b1e0972c331f365076d7bdeff03a3ca3f9926227c5a8cd0a4353819b0d37240503464cea7ad56fcdd32a12249d89d50685ff6742a95f669b780b80cfb70e90dee859d9ba7cf3481464ec7c3caefd5c605e66a3d78b6009a7ff6a92ae0fb552ea843ab8f734ffa9d9c09cf3880d8c2fb2d69c43a2f226b82540e3d5ff90ab3dfebea678aefae560a219fc38ec4003d06d073f7d0c0b00e507ab3434fd940f78b533fa8a1b87eb1ef9ab834231322cec017924af412f4c84610e43c92776ab67ca044aea44091d7c4d5f713a3f71e30cf1a8bd38c94a6e0d3baf22f5a1270219032cadf9ae7251c099c2118f12db2fa45a9a352020c886bf078b21f8f90cf8d6fdf28481fdb34de485d3e405ae967418cc3c9981a62d724af44cd9ca8d2dafd2a26b9609d6259130fdfdbb87ed72c2fe3ece03326689e5cfeabe2d9c90896972a8e4e225c7924d075ad7a55d13fa6998f378c5a091de397cefd09b6b1e3c96036191d19ef0260229abb41a2742d7dbb822a42e71e014ecf37da6a7a7a3ed57a83f9e431ac4cdc8be05907e6871bc003bd4965c795abeec48e229c9879123bbd97ecf8df06144fea3ee0eedbfe86f4e0d9933558c73401594f9cb1fc45aab218ce19c1141195251895f073d9eff719ab51585965704589f7b5c2367dd862b876e691dca46beb3860bc4fb4316cedb1b54ee172508a89f735ed67bf892e49743a651ace59def91b99c94b3a8adb626d55117f6d0cc765a37e2b5a537ca8149246b1d8d165d9af69d002a23039faa872ae1b", 0x2ea}], 0x3, 0x0, 0x0, 0x80}], 0x1, 0x50) 4.233494676s ago: executing program 3 (id=1625): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) socket$inet_smc(0x2b, 0x1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfffffffffffffebe}, 0x90) r0 = syz_io_uring_setup(0x24fa, &(0x7f0000000b80)={0x0, 0x1, 0x10100, 0x10, 0x4033a}, &(0x7f0000000300)=0x0, &(0x7f00000004c0)=0x0) sendmsg$IPSET_CMD_TYPE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='8'], 0x38}}, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r3, &(0x7f0000000180)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r3, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_RECVMSG={0xa, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}) io_uring_enter(r0, 0x2d3e, 0x0, 0x40, 0x0, 0x0) 3.998728217s ago: executing program 8 (id=1626): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat$smackfs_cipso(0xffffffffffffff9c, &(0x7f0000000280)='/sys/fs/smackfs/cipso2\x00', 0x2, 0x0) write$smackfs_cipso(r3, &(0x7f0000005980)=ANY=[@ANYBLOB='syz0\x00 0000'], 0x31) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000002d00)=ANY=[@ANYBLOB="200000001000010700000001000000000a0000000c0002006e6c3830323131"], 0x20}}, 0x800) readv(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) recvmmsg(r4, &(0x7f0000000780)=[{{0x0, 0x0, 0x0}, 0x7f}], 0x1, 0x40012100, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) (async) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) (async) getpid() (async) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) (async) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) (async) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) (async) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) (async) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) openat$smackfs_cipso(0xffffffffffffff9c, &(0x7f0000000280)='/sys/fs/smackfs/cipso2\x00', 0x2, 0x0) (async) write$smackfs_cipso(r3, &(0x7f0000005980)=ANY=[@ANYBLOB='syz0\x00 0000'], 0x31) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$nl_generic(r4, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000002d00)=ANY=[@ANYBLOB="200000001000010700000001000000000a0000000c0002006e6c3830323131"], 0x20}}, 0x800) (async) readv(0xffffffffffffffff, 0x0, 0x0) (async) bpf$PROG_LOAD(0x5, 0x0, 0x0) (async) recvmmsg(r4, &(0x7f0000000780)=[{{0x0, 0x0, 0x0}, 0x7f}], 0x1, 0x40012100, 0x0) (async) 3.918130794s ago: executing program 1 (id=1627): socket(0x840000000002, 0x3, 0xff) r0 = socket$unix(0x1, 0x1, 0x0) bind$unix(r0, &(0x7f00000001c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x56) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0xb) bind$netlink(r1, &(0x7f0000000340)={0x10, 0x0, 0x25dfdbff, 0x404}, 0xc) r2 = fcntl$dupfd(r1, 0x0, r1) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)) r3 = socket$netlink(0x10, 0x3, 0x4) writev(r3, &(0x7f0000000300)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560aff820fffff5bab003a0000002058000b4824ca945f6400940f6a0325010ebc000000000000008000f0fffeffe809005300fff5dd00000010000100040c100000000000224e0000", 0x58}], 0x1) r4 = syz_open_dev$audion(&(0x7f00000002c0), 0x8, 0xa2080) r5 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000580)={0x1b, 0x0, 0x0, 0x3, 0x0, r2, 0x854, '\x00', 0x0, r4, 0x2, 0x0, 0x5}, 0x50) r6 = syz_open_procfs(0x0, &(0x7f00000004c0)='mounts\x00') r7 = epoll_create(0x7) epoll_ctl$EPOLL_CTL_ADD(r7, 0x1, r6, &(0x7f0000000500)={0x10000000}) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000004c0)={0x6, 0xc, &(0x7f0000000100)=ANY=[@ANYBLOB="6c65f423f7b486364d7fa7000400000018120000", @ANYRES32=r2, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000001e8a00000e000000112504000400000057382f53fdffffff18440000fdffffff0000000000000000"], &(0x7f0000000080)='syzkaller\x00', 0x9, 0xa7, &(0x7f0000000380)=""/167, 0x41100, 0x38, '\x00', 0x0, 0x25, r2, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000180)={0x4, 0x1, 0x5, 0x5}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000240)=[r2, r2, r5, r2, r2, r6, r2, r2], &(0x7f00000002c0), 0x10, 0xfffffffb}, 0x94) bind$netlink(r2, &(0x7f0000000200)={0x10, 0x0, 0x25dfdbff, 0x2772db1443cb86b7}, 0xc) setsockopt$sock_int(r0, 0x1, 0x20, &(0x7f0000000040), 0x4) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x1, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) r8 = socket$inet(0x2, 0x80000, 0x4) inotify_add_watch(r2, &(0x7f0000000440)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x80000040) sendmmsg$inet(r8, &(0x7f0000000f40)=[{{&(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10, 0x0}}], 0x68000, 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x1c0002, 0x0) 3.915536725s ago: executing program 2 (id=1628): pread64(0xffffffffffffffff, &(0x7f0000001600)=""/4103, 0x1007, 0x97) r0 = fanotify_init(0x0, 0x0) ioctl$LOOP_CONFIGURE(0xffffffffffffffff, 0x4c0a, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000009c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000100)='sched_switch\x00', r1}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2) ioctl$VIDIOC_G_EXT_CTRLS(r5, 0xc0205649, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) (fail_nth: 1) 3.78446994s ago: executing program 7 (id=1629): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000300), 0xffffffffffffffff) r6 = socket$inet6_udp(0xa, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xe, 0x6, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x71, 0x11, 0x39}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x5}, @exit], {0x95, 0x0, 0x5a5}}, &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x6}, 0x70) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r4, &(0x7f0000000d00)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f00000001c0)={0x1c, r5, 0x1, 0x70bd2d, 0x25dfdbfc, {}, [@WGDEVICE_A_IFINDEX={0x8, 0x1, r7}]}, 0x1c}, 0x1, 0x0, 0x0, 0x202e98cd6426236a}, 0x4008020) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f0000000280)={&(0x7f0000000040), 0xc, &(0x7f0000000100)={&(0x7f0000000580)={0x5c, r5, 0x8, 0x70bd2d, 0x25dfdbff, {}, [@WGDEVICE_A_PRIVATE_KEY={0x24, 0x3, @a}, @WGDEVICE_A_PRIVATE_KEY={0x24}]}, 0x5c}, 0x1, 0x0, 0x0, 0x40000}, 0x2881) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) r8 = syz_open_dev$dri(&(0x7f0000000500), 0x888f, 0x200) ioctl$DRM_IOCTL_ADD_CTX(r8, 0xc0086420, &(0x7f0000000540)) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, 0x0, &(0x7f0000000240)='//\xf2/\x06\b///o\xdc\xea\x95\x9a\x82\x10\x97W\x8f7\x98\x9b\\/\\\xf9\rmD\x94)U\xdb\x15X.I\n}\xf3\x9d\xe4_\x05\x9cqf4I^#b?9\xde\xafu\'\x83L\xe0\x97\xe1n_\xa4%\xb1\x97\x93\xafv\xce/\\\xb4L\xf2_\xa7\xfb\xf4\x84\x1fA\xeas^\xef\xa2\x85\xa3!\xfb\x93\xd7R\xab2\x1eW\xe9h\x9b\xf7ul\xf9D\xd4\x82X5\x13\xaa\x87\xf9\xba\xa9m\x14\x14R_\x9a\\>4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\xef\x8b0x0}) sendto$packet(r9, &(0x7f00000002c0)="05031600d3fc140000004788031c09102c28", 0x12, 0x80, &(0x7f0000000140)={0x11, 0x86dd, r10, 0x1, 0x0, 0x6, @multicast}, 0x14) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0xf, &(0x7f0000000340)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, {{0x18, 0x1, 0x1, 0x0, r11}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000001dc0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r12 = socket(0x10, 0x3, 0x0) getpid() sendmsg$nl_generic(r12, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)={0x14, 0x52, 0x201, 0x0, 0x0, {0xa}}, 0x14}}, 0x40044c4) 3.736214934s ago: executing program 3 (id=1630): mknodat(0xffffffffffffff9c, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) r3 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) getgroups(0x2, &(0x7f0000001080)=[0xee00, 0xffffffffffffffff]) keyctl$chown(0x4, r3, 0xee01, r4) keyctl$setperm(0x5, r3, 0x30925) keyctl$KEYCTL_MOVE(0x3, r3, 0x0, 0x0, 0x0) 2.315511882s ago: executing program 3 (id=1631): r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) r1 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000180)=ANY=[@ANYBLOB="1201fb0019030320d812010079de01ec020109021b0001000003000904000001785ecc00090585020004"], 0x0) openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='net/rt_cache\x00') read$char_usb(r3, &(0x7f00000000c0)=""/41, 0x29) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r3, 0x1, &(0x7f0000000340)={0x450, r0}, 0x0) read$char_usb(r2, &(0x7f0000000000)=""/188, 0xbc) read$char_usb(r2, &(0x7f0000000100)=""/67, 0x43) r4 = signalfd(0xffffffffffffffff, &(0x7f0000000240)={[0xfffffffe]}, 0x8) read(r4, &(0x7f0000000740)=""/384, 0x200008ca) sendmsg$IPSET_CMD_TYPE(r4, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x54, 0xd, 0x6, 0x801, 0x0, 0x0, {0x1, 0x0, 0xa}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,port\x00'}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:mac\x00'}, @IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x54}, 0x1, 0x0, 0x0, 0x800}, 0x1) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_disconnect(r1) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18, 0x68000000}, 0x0) r5 = socket$kcm(0x21, 0x2, 0xa) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a70000000060a090400000000000000000200000044000480300001800e000100696d6d6564696174650000001c000280100002800c00028008000180fffffffe0800014000000000100001800a00010071756f74610000000900010073787a30000000000900020073797a3200000000140000001100010000000000000000000000000a"], 0x98}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000001c6a000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x16, 0x16, &(0x7f0000000440)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000080000003d0301000000000095000000000000006926000000000000bf67000000000000150700000fff00003506000002000000170600000ee5e50cbf250000000000001f650000000000007507000002000000170700004c0001000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector}, 0x94) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a68000000060a09040000000006000000020000000900010073797a3000e2ff000900020073797a32000000003c000480380001800b00010064796e736574000028000280080004400000000008000340000000000900010073797a3100000000080009"], 0x90}}, 0x0) sendmsg$kcm(r5, &(0x7f0000000080)={&(0x7f0000000100)=@rxrpc=@in6={0x21, 0x2, 0x2, 0x1c, {0xa, 0x4e23, 0x9, @private1}}, 0xa0, 0x0, 0x0, &(0x7f0000000180)=ANY=[], 0x18, 0x68000000}, 0x80fe) r7 = socket$kcm(0x21, 0x2, 0xa) sendmsg$kcm(r7, &(0x7f0000000080)={&(0x7f0000000100)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x4e23, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}}}, 0x80, 0x0, 0x0, &(0x7f0000000180)=ANY=[], 0x18, 0x68000000}, 0x80fe) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, &(0x7f00000002c0)={'vxcan0\x00', 0x0}) connect$can_j1939(r4, &(0x7f0000000300)={0x1d, r8, 0x3, {0x1, 0xf0, 0x3}}, 0x18) prctl$PR_GET_NAME(0x10, &(0x7f00000004c0)=""/66) openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) 2.131458066s ago: executing program 1 (id=1632): pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r1, &(0x7f0000000000)="06", 0x1) r2 = socket$alg(0x26, 0x5, 0x0) r3 = socket(0x840000000002, 0x3, 0xfa) utimensat(0xffffffffffffff9c, 0x0, 0x0, 0xb34caef819d8855f) connect$inet(r3, &(0x7f0000000140)={0x2, 0x0, @remote}, 0x10) sendmmsg$inet(r3, &(0x7f0000005240), 0x4000095, 0x0) setsockopt$sock_int(r3, 0x1, 0xb, &(0x7f00000003c0)=0xfff, 0x4) bind$alg(r2, &(0x7f0000000280)={0x26, 'hash\x00', 0x0, 0x0, 'blake2b-384-generic\x00'}, 0x58) r4 = accept4(r2, 0x0, 0x0, 0x800) sendmsg$NL80211_CMD_GET_WOWLAN(r4, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000003c0)=ANY=[], 0x30}, 0x1, 0x0, 0x0, 0x1}, 0x0) r5 = fsopen(&(0x7f0000000000)='9p\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000c80)='source\xbb\xbf\xf1BSON\x98G\xd3\x86?E\xf5-\x80\xc0\"G\x1e\x97Nx\x92]\xc9P\xf6X\xd2?\x94\xf4\x1e-\xce*V\"J\xe8\xd2\x96p\xab R\xac\xd6Ld\x92\xe0\x87\xa4\x11}\x02\x12\x8e\xbdn}\b#\xf0\xa5\xd0\xdb\xe1\xdc\x1c~\xbb\xe3\x84j\x1d\xb3\xb7Wp\xc3\x9e/\xd0\x9a\xa1\x87\xc7\xf6\xd7\x88^_\x1e\x16\x0e\xc2\x9c\x99\x9d;2\x05T)z\xa5\x01S\x96wG\x96`\x9c]\xd1\xb0`,\xef@\x827\x9d\xc9\x19F\x1a\xf9V(\x94\"\x89\x91\xe0\xa7E\xd1Bgd\xc8#:\x13f\x16\xd5\xc5y\x9e?\xa3l\x9cd\xb9r\x02\x81\x0f\xba\xf5\x7f\xac\x87\x10\x9fW(\x9cB\x00\x99\xdb\xf3\r', &(0x7f0000000dc0)='//\xd1\x1c\x83\xean\xf2/\x06\b/?\\o\xdc\xea\x95\x9a)\x00bb\x8a\x80\x91\xdf\\/\\\xf9\rmD\x94)U\xdb\x15X.I\n}\xf3\x9d\xe4_\x05\x9cqf4I^#b?9\xde\xafu\'\x83L\xe0\x97\xe1n_\xa4%\xb1\x97\x93\xafv\xce/$K\xe2\x1b\xcc\\\xb4L\xf2_\xa7\xfb\xf4\x84\x1fA\xeas^\xef\xa2\x85\xa3!\xfb\x93\xd7R\xab2\x1eW\xe9h\x9b\xf7ul\xf9D\xd4\x82X5\x13\xaa\x87\xf9\xba\xa9m\x14\x14R_\x9a\\>4\xce\x8e_#\xf8D\xb1\xdep\x01\xd8:\xa6h\xd1\x1d\xac\xaa\xfb\xc7Y\xcd\xc5n\xeb\xab\xf70\x99\xef\x8b0x0, &(0x7f0000000400)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000080)=0x103, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000040)=""/15, 0xf}], 0x1, 0x0, 0x1}) io_uring_enter(r4, 0x47ba, 0x3000000, 0x0, 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(0xffffffffffffffff, 0x4008af20, &(0x7f0000000040)={0x1, r3}) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/67, 0x0, 0x4}) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, &(0x7f00000000c0)=""/87, 0x0}) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f0000000680)) r7 = socket$nl_rdma(0x10, 0x3, 0x14) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r3, 0x0, r10, 0x0, 0x2, 0x0) splice(r9, 0x0, r8, 0x0, 0x114, 0xe) r11 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r11, 0x89f8, &(0x7f0000000440)={'sit0\x00', 0x0}) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r7, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="00010000031401"], 0x100}, 0x1, 0x0, 0x0, 0x4040024}, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, &(0x7f0000000000)=0x1) syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000000)={0x81, 0x0, 0x0, &(0x7f0000000100)={0x0, 0x8, 0x1}, 0x0, 0x0}) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1000004, 0x10010, 0xffffffffffffffff, 0x0) 546.322171ms ago: executing program 7 (id=1638): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$ptp0(0xffffffffffffff9c, &(0x7f00000001c0), 0x8100, 0x0) ioctl$PTP_PEROUT_REQUEST(r1, 0x40383d03, 0x0) sendmsg$IPSET_CMD_FLUSH(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, 0x4, 0x6, 0x101, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) r2 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_GET_FEATURE(r2, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x10, 0x3fb, 0x8, 0x70bd27, 0x25dfdbfb, "", ["", "", "", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000000) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r3, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000500)={0x20, 0x12, 0x1, 0x0, 0x440000, "", [@generic="c69a243764bedebb4754e765b1"]}, 0x20}], 0x1}, 0x4040000) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_TID_CONFIG(r3, &(0x7f0000001c00)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000001bc0)={&(0x7f0000001c40)={0x1934, r4, 0x4, 0x3, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_TID_CONFIG={0x34, 0x11d, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0xa4}]}, {0x24, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_NOACK={0x5, 0x6, 0x1}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5, 0x6, 0x1}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5, 0xa, 0x1}]}]}, @NL80211_ATTR_TID_CONFIG={0x14c, 0x11d, 0x0, 0x1, [{0x54, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x24, 0xd, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x20, 0x3, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x5, 0x4, 0x8, 0x97, 0x5, 0x7, 0xad3, 0x1]}}]}]}, @NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0x6a}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5, 0x6, 0x1}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5, 0x9, 0x1}]}, {0x38, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x45}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x6}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0xd5}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc}]}, {0x34, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0xed}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0xa4}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0xa4}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0x7e}]}, {0x28, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0xf7}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0xa}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5, 0xc, 0x2}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5, 0xb, 0x1}]}, {0x60, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x200000000000000}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5, 0x6, 0x1}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x74}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x40}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x9}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x5}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x9}]}]}, @NL80211_ATTR_TID_CONFIG={0x588, 0x11d, 0x0, 0x1, [{0x18, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0xcc}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5, 0xb, 0x1}]}, {0x58, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5, 0xc, 0x1}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x1}, @NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0xbe}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0xeb}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0xe0d5}, @NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5}]}, {0x34, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_NOACK={0x5}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x3}, @NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5, 0xc, 0x1}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5}]}, {0xc, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5, 0xa, 0x1}]}, {0x4c0, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x70}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x16c, 0xd, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x3c, 0x1, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}]}, @NL80211_BAND_60GHZ={0x6c, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_LEGACY={0x1c, 0x1, [0x24, 0x16, 0x48, 0x36, 0x66, 0x9, 0x1b, 0x6c, 0x18, 0xb, 0x60, 0x3, 0x12, 0x2, 0x60, 0x5, 0x12, 0x24, 0x3, 0x5, 0x1, 0xb, 0xc, 0x30]}, @NL80211_TXRATE_LEGACY={0x11, 0x1, [0x48, 0x24, 0x1b, 0x5, 0x18, 0x36, 0x16, 0x6c, 0xc, 0x12, 0x371009ba55c3c815, 0x3, 0x6c]}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_HT={0x26, 0x2, [{0x4, 0xa}, {0x1, 0x6}, {0x4, 0x5}, {0x7, 0x3}, {0x2, 0x4}, {0x0, 0x4}, {0x4, 0x8}, {0x0, 0x4}, {0x7, 0x6}, {0x3}, {0x4, 0x6}, {0x2, 0x1}, {0x5, 0x9}, {0x5, 0x8}, {0x2, 0x2}, {0x1, 0x6}, {0x3, 0x6}, {0x6, 0x5}, {0x6, 0x9}, {0x1, 0x4}, {0x2, 0x8}, {0x6, 0x5}, {0x0, 0x7}, {0x7, 0x3}, {0x6, 0x7}, {0x4, 0xa}, {0x5, 0xa}, {0x0, 0x6}, {0x4, 0x8}, {0x4, 0x2}, {0x0, 0x6}, {0x1, 0x7}, {0x4, 0x9}, {0x0, 0x9}]}]}, @NL80211_BAND_6GHZ={0x78, 0x3, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x22, 0x1, [0x1b, 0x1b, 0x48, 0xc, 0x18, 0x6, 0x12, 0x18, 0x1b, 0x5, 0x18, 0xc, 0x6, 0x60, 0x63, 0x36, 0x1, 0x6c, 0xb, 0x60, 0x30, 0x6, 0x6, 0x1, 0x6c, 0x2, 0x16, 0x3, 0x1e, 0x1]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0xc0, 0x4, 0x8, 0x2, 0xd4c, 0x0, 0x2, 0x6]}}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x9, 0x6, 0x3ff, 0x8, 0x7, 0x1f1b, 0x7, 0xac0]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x9, 0x99, 0xf000, 0xa9, 0xbe96, 0xfffb, 0x2, 0x101]}}, @NL80211_TXRATE_LEGACY={0xa, 0x1, [0x16, 0x36, 0x12, 0x24, 0xc, 0xb]}]}, @NL80211_BAND_60GHZ={0x48, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HT={0x2d, 0x2, [{0x3, 0xa}, {0x2}, {0x6, 0x6}, {0x0, 0x9}, {0x7, 0xa}, {0x0, 0x2}, {0x7, 0x6}, {0x5, 0x9}, {0x0, 0x6}, {0x2, 0x5}, {}, {0x2, 0x6}, {0x1}, {0x4, 0x4}, {0x2, 0x2}, {0x1}, {0x3, 0xa}, {0x4, 0x3}, {0x5, 0x8}, {0x3}, {0x3, 0x1}, {0x4, 0x4}, {0x5, 0x8}, {0x7, 0x9}, {0x2, 0x1}, {0x4, 0x1}, {0x0, 0x2}, {0x4, 0xa}, {0x5, 0x9}, {0x1, 0x3}, {0x6, 0x4}, {0x4, 0x8}, {0x2, 0x6}, {0x2, 0xa}, {0x0, 0x3}, {0x1, 0x3}, {0x5, 0x8}, {0x0, 0x3}, {0x3, 0x9}, {0x0, 0x7}, {0x0, 0x8}]}, @NL80211_TXRATE_LEGACY={0x13, 0x1, [0x1e, 0x9, 0x6c, 0xc, 0x12, 0x9, 0x16, 0x6c, 0x36, 0x36, 0xc, 0x4, 0x36, 0x9, 0x30]}]}]}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5, 0xc, 0x1}, @NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0xe8}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x328, 0xd, 0x0, 0x1, [@NL80211_BAND_60GHZ={0x70, 0x2, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x4, 0x9, 0x782, 0x3, 0x4, 0xe, 0x1]}}, @NL80211_TXRATE_HT={0x15, 0x2, [{0x7, 0x5}, {0x7, 0x7}, {0x1, 0x5}, {0x4, 0x2}, {0x1}, {0x7, 0x5}, {0x3, 0x3}, {0x5, 0x7}, {0x3}, {0x7, 0x7}, {0x6, 0x3}, {0x3, 0xa}, {0x6, 0x7}, {0x3, 0x9}, {0x5, 0x3}, {0x2, 0x6}, {0x1, 0x9}]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x401, 0x704, 0x79, 0x3, 0x4, 0x2e7, 0x1, 0x9]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x100, 0x43, 0x1, 0x8, 0x4, 0x32c9, 0x101, 0x2]}}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_LEGACY={0x5, 0x1, [0x1b]}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}]}, @NL80211_BAND_6GHZ={0x18, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x3, 0x1, 0x8001, 0xd61f, 0xa1fb, 0x6, 0x5, 0x5]}}]}, @NL80211_BAND_2GHZ={0x90, 0x0, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0xd, 0x1, [0x6c, 0x9, 0x18, 0x24, 0x6c, 0x1b, 0x64, 0xb, 0x16]}, @NL80211_TXRATE_LEGACY={0x1a, 0x1, [0x24, 0x12, 0x24, 0x4, 0x6c, 0x6c, 0x9, 0x80d7a2e2dffa832a, 0x36, 0x18, 0x6c, 0x24, 0x1c, 0x1, 0x12, 0x48, 0x16, 0x18, 0x1b, 0x0, 0x60, 0x16]}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HT={0x47, 0x2, [{0x0, 0x7}, {0x6, 0x7}, {0x7, 0xa}, {0x3, 0xa}, {0x2, 0xa}, {0x1, 0x7}, {0x7, 0x7}, {0x5, 0x1}, {0x7, 0x6}, {0x1, 0x5}, {0x1, 0x4}, {0x6, 0x3}, {0x2, 0x1}, {0x2, 0x7}, {0x3, 0x5}, {0x4, 0x3}, {0x5, 0xa}, {0x1}, {0x6, 0x1}, {0x1, 0x7}, {0x6, 0x3}, {0x5, 0x3}, {0x1, 0xa}, {0x7, 0x6}, {0x1, 0x2}, {0x7, 0x3}, {0x4, 0x4}, {0x5, 0x9}, {0x6, 0x9}, {0x3, 0xa}, {0x1, 0x6}, {0x2, 0x1}, {0x7, 0x7}, {0x2, 0x7}, {0x3, 0xa}, {0x3, 0x2}, {0x2, 0x7}, {0x1, 0x1}, {0x6, 0x4}, {0x7, 0xa}, {0x5, 0x9}, {0x4, 0x4}, {0x6, 0xa}, {0x7, 0x2}, {0x4, 0x3}, {0x2}, {0x4, 0x3}, {0x6, 0x5}, {0x3, 0x2}, {0x6, 0x2}, {0x2, 0x3}, {0x3, 0x5}, {0x3, 0x2}, {0x2}, {}, {0x5, 0x3}, {0x3, 0x9}, {0x1, 0x9}, {0x1}, {0x5, 0x2}, {0x6, 0x9}, {0x5, 0x3}, {0x6, 0x1}, {0x4, 0x1}, {0x2, 0x9}, {0x3, 0x1}, {0x5, 0x7}]}]}, @NL80211_BAND_60GHZ={0xc, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}]}, @NL80211_BAND_2GHZ={0xb8, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_LEGACY={0x20, 0x1, [0xb, 0x60, 0x24, 0x48, 0x60, 0x1, 0x5ea2948b6cc3dfe1, 0x36, 0x5, 0x60, 0x18, 0x16, 0x60, 0x60, 0x12, 0x7, 0x30, 0x4, 0x4, 0x12, 0x16, 0x56, 0xb, 0x9, 0x24, 0x6c, 0x18, 0x12]}, @NL80211_TXRATE_LEGACY={0xb, 0x1, [0x12, 0x9, 0x5, 0xb, 0x48, 0x1b, 0x4]}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x800, 0x6, 0x8, 0x5, 0x101, 0x3ff, 0x2, 0x5]}}, @NL80211_TXRATE_HT={0x4f, 0x2, [{0x0, 0x7}, {0x0, 0x9}, {0x4, 0x4}, {0x7, 0x6}, {0x1, 0x6}, {0x4, 0x6}, {0x0, 0x8}, {0x4, 0x2}, {0x0, 0x1}, {0x7, 0x7}, {0x5, 0x8}, {0x1, 0x6}, {0x6, 0x9}, {0x1, 0x2}, {0x2, 0x7}, {0x1, 0x2}, {0x2, 0x7}, {0x2, 0x1}, {0x5, 0xa}, {0x7, 0x4}, {0x7, 0x4}, {0x6, 0xa}, {0x4, 0xa}, {0x3, 0x9}, {0x4}, {0x0, 0x4}, {0x3, 0x3}, {0x5, 0x1}, {0x0, 0x3}, {0x2, 0x1}, {0x3, 0xa}, {0x1, 0x3}, {0x3, 0x1}, {0x0, 0x4}, {}, {0x7}, {0x7, 0x6}, {0x1}, {0x4, 0x3}, {0x5, 0xa}, {0x0, 0x4}, {0x4, 0x8}, {0x1, 0x8}, {0x0, 0x1}, {}, {0x1, 0x4}, {0x4, 0x3}, {0x7, 0x8}, {0x2, 0x5}, {0x6, 0x6}, {0x6, 0x2}, {0x0, 0x4}, {0x4, 0x5}, {0x7}, {}, {0x1, 0x5}, {0x3, 0x4}, {0x6, 0x1}, {0x6, 0x1}, {0x7, 0x5}, {0x0, 0x1}, {0x2, 0x7}, {0x5, 0x3}, {0x6, 0x1}, {0x3, 0x4}, {0x2, 0x9}, {0x0, 0x4}, {0x3, 0x5}, {0x4, 0x2}, {0x3, 0x7}, {0x2, 0x8}, {0x4, 0x5}, {0x1, 0x6}, {0x5, 0x7}, {0x6, 0x9}]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x7f, 0xe61e, 0x48, 0xffff, 0x0, 0x0, 0xf11f, 0x6]}}]}, @NL80211_BAND_2GHZ={0x88, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x8d6d, 0x90, 0x1ff, 0xab, 0x4, 0xf, 0x9, 0x7]}}, @NL80211_TXRATE_HT={0x49, 0x2, [{0x0, 0x1}, {0x6, 0x4}, {0x2, 0x2}, {0x7, 0x5}, {0x6, 0x3}, {0x4, 0x4}, {0x5, 0x2}, {0x1, 0xa}, {0x0, 0x4}, {0x2, 0x1}, {0x0, 0x3}, {0x0, 0x2}, {0x4, 0x4}, {0x1, 0x5}, {0x2, 0x4}, {0x3, 0x1}, {0x3, 0x4}, {0x2, 0xa}, {}, {0x5}, {0x6, 0x7}, {0x5, 0x9}, {0x3, 0x7}, {0x4, 0x5}, {0x1, 0xa}, {0x5, 0x7}, {0x0, 0xa}, {0x1, 0xa}, {0x2, 0x8}, {0x4, 0x1}, {0x4, 0x2}, {0x4, 0x3}, {0x6, 0x3}, {0x0, 0x4}, {0x2, 0x6}, {0x7}, {0x7, 0x8}, {0x0, 0x1}, {0x5, 0x9}, {0x6, 0x4}, {0x7, 0x4}, {0x2, 0x2}, {0x4, 0x7}, {0x3, 0x1}, {0x0, 0xa}, {0x6, 0x8}, {0x1, 0x6}, {0x3, 0x2}, {0x1, 0x8}, {0x7, 0x3}, {0x4}, {0x4, 0x2}, {0x2, 0x6}, {0x3, 0x3}, {0x0, 0x4}, {0x3, 0xa}, {0x1, 0x5}, {0x0, 0xa}, {0x5, 0x9}, {0x0, 0x2}, {0x5, 0x1}, {0x4, 0xa}, {0x3}, {0x3, 0x7}, {0x6, 0x8}, {0x1, 0x7}, {0x4, 0x8}, {0x4}, {0x2, 0x3}]}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_LEGACY={0xb, 0x1, [0x24, 0x59, 0xc, 0x6, 0x48, 0x2, 0x60]}]}, @NL80211_BAND_6GHZ={0x14, 0x3, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}]}, @NL80211_BAND_5GHZ={0xac, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HT={0x3e, 0x2, [{0x7, 0x2}, {0x1, 0x3}, {0x0, 0x3}, {0x4, 0x2}, {0x2, 0x5}, {0x3, 0x9}, {0x5, 0x5}, {0x0, 0x2}, {0x6}, {0x3, 0x8}, {0x1, 0x4}, {0x7, 0xa}, {0x6, 0x7}, {0x1, 0x3}, {0x5, 0x5}, {0x5}, {0x4, 0xa}, {0x7, 0x4}, {0x4, 0x8}, {0x5, 0x9}, {0x0, 0xa}, {0x0, 0x8}, {0x0, 0x8}, {0x4, 0x1}, {0x3, 0x3}, {0x0, 0x4}, {0x2, 0x5}, {0x5}, {0x0, 0x5}, {0x5, 0x8}, {0x1, 0x6}, {0x4, 0x8}, {0x7, 0x7}, {0x3, 0x2}, {0x3}, {0x5, 0x4}, {0x4, 0x4}, {0x2, 0x4}, {0x6, 0x5}, {0x0, 0x7}, {0x6, 0x3}, {0x6, 0x9}, {0x3, 0x4}, {0x0, 0xa}, {0x0, 0x8}, {0x2, 0xa}, {0x1}, {0x6, 0x8}, {0x6, 0x4}, {0x4, 0x9}, {0x4, 0xa}, {0x3, 0x8}, {0x7, 0x4}, {0x6, 0x4}, {0x0, 0x2}, {0x7, 0x9}, {0x4, 0x8}, {0x4, 0x1}]}, @NL80211_TXRATE_HT={0x23, 0x2, [{0x1, 0x9}, {0x7}, {0x0, 0x1}, {0x6, 0x8}, {0x7, 0x3}, {0x5, 0x2}, {0x4, 0x8}, {0x0, 0x3}, {0x2, 0x1}, {0x3, 0x5}, {0x7, 0x2}, {0x0, 0x3}, {0x1}, {0x3, 0x3}, {0x0, 0xa}, {0x2, 0x2}, {0x6}, {0x0, 0x4}, {0x7, 0x9}, {0x1}, {0x1, 0x2}, {0x3, 0x3}, {0x6, 0x2}, {0x1, 0xa}, {0x1, 0x4}, {0x0, 0x4}, {0x4, 0x6}, {0x0, 0xa}, {0x5}, {0x5, 0x7}, {0x6, 0xa}]}, @NL80211_TXRATE_HT={0x43, 0x2, [{0x5, 0x3}, {0x0, 0x4}, {0x5, 0x5}, {0x5, 0x5}, {0x7, 0x8}, {0x0, 0x4}, {0x0, 0x6}, {0x3, 0x9}, {0x0, 0x4}, {0x2, 0x1e}, {0x4, 0xa}, {0x7, 0x6}, {0x6, 0x7}, {0x1, 0x2}, {0x1, 0x9}, {0x5, 0x5}, {0x2, 0x4}, {0x6, 0x3}, {0x4, 0x7}, {0x2, 0x3}, {0x4, 0x7}, {0x7, 0x9}, {0x6, 0x6}, {0x2, 0x3}, {0x3, 0x2}, {0x4, 0x2}, {0x3, 0x9}, {0x7, 0x7}, {0x1}, {0x1, 0x1}, {0x2, 0x3}, {0x1, 0x8}, {0x1}, {0x0, 0x6}, {0x3, 0x6}, {0x7, 0x5}, {0x7, 0x7}, {0x5, 0x1}, {0x0, 0x9}, {0x1, 0x4}, {0x6, 0x8}, {0x2, 0x4}, {0x1, 0x4}, {0x7, 0x6}, {0x4}, {0x2, 0x4}, {0x6}, {0x3, 0x3}, {0x1, 0x2}, {0x0, 0x6}, {0x7, 0x7}, {0x3, 0xa}, {0x3, 0x6}, {0x4, 0x2}, {}, {0x0, 0x5}, {0x4, 0x7}, {0x3, 0x7}, {0x6}, {0x6, 0x4}, {0x1, 0x2}, {0x6, 0x6}, {0x0, 0x9}]}]}]}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0x50}]}, {0x14, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0xe}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5, 0xa, 0x1}]}]}, @NL80211_ATTR_TID_CONFIG={0x204, 0x11d, 0x0, 0x1, [{0x200, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_NOACK={0x5}, @NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0xac}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x57}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x1d4, 0xd, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x18, 0x1, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x1000, 0x4, 0x6, 0x10, 0x200, 0x1, 0x8000, 0x800]}}]}, @NL80211_BAND_6GHZ={0xc8, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_HT={0x2e, 0x2, [{0x7, 0x4}, {0x0, 0x2}, {0x7, 0x1}, {0x1, 0x7}, {0x7, 0x2}, {0x6, 0x9}, {0x5, 0x1}, {0x1, 0x8}, {0x1, 0x6}, {0x0, 0x3}, {0x7, 0x8}, {0x2, 0x8}, {0x7, 0x3}, {0x6}, {0x1, 0x3}, {0x1, 0x5}, {0x0, 0x8}, {0x4, 0x3}, {0x0, 0xa}, {0x6, 0x8}, {0x1, 0xa}, {0x7, 0x7}, {0x2, 0x9}, {0x2, 0x5}, {0x6, 0x6}, {0x3}, {0x4, 0xa}, {0x6}, {0x7, 0x1}, {0x3, 0xa}, {}, {0x6, 0xa}, {0x0, 0x9}, {0x7, 0x3}, {0x6, 0x8}, {0x5, 0x6}, {0x6, 0x1}, {0x5, 0xa}, {0x3}, {0x1, 0x4}, {0x6, 0xa}, {0x5, 0x5}]}, @NL80211_TXRATE_LEGACY={0xa, 0x1, [0x3, 0xc, 0x36, 0x24, 0x4, 0x1]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0xf7df, 0x7fff, 0x4, 0x7, 0x2, 0x3, 0x1, 0x73]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_HT={0x40, 0x2, [{0x2, 0x7}, {0x2, 0x5}, {0x6, 0x8}, {0x3}, {0x6, 0x2}, {0x4, 0x8}, {0x7, 0x4}, {0x2, 0x5}, {0x7}, {0x1, 0xa}, {0x3, 0x5}, {0x0, 0x1}, {0x4, 0x5}, {0x7, 0x9}, {0x0, 0x3}, {0x0, 0x8}, {0x6, 0x9}, {0x5, 0xa}, {0x4, 0x9}, {0x0, 0x1}, {0x0, 0x1}, {0x4, 0x3}, {0x0, 0xa}, {0x1, 0x4}, {}, {0x6, 0x2}, {0x4, 0x6}, {0x1, 0x3}, {0x3, 0x2}, {0x4}, {0x3, 0x4}, {0x5, 0x19}, {0x1, 0x6}, {0x1, 0x2}, {0x4, 0x2}, {0x3, 0x2}, {0x6, 0x8}, {0x1, 0xa}, {0x0, 0x1}, {0x7, 0x1}, {0x2, 0x9}, {0x0, 0x7}, {0x3, 0x4}, {0x5, 0xa}, {0x3, 0x8}, {0x3, 0x2}, {0x0, 0x7}, {0x7, 0x6}, {0x3, 0x4}, {0x4, 0x5}, {0x1, 0x5}, {0x4, 0x9}, {0x3, 0x4}, {0x1, 0x3}, {0x5, 0x4}, {0x0, 0x1}, {0x5}, {0x2, 0x4}, {0x7, 0x9}, {0x3, 0x9}]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x401, 0x4, 0xfff, 0xfffd, 0x2, 0x0, 0x8001, 0xfff8]}}]}, @NL80211_BAND_6GHZ={0x20, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x83, 0x4, 0x0, 0x6, 0x6, 0x5, 0x4, 0xfff4]}}]}, @NL80211_BAND_5GHZ={0x2c, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x2, 0x1, 0x8, 0xc3e, 0x14, 0x4, 0x1, 0x221]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_HT={0x9, 0x2, [{0x7, 0x6}, {0x4, 0x1}, {0x0, 0x7}, {0x3, 0x3}, {0x7, 0x7}]}]}, @NL80211_BAND_5GHZ={0x68, 0x1, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x7, 0x1, [0x3, 0x5, 0xc]}, @NL80211_TXRATE_LEGACY={0x17, 0x1, [0x30, 0x50, 0x9, 0x60, 0x18, 0x3, 0x4, 0x4, 0x5, 0x1, 0x6, 0xc, 0x2, 0x12, 0x36, 0x3, 0x6, 0x4, 0x4]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x52e, 0x4, 0x8, 0x4, 0xd3a0, 0x4, 0x8, 0xffff]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x8001, 0x3, 0x1, 0x1, 0x6, 0x1, 0x0, 0x6]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x9, 0x1, 0x3, 0x0, 0xff, 0x4, 0x5]}}]}, @NL80211_BAND_5GHZ={0x18, 0x1, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x3, 0xfffe, 0x2, 0xaf2, 0x7164, 0x9, 0x24]}}]}, @NL80211_BAND_2GHZ={0x24, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HT={0x17, 0x2, [{0x0, 0x6}, {0x5, 0x5}, {0x5, 0x8}, {0x4, 0x8}, {0x4, 0x2}, {0x1, 0x9}, {0x1, 0x1}, {0x4, 0xa}, {0x0, 0x6}, {0x2, 0x1}, {0x1, 0x6}, {0x7, 0x6}, {0x2, 0x5}, {0x1, 0x8}, {0x0, 0x1}, {0x3}, {0x6, 0x5}, {0x5, 0x4}, {0x0, 0x3}]}, @NL80211_TXRATE_HE_LTF={0x5}]}]}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5, 0x9, 0x1}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5}]}]}, @NL80211_ATTR_TID_CONFIG={0x8bc, 0x11d, 0x0, 0x1, [{0x90, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0x4}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x4c, 0xd, 0x0, 0x1, [@NL80211_BAND_60GHZ={0x48, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x110, 0x7, 0x3000, 0xde0, 0x6, 0x3, 0xb, 0xff]}}, @NL80211_TXRATE_LEGACY={0x8, 0x1, [0x6c, 0x6, 0x4, 0x12]}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_LEGACY={0x1d, 0x1, [0x36, 0xc, 0x16, 0xc, 0x24, 0x24, 0x16, 0x24, 0x3, 0xc, 0x16, 0x5, 0x48, 0x9, 0x16, 0x48, 0x1b, 0x24, 0xb, 0x18, 0x16, 0x30, 0x18, 0x1, 0x3]}]}]}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x6}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x1}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0x7b}, @NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x800}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x5a}]}, {0x228, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x26}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x1fc, 0xd, 0x0, 0x1, [@NL80211_BAND_2GHZ={0xa0, 0x0, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x15, 0x1, [0xc, 0x6c, 0x24, 0x16, 0x18, 0x22, 0x18, 0x4, 0x6, 0x36, 0x0, 0xb, 0x16, 0x30, 0xc, 0x5, 0x18]}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_LEGACY={0xf, 0x1, [0x3, 0xb, 0x3, 0x6, 0x48, 0x1c, 0xb, 0x6, 0x60, 0x7e, 0x0]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x800, 0x400, 0x4, 0x3, 0xbea, 0xfff8, 0x0, 0xf2]}}, @NL80211_TXRATE_HT={0x17, 0x2, [{0x6, 0x1}, {0x6, 0x9}, {0x4, 0x1}, {0x7, 0x9}, {0x6, 0x5}, {0x3, 0x8}, {0x0, 0x3}, {0x5, 0x4}, {0x4, 0x3}, {0x6, 0x5}, {0x3, 0x6}, {0x6, 0x8}, {0x0, 0x4}, {0x2, 0x2}, {0x0, 0x6}, {0x7, 0x1}, {0x2, 0x8}, {0x2, 0xa}, {0x0, 0x4}]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x0, 0x3a98, 0x3, 0x8, 0x7, 0x3, 0xfffd, 0x5456]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x8, 0x5, 0x7, 0x5, 0x7, 0x7, 0x0, 0x9]}}, @NL80211_TXRATE_HT={0xd, 0x2, [{0x4, 0x8}, {0x6, 0x5}, {0x1, 0x8}, {0x3, 0x3}, {0x6, 0x3}, {0x1, 0x6}, {0x7, 0x6}, {0x5, 0x5}, {0x5, 0x5}]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}]}, @NL80211_BAND_5GHZ={0x18, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x401, 0x0, 0x3ff, 0x9648, 0x5, 0x7, 0xe, 0x4]}}]}, @NL80211_BAND_2GHZ={0x78, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x7, 0x96fa, 0xfff, 0x5, 0xfffb, 0x1ff, 0x2, 0x1d]}}, @NL80211_TXRATE_HT={0x26, 0x2, [{0x0, 0xa}, {0x0, 0x5}, {0x1, 0xa}, {0x6, 0x5}, {0x7, 0x5}, {0x4, 0x8}, {0x5, 0x3}, {0x3, 0x7}, {0x7, 0x9}, {0x2, 0x9}, {0x4, 0x5}, {0x5, 0x8}, {0x7}, {0x2, 0x6}, {0x0, 0x6}, {0x0, 0x4}, {0x0, 0x6}, {0x7, 0x1}, {0x4, 0x4}, {0x6, 0x3}, {0x0, 0x9}, {0x3, 0x1}, {0x2, 0x4}, {0x5, 0xa}, {0x6, 0x9}, {0x4, 0x2}, {0x6, 0x7}, {0x2, 0x2}, {0x7, 0x1}, {0x6, 0x8}, {0x7}, {0x3, 0x7}, {0x7, 0x9}, {0x4, 0xa}]}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_HE={0x14, 0x5, {[0xf847, 0x3, 0x40, 0x8, 0x5, 0x2, 0x0, 0x3]}}, @NL80211_TXRATE_HT={0x4}]}, @NL80211_BAND_6GHZ={0xa0, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x9, 0x2, 0x4, 0x8, 0x7, 0x3, 0x8, 0x92]}}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_LEGACY={0x11, 0x1, [0x61, 0x5, 0x18, 0x16, 0x16, 0x0, 0x2, 0x48, 0x3, 0x60, 0x24, 0x2, 0x30]}, @NL80211_TXRATE_HT={0x4c, 0x2, [{0x0, 0x8}, {0x5, 0x1}, {0x0, 0x4}, {0x0, 0x8}, {0x0, 0xa}, {0x0, 0x4}, {0x1, 0x6}, {0x2, 0x3}, {0x5, 0x6}, {0x7, 0x1}, {0x6, 0xa}, {0x4, 0x8}, {0x6, 0x2}, {0x5, 0x1}, {0x6, 0x7}, {0x7}, {0x1, 0x1}, {0x1}, {0x0, 0x6}, {0x4, 0x8}, {0x1, 0x5}, {0x4, 0x2}, {0x4, 0x9}, {0x0, 0x3}, {0x6, 0x8}, {0x1, 0x1}, {0x1, 0x3}, {0x0, 0x6}, {0x5, 0xa}, {0x6, 0x6}, {0x5, 0x6}, {0x2, 0x3}, {0x2}, {0x0, 0x4}, {0x0, 0x9}, {0x1, 0x7}, {0x3, 0x1}, {0x0, 0x7}, {0x2, 0x1}, {0x3, 0x9}, {0x1, 0x8}, {0x0, 0x6}, {0x0, 0x7}, {0x2, 0x7}, {0x7, 0x5}, {0x5, 0x7}, {0x5, 0x5}, {0x5, 0x6}, {0x1, 0x7}, {0x6, 0x3}, {0x1, 0x6}, {0x2, 0x7}, {0x5, 0x7}, {0x2, 0x1}, {0x7, 0x3}, {0x2, 0x6}, {0x2, 0x5}, {0x1, 0x8}, {0x0, 0x5}, {0x0, 0x6}, {0x7, 0x3}, {0x1, 0x5}, {0x4, 0x8}, {0x7, 0x4}, {0x3, 0x6}, {0x1, 0x9}, {0x6, 0x1}, {0x1, 0x8}, {0x2, 0x5}, {0x1, 0x4}, {0x2, 0xa}, {0x3, 0xa}]}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}]}, @NL80211_BAND_60GHZ={0x28, 0x2, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x23, 0x1, [0x1, 0x5, 0x9, 0x9, 0x6, 0x5, 0x16, 0x4, 0xb, 0x18, 0xb, 0x1a, 0xc, 0x16, 0x12, 0x2, 0x9, 0xc, 0x0, 0x48, 0x60, 0x12, 0x3, 0xb, 0x18, 0xb, 0x1b, 0x24, 0x12, 0x4, 0x3]}]}]}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5, 0x6, 0x1}, @NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0xf3}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}]}, {0xc, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0xff}]}, {0x2c, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0xfa}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x7}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x39}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x1}]}, {0x2c, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0xed}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5, 0xb, 0x1}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5, 0x6, 0x1}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5, 0x9, 0x1}]}, {0xa4, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x7}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x64, 0xd, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x48, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x6, 0x1, 0xfffd, 0xfffb, 0x317, 0x14, 0x0, 0x23]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x7, 0x1, 0x6, 0x3, 0x3, 0x40, 0xb, 0x1]}}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x4, 0x1, 0x1, 0x6, 0x0, 0x6, 0x0, 0x24]}}]}, @NL80211_BAND_2GHZ={0x18, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0xa284, 0x7, 0x0, 0x7, 0x101, 0x1, 0x9, 0x7]}}]}]}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x52}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x4}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5, 0x6, 0x1}, @NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0x17}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x9}]}, {0x4f8, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0xea}, @NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0x66}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x2c4, 0xd, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x68, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_HT={0x1e, 0x2, [{0x0, 0x9}, {0x7, 0x2}, {0x0, 0x8}, {0x1, 0x3}, {0x2, 0x6}, {0x4, 0x2}, {0x4, 0x3}, {0x1}, {0x1, 0x5}, {0x0, 0x3}, {0x1}, {0x0, 0x2}, {0x5, 0x8}, {0x5, 0x9}, {0x3, 0x1}, {0x2, 0x5}, {0x4, 0x7}, {0x0, 0x5}, {0x2, 0x2}, {0x0, 0x8}, {0x7, 0x3}, {0x2}, {0x3, 0x9}, {0x1, 0x4}, {0x1, 0x1}, {0x7, 0xa}]}, @NL80211_TXRATE_HT={0x25, 0x2, [{0x1, 0x2}, {0x0, 0xa}, {0x2, 0x1a}, {0x3, 0x7}, {0x2, 0x3}, {0x6, 0x8}, {0x0, 0x4}, {0x7, 0x1}, {0x2, 0x3}, {0x5, 0x4}, {0x3, 0x4}, {0x1, 0x2}, {0x7, 0x3}, {0x5, 0x6}, {0x3, 0x3}, {0x4}, {0x2, 0x9}, {0x5, 0x5}, {0x6, 0x3}, {0x2, 0x6}, {0x4, 0x7}, {0x7, 0x2}, {0x7, 0x3}, {0x7, 0x8}, {0x3, 0x3}, {0x6, 0x9}, {0x0, 0x9}, {0x3, 0x8}, {0x2, 0x2}, {0x1, 0x7}, {0x1}, {0x0, 0x9}, {0x3, 0xa}]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x4, 0x1, 0x2bba, 0xcfac, 0x4, 0xfff4, 0x332, 0x6]}}]}, @NL80211_BAND_2GHZ={0x44, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HT={0x38, 0x2, [{0x0, 0x5}, {0x4, 0x4}, {0x6, 0x9}, {0x1, 0xa}, {0x4, 0x6}, {0x7, 0x5}, {0x1, 0x5}, {0x7, 0x5}, {0x1, 0x7}, {0x7, 0x3}, {0x5, 0x2}, {0x0, 0x6}, {0x1, 0x7}, {0x3}, {0x7, 0x5}, {0x0, 0xa}, {0x3, 0x8}, {0x1, 0x6}, {0x6, 0x8}, {0x7, 0xa}, {0x3, 0x7}, {0x4, 0x2}, {0x5, 0x7}, {}, {0x7, 0x4}, {0x2, 0x8}, {0x3, 0x6}, {0x3, 0x8}, {0x4, 0x9}, {0x3, 0x8}, {0x0, 0x1}, {0x1}, {0x7, 0x5}, {0x7, 0xa}, {0x0, 0x4}, {}, {0x7, 0x8}, {0x3, 0x1}, {0x4, 0x6}, {0x6, 0xa}, {0x5, 0x3}, {0x2}, {0x1, 0x4}, {0x1, 0x4}, {0x7, 0x3}, {0x1, 0x3}, {0x0, 0x6}, {0x1, 0x4}, {0x0, 0x1}, {0x5, 0x5}, {0x5, 0x8}, {0x0, 0x7}]}, @NL80211_TXRATE_GI={0x5}]}, @NL80211_BAND_6GHZ={0x24, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HT={0x1e, 0x2, [{0x4, 0x5}, {0x1, 0x3}, {0x3, 0x5}, {0x4, 0x8}, {0x2, 0x1}, {0x1, 0x6}, {0x0, 0x6}, {0x7, 0x8}, {0x6, 0xa}, {0x4, 0xa}, {0x4, 0x8}, {0x7, 0x3}, {0x0, 0x3}, {0x3, 0x9}, {0x1, 0x8}, {0x7, 0x6}, {0x3}, {0x1, 0x6}, {}, {0x3, 0x4}, {0x3, 0x5}, {0x7, 0x5}, {0x4, 0x1}, {0x1, 0x5}, {0x6, 0x6}, {0x1, 0x8}]}]}, @NL80211_BAND_5GHZ={0x10, 0x1, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0xa, 0x1, [0x18, 0x9, 0x30, 0x30, 0x2, 0x9]}]}, @NL80211_BAND_5GHZ={0x64, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HT={0x9, 0x2, [{0x2, 0x6}, {0x1, 0x5}, {0x3, 0x3}, {0x6, 0xf}, {}]}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HT={0x49, 0x2, [{0x7, 0x3}, {0x1, 0x2}, {0x1, 0xa}, {0x2, 0x5}, {0x5, 0x8}, {0x0, 0x9}, {0x6, 0x8}, {0x4, 0x4}, {0x3, 0x3}, {0x6, 0x9}, {0x7, 0x8}, {0x0, 0x4}, {0x4, 0x3}, {0x0, 0x7}, {0x7, 0x7}, {0x4, 0x1}, {0x1, 0x3}, {0x4, 0x7}, {0x5, 0x3}, {0x1, 0x5}, {0x6, 0xa}, {0x1, 0x7}, {0x6, 0x3}, {0x1, 0x6}, {0x1, 0x7}, {0x6, 0x3}, {0x0, 0x5}, {0x1, 0x1}, {0x0, 0x5}, {0x1, 0x1}, {0x0, 0x9}, {0x5, 0x1}, {0x0, 0x8}, {0x5, 0x5}, {0x3, 0xa}, {0x4, 0xa}, {0x0, 0x3}, {0x3, 0x1}, {0x0, 0x6}, {0x3, 0x2}, {0x0, 0x7}, {0x0, 0x1e}, {0x3, 0x7}, {0x7, 0x9}, {0x3, 0x8}, {0x2, 0x8}, {0x0, 0x7}, {0x1, 0x3}, {0x3, 0x2}, {0x4, 0x7}, {0x7, 0x3}, {0x6, 0x1}, {0x1, 0x1}, {0x5, 0x5}, {0x7, 0x6}, {0x4, 0x3}, {0x5}, {0x6, 0x4}, {0x7, 0x7}, {0x7, 0xa}, {0x4}, {0x1, 0xa}, {0x3, 0x4}, {0x1, 0x8}, {}, {0x2, 0x6}, {0x1, 0x6}, {0x5, 0x4}, {0x7, 0x2}]}]}, @NL80211_BAND_6GHZ={0x18, 0x3, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0xa4, 0x3, 0xf75, 0x800, 0x100, 0x84, 0x8, 0x8000]}}]}, @NL80211_BAND_60GHZ={0x60, 0x2, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x17, 0x1, [0xc, 0x9, 0x1, 0x36, 0x4, 0x5, 0x60, 0x9, 0x5, 0x3, 0x60, 0x5, 0x4, 0x9, 0x6c, 0x0, 0x16, 0x36, 0x6c]}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_LEGACY={0xa, 0x1, [0x12, 0x6, 0x12, 0x3, 0x36, 0x30]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x8733, 0x7, 0x401, 0x81, 0xdf94, 0x108, 0x4, 0x5]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x7f, 0x3, 0x4, 0x0, 0x4, 0x0, 0x2b47, 0x2]}}]}, @NL80211_BAND_6GHZ={0x40, 0x3, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x7, 0xffbe, 0x800, 0x4, 0x400, 0x4f, 0xe, 0x4]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}]}, @NL80211_BAND_6GHZ={0xa4, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x4, 0xc4c4, 0x7ff, 0x8, 0xc2e, 0x122, 0x3, 0x745]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0xc, 0xfdfa, 0x0, 0x6, 0x1, 0x7, 0x200, 0x8000]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x5, 0x3ff, 0x101, 0x1, 0x101, 0x52, 0x1, 0x2]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x7, 0xfe00, 0xfc00, 0xffff, 0x7ff, 0xc3, 0xc9, 0x6]}}, @NL80211_TXRATE_HT={0x26, 0x2, [{0x5, 0x4}, {0x3}, {0x0, 0x4}, {0x4, 0x2}, {0x0, 0x7}, {0x2, 0x4}, {}, {0x5, 0x2}, {0x4, 0x2}, {0x7, 0x8}, {0x2}, {0x1, 0xa}, {0x1, 0x7}, {0x5, 0x1}, {0x6, 0x3}, {0x0, 0x8}, {0x1, 0x5}, {0x0, 0x2}, {0x4, 0x4}, {0x5, 0x6}, {0x3, 0x6}, {0x3, 0x8}, {0x5, 0x4}, {0x5, 0xa}, {0x7, 0x3}, {}, {0x7, 0x9}, {}, {0x4, 0x5}, {0x4, 0x4}, {0x6, 0x2}, {0x3, 0x2}, {0x4, 0xa}, {0x5, 0x6}]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x1, 0xe5f, 0x101, 0x6, 0xff, 0x4, 0x9, 0x7ff]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x8000, 0xef77, 0x7, 0x3, 0x3, 0x1, 0x4ad, 0x9c6]}}]}, @NL80211_BAND_2GHZ={0x20, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_LEGACY={0xb, 0x1, [0x12, 0x48, 0x5, 0x1b, 0x1b, 0x48, 0x18]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}]}]}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5, 0xc, 0x2}, @NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x214, 0xd, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x58, 0x1, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0xf, 0x1, [0x3, 0x79, 0x48, 0xc, 0x36, 0x2, 0x1b, 0x6c, 0x48, 0x1b, 0x6]}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x3, 0x2, 0xbe77, 0x50, 0xd4, 0x4, 0x3]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x6d, 0x2, 0x100, 0x2, 0x6, 0x3, 0x7, 0x6]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x24, 0x3, 0x7, 0x0, 0x1000, 0x2, 0x1, 0x8000]}}]}, @NL80211_BAND_2GHZ={0xc0, 0x0, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_HT={0x4c, 0x2, [{0x6, 0xa}, {0x1}, {0x3, 0x8}, {0x7, 0x7}, {0x2, 0x5}, {0x7, 0x1}, {0x0, 0x7}, {0x6, 0x3}, {0x5, 0x8}, {0x4, 0x9}, {0x2, 0x7}, {0x2}, {0x3, 0x3}, {0x2, 0x9}, {0x3, 0x8}, {0x0, 0x5}, {0x4, 0x4}, {0x6, 0x6}, {0x1, 0x4}, {0x1, 0x9}, {0x1, 0x3}, {0x5, 0x8}, {0x1, 0x9}, {0x1, 0x2}, {0x4, 0x8}, {0x5, 0x1}, {0x1, 0x4}, {0x3, 0xa}, {0x1, 0x7}, {0x2, 0x8}, {0x7, 0x1}, {0x0, 0x4}, {0x0, 0x3}, {0x4, 0x5}, {0x4, 0x6}, {0x0, 0x3}, {0x1, 0x4}, {0x1, 0xa}, {0x7, 0x3}, {0x3, 0x2}, {0x2, 0x4}, {0x2, 0x7}, {0x5}, {0x5, 0x8}, {0x7, 0x4}, {0x6, 0xa}, {0x1, 0x1}, {0x4, 0x9}, {0x7, 0x9}, {0x7, 0x7}, {0x2, 0x5}, {0x4, 0x7}, {0x7, 0x4}, {0x5, 0x13}, {0x7, 0x6}, {0x4, 0xa}, {0x0, 0x3}, {0x3, 0x9}, {0x0, 0x3}, {0x0, 0x3}, {0x0, 0x4}, {0x0, 0x3}, {0x5, 0x2}, {0x3, 0x9}, {0x7, 0x7}, {0x1, 0x1}, {0x4, 0x6}, {0x6, 0x1}, {0x6, 0x8}, {0x0, 0x7}, {0x0, 0x4}, {0x2, 0x9}]}, @NL80211_TXRATE_LEGACY={0x10, 0x1, [0x9, 0x0, 0x30, 0x36, 0x6c, 0x6, 0x6c, 0x16, 0x30, 0x2, 0x30, 0x6]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x1, 0x3, 0x9, 0x9, 0x5, 0x29b, 0x7, 0x2]}}, @NL80211_TXRATE_HT={0x29, 0x2, [{0x3, 0x8}, {0x7, 0x2}, {0x7, 0x2}, {0x4, 0x14}, {0x7, 0x2}, {0x1, 0x8}, {0x1, 0xa}, {0x5, 0x8}, {0x0, 0xa}, {0x2, 0x9}, {0x3, 0x2}, {0x5, 0x9}, {0x3, 0x1e}, {0x7}, {0x4, 0x7}, {0x1, 0x2}, {0x7, 0x2}, {0x6, 0x3}, {0x1, 0x5}, {0x5, 0x4}, {0x0, 0xa}, {0x4, 0x7}, {0x2, 0x7}, {0x2, 0x7}, {0x1, 0xa}, {0x5, 0x2}, {0x2}, {0x7, 0x7}, {0x1, 0x5}, {0x2, 0x8}, {0x2, 0x8}, {0x2, 0x3}, {0x3}, {0x5, 0x2}, {0x5, 0x6}, {0x0, 0x2}, {0x4, 0xa}]}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}]}, @NL80211_BAND_60GHZ={0xc, 0x2, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5, 0x4, 0x1}]}, @NL80211_BAND_2GHZ={0x54, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HT={0x4d, 0x2, [{0x4, 0x4}, {0x6, 0x5}, {0x4, 0x2}, {0x1, 0x8}, {0x1, 0x4}, {0x1, 0x4}, {0x3, 0x7}, {0x2, 0xa}, {0x6, 0xd}, {0x0, 0x6}, {0x0, 0x7}, {0x2, 0x9}, {0x0, 0x7}, {0x5, 0x4}, {0x6, 0xa}, {0x7, 0x9}, {0x1, 0x3}, {0x4, 0x6}, {0x2, 0x5}, {0x3, 0x5}, {0x0, 0x8}, {0x3, 0x3}, {0x1}, {0x4, 0xa}, {0x4, 0x4}, {0x5, 0x2}, {0x3, 0x9}, {0x0, 0x2}, {0x0, 0x6}, {0x5, 0xa}, {0x1, 0x9}, {0x2}, {0x0, 0x7}, {0x0, 0xa}, {0x0, 0x6}, {0x0, 0x5}, {0x6, 0x4}, {0x5, 0x3}, {0x3, 0x2}, {0x7, 0x6}, {0x1, 0xa}, {0x1, 0x8}, {0x7, 0x8}, {0x5, 0x5}, {0x1, 0x8}, {0x3, 0x7}, {0x4, 0x9}, {0x1, 0x6}, {0x0, 0x3}, {0x1}, {0x3, 0x2}, {0x1, 0x7}, {0x0, 0x8}, {0x6}, {0x2, 0x6}, {0x7, 0x9}, {0x4, 0x9}, {0x1, 0x5}, {0x2, 0x9}, {0x7, 0x8}, {0x2}, {0x6, 0x9}, {0x3, 0x7}, {0x4, 0x3}, {}, {0x0, 0x5}, {0x1, 0x7}, {0x5, 0x2}, {0x3, 0x3}, {0x0, 0x8}, {0x5, 0x2}, {0x0, 0x3}, {0x2, 0x2}]}]}, @NL80211_BAND_2GHZ={0x8c, 0x0, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x1e, 0x1, [0x60, 0x60, 0xc, 0x6c, 0x6, 0x30, 0x48, 0x12, 0x12, 0x2, 0x30, 0x60, 0x12, 0xb, 0x1, 0x18, 0x24, 0x18, 0x60, 0x48, 0x1ab6878eef09202, 0x16, 0x24, 0x0, 0x48, 0x18]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_HT={0x8, 0x2, [{0x1}, {0x6, 0x8}, {0x3}, {0x0, 0x6}]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0xac00, 0x6, 0x6, 0x5, 0xe, 0xa, 0xe, 0xfffc]}}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x8, 0x3, 0xfff, 0x5, 0x5, 0x400, 0x3f82, 0x9]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x3, 0xffff, 0x9, 0x9, 0x8, 0x3ff, 0x1000]}}, @NL80211_TXRATE_HT={0xa, 0x2, [{0x7, 0x5}, {0x6, 0xa}, {0x7, 0x3}, {0x1, 0x8}, {0x2, 0x1}, {0x7, 0x4}]}]}, @NL80211_BAND_5GHZ={0xc, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}]}]}]}]}, @NL80211_ATTR_TID_CONFIG={0x230, 0x11d, 0x0, 0x1, [{0x40, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5, 0xb, 0x1}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5, 0xc, 0x2}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5, 0xa, 0x1}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x2}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5, 0xa, 0x1}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0x30}]}, {0x1e4, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0xf7}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0x96}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x1b4, 0xd, 0x0, 0x1, [@NL80211_BAND_60GHZ={0xe4, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_LEGACY={0x1b, 0x1, [0x12, 0x1, 0x12, 0x5, 0x24, 0x48, 0x36, 0x32, 0x6, 0x30, 0x9, 0x6, 0xc, 0x48, 0x2, 0x12, 0x48, 0xb, 0x16, 0x36, 0x9, 0x1, 0x48]}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_LEGACY={0x20, 0x1, [0x60, 0xb, 0x6, 0x37, 0x48, 0x4, 0xc, 0x16, 0x30, 0x12, 0x9, 0x0, 0x36, 0x2, 0x24, 0x6c, 0x4, 0x36, 0x18, 0x1, 0x3, 0x18, 0x30, 0x1, 0x16, 0x6, 0x18, 0x2]}, @NL80211_TXRATE_HT={0x34, 0x2, [{0x4, 0x1}, {0x5, 0x7}, {0x3, 0xa}, {0x0, 0x8}, {0x6, 0x3}, {0x5}, {0x2, 0x4}, {0x3, 0x5}, {0x2, 0x3}, {0x0, 0x9}, {0x0, 0x6}, {0x4, 0x7}, {0x1, 0x4}, {0x1, 0x6}, {0x7, 0x7}, {0x1, 0x1}, {0x4, 0x7}, {0x5, 0x7}, {0x1, 0x2}, {0x4, 0x2}, {0x4, 0x1}, {0x7, 0x4}, {0x1, 0x3}, {0x4, 0xa}, {0x3, 0x8}, {0x3, 0x7}, {0x7, 0x2}, {0x7}, {0x2, 0x6}, {0x2, 0x9}, {0x4, 0x3}, {0x2, 0x8}, {0x0, 0x3}, {0x3, 0xa}, {0x2, 0x4}, {0x0, 0x4}, {0x7, 0xa}, {0x7, 0x8}, {0x1, 0x1}, {0x6, 0x5}, {0x0, 0x9}, {0x7, 0x4}, {0x0, 0x5}, {0x4}, {0x6, 0xa}, {}, {0x3, 0x7}, {0x1, 0x9}]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x9, 0x6f0, 0x0, 0xc, 0x5, 0x0, 0x0, 0xa]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x2, 0xc, 0x4, 0x5, 0x7afd, 0x6, 0x1]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x1ff, 0x3, 0xfe01, 0x0, 0x9, 0x69e, 0x5, 0xff]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x1, 0x7e90, 0x8, 0x1, 0x10, 0xf, 0x4, 0x8]}}, @NL80211_TXRATE_LEGACY={0x10, 0x1, [0x48, 0x5, 0x2, 0x6c, 0x6, 0x36, 0x6, 0x1, 0x30, 0x48, 0x24, 0x1b]}]}, @NL80211_BAND_5GHZ={0xc8, 0x1, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x11, 0x1, [0x36, 0x1a, 0x36, 0x6, 0x12, 0x9, 0x1b, 0x12, 0x60, 0x2, 0x18, 0x6, 0x30]}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x8, 0x1, 0x7fff, 0x2, 0x2, 0x40, 0x635a, 0xf01f]}}, @NL80211_TXRATE_HT={0x3b, 0x2, [{0x2, 0xa}, {0x0, 0x4}, {0x7, 0x5}, {0x3, 0x8}, {0x7, 0xa}, {0x2, 0x4}, {0x6, 0x6}, {0x6, 0x2}, {0x0, 0x9}, {0x0, 0x1}, {0x2, 0x9}, {0x7, 0x1}, {0x7, 0x8}, {0x5, 0x8}, {0x7, 0x4}, {0x4, 0xa}, {0x4, 0x8}, {0x6, 0x4}, {0x1, 0x9}, {0x7, 0x6}, {0x1, 0x1}, {0x0, 0x5}, {0x2, 0x7}, {0x2, 0xa}, {0x0, 0x4}, {0x5, 0x6}, {0x7, 0x9}, {0x6, 0x7}, {0x0, 0x7}, {0x1, 0x7}, {0x4, 0x6}, {0x2}, {0x5, 0x9}, {0x4, 0x1}, {0x7, 0x5}, {0x7, 0x4}, {0x6}, {0x0, 0x4}, {0x7}, {0x3, 0x4}, {0x0, 0x4}, {0x6, 0x6}, {0x6, 0x4}, {0x7, 0x5}, {0x0, 0x4}, {0x5, 0x1e}, {0x1}, {0x4, 0x4}, {0x4, 0x7}, {0x2, 0x6}, {0x1, 0x3}, {0x7, 0xa}, {0x1, 0x1}, {0x2, 0x3}, {0x2, 0x7}]}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_HT={0x50, 0x2, [{0x7, 0xa}, {0x6, 0x9}, {0x2, 0x2}, {0x5, 0x8}, {0x3, 0x1}, {0x2, 0x1}, {0x1, 0x4}, {0x3, 0x2}, {0x4, 0x4}, {0x0, 0x6}, {0x6, 0x3}, {0x6, 0x3}, {0x6, 0x6}, {0x7, 0x9}, {0x3, 0x9}, {0x5, 0x5}, {0x7, 0x5}, {0x6, 0x8}, {0x2}, {0x3, 0x9}, {0x0, 0xa}, {0x6, 0x3}, {0x4}, {0x2, 0x3}, {0x6, 0x4}, {0x1, 0x8}, {0x7, 0xa}, {0x4, 0x1}, {0x6, 0x1}, {0x6, 0x3}, {0x3, 0x2}, {0x0, 0x3}, {0x1, 0x9}, {0x1, 0x1}, {0x4, 0x7}, {0x3, 0x7}, {0x7, 0x2}, {0x5, 0x6}, {0x0, 0x7}, {0x2, 0x3}, {0x6, 0x6}, {0x2, 0x1}, {0x1, 0x3}, {0x0, 0x6}, {0x5, 0x7}, {0x0, 0x4}, {0x0, 0x6}, {0x1, 0x4}, {0x1, 0x2}, {0x7, 0x6}, {0x6, 0x7}, {0x6, 0x9}, {0x2, 0x5}, {0x1, 0x7}, {0x1, 0x7}, {0x0, 0x7}, {0x2, 0x3}, {0x2, 0x2}, {0x2, 0x9}, {0x3, 0x8}, {0x2, 0x1}, {0x3, 0xa}, {0x5, 0xa}, {0x0, 0x9}, {0x0, 0x2}, {0x1, 0x1}, {0x0, 0x2}, {0x2, 0x9}, {0x1, 0x4}, {0x0, 0x8}, {0x0, 0x4}, {0x3, 0x2}, {0x3, 0x1}, {0x2, 0x4}, {0x1, 0x6}, {0x0, 0x1}]}]}, @NL80211_BAND_60GHZ={0x4}]}]}, {0x8, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}]}]}, @NL80211_ATTR_TID_CONFIG={0x520, 0x11d, 0x0, 0x1, [{0x28, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0xb2}, @NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5, 0xc, 0x2}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5, 0x9, 0x1}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5, 0xa, 0x1}]}, {0x47c, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0x48}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x3ff}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x274, 0xd, 0x0, 0x1, [@NL80211_BAND_6GHZ={0xc, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5}]}, @NL80211_BAND_2GHZ={0xc, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}]}, @NL80211_BAND_2GHZ={0x70, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_LEGACY={0x24, 0x1, [0x6c, 0x24, 0x30, 0x48, 0x0, 0x36, 0x4, 0x60, 0xc, 0x30, 0x3, 0x33, 0x36, 0x6, 0x12, 0x4, 0x1, 0x1, 0x2, 0x16, 0x9, 0x1, 0x0, 0x9, 0x36, 0x9, 0x16, 0x16, 0x2, 0x5, 0x5, 0x6]}, @NL80211_TXRATE_LEGACY={0xd, 0x1, [0x3, 0x6c, 0xb, 0x4e, 0x4, 0x12, 0x1b, 0x16, 0xb]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x7a, 0x1, 0x7b76, 0x41, 0x101, 0x10, 0x9c]}}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HT={0x13, 0x2, [{0x2, 0x4}, {0x5, 0xa}, {0x2, 0x8}, {0x5}, {0x2, 0xa}, {0x1, 0x3}, {0x5, 0xa}, {0x0, 0x4}, {0x4, 0xa}, {0x5, 0x7}, {0x5}, {0x6, 0x9}, {0x4, 0x4}, {0x5, 0x4}, {0x5, 0xa}]}]}, @NL80211_BAND_2GHZ={0xc, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}]}, @NL80211_BAND_6GHZ={0x34, 0x3, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x0, 0x9, 0x8001, 0xfffe, 0xfff, 0x3, 0x8001, 0x6]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x0, 0x2, 0x3, 0x5, 0x6, 0x3, 0xe, 0x6]}}, @NL80211_TXRATE_HT={0x6, 0x2, [{0x7}, {0x4}]}]}, @NL80211_BAND_6GHZ={0x88, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x5, 0x7, 0x6, 0xc6, 0x3, 0x959, 0x2, 0x8000]}}, @NL80211_TXRATE_LEGACY={0x8, 0x1, [0x18, 0x33, 0x30, 0x12]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x6, 0x7, 0xa, 0x8, 0xc, 0xd, 0x6, 0x9]}}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HT={0x44, 0x2, [{0x1, 0x9}, {0x5, 0x6}, {0x2, 0x6}, {0x5, 0x2}, {0x3}, {0x0, 0x4}, {0x1, 0x8}, {0x3}, {0x0, 0x1}, {0x1, 0x7}, {0x1, 0x6}, {0x4, 0x8}, {0x4, 0x9}, {0x0, 0x8}, {}, {}, {0x3, 0x6}, {0x3, 0x7}, {0x0, 0x9}, {0x7, 0x4}, {0x4, 0x7}, {0x5, 0x3}, {0x2, 0x1}, {0x3}, {0x0, 0x6}, {0x7, 0x1}, {0x1, 0x9}, {0x0, 0x4}, {0x7, 0xa}, {0x0, 0x6}, {0x0, 0x3}, {0x7, 0x6}, {0x0, 0x3}, {0x6, 0x4}, {0x6, 0x3}, {0x0, 0x7}, {0x2, 0x2}, {0x2, 0x1}, {0x3, 0x5}, {0x2, 0xa}, {0x3}, {0x4, 0x2}, {0x2, 0x9}, {0x2}, {0x6, 0x9}, {0x0, 0x2}, {0x7, 0xa}, {0x5, 0x8}, {0x1, 0x8}, {0x4, 0x9}, {0x2, 0x8}, {0x4, 0x5}, {0x0, 0x2}, {0x0, 0x9}, {0x7, 0x1}, {0x4, 0x1}, {0x7, 0x1}, {0x0, 0x6}, {0x5, 0x2}, {0x0, 0x9}, {0x5}, {0x5, 0x3}, {0x6, 0x8}, {0x6, 0x2}]}]}, @NL80211_BAND_6GHZ={0x8c, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HT={0x3e, 0x2, [{0x0, 0x9}, {0x4, 0x1}, {0x0, 0x3}, {0x3, 0x3}, {0x4, 0x8}, {0x3, 0x3}, {0x4, 0x9}, {0x5, 0x7}, {0x0, 0x2}, {0x1, 0x2}, {0x6, 0x8}, {0x7, 0x4}, {0x6, 0x4}, {0x2, 0x5}, {0x7, 0x4}, {0x3, 0x4}, {0x5, 0xf}, {0x2, 0x1}, {0x3, 0x6}, {0x6, 0x3}, {0x3, 0x9}, {0x0, 0x7}, {0x1, 0x4}, {0x1, 0x1}, {0x0, 0x9}, {0x2, 0x3}, {0x6, 0x7}, {0x0, 0x5}, {0x4, 0x7}, {0x6, 0x1}, {0x2, 0x8}, {0x5, 0x1}, {0x0, 0x6}, {0x2, 0x3}, {0x5, 0x7}, {0x6, 0x8}, {0x4, 0x7}, {0x7, 0x1}, {0x5, 0x1}, {0x4, 0x8}, {0x3, 0x7}, {0x7, 0x6}, {}, {0x0, 0x9}, {0x4, 0x1}, {0x2, 0x5}, {0x2, 0x5}, {0x2, 0xa}, {0x7, 0x3}, {0x3, 0xa}, {0x4, 0x1}, {0x1, 0x1}, {0x1, 0x5}, {0x3, 0x7}, {0x5, 0x9}, {0x4, 0x5}, {0x5, 0x7}, {0x1, 0xa}]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0xff01, 0x59fa, 0x7f, 0x1, 0x1, 0x401, 0x5, 0x800]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_LEGACY={0x5, 0x1, [0x18]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x1, 0x9, 0x8, 0x0, 0x1, 0x5, 0x0, 0x9f]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}]}, @NL80211_BAND_2GHZ={0x2c, 0x0, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0xa, 0x1, [0x30, 0x36, 0x18, 0xc, 0x24, 0x18]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x3, 0x2, 0x4, 0x9cf, 0x81, 0x4f, 0x2, 0x3ce7]}}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}]}, @NL80211_BAND_5GHZ={0x68, 0x1, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x9, 0xc, 0x101, 0x9, 0x0, 0x3, 0x4, 0x9]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_HT={0x24, 0x2, [{0x3}, {0x2, 0x4}, {0x4, 0x5}, {0x0, 0x5}, {0x4, 0x3}, {0x1}, {0x4}, {0x5, 0xa}, {0x4, 0x6}, {0x7, 0x8}, {0x4, 0x5}, {0x3, 0x9}, {0x2, 0x6}, {0x6, 0x8}, {0x3, 0x7}, {0x1, 0x3}, {0x2, 0x4}, {0x2, 0x6}, {0x5}, {0x3}, {0x1, 0x7}, {0x6, 0x4}, {0x4, 0x9}, {0x0, 0xa}, {0x5, 0x6}, {0x7, 0x8}, {0x1, 0x5}, {0x1, 0x8}, {0x1, 0xa}, {0x6, 0x3}, {0x0, 0x7}, {0x5, 0x9}]}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_LEGACY={0x13, 0x1, [0x6c, 0x1b, 0x1, 0x30, 0x4, 0x2, 0x36, 0x1f, 0x36, 0x12, 0x36, 0x1b, 0x6, 0x6c, 0x37]}]}]}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0x94}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x1e0, 0xd, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x5c, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x5, 0x5, 0x7, 0x2, 0xb, 0xd4, 0x9, 0x7f]}}, @NL80211_TXRATE_LEGACY={0x17, 0x1, [0x5, 0x16, 0x18, 0x1b, 0x4, 0x4, 0x5, 0x16, 0x9, 0x18, 0x60, 0x5, 0x24, 0x3, 0x30, 0x16, 0xb, 0x6c, 0x36]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x5, 0xfffe, 0x1, 0x8d5, 0x4, 0x9, 0x7, 0xf4c9]}}, @NL80211_TXRATE_LEGACY={0xe, 0x1, [0x2, 0x30, 0x30, 0x9, 0x18, 0x9, 0x30, 0x1, 0xc, 0x12]}]}, @NL80211_BAND_2GHZ={0x48, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x1, 0x4, 0xc3, 0x10, 0x14, 0x3, 0xe, 0xfdf6]}}, @NL80211_TXRATE_HT={0x2d, 0x2, [{0x4, 0x4}, {0x6, 0x6}, {0x3, 0x3}, {}, {0x3, 0x9}, {0x5}, {0x5, 0x9}, {0x1, 0x2}, {0x0, 0x2}, {0x3, 0x3}, {0x6}, {0x1, 0x8}, {0x6, 0x4}, {0x4, 0x1}, {0x2, 0x6}, {0x1, 0x4}, {0x2, 0x7}, {0x5, 0x8}, {}, {0x7, 0x5}, {0x2, 0x6}, {0x1, 0x8}, {0x4, 0x6}, {0x2, 0x2}, {0x1}, {0x3}, {0x1, 0xa}, {0x0, 0x4}, {0x5, 0x6}, {0x7, 0x8}, {0x2, 0x4}, {0x0, 0x9}, {0x1, 0x2}, {0x2, 0x8}, {0x4, 0x9}, {}, {0x1, 0x7}, {}, {}, {0x1, 0x8}, {0x1, 0x3}]}]}, @NL80211_BAND_2GHZ={0x20, 0x0, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x1b, 0x1, [0x12, 0x5, 0x1b, 0xb, 0x1, 0x24, 0x4, 0x60, 0xa, 0x12, 0x16, 0x30, 0x60, 0xb, 0x49, 0x9, 0x9, 0xb, 0x5, 0xc, 0x1b, 0xb, 0x5]}]}, @NL80211_BAND_5GHZ={0x3c, 0x1, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0xfffa, 0x7, 0x0, 0x0, 0x1, 0x2f6b, 0x2, 0x7f]}}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x2, 0x270a, 0x7fff, 0xd, 0x16, 0xff06, 0xf, 0x3]}}]}, @NL80211_BAND_6GHZ={0x98, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HT={0x32, 0x2, [{0x4, 0x2}, {0x0, 0x8}, {0x6, 0x8}, {0x5, 0x8}, {0x4, 0xa}, {0x6}, {0x1, 0x5}, {0x1}, {0x2, 0x5}, {0x3, 0x7}, {0x4, 0xa}, {0x1}, {0x1, 0xa}, {0x1, 0x9}, {0x3, 0x4}, {0x0, 0x9}, {0x6, 0x8}, {0x5, 0x7}, {0x6, 0x8}, {0x1, 0x3}, {0x1, 0x5}, {0x3, 0x4}, {0x3, 0x1}, {0x1, 0x4}, {0x4, 0x8}, {0x3, 0x1}, {0x5, 0x8}, {0x2, 0x1}, {0x4, 0xa}, {0x6}, {0x6, 0xa}, {0x2}, {0x6, 0x7}, {0x1, 0x4}, {0x0, 0x1}, {0x6}, {0x1, 0x8}, {0x0, 0x2}, {0x1, 0x1}, {0x5, 0x4}, {0x7}, {0x7, 0x9}, {0x6, 0xa}, {0x5, 0x5}, {0x0, 0x4}, {0x0, 0x6}]}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HE={0x14, 0x5, {[0xffff, 0x3, 0x81, 0x11, 0x80, 0x5, 0x80, 0xffff]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_LEGACY={0x1a, 0x1, [0xb, 0x18, 0xc, 0x1, 0x6c, 0x1b, 0x2d, 0x30, 0xccb3d46c9a6f69e8, 0xc, 0x18, 0x24, 0x6c, 0x5, 0x2, 0x24, 0x6c, 0x36, 0x60, 0x5, 0x6c, 0x2]}, @NL80211_TXRATE_HT={0x1e, 0x2, [{0x2, 0xa}, {0x4, 0x5}, {0x6, 0x2}, {0x4, 0x7}, {0x4, 0x4}, {0x7, 0x8}, {0x7, 0x3}, {0x6, 0x5}, {0x1, 0x4}, {0x6, 0x2}, {0x1, 0x9}, {0x3, 0x2}, {0x1, 0x6}, {0x5, 0x5}, {0x0, 0x4}, {0x5, 0x9}, {0x0, 0x5}, {0x5, 0x6}, {0x4}, {0x1, 0x8}, {0x5, 0x1}, {0x3, 0x4}, {0x2, 0x4}, {0x5, 0x6}, {0x6, 0x9}, {0x2, 0x6}]}]}, @NL80211_BAND_6GHZ={0x44, 0x3, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x2, 0x6, 0x7, 0x1, 0x9, 0x3, 0x3, 0x8]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_LEGACY={0x12, 0x1, [0x6c, 0x53, 0x12, 0x2, 0x24, 0x3, 0x36, 0x5, 0x24, 0x2d, 0x30, 0x30, 0x30, 0xb]}]}]}]}, {0x14, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5, 0xa, 0x1}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0x81}]}, {0x40, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5, 0x6, 0x1}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5, 0xb, 0x1}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0x1f}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5, 0xc, 0x1}]}, {0x18, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5, 0xc, 0x2}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x6}]}, {0xc, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5, 0x9, 0x1}]}]}]}, 0x1934}, 0x1, 0x0, 0x0, 0x20000000}, 0x48014) 83.03131ms ago: executing program 1 (id=1639): syz_usb_connect(0x0, 0x2d, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x33}}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x3, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41100, 0x25}, 0x94) setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000000)=0x4, 0x4) sched_setscheduler(0x0, 0x1, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) creat(0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000140)="26000000220047010500", 0xa) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, 0x0, 0x0) gettid() sendmmsg$inet(r1, &(0x7f0000004d00)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x30000}}], 0x300, 0xf00) r3 = socket(0xa, 0x3, 0xff) setsockopt$inet6_int(r3, 0x29, 0x21, &(0x7f0000000080)=0x8, 0x4) sendmsg$inet6(r3, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000001680)=[{&(0x7f00000002c0)="5665702f5e5648f3dab42167388ebf5ed679d647b515d24e4890314545f8", 0x1e}], 0x1}, 0x80090) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) 0s ago: executing program 7 (id=1640): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r3, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@mcast1, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x10000, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0xfffffffffffffffd}, {0x0, 0x8, 0x0, 0x8}, 0x0, 0x0, 0x1, 0x0, 0x1}, {{@in=@remote, 0x2, 0x6c}, 0x0, @in=@empty, 0x0, 0x5, 0x0, 0xb7}}, 0xe8) sendmmsg(r3, &(0x7f0000007fc0), 0x800001d, 0x0) kernel console output (not intermixed with test programs): ig 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 1756.243713][T12665] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1756.249307][T12665] usb 8-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1756.249332][T12665] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1756.249351][T12665] usb 8-1: Product: syz [ 1756.249364][T12665] usb 8-1: Manufacturer: syz [ 1756.249378][T12665] usb 8-1: SerialNumber: syz [ 1756.300874][T12665] usb 8-1: config 0 descriptor?? [ 1756.319280][ T9816] usb 4-1: new full-speed USB device number 5 using dummy_hcd [ 1756.340350][T12665] em28xx 8-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1756.340379][T12665] em28xx 8-1:0.0: Audio interface 0 found (Vendor Class) [ 1756.403233][T14244] tipc: Enabled bearer , priority 10 [ 1756.475533][ T9816] usb 4-1: not running at top speed; connect to a high speed hub [ 1756.477064][ T9816] usb 4-1: config 1 has an invalid descriptor of length 215, skipping remainder of the config [ 1756.477087][ T9816] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 1756.477107][ T9816] usb 4-1: config 1 has no interface number 1 [ 1756.477149][ T9816] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 1756.477192][ T9816] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 180, changing to 4 [ 1756.477217][ T9816] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid maxpacket 4432, setting to 1023 [ 1756.539527][ T9816] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1756.539555][ T9816] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1756.539573][ T9816] usb 4-1: Product: syz [ 1756.539584][ T9816] usb 4-1: Manufacturer: syz [ 1756.539597][ T9816] usb 4-1: SerialNumber: syz [ 1756.624220][T14246] tipc: Started in network mode [ 1756.625111][T14246] tipc: Node identity , cluster identity 4711 [ 1756.625130][T14246] tipc: Failed to obtain node identity [ 1756.625159][T14246] tipc: Enabling of bearer rejected, failed to enable media [ 1756.703838][T14248] FAULT_INJECTION: forcing a failure. [ 1756.703838][T14248] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1756.703930][T14248] CPU: 1 UID: 0 PID: 14248 Comm: syz.8.1372 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 1756.703952][T14248] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1756.703964][T14248] Call Trace: [ 1756.703972][T14248] [ 1756.703981][T14248] dump_stack_lvl+0x189/0x250 [ 1756.704009][T14248] ? __pfx____ratelimit+0x10/0x10 [ 1756.704036][T14248] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1756.704060][T14248] ? __pfx__printk+0x10/0x10 [ 1756.704094][T14248] should_fail_ex+0x46c/0x600 [ 1756.704123][T14248] _copy_to_user+0x31/0xb0 [ 1756.704145][T14248] simple_read_from_buffer+0xe1/0x170 [ 1756.704173][T14248] proc_fail_nth_read+0x1b6/0x220 [ 1756.704196][T14248] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1756.704217][T14248] ? rw_verify_area+0x2ac/0x4e0 [ 1756.704237][T14248] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1756.704256][T14248] vfs_read+0x203/0xa30 [ 1756.704285][T14248] ? __pfx_vfs_read+0x10/0x10 [ 1756.704309][T14248] ? try_to_take_rt_mutex+0x7fd/0xac0 [ 1756.704338][T14248] ? mutex_lock_nested+0x154/0x1d0 [ 1756.704355][T14248] ? fdget_pos+0x253/0x320 [ 1756.704388][T14248] ksys_read+0x14b/0x260 [ 1756.704411][T14248] ? __pfx_ksys_read+0x10/0x10 [ 1756.704431][T14248] ? rcu_is_watching+0x15/0xb0 [ 1756.704456][T14248] ? trace_sys_enter+0x25/0x100 [ 1756.704484][T14248] do_syscall_64+0xfa/0x3b0 [ 1756.704506][T14248] ? lockdep_hardirqs_on+0x9c/0x150 [ 1756.704532][T14248] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1756.704550][T14248] ? clear_bhb_loop+0x60/0xb0 [ 1756.704572][T14248] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1756.704589][T14248] RIP: 0033:0x7fd1e0e0d5fc [ 1756.704605][T14248] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 1756.704620][T14248] RSP: 002b:00007fd1df076030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1756.704639][T14248] RAX: ffffffffffffffda RBX: 00007fd1e1045fa0 RCX: 00007fd1e0e0d5fc [ 1756.704653][T14248] RDX: 000000000000000f RSI: 00007fd1df0760a0 RDI: 0000000000000004 [ 1756.704665][T14248] RBP: 00007fd1df076090 R08: 0000000000000000 R09: 0000000000000000 [ 1756.704677][T14248] R10: 0000000000000805 R11: 0000000000000246 R12: 0000000000000001 [ 1756.704688][T14248] R13: 00007fd1e1046038 R14: 00007fd1e1045fa0 R15: 00007fffb2bbdf18 [ 1756.704719][T14248] [ 1756.968110][T12665] em28xx 8-1:0.0: unknown em28xx chip ID (0) [ 1756.971912][T12665] em28xx 8-1:0.0: Config register raw data: 0xfffffffb [ 1757.073150][ T9816] usb 4-1: 2:1 : no or invalid class specific endpoint descriptor [ 1757.153486][ T9816] usb 4-1: USB disconnect, device number 5 [ 1757.366368][T14164] udevd[14164]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1758.031638][T12665] em28xx 8-1:0.0: Unknown AC97 audio processor detected! [ 1758.032184][T12665] em28xx 8-1:0.0: couldn't setup AC97 register 2 [ 1758.032605][T12665] em28xx 8-1:0.0: couldn't setup AC97 register 4 [ 1758.033028][T12665] em28xx 8-1:0.0: couldn't setup AC97 register 6 [ 1758.033582][T12665] em28xx 8-1:0.0: couldn't setup AC97 register 54 [ 1758.034049][T12665] em28xx 8-1:0.0: couldn't setup AC97 register 56 [ 1758.074567][T12665] usb 8-1: USB disconnect, device number 19 [ 1759.059703][T14272] FAULT_INJECTION: forcing a failure. [ 1759.059703][T14272] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1759.059736][T14272] CPU: 1 UID: 0 PID: 14272 Comm: syz.7.1379 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 1759.059758][T14272] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1759.059769][T14272] Call Trace: [ 1759.059777][T14272] [ 1759.059785][T14272] dump_stack_lvl+0x189/0x250 [ 1759.059813][T14272] ? __pfx____ratelimit+0x10/0x10 [ 1759.059836][T14272] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1759.059860][T14272] ? __pfx__printk+0x10/0x10 [ 1759.059879][T14272] ? __might_fault+0xb0/0x130 [ 1759.059913][T14272] should_fail_ex+0x46c/0x600 [ 1759.059941][T14272] _copy_from_user+0x2d/0xb0 [ 1759.059961][T14272] ___sys_sendmsg+0x158/0x2a0 [ 1759.059989][T14272] ? __pfx____sys_sendmsg+0x10/0x10 [ 1759.060049][T14272] ? __fget_files+0x2a/0x420 [ 1759.060071][T14272] ? __fget_files+0x3a6/0x420 [ 1759.060104][T14272] __x64_sys_sendmsg+0x1a1/0x260 [ 1759.060130][T14272] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1759.060170][T14272] ? __pfx_ksys_write+0x10/0x10 [ 1759.060189][T14272] ? rcu_is_watching+0x15/0xb0 [ 1759.060218][T14272] ? do_syscall_64+0xbe/0x3b0 [ 1759.060247][T14272] do_syscall_64+0xfa/0x3b0 [ 1759.060268][T14272] ? lockdep_hardirqs_on+0x9c/0x150 [ 1759.060289][T14272] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1759.060307][T14272] ? clear_bhb_loop+0x60/0xb0 [ 1759.060328][T14272] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1759.060346][T14272] RIP: 0033:0x7f581889ebe9 [ 1759.060362][T14272] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1759.060377][T14272] RSP: 002b:00007f5816b06038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1759.060396][T14272] RAX: ffffffffffffffda RBX: 00007f5818ad5fa0 RCX: 00007f581889ebe9 [ 1759.060410][T14272] RDX: 0000000000008400 RSI: 0000200000000480 RDI: 0000000000000003 [ 1759.060422][T14272] RBP: 00007f5816b06090 R08: 0000000000000000 R09: 0000000000000000 [ 1759.060434][T14272] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1759.060445][T14272] R13: 00007f5818ad6038 R14: 00007f5818ad5fa0 R15: 00007ffc86a76c78 [ 1759.060475][T14272] [ 1759.934628][T14274] could not allocate digest TFM handle blake2s-128-generic [ 1760.015369][T14281] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1382'. [ 1760.015385][T14281] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1382'. [ 1762.392730][T14308] fuse: Unknown parameter 'rooP5/00000000003777772?000' [ 1762.689045][T14310] tmpfs: Bad value for 'nr_inodes' [ 1764.104857][T14318] netlink: 'syz.7.1392': attribute type 6 has an invalid length. [ 1765.842637][T14334] FAULT_INJECTION: forcing a failure. [ 1765.842637][T14334] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1765.842674][T14334] CPU: 0 UID: 0 PID: 14334 Comm: syz.3.1397 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 1765.842726][T14334] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1765.842753][T14334] Call Trace: [ 1765.842770][T14334] [ 1765.842789][T14334] dump_stack_lvl+0x189/0x250 [ 1765.842856][T14334] ? __pfx____ratelimit+0x10/0x10 [ 1765.842890][T14334] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1765.842914][T14334] ? __pfx__printk+0x10/0x10 [ 1765.842934][T14334] ? __might_fault+0xb0/0x130 [ 1765.842969][T14334] should_fail_ex+0x46c/0x600 [ 1765.842997][T14334] _copy_from_user+0x2d/0xb0 [ 1765.843017][T14334] __sys_bpf+0x1ed/0x870 [ 1765.843041][T14334] ? __pfx___sys_bpf+0x10/0x10 [ 1765.843075][T14334] ? ksys_write+0x230/0x260 [ 1765.843099][T14334] ? __pfx_ksys_write+0x10/0x10 [ 1765.843117][T14334] ? rcu_is_watching+0x15/0xb0 [ 1765.843149][T14334] __x64_sys_bpf+0x7c/0x90 [ 1765.843169][T14334] do_syscall_64+0xfa/0x3b0 [ 1765.843190][T14334] ? lockdep_hardirqs_on+0x9c/0x150 [ 1765.843217][T14334] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1765.843235][T14334] ? clear_bhb_loop+0x60/0xb0 [ 1765.843257][T14334] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1765.843274][T14334] RIP: 0033:0x7fc6ed6eebe9 [ 1765.843290][T14334] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1765.843304][T14334] RSP: 002b:00007fc6eb94e038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1765.843328][T14334] RAX: ffffffffffffffda RBX: 00007fc6ed925fa0 RCX: 00007fc6ed6eebe9 [ 1765.843341][T14334] RDX: 0000000000000037 RSI: 0000200000000380 RDI: 000000000000000a [ 1765.843353][T14334] RBP: 00007fc6eb94e090 R08: 0000000000000000 R09: 0000000000000000 [ 1765.843365][T14334] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1765.843376][T14334] R13: 00007fc6ed926038 R14: 00007fc6ed925fa0 R15: 00007ffef335e6f8 [ 1765.843406][T14334] [ 1767.723637][T14340] [U] [ 1768.009372][ T5891] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 1768.495379][ T5891] usb 3-1: Using ep0 maxpacket: 16 [ 1768.510871][ T5891] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1768.510896][ T5891] usb 3-1: config 0 has no interfaces? [ 1768.510927][ T5891] usb 3-1: New USB device found, idVendor=045e, idProduct=05da, bcdDevice= 0.00 [ 1768.510948][ T5891] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1769.483746][ T5891] usb 3-1: config 0 descriptor?? [ 1770.834212][ T5891] usb 3-1: can't set config #0, error -71 [ 1770.889511][ T5891] usb 3-1: USB disconnect, device number 11 [ 1771.086290][T14362] netlink: 12 bytes leftover after parsing attributes in process `syz.8.1405'. [ 1771.559289][ T5891] usb 8-1: new high-speed USB device number 20 using dummy_hcd [ 1771.569274][ T9816] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 1771.747351][ T5891] usb 8-1: Using ep0 maxpacket: 32 [ 1771.753973][ T5891] usb 8-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 1771.754000][ T5891] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1771.781499][ T9816] usb 3-1: Using ep0 maxpacket: 32 [ 1771.787380][ T9816] usb 3-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 1771.787405][ T9816] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1771.825200][ T9816] usb 3-1: config 0 descriptor?? [ 1771.842226][ T5891] usb 8-1: config 0 descriptor?? [ 1772.046759][ T9816] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 1772.059887][ T9816] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1772.061038][ T9816] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 1772.061091][ T9816] usb 3-1: media controller created [ 1772.077670][ T5891] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 1772.122725][ T5891] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1772.129056][ T9816] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1772.154397][ T5891] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 1772.154465][ T5891] usb 8-1: media controller created [ 1772.266788][ T9816] az6027: usb out operation failed. (-71) [ 1772.275236][ T9816] az6027: usb out operation failed. (-71) [ 1772.275252][ T9816] stb0899_attach: Driver disabled by Kconfig [ 1772.275261][ T9816] az6027: no front-end attached [ 1772.275261][ T9816] [ 1772.276696][ T9816] az6027: usb out operation failed. (-71) [ 1772.276713][ T9816] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 1772.321386][ T9816] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.2/usb3/3-1/input/input24 [ 1772.352778][ T9816] dvb-usb: schedule remote query interval to 400 msecs. [ 1772.352807][ T9816] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 1772.358292][ T9816] usb 3-1: USB disconnect, device number 12 [ 1772.378407][ T5891] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1772.589381][ T5891] az6027: usb out operation failed. (-71) [ 1772.589823][ T5891] az6027: usb out operation failed. (-71) [ 1772.589839][ T5891] stb0899_attach: Driver disabled by Kconfig [ 1772.589848][ T5891] az6027: no front-end attached [ 1772.589848][ T5891] [ 1772.645039][ T5891] az6027: usb out operation failed. (-71) [ 1772.645061][ T5891] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 1772.768981][ T5891] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.7/usb8/8-1/input/input25 [ 1772.892580][T14391] netlink: 'syz.1.1413': attribute type 6 has an invalid length. [ 1773.319693][ T5891] dvb-usb: schedule remote query interval to 400 msecs. [ 1773.319715][ T5891] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 1773.433600][ T5891] usb 8-1: USB disconnect, device number 20 [ 1773.815163][ T9816] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 1774.928665][ T5891] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 1775.229373][ T7515] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 1775.269350][ T5891] usb 8-1: new full-speed USB device number 21 using dummy_hcd [ 1775.336395][T14411] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1421'. [ 1775.336436][T14411] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1421'. [ 1775.382265][ T7515] usb 2-1: Using ep0 maxpacket: 16 [ 1775.386350][ T7515] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1775.386377][ T7515] usb 2-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 1775.386388][ T7515] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1775.430892][ T5891] usb 8-1: not running at top speed; connect to a high speed hub [ 1775.432634][ T5891] usb 8-1: config 1 has an invalid descriptor of length 215, skipping remainder of the config [ 1775.432658][ T5891] usb 8-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 1775.432676][ T5891] usb 8-1: config 1 has no interface number 1 [ 1775.432721][ T5891] usb 8-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 1775.432764][ T5891] usb 8-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 180, changing to 4 [ 1775.432788][ T5891] usb 8-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid maxpacket 4432, setting to 1023 [ 1775.437191][ T5891] usb 8-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1775.437216][ T5891] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1775.437235][ T5891] usb 8-1: Product: syz [ 1775.437248][ T5891] usb 8-1: Manufacturer: syz [ 1775.437262][ T5891] usb 8-1: SerialNumber: syz [ 1775.556952][ T7515] usb 2-1: config 0 descriptor?? [ 1775.679340][T12665] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 1775.929311][T12665] usb 4-1: Using ep0 maxpacket: 16 [ 1775.933893][T12665] usb 4-1: config 1 has an invalid interface number: 105 but max is 0 [ 1775.933918][T12665] usb 4-1: config 1 has no interface number 0 [ 1775.933953][T12665] usb 4-1: config 1 interface 105 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 1775.933966][T12665] usb 4-1: config 1 interface 105 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 1775.934025][T12665] usb 4-1: config 1 interface 105 has no altsetting 0 [ 1776.882744][T12665] usb 4-1: New USB device found, idVendor=20f4, idProduct=e05a, bcdDevice=6c.6d [ 1776.882829][T12665] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1776.882848][T12665] usb 4-1: Product: syz [ 1776.882860][T12665] usb 4-1: Manufacturer: syz [ 1776.882873][T12665] usb 4-1: SerialNumber: syz [ 1776.956617][ T7515] mcp2221 0003:04D8:00DD.0008: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.1-1/input0 [ 1777.026525][T14411] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 1777.042688][T14411] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 1777.425899][ T5891] usb 8-1: 2:1 : no or invalid class specific endpoint descriptor [ 1777.506440][T14411] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 1777.523620][T14411] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 1777.607727][ T5891] usb 8-1: USB disconnect, device number 21 [ 1777.899371][T12664] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 1777.994258][T14164] udevd[14164]: error opening ATTR{/sys/devices/platform/dummy_hcd.7/usb8/8-1/8-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1778.049538][T12664] usb 3-1: Using ep0 maxpacket: 16 [ 1778.052099][T12664] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 1778.052117][T12664] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1778.055879][T12664] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1778.055968][T12664] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1778.055988][T12664] usb 3-1: Product: syz [ 1778.056001][T12664] usb 3-1: Manufacturer: syz [ 1778.056015][T12664] usb 3-1: SerialNumber: syz [ 1778.169046][ T7516] usb 2-1: USB disconnect, device number 10 [ 1778.273335][T12665] aqc111 4-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x1) reg index 0x0001: -71 [ 1778.277231][T12665] aqc111 4-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x1) reg index 0x0001: -71 [ 1778.382271][T12664] usb 3-1: config 0 descriptor?? [ 1778.528591][T12664] em28xx 3-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1778.528624][T12664] em28xx 3-1:0.0: Audio interface 0 found (Vendor Class) [ 1778.709312][ T5849] Bluetooth: hci0: command 0x0406 tx timeout [ 1778.826859][T12665] aqc111 4-1:1.105 eth9: register 'aqc111' at usb-dummy_hcd.3-1, USB-C 3.1 to 5GBASE-T Ethernet Adapter, 20:fc:94:45:3a:41 [ 1778.864003][T12665] usb 4-1: USB disconnect, device number 6 [ 1778.867775][T12665] aqc111 4-1:1.105 eth9: unregister 'aqc111' usb-dummy_hcd.3-1, USB-C 3.1 to 5GBASE-T Ethernet Adapter [ 1779.051826][T12664] em28xx 3-1:0.0: unknown em28xx chip ID (0) [ 1779.052643][T12664] em28xx 3-1:0.0: Config register raw data: 0xfffffffb [ 1779.139879][ T7516] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 1779.289634][ T7516] usb 2-1: Using ep0 maxpacket: 16 [ 1779.297826][ T7516] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 1779.297912][ T7516] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1779.349795][ T7516] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1779.349882][ T7516] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1779.349901][ T7516] usb 2-1: Product: syz [ 1779.349935][ T7516] usb 2-1: Manufacturer: syz [ 1779.349950][ T7516] usb 2-1: SerialNumber: syz [ 1779.483325][ T7516] usb 2-1: config 0 descriptor?? [ 1779.519443][T14429] netlink: 'syz.8.1426': attribute type 6 has an invalid length. [ 1779.546261][ T7516] em28xx 2-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1779.546293][ T7516] em28xx 2-1:0.0: Audio interface 0 found (Vendor Class) [ 1779.594908][T12665] aqc111 4-1:1.105 eth9 (unregistered): Failed to write(0x1) reg index 0x0002: -19 [ 1779.595670][T12665] aqc111 4-1:1.105 eth9 (unregistered): Failed to write(0x1) reg index 0x0002: -19 [ 1779.596637][T12665] aqc111 4-1:1.105 eth9 (unregistered): Failed to write(0x61) reg index 0x0000: -19 [ 1780.551927][T12664] em28xx 3-1:0.0: Unknown AC97 audio processor detected! [ 1780.552556][T12664] em28xx 3-1:0.0: couldn't setup AC97 register 2 [ 1780.553222][T12664] em28xx 3-1:0.0: couldn't setup AC97 register 4 [ 1780.556322][T12664] em28xx 3-1:0.0: couldn't setup AC97 register 6 [ 1780.558016][T12664] em28xx 3-1:0.0: couldn't setup AC97 register 54 [ 1780.559593][T12664] em28xx 3-1:0.0: couldn't setup AC97 register 56 [ 1780.629978][T12664] usb 3-1: USB disconnect, device number 13 [ 1780.693540][ T7516] em28xx 2-1:0.0: unknown em28xx chip ID (0) [ 1780.724066][ T7516] em28xx 2-1:0.0: Config register raw data: 0xfffffffb [ 1781.765541][T14444] FAULT_INJECTION: forcing a failure. [ 1781.765541][T14444] name failslab, interval 1, probability 0, space 0, times 0 [ 1781.765667][T14444] CPU: 0 UID: 0 PID: 14444 Comm: syz.2.1430 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 1781.765690][T14444] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1781.765701][T14444] Call Trace: [ 1781.765710][T14444] [ 1781.765719][T14444] dump_stack_lvl+0x189/0x250 [ 1781.765748][T14444] ? __pfx____ratelimit+0x10/0x10 [ 1781.765775][T14444] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1781.765799][T14444] ? __pfx__printk+0x10/0x10 [ 1781.765825][T14444] ? __pfx___might_resched+0x10/0x10 [ 1781.765845][T14444] ? fs_reclaim_acquire+0x7d/0x100 [ 1781.765867][T14444] should_fail_ex+0x46c/0x600 [ 1781.765896][T14444] should_failslab+0xa8/0x100 [ 1781.765921][T14444] __kmalloc_noprof+0xcb/0x430 [ 1781.765942][T14444] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 1781.765972][T14444] tomoyo_realpath_from_path+0xe3/0x5d0 [ 1781.765997][T14444] ? tomoyo_domain+0xda/0x130 [ 1781.766026][T14444] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 1781.766047][T14444] tomoyo_path_number_perm+0x1e8/0x5a0 [ 1781.766070][T14444] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1781.766095][T14444] ? _raw_spin_unlock_irqrestore+0x85/0x110 [ 1781.766114][T14444] ? lockdep_hardirqs_on+0x9c/0x150 [ 1781.766142][T14444] ? __lock_acquire+0xab9/0xd20 [ 1781.766180][T14444] ? __fget_files+0x2a/0x420 [ 1781.766203][T14444] ? __fget_files+0x2a/0x420 [ 1781.766219][T14444] ? __fget_files+0x3a6/0x420 [ 1781.766235][T14444] ? __fget_files+0x2a/0x420 [ 1781.766255][T14444] security_file_ioctl+0xcb/0x2d0 [ 1781.766273][T14444] __se_sys_ioctl+0x47/0x170 [ 1781.766290][T14444] do_syscall_64+0xfa/0x3b0 [ 1781.766307][T14444] ? lockdep_hardirqs_on+0x9c/0x150 [ 1781.766322][T14444] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1781.766336][T14444] ? clear_bhb_loop+0x60/0xb0 [ 1781.766353][T14444] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1781.766366][T14444] RIP: 0033:0x7f2b777febe9 [ 1781.766378][T14444] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1781.766390][T14444] RSP: 002b:00007f2b75a24038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1781.766405][T14444] RAX: ffffffffffffffda RBX: 00007f2b77a36180 RCX: 00007f2b777febe9 [ 1781.766415][T14444] RDX: 0000200000000140 RSI: 00000000c01064b5 RDI: 0000000000000005 [ 1781.766425][T14444] RBP: 00007f2b75a24090 R08: 0000000000000000 R09: 0000000000000000 [ 1781.766433][T14444] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1781.766441][T14444] R13: 00007f2b77a36218 R14: 00007f2b77a36180 R15: 00007fffa6cfde68 [ 1781.766464][T14444] [ 1781.766556][T14444] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1782.056384][ T7516] em28xx 2-1:0.0: Unknown AC97 audio processor detected! [ 1782.060878][ T7516] em28xx 2-1:0.0: couldn't setup AC97 register 2 [ 1782.061978][ T7516] em28xx 2-1:0.0: couldn't setup AC97 register 4 [ 1782.062393][ T7516] em28xx 2-1:0.0: couldn't setup AC97 register 6 [ 1782.062867][ T7516] em28xx 2-1:0.0: couldn't setup AC97 register 54 [ 1782.063281][ T7516] em28xx 2-1:0.0: couldn't setup AC97 register 56 [ 1782.166682][ T7516] usb 2-1: USB disconnect, device number 11 [ 1782.681289][T14449] tmpfs: Bad value for 'huge' [ 1782.999328][ T7516] usb 8-1: new full-speed USB device number 22 using dummy_hcd [ 1783.192523][ C1] vkms_vblank_simulate: vblank timer overrun [ 1784.039773][ C1] vkms_vblank_simulate: vblank timer overrun [ 1784.152197][ T7516] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1784.177313][ T7516] usb 8-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1784.177340][ T7516] usb 8-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1784.177350][ T7516] usb 8-1: Manufacturer: syz [ 1784.210883][ T7516] usb 8-1: config 0 descriptor?? [ 1784.540614][ T7516] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 1784.701686][ T7516] usb 2-1: Using ep0 maxpacket: 16 [ 1784.712042][ T7516] usb 2-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 1784.712073][ T7516] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1784.712092][ T7516] usb 2-1: Product: syz [ 1784.712105][ T7516] usb 2-1: Manufacturer: syz [ 1784.712118][ T7516] usb 2-1: SerialNumber: syz [ 1784.747542][ T7516] r8152-cfgselector 2-1: Unknown version 0x0000 [ 1784.747559][ T7516] r8152-cfgselector 2-1: config 0 descriptor?? [ 1785.029930][ T7516] r8152-cfgselector 2-1: Needed 1 retries to read version [ 1785.029983][ T7516] r8152-cfgselector 2-1: Unknown version 0x0000 [ 1785.030508][ T7516] r8152-cfgselector 2-1: bad CDC descriptors [ 1785.100032][ T7516] usb 8-1: USB disconnect, device number 22 [ 1785.161198][ C1] vkms_vblank_simulate: vblank timer overrun [ 1785.561403][ C1] vkms_vblank_simulate: vblank timer overrun [ 1785.795166][T14471] netlink: 52 bytes leftover after parsing attributes in process `syz.7.1437'. [ 1785.825146][ C1] vkms_vblank_simulate: vblank timer overrun [ 1786.559768][ C1] vkms_vblank_simulate: vblank timer overrun [ 1786.792100][ C1] vkms_vblank_simulate: vblank timer overrun [ 1786.889288][ C1] vkms_vblank_simulate: vblank timer overrun [ 1786.994135][ C1] vkms_vblank_simulate: vblank timer overrun [ 1787.095379][ C1] vkms_vblank_simulate: vblank timer overrun [ 1787.477485][ C1] vkms_vblank_simulate: vblank timer overrun [ 1787.860232][ T9816] r8152-cfgselector 2-1: USB disconnect, device number 12 [ 1788.159424][ T6005] usb 4-1: new full-speed USB device number 7 using dummy_hcd [ 1788.565015][ T6005] usb 4-1: not running at top speed; connect to a high speed hub [ 1788.566691][ T6005] usb 4-1: config 1 has an invalid descriptor of length 215, skipping remainder of the config [ 1788.566716][ T6005] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 1788.566735][ T6005] usb 4-1: config 1 has no interface number 1 [ 1788.567515][ T6005] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 1788.567560][ T6005] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 180, changing to 4 [ 1788.567584][ T6005] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid maxpacket 4432, setting to 1023 [ 1788.580248][ T6005] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1788.580277][ T6005] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1788.580301][ T6005] usb 4-1: Product: syz [ 1788.580314][ T6005] usb 4-1: Manufacturer: syz [ 1788.580328][ T6005] usb 4-1: SerialNumber: syz [ 1790.028475][ T6005] usb 4-1: 2:1 : no or invalid class specific endpoint descriptor [ 1790.072452][ T9817] usb 3-1: new full-speed USB device number 14 using dummy_hcd [ 1790.130990][ T6005] usb 4-1: USB disconnect, device number 7 [ 1790.238286][ T9817] usb 3-1: config 2 has an invalid interface number: 211 but max is 0 [ 1790.238312][ T9817] usb 3-1: config 2 has no interface number 0 [ 1790.238360][ T9817] usb 3-1: config 2 interface 211 altsetting 0 endpoint 0x4 has invalid maxpacket 512, setting to 64 [ 1790.238385][ T9817] usb 3-1: config 2 interface 211 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1790.298789][ T9817] usb 3-1: New USB device found, idVendor=2040, idProduct=8268, bcdDevice=27.95 [ 1790.298819][ T9817] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1790.298837][ T9817] usb 3-1: Product: syz [ 1790.298850][ T9817] usb 3-1: Manufacturer: syz [ 1790.298863][ T9817] usb 3-1: SerialNumber: syz [ 1790.345064][T14505] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 1790.358060][ T9817] em28xx 3-1:2.211: New device syz syz @ 12 Mbps (2040:8268, interface 211, class 211) [ 1790.358081][ T9817] em28xx 3-1:2.211: Device initialization failed. [ 1790.358088][ T9817] em28xx 3-1:2.211: Device must be connected to a high-speed USB 2.0 port. [ 1790.584067][T13789] udevd[13789]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1791.990750][T14526] netlink: 52 bytes leftover after parsing attributes in process `syz.8.1452'. [ 1792.770121][T12664] usb 3-1: USB disconnect, device number 14 [ 1794.268392][ C0] vkms_vblank_simulate: vblank timer overrun [ 1794.574411][ C0] vkms_vblank_simulate: vblank timer overrun [ 1794.708978][ C0] vkms_vblank_simulate: vblank timer overrun [ 1795.697366][T14553] FAULT_INJECTION: forcing a failure. [ 1795.697366][T14553] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1795.697397][T14553] CPU: 1 UID: 0 PID: 14553 Comm: syz.1.1459 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 1795.697409][T14553] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1795.697416][T14553] Call Trace: [ 1795.697420][T14553] [ 1795.697426][T14553] dump_stack_lvl+0x189/0x250 [ 1795.697444][T14553] ? __pfx____ratelimit+0x10/0x10 [ 1795.697458][T14553] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1795.697471][T14553] ? __pfx__printk+0x10/0x10 [ 1795.697482][T14553] ? __might_fault+0xb0/0x130 [ 1795.697501][T14553] should_fail_ex+0x46c/0x600 [ 1795.697517][T14553] _copy_from_user+0x2d/0xb0 [ 1795.697529][T14553] __sys_bpf+0x1ed/0x870 [ 1795.697542][T14553] ? __pfx___sys_bpf+0x10/0x10 [ 1795.697560][T14553] ? ksys_write+0x230/0x260 [ 1795.697574][T14553] ? __pfx_ksys_write+0x10/0x10 [ 1795.697589][T14553] __x64_sys_bpf+0x7c/0x90 [ 1795.697600][T14553] do_syscall_64+0xfa/0x3b0 [ 1795.697613][T14553] ? lockdep_hardirqs_on+0x9c/0x150 [ 1795.697625][T14553] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1795.697634][T14553] ? clear_bhb_loop+0x60/0xb0 [ 1795.697647][T14553] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1795.697656][T14553] RIP: 0033:0x7fc13ca9ebe9 [ 1795.697666][T14553] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1795.697674][T14553] RSP: 002b:00007fc13ad06038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1795.697685][T14553] RAX: ffffffffffffffda RBX: 00007fc13ccd5fa0 RCX: 00007fc13ca9ebe9 [ 1795.697693][T14553] RDX: 0000000000000050 RSI: 0000200000000600 RDI: 000000000000000a [ 1795.697699][T14553] RBP: 00007fc13ad06090 R08: 0000000000000000 R09: 0000000000000000 [ 1795.697705][T14553] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1795.697711][T14553] R13: 00007fc13ccd6038 R14: 00007fc13ccd5fa0 R15: 00007ffe999a3e98 [ 1795.697727][T14553] [ 1796.640152][T12664] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 1796.769374][T12664] usb 2-1: device descriptor read/64, error -71 [ 1796.958001][ C0] vkms_vblank_simulate: vblank timer overrun [ 1797.038656][ C0] vkms_vblank_simulate: vblank timer overrun [ 1797.179392][T12664] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 1797.324714][T12664] usb 2-1: device descriptor read/64, error -71 [ 1797.439857][T12664] usb usb2-port1: attempt power cycle [ 1797.842575][T12664] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 1797.859936][T12664] usb 2-1: device descriptor read/8, error -71 [ 1798.099310][T12664] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 1798.124749][T12664] usb 2-1: device descriptor read/8, error -71 [ 1798.151768][ T9817] usb 9-1: new high-speed USB device number 32 using dummy_hcd [ 1798.248245][T12664] usb usb2-port1: unable to enumerate USB device [ 1798.304117][ T9817] usb 9-1: config 0 has no interfaces? [ 1798.323764][ T9817] usb 9-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1798.323792][ T9817] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1798.323810][ T9817] usb 9-1: Product: syz [ 1798.323822][ T9817] usb 9-1: Manufacturer: syz [ 1798.323835][ T9817] usb 9-1: SerialNumber: syz [ 1798.374039][ T9817] usb 9-1: config 0 descriptor?? [ 1798.479367][ T5891] usb 8-1: new full-speed USB device number 23 using dummy_hcd [ 1798.558324][ T7516] usb 4-1: new full-speed USB device number 8 using dummy_hcd [ 1798.577464][T14562] FAULT_INJECTION: forcing a failure. [ 1798.577464][T14562] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1798.577497][T14562] CPU: 0 UID: 0 PID: 14562 Comm: syz.8.1462 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 1798.577519][T14562] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1798.577530][T14562] Call Trace: [ 1798.577538][T14562] [ 1798.577546][T14562] dump_stack_lvl+0x189/0x250 [ 1798.577575][T14562] ? __pfx____ratelimit+0x10/0x10 [ 1798.577599][T14562] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1798.577623][T14562] ? __pfx__printk+0x10/0x10 [ 1798.577643][T14562] ? __might_fault+0xb0/0x130 [ 1798.577679][T14562] should_fail_ex+0x46c/0x600 [ 1798.577708][T14562] _copy_from_user+0x2d/0xb0 [ 1798.577729][T14562] ___sys_sendmsg+0x158/0x2a0 [ 1798.577758][T14562] ? __pfx____sys_sendmsg+0x10/0x10 [ 1798.577819][T14562] ? __fget_files+0x2a/0x420 [ 1798.577841][T14562] ? __fget_files+0x3a6/0x420 [ 1798.577930][T14562] __x64_sys_sendmsg+0x1a1/0x260 [ 1798.577957][T14562] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1798.577995][T14562] ? rcu_is_watching+0x15/0xb0 [ 1798.578020][T14562] ? trace_sys_enter+0x25/0x100 [ 1798.578049][T14562] do_syscall_64+0xfa/0x3b0 [ 1798.578074][T14562] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1798.578090][T14562] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 1798.578107][T14562] ? clear_bhb_loop+0x60/0xb0 [ 1798.578128][T14562] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1798.578201][T14562] RIP: 0033:0x7fd1e0e0ebe9 [ 1798.578220][T14562] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1798.578234][T14562] RSP: 002b:00007fd1df034038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1798.578252][T14562] RAX: ffffffffffffffda RBX: 00007fd1e1046180 RCX: 00007fd1e0e0ebe9 [ 1798.578265][T14562] RDX: 0000000000004000 RSI: 0000200000000000 RDI: 0000000000000007 [ 1798.578277][T14562] RBP: 00007fd1df034090 R08: 0000000000000000 R09: 0000000000000000 [ 1798.578288][T14562] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1798.578299][T14562] R13: 00007fd1e1046218 R14: 00007fd1e1046180 R15: 00007fffb2bbdf18 [ 1798.578325][T14562] [ 1798.674184][ T5891] usb 8-1: not running at top speed; connect to a high speed hub [ 1798.675677][ T5891] usb 8-1: config 1 has an invalid descriptor of length 215, skipping remainder of the config [ 1798.675699][ T5891] usb 8-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 1798.675717][ T5891] usb 8-1: config 1 has no interface number 1 [ 1798.675760][ T5891] usb 8-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 1798.675797][ T5891] usb 8-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 180, changing to 4 [ 1798.675820][ T5891] usb 8-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid maxpacket 4432, setting to 1023 [ 1798.679053][ T5891] usb 8-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1798.679079][ T5891] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1798.679098][ T5891] usb 8-1: Product: syz [ 1798.679119][ T5891] usb 8-1: Manufacturer: syz [ 1798.679132][ T5891] usb 8-1: SerialNumber: syz [ 1798.751380][ T7516] usb 4-1: not running at top speed; connect to a high speed hub [ 1798.753620][ T7516] usb 4-1: config 1 has an invalid descriptor of length 215, skipping remainder of the config [ 1798.753644][ T7516] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 1798.753664][ T7516] usb 4-1: config 1 has no interface number 1 [ 1798.753764][ T7516] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 1798.753806][ T7516] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 180, changing to 4 [ 1798.753830][ T7516] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid maxpacket 4432, setting to 1023 [ 1798.757686][ T7516] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1798.757713][ T7516] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1798.757785][ T7516] usb 4-1: Product: syz [ 1798.757799][ T7516] usb 4-1: Manufacturer: syz [ 1798.757812][ T7516] usb 4-1: SerialNumber: syz [ 1799.160761][T14568] FAULT_INJECTION: forcing a failure. [ 1799.160761][T14568] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1799.160793][T14568] CPU: 1 UID: 0 PID: 14568 Comm: syz.2.1465 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 1799.160814][T14568] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1799.160826][T14568] Call Trace: [ 1799.160833][T14568] [ 1799.160841][T14568] dump_stack_lvl+0x189/0x250 [ 1799.160880][T14568] ? __pfx____ratelimit+0x10/0x10 [ 1799.160904][T14568] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1799.160927][T14568] ? __pfx__printk+0x10/0x10 [ 1799.160947][T14568] ? __might_fault+0xb0/0x130 [ 1799.160981][T14568] should_fail_ex+0x46c/0x600 [ 1799.161009][T14568] _copy_from_user+0x2d/0xb0 [ 1799.161029][T14568] __sys_bpf+0x1ed/0x870 [ 1799.161052][T14568] ? __pfx___sys_bpf+0x10/0x10 [ 1799.161069][T14568] ? bpf_trace_run2+0x186/0x4b0 [ 1799.161108][T14568] ? rcu_is_watching+0x15/0xb0 [ 1799.161137][T14568] __x64_sys_bpf+0x7c/0x90 [ 1799.161155][T14568] do_syscall_64+0xfa/0x3b0 [ 1799.161175][T14568] ? lockdep_hardirqs_on+0x9c/0x150 [ 1799.161196][T14568] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1799.161214][T14568] ? clear_bhb_loop+0x60/0xb0 [ 1799.161235][T14568] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1799.161251][T14568] RIP: 0033:0x7f2b777febe9 [ 1799.161266][T14568] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1799.161280][T14568] RSP: 002b:00007f2b75a66038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1799.161299][T14568] RAX: ffffffffffffffda RBX: 00007f2b77a35fa0 RCX: 00007f2b777febe9 [ 1799.161312][T14568] RDX: 0000000000000022 RSI: 0000200000001bc0 RDI: 000000000000000a [ 1799.161324][T14568] RBP: 00007f2b75a66090 R08: 0000000000000000 R09: 0000000000000000 [ 1799.161335][T14568] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1799.161347][T14568] R13: 00007f2b77a36038 R14: 00007f2b77a35fa0 R15: 00007fffa6cfde68 [ 1799.161377][T14568] [ 1799.667151][ T5891] usb 8-1: 2:1 : no or invalid class specific endpoint descriptor [ 1799.743514][T14573] FAULT_INJECTION: forcing a failure. [ 1799.743514][T14573] name failslab, interval 1, probability 0, space 0, times 0 [ 1799.743536][T14573] CPU: 0 UID: 0 PID: 14573 Comm: syz.2.1466 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 1799.743548][T14573] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1799.743555][T14573] Call Trace: [ 1799.743560][T14573] [ 1799.743565][T14573] dump_stack_lvl+0x189/0x250 [ 1799.743582][T14573] ? __pfx____ratelimit+0x10/0x10 [ 1799.743596][T14573] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1799.743614][T14573] ? __pfx__printk+0x10/0x10 [ 1799.743628][T14573] ? __pfx___might_resched+0x10/0x10 [ 1799.743640][T14573] ? fs_reclaim_acquire+0x7d/0x100 [ 1799.743651][T14573] should_fail_ex+0x46c/0x600 [ 1799.743668][T14573] should_failslab+0xa8/0x100 [ 1799.743682][T14573] __kmalloc_noprof+0xcb/0x430 [ 1799.743694][T14573] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 1799.743711][T14573] tomoyo_realpath_from_path+0xe3/0x5d0 [ 1799.743724][T14573] ? tomoyo_domain+0xda/0x130 [ 1799.743740][T14573] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 1799.743759][T14573] tomoyo_path_number_perm+0x1e8/0x5a0 [ 1799.743772][T14573] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1799.743785][T14573] ? _raw_spin_unlock_irqrestore+0x85/0x110 [ 1799.743798][T14573] ? lockdep_hardirqs_on+0x9c/0x150 [ 1799.743815][T14573] ? __lock_acquire+0xab9/0xd20 [ 1799.743839][T14573] ? __fget_files+0x2a/0x420 [ 1799.743854][T14573] ? __fget_files+0x2a/0x420 [ 1799.743866][T14573] ? __fget_files+0x3a6/0x420 [ 1799.743878][T14573] ? __fget_files+0x2a/0x420 [ 1799.743892][T14573] security_file_ioctl+0xcb/0x2d0 [ 1799.743906][T14573] __se_sys_ioctl+0x47/0x170 [ 1799.743919][T14573] do_syscall_64+0xfa/0x3b0 [ 1799.743932][T14573] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1799.743942][T14573] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1799.743952][T14573] ? clear_bhb_loop+0x60/0xb0 [ 1799.743964][T14573] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1799.743974][T14573] RIP: 0033:0x7f2b777febe9 [ 1799.743984][T14573] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1799.743993][T14573] RSP: 002b:00007f2b75a45038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1799.744005][T14573] RAX: ffffffffffffffda RBX: 00007f2b77a36090 RCX: 00007f2b777febe9 [ 1799.744012][T14573] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000006 [ 1799.744019][T14573] RBP: 00007f2b75a45090 R08: 0000000000000000 R09: 0000000000000000 [ 1799.744025][T14573] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1799.744031][T14573] R13: 00007f2b77a36128 R14: 00007f2b77a36090 R15: 00007fffa6cfde68 [ 1799.744048][T14573] [ 1799.744150][T14573] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1799.759378][T14573] kvm: kvm [14570]: vcpu0, guest rIP: 0x1be Unhandled WRMSR(0xc1) = 0x4000 [ 1799.759521][T14573] kvm: kvm [14570]: vcpu0, guest rIP: 0x1be Unhandled WRMSR(0xc2) = 0x4000 [ 1799.790684][T14573] kvm: kvm [14570]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x11e) = 0x0 [ 1799.790752][T14573] kvm: kvm [14570]: vcpu0, guest rIP: 0x1be Unhandled WRMSR(0x11e) = 0x4000 [ 1799.838356][T14573] kvm: kvm [14570]: vcpu0, guest rIP: 0x1be Unhandled WRMSR(0x186) = 0x4000 [ 1799.838488][T14573] kvm: kvm [14570]: vcpu0, guest rIP: 0x1be Unhandled WRMSR(0x187) = 0x4000 [ 1800.039750][ T7516] usb 4-1: 2:1 : no or invalid class specific endpoint descriptor [ 1800.163365][ T5891] usb 8-1: USB disconnect, device number 23 [ 1800.374784][ T7516] usb 4-1: USB disconnect, device number 8 [ 1802.087922][T14163] udevd[14163]: error opening ATTR{/sys/devices/platform/dummy_hcd.7/usb8/8-1/8-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1802.296792][T14164] udevd[14164]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 1802.305893][T14597] netlink: 52 bytes leftover after parsing attributes in process `syz.7.1472'. [ 1802.375607][ T5891] usb 9-1: USB disconnect, device number 32 [ 1802.399516][ T9817] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 1802.439508][ T7516] usb 4-1: new full-speed USB device number 9 using dummy_hcd [ 1802.533741][T14599] loop8: detected capacity change from 0 to 8 [ 1802.548878][T14599] Dev loop8: unable to read RDB block 8 [ 1802.548908][T14599] loop8: unable to read partition table [ 1802.549041][T14599] loop8: partition table beyond EOD, truncated [ 1802.549062][T14599] loop_reread_partitions: partition scan of loop8 (被x^> ) failed (rc=-5) [ 1802.579407][ T9817] usb 3-1: Using ep0 maxpacket: 32 [ 1802.596733][ T9817] usb 3-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 1802.596761][ T9817] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1802.601513][ T7516] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1802.611483][ T7516] usb 4-1: not running at top speed; connect to a high speed hub [ 1802.641008][ T7516] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1802.641062][ T7516] usb 4-1: config 1 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1802.641083][ T7516] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 1802.641104][ T7516] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 1802.641212][ T7516] usb 4-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 1802.647088][ T7516] usb 4-1: New USB device found, idVendor=045e, idProduct=043f, bcdDevice=fc.90 [ 1802.647114][ T7516] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1802.647133][ T7516] usb 4-1: Product: syz [ 1802.647146][ T7516] usb 4-1: Manufacturer: syz [ 1802.647159][ T7516] usb 4-1: SerialNumber: syz [ 1802.799764][ T9817] usb 3-1: config 0 descriptor?? [ 1802.966305][ T7516] ipaq 4-1:1.0: PocketPC PDA converter detected [ 1803.077911][ T9817] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 1803.114977][ T9817] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1803.145292][ T9817] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 1803.145351][ T9817] usb 3-1: media controller created [ 1803.708032][ T9817] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1804.044874][T14602] IPVS: wlc: SCTP 172.20.20.187:0 - no destination available [ 1804.069293][T14590] Bluetooth: hci2: command 0x0406 tx timeout [ 1804.214067][ T9817] az6027: usb out operation failed. (-71) [ 1804.214515][ T9817] az6027: usb out operation failed. (-71) [ 1804.214534][ T9817] stb0899_attach: Driver disabled by Kconfig [ 1804.214545][ T9817] az6027: no front-end attached [ 1804.214545][ T9817] [ 1804.244719][ T9817] az6027: usb out operation failed. (-71) [ 1804.244740][ T9817] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 1804.247873][ T9817] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.2/usb3/3-1/input/input30 [ 1804.315851][ T7516] ipaq 4-1:1.0: probe with driver ipaq failed with error -71 [ 1804.341177][ T7516] usb 4-1: USB disconnect, device number 9 [ 1804.347192][ T9817] dvb-usb: schedule remote query interval to 400 msecs. [ 1804.347216][ T9817] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 1804.561698][ T9817] usb 3-1: USB disconnect, device number 15 [ 1804.870445][ T9817] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 1805.219801][ T9817] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 1805.299393][ T6005] usb 8-1: new full-speed USB device number 24 using dummy_hcd [ 1805.360340][ T9817] usb 3-1: device descriptor read/64, error -71 [ 1805.450677][ T6005] usb 8-1: not running at top speed; connect to a high speed hub [ 1805.451804][ T6005] usb 8-1: config 1 has an invalid descriptor of length 215, skipping remainder of the config [ 1805.451819][ T6005] usb 8-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 1805.451829][ T6005] usb 8-1: config 1 has no interface number 1 [ 1805.451854][ T6005] usb 8-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 1805.451876][ T6005] usb 8-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 180, changing to 4 [ 1805.451890][ T6005] usb 8-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid maxpacket 4432, setting to 1023 [ 1805.456701][ T6005] usb 8-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1805.456717][ T6005] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1805.456727][ T6005] usb 8-1: Product: syz [ 1805.456734][ T6005] usb 8-1: Manufacturer: syz [ 1805.456741][ T6005] usb 8-1: SerialNumber: syz [ 1805.639359][ T9817] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 1805.769361][ T5857] usb 9-1: new high-speed USB device number 33 using dummy_hcd [ 1805.769548][ T9817] usb 3-1: device descriptor read/64, error -71 [ 1805.879683][ T9817] usb usb3-port1: attempt power cycle [ 1805.881759][ T6005] usb 8-1: 2:1 : no or invalid class specific endpoint descriptor [ 1805.929339][ T5857] usb 9-1: Using ep0 maxpacket: 16 [ 1805.931254][ T5857] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1805.931286][ T5857] usb 9-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x33, changing to 0x3 [ 1805.931298][ T5857] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 1805.931312][ T5857] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 51807, setting to 1024 [ 1805.931325][ T5857] usb 9-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 1024 [ 1805.931337][ T5857] usb 9-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1805.935253][ T5857] usb 9-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1805.935268][ T5857] usb 9-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1805.935278][ T5857] usb 9-1: Manufacturer: syz [ 1806.037413][ T5857] usb 9-1: config 0 descriptor?? [ 1806.337225][T14633] Driver unsupported XDP return value 0 on prog (id 190) dev N/A, expect packet loss! [ 1806.350389][T14633] netlink: 8 bytes leftover after parsing attributes in process `syz.8.1482'. [ 1806.360421][T14633] macvlan2: entered allmulticast mode [ 1806.360438][T14633] veth1_vlan: entered allmulticast mode [ 1806.383620][ T9817] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 1806.400069][ T9817] usb 3-1: device descriptor read/8, error -71 [ 1806.546409][ T5857] usb 9-1: USB disconnect, device number 33 [ 1806.549431][ T6005] usb 8-1: USB disconnect, device number 24 [ 1806.670788][ T9817] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 1806.690142][ T9817] usb 3-1: device descriptor read/8, error -71 [ 1806.799914][ T9817] usb usb3-port1: unable to enumerate USB device [ 1807.215851][ T1322] ieee802154 phy0 wpan0: encryption failed: -22 [ 1807.216415][ T1322] ieee802154 phy1 wpan1: encryption failed: -22 [ 1808.052267][T14644] netlink: 'syz.7.1486': attribute type 2 has an invalid length. [ 1808.052289][T14644] netlink: 'syz.7.1486': attribute type 1 has an invalid length. [ 1808.052306][T14644] netlink: 193500 bytes leftover after parsing attributes in process `syz.7.1486'. [ 1808.052328][T14644] nbd: couldn't find device at index 16 [ 1808.322602][T13783] udevd[13783]: error opening ATTR{/sys/devices/platform/dummy_hcd.7/usb8/8-1/8-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1810.112730][T14656] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1810.550896][T14661] FAULT_INJECTION: forcing a failure. [ 1810.550896][T14661] name failslab, interval 1, probability 0, space 0, times 0 [ 1810.550937][T14661] CPU: 1 UID: 0 PID: 14661 Comm: syz.3.1490 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 1810.550958][T14661] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1810.550968][T14661] Call Trace: [ 1810.550977][T14661] [ 1810.550986][T14661] dump_stack_lvl+0x189/0x250 [ 1810.551014][T14661] ? __pfx____ratelimit+0x10/0x10 [ 1810.551037][T14661] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1810.551060][T14661] ? __pfx__printk+0x10/0x10 [ 1810.551085][T14661] ? __pfx___might_resched+0x10/0x10 [ 1810.551105][T14661] ? fs_reclaim_acquire+0x7d/0x100 [ 1810.551128][T14661] should_fail_ex+0x46c/0x600 [ 1810.551157][T14661] should_failslab+0xa8/0x100 [ 1810.551182][T14661] __kmalloc_noprof+0xcb/0x430 [ 1810.551202][T14661] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 1810.551231][T14661] tomoyo_realpath_from_path+0xe3/0x5d0 [ 1810.551255][T14661] ? tomoyo_domain+0xda/0x130 [ 1810.551283][T14661] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 1810.551304][T14661] tomoyo_path_number_perm+0x1e8/0x5a0 [ 1810.551326][T14661] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1810.551350][T14661] ? _raw_spin_unlock_irqrestore+0x85/0x110 [ 1810.551372][T14661] ? lockdep_hardirqs_on+0x9c/0x150 [ 1810.551401][T14661] ? __lock_acquire+0xab9/0xd20 [ 1810.551445][T14661] ? __fget_files+0x2a/0x420 [ 1810.551470][T14661] ? __fget_files+0x2a/0x420 [ 1810.551491][T14661] ? __fget_files+0x3a6/0x420 [ 1810.551511][T14661] ? __fget_files+0x2a/0x420 [ 1810.551537][T14661] security_file_ioctl+0xcb/0x2d0 [ 1810.551560][T14661] __se_sys_ioctl+0x47/0x170 [ 1810.551583][T14661] do_syscall_64+0xfa/0x3b0 [ 1810.551605][T14661] ? lockdep_hardirqs_on+0x9c/0x150 [ 1810.551625][T14661] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1810.551644][T14661] ? clear_bhb_loop+0x60/0xb0 [ 1810.551664][T14661] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1810.551681][T14661] RIP: 0033:0x7fc6ed6eebe9 [ 1810.551698][T14661] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1810.551713][T14661] RSP: 002b:00007fc6eb94e038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1810.551733][T14661] RAX: ffffffffffffffda RBX: 00007fc6ed925fa0 RCX: 00007fc6ed6eebe9 [ 1810.551746][T14661] RDX: 0000200000000000 RSI: 0000000000008983 RDI: 0000000000000003 [ 1810.551758][T14661] RBP: 00007fc6eb94e090 R08: 0000000000000000 R09: 0000000000000000 [ 1810.551768][T14661] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1810.551779][T14661] R13: 00007fc6ed926038 R14: 00007fc6ed925fa0 R15: 00007ffef335e6f8 [ 1810.551809][T14661] [ 1810.551816][T14661] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1811.079345][ T5857] usb 8-1: new full-speed USB device number 25 using dummy_hcd [ 1811.109481][ T6005] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 1811.231212][ T5857] usb 8-1: not running at top speed; connect to a high speed hub [ 1811.232772][ T5857] usb 8-1: config 1 has an invalid descriptor of length 215, skipping remainder of the config [ 1811.232786][ T5857] usb 8-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 1811.232798][ T5857] usb 8-1: config 1 has no interface number 1 [ 1811.232823][ T5857] usb 8-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 1811.232845][ T5857] usb 8-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 180, changing to 4 [ 1811.232858][ T5857] usb 8-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid maxpacket 4432, setting to 1023 [ 1811.237183][ T5857] usb 8-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1811.237200][ T5857] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1811.237210][ T5857] usb 8-1: Product: syz [ 1811.237217][ T5857] usb 8-1: Manufacturer: syz [ 1811.237224][ T5857] usb 8-1: SerialNumber: syz [ 1811.259348][ T6005] usb 4-1: Using ep0 maxpacket: 32 [ 1811.263136][ T6005] usb 4-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 1811.263162][ T6005] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1811.288647][ T6005] usb 4-1: config 0 descriptor?? [ 1811.348543][T12664] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 1811.539300][T12664] usb 3-1: Using ep0 maxpacket: 16 [ 1811.540926][ T6005] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 1811.545471][T12664] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 1811.545499][T12664] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1811.594902][ T6005] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1811.600987][T12664] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1811.601020][T12664] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1811.601038][T12664] usb 3-1: Product: syz [ 1811.601051][T12664] usb 3-1: Manufacturer: syz [ 1811.601064][T12664] usb 3-1: SerialNumber: syz [ 1811.648906][T12664] usb 3-1: config 0 descriptor?? [ 1811.660945][T12664] em28xx 3-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1811.660963][T12664] em28xx 3-1:0.0: Audio interface 0 found (Vendor Class) [ 1811.698192][ T5857] usb 8-1: 2:1 : no or invalid class specific endpoint descriptor [ 1811.700853][ T6005] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 1811.700908][ T6005] usb 4-1: media controller created [ 1811.959082][ T6005] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1811.975021][ T5857] usb 8-1: USB disconnect, device number 25 [ 1812.075691][ T6005] az6027: usb out operation failed. (-71) [ 1812.076445][ T6005] az6027: usb out operation failed. (-71) [ 1812.076455][ T6005] stb0899_attach: Driver disabled by Kconfig [ 1812.076461][ T6005] az6027: no front-end attached [ 1812.076461][ T6005] [ 1812.078304][ T6005] az6027: usb out operation failed. (-71) [ 1812.078319][ T6005] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 1812.179985][ T6005] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.3/usb4/4-1/input/input31 [ 1812.266200][T12664] em28xx 3-1:0.0: unknown em28xx chip ID (0) [ 1812.266894][T12664] em28xx 3-1:0.0: Config register raw data: 0xfffffffb [ 1812.296747][ T6005] dvb-usb: schedule remote query interval to 400 msecs. [ 1812.296772][ T6005] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 1812.519656][ T6005] usb 4-1: USB disconnect, device number 10 [ 1812.842794][T14164] udevd[14164]: error opening ATTR{/sys/devices/platform/dummy_hcd.7/usb8/8-1/8-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1813.047516][T12664] em28xx 3-1:0.0: Unknown AC97 audio processor detected! [ 1813.366026][T12664] em28xx 3-1:0.0: couldn't setup AC97 register 2 [ 1813.366446][T12664] em28xx 3-1:0.0: couldn't setup AC97 register 4 [ 1813.366848][T12664] em28xx 3-1:0.0: couldn't setup AC97 register 6 [ 1813.367237][T12664] em28xx 3-1:0.0: couldn't setup AC97 register 54 [ 1813.367631][T12664] em28xx 3-1:0.0: couldn't setup AC97 register 56 [ 1813.420887][T12664] usb 3-1: USB disconnect, device number 20 [ 1814.158549][ C1] vkms_vblank_simulate: vblank timer overrun [ 1814.362410][ T6005] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 1814.600116][T12665] usb 8-1: new high-speed USB device number 26 using dummy_hcd [ 1814.661970][T14684] FAULT_INJECTION: forcing a failure. [ 1814.661970][T14684] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1814.662003][T14684] CPU: 1 UID: 0 PID: 14684 Comm: syz.8.1499 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 1814.662025][T14684] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1814.662036][T14684] Call Trace: [ 1814.662043][T14684] [ 1814.662052][T14684] dump_stack_lvl+0x189/0x250 [ 1814.662080][T14684] ? __pfx____ratelimit+0x10/0x10 [ 1814.662103][T14684] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1814.662127][T14684] ? __pfx__printk+0x10/0x10 [ 1814.662147][T14684] ? __might_fault+0xb0/0x130 [ 1814.662182][T14684] should_fail_ex+0x46c/0x600 [ 1814.662210][T14684] _copy_from_user+0x2d/0xb0 [ 1814.662230][T14684] __sys_bpf+0x1ed/0x870 [ 1814.662254][T14684] ? __pfx___sys_bpf+0x10/0x10 [ 1814.662287][T14684] ? ksys_write+0x230/0x260 [ 1814.662311][T14684] ? __pfx_ksys_write+0x10/0x10 [ 1814.662329][T14684] ? rcu_is_watching+0x15/0xb0 [ 1814.662361][T14684] __x64_sys_bpf+0x7c/0x90 [ 1814.662382][T14684] do_syscall_64+0xfa/0x3b0 [ 1814.662403][T14684] ? lockdep_hardirqs_on+0x9c/0x150 [ 1814.662424][T14684] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1814.662442][T14684] ? clear_bhb_loop+0x60/0xb0 [ 1814.662464][T14684] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1814.662480][T14684] RIP: 0033:0x7fd1e0e0ebe9 [ 1814.662496][T14684] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1814.662517][T14684] RSP: 002b:00007fd1df076038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1814.662537][T14684] RAX: ffffffffffffffda RBX: 00007fd1e1045fa0 RCX: 00007fd1e0e0ebe9 [ 1814.662551][T14684] RDX: 0000000000000094 RSI: 0000200000000880 RDI: 0000000000000005 [ 1814.662563][T14684] RBP: 00007fd1df076090 R08: 0000000000000000 R09: 0000000000000000 [ 1814.662575][T14684] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1814.662586][T14684] R13: 00007fd1e1046038 R14: 00007fd1e1045fa0 R15: 00007fffb2bbdf18 [ 1814.662617][T14684] [ 1814.670707][ T6005] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 1814.749510][T12665] usb 8-1: device descriptor read/64, error -71 [ 1814.913002][ T6005] usb 4-1: Using ep0 maxpacket: 8 [ 1814.933848][ T6005] usb 4-1: config 0 has an invalid interface number: 55 but max is 0 [ 1814.933874][ T6005] usb 4-1: config 0 has no interface number 0 [ 1814.933924][ T6005] usb 4-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1814.933943][ T6005] usb 4-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 1814.933966][ T6005] usb 4-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1814.933987][ T6005] usb 4-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 1814.934028][ T6005] usb 4-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 1814.934048][ T6005] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1814.951468][ T6005] usb 4-1: config 0 descriptor?? [ 1815.069514][T12665] usb 8-1: new high-speed USB device number 27 using dummy_hcd [ 1815.105140][ T6005] ldusb 4-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 1815.322290][T12665] usb 8-1: device descriptor read/64, error -71 [ 1815.346246][ T5891] usb 4-1: USB disconnect, device number 11 [ 1815.377436][ T5891] ldusb 4-1:0.55: LD USB Device #0 now disconnected [ 1815.440212][T12665] usb usb8-port1: attempt power cycle [ 1815.485562][T14690] FAULT_INJECTION: forcing a failure. [ 1815.485562][T14690] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1815.485593][T14690] CPU: 1 UID: 0 PID: 14690 Comm: syz.8.1501 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 1815.485614][T14690] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1815.485624][T14690] Call Trace: [ 1815.485632][T14690] [ 1815.485641][T14690] dump_stack_lvl+0x189/0x250 [ 1815.485668][T14690] ? __pfx____ratelimit+0x10/0x10 [ 1815.485691][T14690] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1815.485714][T14690] ? __pfx__printk+0x10/0x10 [ 1815.485748][T14690] should_fail_ex+0x46c/0x600 [ 1815.485777][T14690] _copy_to_user+0x31/0xb0 [ 1815.485799][T14690] simple_read_from_buffer+0xe1/0x170 [ 1815.485825][T14690] proc_fail_nth_read+0x1b6/0x220 [ 1815.485847][T14690] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1815.485869][T14690] ? rw_verify_area+0x2ac/0x4e0 [ 1815.485888][T14690] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1815.485907][T14690] vfs_read+0x203/0xa30 [ 1815.485937][T14690] ? __pfx_vfs_read+0x10/0x10 [ 1815.485954][T14690] ? try_to_take_rt_mutex+0x7fd/0xac0 [ 1815.485982][T14690] ? mutex_lock_nested+0x154/0x1d0 [ 1815.485999][T14690] ? fdget_pos+0x253/0x320 [ 1815.486031][T14690] ksys_read+0x14b/0x260 [ 1815.486050][T14690] ? __fget_files+0x3a6/0x420 [ 1815.486074][T14690] ? __pfx_ksys_read+0x10/0x10 [ 1815.486100][T14690] ? do_syscall_64+0xbe/0x3b0 [ 1815.486127][T14690] do_syscall_64+0xfa/0x3b0 [ 1815.486148][T14690] ? lockdep_hardirqs_on+0x9c/0x150 [ 1815.486169][T14690] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1815.486187][T14690] ? clear_bhb_loop+0x60/0xb0 [ 1815.486209][T14690] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1815.486226][T14690] RIP: 0033:0x7fd1e0e0d5fc [ 1815.486241][T14690] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 1815.486256][T14690] RSP: 002b:00007fd1df055030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1815.486275][T14690] RAX: ffffffffffffffda RBX: 00007fd1e1046090 RCX: 00007fd1e0e0d5fc [ 1815.486289][T14690] RDX: 000000000000000f RSI: 00007fd1df0550a0 RDI: 0000000000000005 [ 1815.486300][T14690] RBP: 00007fd1df055090 R08: 0000000000000000 R09: 0000000000000000 [ 1815.486311][T14690] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1815.486323][T14690] R13: 00007fd1e1046128 R14: 00007fd1e1046090 R15: 00007fffb2bbdf18 [ 1815.486354][T14690] [ 1815.809471][T12665] usb 8-1: new high-speed USB device number 28 using dummy_hcd [ 1815.840895][T12665] usb 8-1: device descriptor read/8, error -71 [ 1815.987775][T14685] [U] . [ 1816.099508][T12665] usb 8-1: new high-speed USB device number 29 using dummy_hcd [ 1816.145431][T12665] usb 8-1: device descriptor read/8, error -71 [ 1816.282125][T12665] usb usb8-port1: unable to enumerate USB device [ 1816.529380][ T9817] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 1816.699237][ T9817] usb 3-1: Using ep0 maxpacket: 32 [ 1816.701684][ T9817] usb 3-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 1816.701713][ T9817] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1816.727032][ T9817] usb 3-1: config 0 descriptor?? [ 1816.829324][ T5891] usb 2-1: new full-speed USB device number 17 using dummy_hcd [ 1816.934422][ T9817] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 1816.975631][ T9817] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1816.976696][ T9817] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 1816.976744][ T9817] usb 3-1: media controller created [ 1817.000905][ T5891] usb 2-1: not running at top speed; connect to a high speed hub [ 1817.002459][ T5891] usb 2-1: config 1 has an invalid descriptor of length 215, skipping remainder of the config [ 1817.002480][ T5891] usb 2-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 1817.002499][ T5891] usb 2-1: config 1 has no interface number 1 [ 1817.002543][ T5891] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 1817.002583][ T5891] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 180, changing to 4 [ 1817.002607][ T5891] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid maxpacket 4432, setting to 1023 [ 1817.038346][ T9817] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1817.082640][ T5891] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1817.082668][ T5891] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1817.082687][ T5891] usb 2-1: Product: syz [ 1817.082699][ T5891] usb 2-1: Manufacturer: syz [ 1817.082712][ T5891] usb 2-1: SerialNumber: syz [ 1817.151491][ T9817] az6027: usb out operation failed. (-71) [ 1817.152083][ T9817] az6027: usb out operation failed. (-71) [ 1817.152097][ T9817] stb0899_attach: Driver disabled by Kconfig [ 1817.152107][ T9817] az6027: no front-end attached [ 1817.152107][ T9817] [ 1817.152558][ T9817] az6027: usb out operation failed. (-71) [ 1817.152571][ T9817] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 1817.173911][ T9817] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.2/usb3/3-1/input/input32 [ 1817.203495][ T9817] dvb-usb: schedule remote query interval to 400 msecs. [ 1817.203517][ T9817] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 1817.223656][ T9817] usb 3-1: USB disconnect, device number 21 [ 1817.343625][ T5891] usb 2-1: 2:1 : no or invalid class specific endpoint descriptor [ 1818.587679][ T9817] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 1818.645667][ T5891] usb 2-1: USB disconnect, device number 17 [ 1818.876418][ T37] kauditd_printk_skb: 1 callbacks suppressed [ 1818.876437][ T37] audit: type=1326 audit(1756660432.753:47): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=14723 comm="syz.3.1511" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc6ed6eebe9 code=0x7ffc0000 [ 1818.932733][ T37] audit: type=1326 audit(1756660432.793:48): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=14723 comm="syz.3.1511" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc6ed6eebe9 code=0x7ffc0000 [ 1818.932783][ T37] audit: type=1326 audit(1756660432.813:49): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=14723 comm="syz.3.1511" exe="/root/syz-executor" sig=0 arch=c000003e syscall=23 compat=0 ip=0x7fc6ed6eebe9 code=0x7ffc0000 [ 1818.932820][ T37] audit: type=1326 audit(1756660432.813:50): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=14723 comm="syz.3.1511" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc6ed6eebe9 code=0x7ffc0000 [ 1818.932856][ T37] audit: type=1326 audit(1756660432.813:51): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=14723 comm="syz.3.1511" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc6ed6eebe9 code=0x7ffc0000 [ 1818.941908][ T37] audit: type=1326 audit(1756660432.823:52): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=14723 comm="syz.3.1511" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fc6ed6eebe9 code=0x7ffc0000 [ 1818.992639][ T37] audit: type=1326 audit(1756660432.863:53): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=14723 comm="syz.3.1511" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc6ed6eebe9 code=0x7ffc0000 [ 1819.007601][ T37] audit: type=1326 audit(1756660432.873:54): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=14723 comm="syz.3.1511" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc6ed6eebe9 code=0x7ffc0000 [ 1819.007650][ T37] audit: type=1326 audit(1756660432.883:55): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=14723 comm="syz.3.1511" exe="/root/syz-executor" sig=0 arch=c000003e syscall=137 compat=0 ip=0x7fc6ed6eebe9 code=0x7ffc0000 [ 1819.008879][ T37] audit: type=1326 audit(1756660432.883:56): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=14723 comm="syz.3.1511" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7fc6ed6e5ba7 code=0x7ffc0000 [ 1819.096412][T14676] udevd[14676]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1819.425151][T14726] could not allocate digest TFM handle blake2s-128-generic [ 1819.733272][T14745] FAULT_INJECTION: forcing a failure. [ 1819.733272][T14745] name failslab, interval 1, probability 0, space 0, times 0 [ 1819.733298][T14745] CPU: 1 UID: 0 PID: 14745 Comm: syz.2.1516 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 1819.733319][T14745] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1819.733330][T14745] Call Trace: [ 1819.733337][T14745] [ 1819.733345][T14745] dump_stack_lvl+0x189/0x250 [ 1819.733374][T14745] ? __pfx____ratelimit+0x10/0x10 [ 1819.733397][T14745] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1819.733420][T14745] ? __pfx__printk+0x10/0x10 [ 1819.733435][T14745] ? __pfx___might_resched+0x10/0x10 [ 1819.733446][T14745] ? fs_reclaim_acquire+0x7d/0x100 [ 1819.733458][T14745] should_fail_ex+0x46c/0x600 [ 1819.733474][T14745] should_failslab+0xa8/0x100 [ 1819.733489][T14745] __kmalloc_noprof+0xcb/0x430 [ 1819.733501][T14745] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 1819.733517][T14745] tomoyo_realpath_from_path+0xe3/0x5d0 [ 1819.733531][T14745] ? tomoyo_domain+0xda/0x130 [ 1819.733547][T14745] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 1819.733558][T14745] tomoyo_path_number_perm+0x1e8/0x5a0 [ 1819.733570][T14745] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1819.733584][T14745] ? _raw_spin_unlock_irqrestore+0x85/0x110 [ 1819.733597][T14745] ? lockdep_hardirqs_on+0x9c/0x150 [ 1819.733616][T14745] ? __lock_acquire+0xab9/0xd20 [ 1819.733640][T14745] ? __fget_files+0x2a/0x420 [ 1819.733655][T14745] ? __fget_files+0x2a/0x420 [ 1819.733666][T14745] ? __fget_files+0x3a6/0x420 [ 1819.733677][T14745] ? __fget_files+0x2a/0x420 [ 1819.733692][T14745] security_file_ioctl+0xcb/0x2d0 [ 1819.733705][T14745] __se_sys_ioctl+0x47/0x170 [ 1819.733718][T14745] do_syscall_64+0xfa/0x3b0 [ 1819.733731][T14745] ? lockdep_hardirqs_on+0x9c/0x150 [ 1819.733742][T14745] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1819.733752][T14745] ? clear_bhb_loop+0x60/0xb0 [ 1819.733765][T14745] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1819.733774][T14745] RIP: 0033:0x7f2b777febe9 [ 1819.733784][T14745] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1819.733793][T14745] RSP: 002b:00007f2b75a66038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1819.733805][T14745] RAX: ffffffffffffffda RBX: 00007f2b77a35fa0 RCX: 00007f2b777febe9 [ 1819.733813][T14745] RDX: 0000200000000080 RSI: 0000000040946400 RDI: 0000000000000003 [ 1819.733822][T14745] RBP: 00007f2b75a66090 R08: 0000000000000000 R09: 0000000000000000 [ 1819.733828][T14745] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1819.733835][T14745] R13: 00007f2b77a36038 R14: 00007f2b77a35fa0 R15: 00007fffa6cfde68 [ 1819.733851][T14745] [ 1819.736588][T14745] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1819.747211][T14745] comedi comedi0: pcm3724: I/O port conflict (0x8,16) [ 1820.004042][T14750] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1517'. [ 1820.539468][ T5891] usb 4-1: new full-speed USB device number 12 using dummy_hcd [ 1820.699131][ T5891] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1820.699361][ T5891] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1820.708161][ T5891] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1820.708178][ T5891] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1820.708188][ T5891] usb 4-1: Product: syz [ 1820.708195][ T5891] usb 4-1: Manufacturer: syz [ 1820.708202][ T5891] usb 4-1: SerialNumber: syz [ 1821.239345][ T7516] usb 9-1: new high-speed USB device number 34 using dummy_hcd [ 1821.249355][T12664] usb 8-1: new low-speed USB device number 30 using dummy_hcd [ 1821.369338][ T7516] usb 9-1: device descriptor read/64, error -71 [ 1821.402254][T12664] usb 8-1: config 0 has an invalid interface number: 1 but max is 0 [ 1821.402280][T12664] usb 8-1: config 0 has no interface number 0 [ 1821.402325][T12664] usb 8-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 1821.402350][T12664] usb 8-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 1821.402442][T12664] usb 8-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1821.402463][T12664] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1821.474461][T12664] usb 8-1: config 0 descriptor?? [ 1821.476425][T14755] raw-gadget.1 gadget.7: fail, usb_ep_enable returned -22 [ 1821.490926][T14765] FAULT_INJECTION: forcing a failure. [ 1821.490926][T14765] name failslab, interval 1, probability 0, space 0, times 0 [ 1821.490959][T14765] CPU: 1 UID: 0 PID: 14765 Comm: syz.1.1523 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 1821.490980][T14765] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1821.490991][T14765] Call Trace: [ 1821.490998][T14765] [ 1821.491006][T14765] dump_stack_lvl+0x189/0x250 [ 1821.491035][T14765] ? __pfx____ratelimit+0x10/0x10 [ 1821.491059][T14765] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1821.491082][T14765] ? __pfx__printk+0x10/0x10 [ 1821.491107][T14765] ? __pfx___might_resched+0x10/0x10 [ 1821.491127][T14765] ? fs_reclaim_acquire+0x7d/0x100 [ 1821.491147][T14765] should_fail_ex+0x46c/0x600 [ 1821.491176][T14765] should_failslab+0xa8/0x100 [ 1821.491200][T14765] __kmalloc_noprof+0xcb/0x430 [ 1821.491221][T14765] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 1821.491250][T14765] tomoyo_realpath_from_path+0xe3/0x5d0 [ 1821.491275][T14765] ? tomoyo_domain+0xda/0x130 [ 1821.491303][T14765] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 1821.491323][T14765] tomoyo_path_number_perm+0x1e8/0x5a0 [ 1821.491345][T14765] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1821.491370][T14765] ? _raw_spin_unlock_irqrestore+0x85/0x110 [ 1821.491393][T14765] ? lockdep_hardirqs_on+0x9c/0x150 [ 1821.491426][T14765] ? __lock_acquire+0xab9/0xd20 [ 1821.491468][T14765] ? __fget_files+0x2a/0x420 [ 1821.491495][T14765] ? __fget_files+0x2a/0x420 [ 1821.491516][T14765] ? __fget_files+0x3a6/0x420 [ 1821.491537][T14765] ? __fget_files+0x2a/0x420 [ 1821.491563][T14765] security_file_ioctl+0xcb/0x2d0 [ 1821.491587][T14765] __se_sys_ioctl+0x47/0x170 [ 1821.491610][T14765] do_syscall_64+0xfa/0x3b0 [ 1821.491639][T14765] ? lockdep_hardirqs_on+0x9c/0x150 [ 1821.491659][T14765] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1821.491678][T14765] ? clear_bhb_loop+0x60/0xb0 [ 1821.491700][T14765] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1821.491717][T14765] RIP: 0033:0x7fc13ca9ebe9 [ 1821.491733][T14765] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1821.491748][T14765] RSP: 002b:00007fc13ad06038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1821.491767][T14765] RAX: ffffffffffffffda RBX: 00007fc13ccd5fa0 RCX: 00007fc13ca9ebe9 [ 1821.491779][T14765] RDX: 0000200000000080 RSI: 0000000040946400 RDI: 0000000000000003 [ 1821.491791][T14765] RBP: 00007fc13ad06090 R08: 0000000000000000 R09: 0000000000000000 [ 1821.491803][T14765] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1821.491814][T14765] R13: 00007fc13ccd6038 R14: 00007fc13ccd5fa0 R15: 00007ffe999a3e98 [ 1821.491844][T14765] [ 1821.494152][T14765] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1821.495376][T14765] comedi comedi0: Minor 8 could not be opened [ 1821.631434][ T7516] usb 9-1: new high-speed USB device number 35 using dummy_hcd [ 1821.636252][T14767] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 1821.803789][T14755] FAULT_INJECTION: forcing a failure. [ 1821.803789][T14755] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1821.803821][T14755] CPU: 1 UID: 0 PID: 14755 Comm: syz.7.1519 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 1821.803840][T14755] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1821.803851][T14755] Call Trace: [ 1821.803859][T14755] [ 1821.803867][T14755] dump_stack_lvl+0x189/0x250 [ 1821.803895][T14755] ? __pfx____ratelimit+0x10/0x10 [ 1821.803918][T14755] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1821.803942][T14755] ? __pfx__printk+0x10/0x10 [ 1821.803977][T14755] should_fail_ex+0x46c/0x600 [ 1821.804005][T14755] _copy_to_user+0x31/0xb0 [ 1821.804026][T14755] simple_read_from_buffer+0xe1/0x170 [ 1821.804053][T14755] proc_fail_nth_read+0x1b6/0x220 [ 1821.804076][T14755] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1821.804096][T14755] ? rw_verify_area+0x2ac/0x4e0 [ 1821.804116][T14755] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1821.804137][T14755] vfs_read+0x203/0xa30 [ 1821.804165][T14755] ? __pfx_vfs_read+0x10/0x10 [ 1821.804182][T14755] ? try_to_take_rt_mutex+0x7fd/0xac0 [ 1821.804211][T14755] ? mutex_lock_nested+0x154/0x1d0 [ 1821.804226][T14755] ? fdget_pos+0x253/0x320 [ 1821.804257][T14755] ksys_read+0x14b/0x260 [ 1821.804277][T14755] ? __fget_files+0x3a6/0x420 [ 1821.804300][T14755] ? __pfx_ksys_read+0x10/0x10 [ 1821.804325][T14755] ? do_syscall_64+0xbe/0x3b0 [ 1821.804351][T14755] do_syscall_64+0xfa/0x3b0 [ 1821.804371][T14755] ? lockdep_hardirqs_on+0x9c/0x150 [ 1821.804392][T14755] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1821.804409][T14755] ? clear_bhb_loop+0x60/0xb0 [ 1821.804431][T14755] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1821.804448][T14755] RIP: 0033:0x7f581889d5fc [ 1821.804464][T14755] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 1821.804479][T14755] RSP: 002b:00007f5816b06030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1821.804498][T14755] RAX: ffffffffffffffda RBX: 00007f5818ad5fa0 RCX: 00007f581889d5fc [ 1821.804511][T14755] RDX: 000000000000000f RSI: 00007f5816b060a0 RDI: 0000000000000005 [ 1821.804522][T14755] RBP: 00007f5816b06090 R08: 0000000000000000 R09: 0000000000000000 [ 1821.804535][T14755] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1821.804546][T14755] R13: 00007f5818ad6038 R14: 00007f5818ad5fa0 R15: 00007ffc86a76c78 [ 1821.804576][T14755] [ 1821.859483][ T6005] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 1822.149531][ T6005] usb 3-1: Using ep0 maxpacket: 32 [ 1822.155722][ T6005] usb 3-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 1822.155796][ T6005] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1822.634014][ T6005] usb 3-1: config 0 descriptor?? [ 1822.897529][ T5891] usb 4-1: 0:2 : does not exist [ 1822.910082][ T5891] usb 4-1: 5:0: failed to get current value for ch 0 (-22) [ 1822.971881][T12664] iowarrior 8-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 1823.009506][T12664] usb 8-1: USB disconnect, device number 30 [ 1823.059294][ T7516] usb 9-1: device descriptor read/64, error -71 [ 1823.068622][ T5891] usb 4-1: USB disconnect, device number 12 [ 1823.098468][ T6005] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 1823.160913][ T6005] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1823.164124][ T6005] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 1823.164184][ T6005] usb 3-1: media controller created [ 1823.192779][ T7516] usb usb9-port1: attempt power cycle [ 1823.335879][T13775] udevd[13775]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1823.448010][ T6005] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1823.530799][ T7516] usb 9-1: new high-speed USB device number 36 using dummy_hcd [ 1823.550275][ T7516] usb 9-1: device descriptor read/8, error -71 [ 1823.574912][ T6005] az6027: usb out operation failed. (-71) [ 1823.579418][ T6005] az6027: usb out operation failed. (-71) [ 1823.579433][ T6005] stb0899_attach: Driver disabled by Kconfig [ 1823.579443][ T6005] az6027: no front-end attached [ 1823.579443][ T6005] [ 1823.579853][ T6005] az6027: usb out operation failed. (-71) [ 1823.579866][ T6005] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 1823.582925][ T6005] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.2/usb3/3-1/input/input33 [ 1823.616512][ T6005] dvb-usb: schedule remote query interval to 400 msecs. [ 1823.616534][ T6005] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 1823.653121][ T6005] usb 3-1: USB disconnect, device number 22 [ 1824.037504][ T6005] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 1826.519769][T14808] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1533'. [ 1827.945330][T14818] loop7: detected capacity change from 0 to 7 [ 1827.977673][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1827.977797][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1827.999687][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1827.999724][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1828.000613][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1828.000633][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1828.012731][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1828.012768][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1828.079993][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1828.080130][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1828.156341][T14820] Invalid logical block size (6) [ 1828.171836][ T7516] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 1828.173132][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1828.173153][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1828.176118][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1828.176149][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1828.179312][T14818] ldm_validate_partition_table(): Disk read failed. [ 1828.180371][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1828.180402][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1828.181005][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1828.181033][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1828.181508][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1828.181534][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1828.182369][T14818] Dev loop7: unable to read RDB block 0 [ 1828.269648][T14818] loop7: unable to read partition table [ 1828.270022][T14818] loop7: partition table beyond EOD, truncated [ 1828.270063][T14818] loop_reread_partitions: partition scan of loop7 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 1828.389409][ T7516] usb 4-1: device descriptor read/64, error -71 [ 1828.630663][ T7516] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 1828.703319][T14823] loop7: detected capacity change from 0 to 7 [ 1828.722523][T14823] ldm_validate_partition_table(): Disk read failed. [ 1828.728560][T14823] Dev loop7: unable to read RDB block 0 [ 1828.749950][T14823] loop7: unable to read partition table [ 1828.750475][T14823] loop7: partition table beyond EOD, truncated [ 1828.750499][T14823] loop_reread_partitions: partition scan of loop7 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 1828.793426][ T7516] usb 4-1: device descriptor read/64, error -71 [ 1828.900286][ T7516] usb usb4-port1: attempt power cycle [ 1828.916862][T14823] Invalid logical block size (6) [ 1830.102560][ T7516] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 1833.410745][ T7516] usb 4-1: device descriptor read/8, error -71 [ 1833.543842][ T5849] Bluetooth: hci5: link tx timeout [ 1833.548352][ T5849] Bluetooth: hci5: killing stalled connection 11:aa:aa:aa:aa:aa [ 1833.617100][T14828] netlink: 80 bytes leftover after parsing attributes in process `syz.2.1540'. [ 1833.983773][T14836] FAULT_INJECTION: forcing a failure. [ 1833.983773][T14836] name failslab, interval 1, probability 0, space 0, times 0 [ 1833.983806][T14836] CPU: 0 UID: 0 PID: 14836 Comm: syz.8.1542 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 1833.983828][T14836] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1833.983839][T14836] Call Trace: [ 1833.983847][T14836] [ 1833.983855][T14836] dump_stack_lvl+0x189/0x250 [ 1833.983883][T14836] ? __pfx____ratelimit+0x10/0x10 [ 1833.983907][T14836] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1833.983931][T14836] ? __pfx__printk+0x10/0x10 [ 1833.983957][T14836] ? __pfx___might_resched+0x10/0x10 [ 1833.983976][T14836] ? fs_reclaim_acquire+0x7d/0x100 [ 1833.983997][T14836] should_fail_ex+0x46c/0x600 [ 1833.984025][T14836] should_failslab+0xa8/0x100 [ 1833.984050][T14836] __kmalloc_noprof+0xcb/0x430 [ 1833.984071][T14836] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 1833.984099][T14836] tomoyo_realpath_from_path+0xe3/0x5d0 [ 1833.984124][T14836] ? tomoyo_domain+0xda/0x130 [ 1833.984152][T14836] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 1833.984172][T14836] tomoyo_path_number_perm+0x1e8/0x5a0 [ 1833.984194][T14836] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1833.984218][T14836] ? _raw_spin_unlock_irqrestore+0x85/0x110 [ 1833.984240][T14836] ? lockdep_hardirqs_on+0x9c/0x150 [ 1833.984269][T14836] ? __lock_acquire+0xab9/0xd20 [ 1833.984312][T14836] ? __fget_files+0x2a/0x420 [ 1833.984338][T14836] ? __fget_files+0x2a/0x420 [ 1833.984367][T14836] ? __fget_files+0x3a6/0x420 [ 1833.984387][T14836] ? __fget_files+0x2a/0x420 [ 1833.984413][T14836] security_file_ioctl+0xcb/0x2d0 [ 1833.984437][T14836] __se_sys_ioctl+0x47/0x170 [ 1833.984460][T14836] do_syscall_64+0xfa/0x3b0 [ 1833.984481][T14836] ? lockdep_hardirqs_on+0x9c/0x150 [ 1833.984502][T14836] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1833.984520][T14836] ? clear_bhb_loop+0x60/0xb0 [ 1833.984546][T14836] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1833.984562][T14836] RIP: 0033:0x7fd1e0e0ebe9 [ 1833.984577][T14836] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1833.984590][T14836] RSP: 002b:00007fd1df076038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1833.984608][T14836] RAX: ffffffffffffffda RBX: 00007fd1e1045fa0 RCX: 00007fd1e0e0ebe9 [ 1833.984620][T14836] RDX: 00002000000000c0 RSI: 0000000040946400 RDI: 0000000000000003 [ 1833.984631][T14836] RBP: 00007fd1df076090 R08: 0000000000000000 R09: 0000000000000000 [ 1833.984642][T14836] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1833.984652][T14836] R13: 00007fd1e1046038 R14: 00007fd1e1045fa0 R15: 00007fffb2bbdf18 [ 1833.984682][T14836] [ 1833.984691][T14836] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1834.041175][T14837] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1543'. [ 1834.362762][T14845] syz.7.1544 uses old SIOCAX25GETINFO [ 1836.604186][T14590] Bluetooth: hci5: command 0x0406 tx timeout [ 1836.711934][T14838] tipc: Started in network mode [ 1836.711953][T14838] tipc: Node identity ac14140f, cluster identity 4711 [ 1836.712166][T14838] tipc: New replicast peer: 255.255.255.255 [ 1836.726089][T14838] tipc: Enabled bearer , priority 10 [ 1836.757568][T14853] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1547'. [ 1837.592193][T14864] comedi comedi0: Minor 8 could not be opened [ 1837.709487][T12664] tipc: Node number set to 2886997007 [ 1837.893608][T14872] comedi comedi0: rti800: I/O port conflict (0xee,16) [ 1837.919592][ T10] usb 3-1: new low-speed USB device number 23 using dummy_hcd [ 1838.510265][ T10] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 1838.510294][ T10] usb 3-1: config 0 has no interface number 0 [ 1838.510340][ T10] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 1838.510366][ T10] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 1838.510406][ T10] usb 3-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1838.510427][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1838.634087][ T10] usb 3-1: config 0 descriptor?? [ 1838.635090][T14866] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1838.754802][ T10] iowarrior 3-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 1838.952016][ T6005] usb 8-1: new high-speed USB device number 31 using dummy_hcd [ 1838.958209][ C0] iowarrior 3-1:0.1: iowarrior_callback - usb_submit_urb failed with result -1 [ 1839.017613][ T7516] usb 3-1: USB disconnect, device number 23 [ 1839.162717][ T6005] usb 8-1: config 0 has an invalid interface number: 205 but max is 0 [ 1839.162743][ T6005] usb 8-1: config 0 has no interface number 0 [ 1839.166628][ T6005] usb 8-1: New USB device found, idVendor=04dd, idProduct=9031, bcdDevice=65.c7 [ 1839.166655][ T6005] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1839.166674][ T6005] usb 8-1: Product: syz [ 1839.166687][ T6005] usb 8-1: Manufacturer: syz [ 1839.166699][ T6005] usb 8-1: SerialNumber: syz [ 1839.272261][T14892] FAULT_INJECTION: forcing a failure. [ 1839.272261][T14892] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1839.272418][T14892] CPU: 0 UID: 0 PID: 14892 Comm: syz.8.1559 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 1839.272441][T14892] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1839.272452][T14892] Call Trace: [ 1839.272460][T14892] [ 1839.272469][T14892] dump_stack_lvl+0x189/0x250 [ 1839.272498][T14892] ? __pfx____ratelimit+0x10/0x10 [ 1839.272521][T14892] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1839.272543][T14892] ? __pfx__printk+0x10/0x10 [ 1839.272560][T14892] ? __might_fault+0xb0/0x130 [ 1839.272594][T14892] should_fail_ex+0x46c/0x600 [ 1839.272622][T14892] _copy_from_user+0x2d/0xb0 [ 1839.272641][T14892] ___sys_recvmsg+0x12e/0x510 [ 1839.272673][T14892] ? __pfx____sys_recvmsg+0x10/0x10 [ 1839.272723][T14892] ? __fget_files+0x3a6/0x420 [ 1839.272757][T14892] do_recvmmsg+0x30d/0x770 [ 1839.272790][T14892] ? __pfx_do_recvmmsg+0x10/0x10 [ 1839.272818][T14892] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 1839.272841][T14892] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 1839.272874][T14892] ? rt_mutex_slowunlock+0x1be/0x2e0 [ 1839.272909][T14892] __x64_sys_recvmmsg+0x190/0x240 [ 1839.272937][T14892] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 1839.272959][T14892] ? rcu_is_watching+0x15/0xb0 [ 1839.272987][T14892] ? do_syscall_64+0xbe/0x3b0 [ 1839.273013][T14892] do_syscall_64+0xfa/0x3b0 [ 1839.273033][T14892] ? lockdep_hardirqs_on+0x9c/0x150 [ 1839.273054][T14892] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1839.273071][T14892] ? clear_bhb_loop+0x60/0xb0 [ 1839.273093][T14892] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1839.273111][T14892] RIP: 0033:0x7fd1e0e0ebe9 [ 1839.273127][T14892] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1839.273143][T14892] RSP: 002b:00007fd1df055038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 1839.273163][T14892] RAX: ffffffffffffffda RBX: 00007fd1e1046090 RCX: 00007fd1e0e0ebe9 [ 1839.273176][T14892] RDX: 0000000000000f00 RSI: 0000200000000400 RDI: 0000000000000005 [ 1839.273186][T14892] RBP: 00007fd1df055090 R08: 0000000000000000 R09: 0000000000000000 [ 1839.273198][T14892] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1839.273209][T14892] R13: 00007fd1e1046128 R14: 00007fd1e1046090 R15: 00007fffb2bbdf18 [ 1839.273236][T14892] [ 1839.758080][ T6005] usb 8-1: config 0 descriptor?? [ 1839.841431][ T6005] usb 8-1: bad CDC descriptors [ 1839.860101][ T6005] usb 8-1: unsupported MDLM descriptors [ 1839.926322][T14897] futex_wake_op: syz.1.1563 tries to shift op by 144; fix this program [ 1839.969511][ T9817] usb 4-1: new full-speed USB device number 17 using dummy_hcd [ 1840.249626][ T9817] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1840.249681][ T9817] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFC, changing to 0x8C [ 1840.249705][ T9817] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8C has an invalid bInterval 0, changing to 10 [ 1840.249788][ T9817] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8C has invalid maxpacket 212, setting to 64 [ 1840.249811][ T9817] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1840.269750][ T9817] usb 4-1: New USB device found, idVendor=045e, idProduct=0284, bcdDevice=a4.8f [ 1840.269778][ T9817] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1840.269797][ T9817] usb 4-1: Product: syz [ 1840.269810][ T9817] usb 4-1: Manufacturer: syz [ 1840.269823][ T9817] usb 4-1: SerialNumber: syz [ 1840.386290][T14903] ubi31: attaching mtd0 [ 1840.460156][T14903] ubi31: scanning is finished [ 1840.460204][T14903] ubi31: empty MTD device detected [ 1841.113220][ T7516] usb 8-1: USB disconnect, device number 31 [ 1841.116852][ T9817] usb 4-1: config 0 descriptor?? [ 1841.176718][T14895] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 1841.343271][ T9817] rc_core: IR keymap rc-xbox-dvd not found [ 1841.343291][ T9817] Registered IR keymap rc-empty [ 1841.352581][ T9817] rc rc0: syz syz as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 1841.366537][ T9817] input: syz syz as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input34 [ 1841.384756][T14903] ubi31 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt31d", error -4 [ 1841.422205][T14895] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1841.548180][T14895] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1841.553618][T14895] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1841.554146][T14895] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1841.703078][T14912] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1566'. [ 1843.336938][T14930] FAULT_INJECTION: forcing a failure. [ 1843.336938][T14930] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1843.336996][T14930] CPU: 0 UID: 0 PID: 14930 Comm: syz.1.1571 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 1843.337019][T14930] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1843.337031][T14930] Call Trace: [ 1843.337039][T14930] [ 1843.337048][T14930] dump_stack_lvl+0x189/0x250 [ 1843.337077][T14930] ? __pfx____ratelimit+0x10/0x10 [ 1843.337100][T14930] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1843.337124][T14930] ? __pfx__printk+0x10/0x10 [ 1843.337147][T14930] ? __might_fault+0xb0/0x130 [ 1843.337179][T14930] should_fail_ex+0x46c/0x600 [ 1843.337208][T14930] _copy_from_user+0x2d/0xb0 [ 1843.337228][T14930] __sys_bpf+0x1ed/0x870 [ 1843.337252][T14930] ? __pfx___sys_bpf+0x10/0x10 [ 1843.337303][T14930] __x64_sys_bpf+0x7c/0x90 [ 1843.337323][T14930] do_syscall_64+0xfa/0x3b0 [ 1843.337347][T14930] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1843.337364][T14930] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 1843.337381][T14930] ? clear_bhb_loop+0x60/0xb0 [ 1843.337402][T14930] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1843.337419][T14930] RIP: 0033:0x7fc13ca9ebe9 [ 1843.337435][T14930] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1843.337450][T14930] RSP: 002b:00007fc13acc4038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1843.337477][T14930] RAX: ffffffffffffffda RBX: 00007fc13ccd6180 RCX: 00007fc13ca9ebe9 [ 1843.337491][T14930] RDX: 0000000000000050 RSI: 0000200000000380 RDI: 0000000000000000 [ 1843.337503][T14930] RBP: 00007fc13acc4090 R08: 0000000000000000 R09: 0000000000000000 [ 1843.337516][T14930] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1843.337527][T14930] R13: 00007fc13ccd6218 R14: 00007fc13ccd6180 R15: 00007ffe999a3e98 [ 1843.337558][T14930] [ 1844.266631][ T10] usb 4-1: USB disconnect, device number 17 [ 1844.266807][ C1] xbox_remote 4-1:0.0: xbox_remote_irq_in: usb_submit_urb()=-19 [ 1844.454800][T14942] FAULT_INJECTION: forcing a failure. [ 1844.454800][T14942] name failslab, interval 1, probability 0, space 0, times 0 [ 1844.454832][T14942] CPU: 0 UID: 0 PID: 14942 Comm: syz.2.1575 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 1844.454850][T14942] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1844.454862][T14942] Call Trace: [ 1844.454869][T14942] [ 1844.454877][T14942] dump_stack_lvl+0x189/0x250 [ 1844.454904][T14942] ? __pfx____ratelimit+0x10/0x10 [ 1844.454927][T14942] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1844.454951][T14942] ? __pfx__printk+0x10/0x10 [ 1844.454976][T14942] ? __pfx___might_resched+0x10/0x10 [ 1844.454995][T14942] ? fs_reclaim_acquire+0x7d/0x100 [ 1844.455017][T14942] should_fail_ex+0x46c/0x600 [ 1844.455046][T14942] should_failslab+0xa8/0x100 [ 1844.455070][T14942] __kmalloc_noprof+0xcb/0x430 [ 1844.455088][T14942] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 1844.455116][T14942] tomoyo_realpath_from_path+0xe3/0x5d0 [ 1844.455140][T14942] ? tomoyo_domain+0xda/0x130 [ 1844.455169][T14942] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 1844.455188][T14942] tomoyo_path_number_perm+0x1e8/0x5a0 [ 1844.455210][T14942] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1844.455235][T14942] ? _raw_spin_unlock_irqrestore+0x85/0x110 [ 1844.455258][T14942] ? lockdep_hardirqs_on+0x9c/0x150 [ 1844.455288][T14942] ? __lock_acquire+0xab9/0xd20 [ 1844.455330][T14942] ? __fget_files+0x2a/0x420 [ 1844.455358][T14942] ? __fget_files+0x2a/0x420 [ 1844.455378][T14942] ? __fget_files+0x3a6/0x420 [ 1844.455398][T14942] ? __fget_files+0x2a/0x420 [ 1844.455423][T14942] security_file_ioctl+0xcb/0x2d0 [ 1844.455446][T14942] __se_sys_ioctl+0x47/0x170 [ 1844.455469][T14942] do_syscall_64+0xfa/0x3b0 [ 1844.455491][T14942] ? lockdep_hardirqs_on+0x9c/0x150 [ 1844.455511][T14942] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1844.455530][T14942] ? clear_bhb_loop+0x60/0xb0 [ 1844.455558][T14942] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1844.455575][T14942] RIP: 0033:0x7f2b777febe9 [ 1844.455592][T14942] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1844.455607][T14942] RSP: 002b:00007f2b75a66038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1844.455626][T14942] RAX: ffffffffffffffda RBX: 00007f2b77a35fa0 RCX: 00007f2b777febe9 [ 1844.455640][T14942] RDX: 0000200000000100 RSI: 0000000000004601 RDI: 0000000000000003 [ 1844.455652][T14942] RBP: 00007f2b75a66090 R08: 0000000000000000 R09: 0000000000000000 [ 1844.455664][T14942] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1844.455675][T14942] R13: 00007f2b77a36038 R14: 00007f2b77a35fa0 R15: 00007fffa6cfde68 [ 1844.455711][T14942] [ 1844.455718][T14942] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1844.511925][T14940] xt_time: invalid argument - start or stop time greater than 23:59:59 [ 1844.581348][ T9816] usb 9-1: new high-speed USB device number 38 using dummy_hcd [ 1844.625416][T14950] loop6: detected capacity change from 0 to 7 [ 1844.742690][ T9816] usb 9-1: Using ep0 maxpacket: 16 [ 1844.745119][ T9816] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 1844.777319][ T9816] usb 9-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1844.777346][ T9816] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1844.777361][ T9816] usb 9-1: Product: syz [ 1844.777371][ T9816] usb 9-1: Manufacturer: syz [ 1844.777382][ T9816] usb 9-1: SerialNumber: syz [ 1844.834048][ T9816] usb 9-1: config 0 descriptor?? [ 1844.840851][ T6005] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 1844.882002][T14950] Dev loop6: unable to read RDB block 7 [ 1844.882045][T14950] loop6: unable to read partition table [ 1844.882283][T14950] loop6: partition table beyond EOD, truncated [ 1844.882316][T14950] loop_reread_partitions: partition scan of loop6 (被x ) failed (rc=-5) [ 1844.913325][ T9816] em28xx 9-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1844.913357][ T9816] em28xx 9-1:0.0: DVB interface 0 found: bulk [ 1845.000680][ T6005] usb 2-1: Using ep0 maxpacket: 32 [ 1845.003902][ T6005] usb 2-1: config index 0 descriptor too short (expected 156, got 27) [ 1845.003942][ T6005] usb 2-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 1845.004060][ T6005] usb 2-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 1845.004085][ T6005] usb 2-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 1845.004109][ T6005] usb 2-1: config 0 interface 0 has no altsetting 0 [ 1845.010824][ T6005] usb 2-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 1845.010849][ T6005] usb 2-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 1845.010868][ T6005] usb 2-1: Product: syz [ 1845.010880][ T6005] usb 2-1: Manufacturer: syz [ 1845.010893][ T6005] usb 2-1: SerialNumber: syz [ 1845.140166][ T6005] usb 2-1: config 0 descriptor?? [ 1845.407961][ T9817] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 1845.601420][ T6005] ldusb 2-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 1845.610056][ T6005] ldusb 2-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 1845.707532][ T10] usb 2-1: USB disconnect, device number 18 [ 1845.719914][ T10] ldusb 2-1:0.0: LD USB Device #0 now disconnected [ 1845.778057][ T9816] em28xx 9-1:0.0: unknown em28xx chip ID (0) [ 1845.809372][ T9817] usb 3-1: Using ep0 maxpacket: 32 [ 1845.829056][ T9817] usb 3-1: config index 0 descriptor too short (expected 156, got 27) [ 1845.829107][ T9817] usb 3-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 1845.852504][ T9817] usb 3-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 1845.852524][ T9817] usb 3-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 1845.852539][ T9817] usb 3-1: config 0 interface 0 has no altsetting 0 [ 1845.909528][ T9817] usb 3-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 1845.909615][ T9817] usb 3-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 1845.909635][ T9817] usb 3-1: Product: syz [ 1845.909647][ T9817] usb 3-1: Manufacturer: syz [ 1845.909659][ T9817] usb 3-1: SerialNumber: syz [ 1845.992930][ T9817] usb 3-1: config 0 descriptor?? [ 1846.055790][ T9817] ldusb 3-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 1846.103604][ T9817] ldusb 3-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 1846.414107][T14961] FAULT_INJECTION: forcing a failure. [ 1846.414107][T14961] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1846.414170][T14961] CPU: 0 UID: 0 PID: 14961 Comm: syz.3.1582 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 1846.414191][T14961] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1846.414202][T14961] Call Trace: [ 1846.414209][T14961] [ 1846.414218][T14961] dump_stack_lvl+0x189/0x250 [ 1846.414247][T14961] ? __pfx____ratelimit+0x10/0x10 [ 1846.414270][T14961] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1846.414292][T14961] ? __pfx__printk+0x10/0x10 [ 1846.414325][T14961] should_fail_ex+0x46c/0x600 [ 1846.414351][T14961] _copy_to_user+0x31/0xb0 [ 1846.414372][T14961] simple_read_from_buffer+0xe1/0x170 [ 1846.414399][T14961] proc_fail_nth_read+0x1b6/0x220 [ 1846.414421][T14961] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1846.414442][T14961] ? rw_verify_area+0x2ac/0x4e0 [ 1846.414462][T14961] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1846.414480][T14961] vfs_read+0x203/0xa30 [ 1846.414497][T14961] ? preempt_schedule_thunk+0x16/0x30 [ 1846.414525][T14961] ? __pfx_vfs_read+0x10/0x10 [ 1846.414542][T14961] ? try_to_take_rt_mutex+0x7fd/0xac0 [ 1846.414570][T14961] ? mutex_lock_nested+0x154/0x1d0 [ 1846.414587][T14961] ? fdget_pos+0x253/0x320 [ 1846.414619][T14961] ksys_read+0x14b/0x260 [ 1846.414642][T14961] ? __pfx_ksys_read+0x10/0x10 [ 1846.414666][T14961] ? __x64_sys_read+0x2d/0x90 [ 1846.414690][T14961] do_syscall_64+0xfa/0x3b0 [ 1846.414714][T14961] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1846.414731][T14961] ? asm_sysvec_call_function_single+0x1a/0x20 [ 1846.414749][T14961] ? clear_bhb_loop+0x60/0xb0 [ 1846.414771][T14961] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1846.414788][T14961] RIP: 0033:0x7fc6ed6ed5fc [ 1846.414805][T14961] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 1846.414820][T14961] RSP: 002b:00007fc6eb92d030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1846.414840][T14961] RAX: ffffffffffffffda RBX: 00007fc6ed926090 RCX: 00007fc6ed6ed5fc [ 1846.414853][T14961] RDX: 000000000000000f RSI: 00007fc6eb92d0a0 RDI: 0000000000000006 [ 1846.414865][T14961] RBP: 00007fc6eb92d090 R08: 0000000000000000 R09: 0000000000000000 [ 1846.414877][T14961] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1846.414887][T14961] R13: 00007fc6ed926128 R14: 00007fc6ed926090 R15: 00007ffef335e6f8 [ 1846.414918][T14961] [ 1846.594706][ T9816] em28xx 9-1:0.0: failed to get i2c transfer status from bridge register (error=-5) [ 1846.595744][ T9816] em28xx 9-1:0.0: board has no eeprom [ 1846.914532][T14952] ldusb 3-1:0.0: Couldn't submit HID_REQ_SET_REPORT -71 [ 1847.012421][ T6005] usb 3-1: USB disconnect, device number 24 [ 1847.012495][ C0] ldusb 3-1:0.0: usb_submit_urb failed (-19) [ 1847.033881][ T6005] ldusb 3-1:0.0: LD USB Device #0 now disconnected [ 1847.069336][ T9816] em28xx 9-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 1847.069362][ T9816] em28xx 9-1:0.0: dvb set to bulk mode. [ 1847.375528][ T9816] usb 9-1: USB disconnect, device number 38 [ 1847.375925][ T31] em28xx 9-1:0.0: Binding DVB extension [ 1847.877441][ T9816] em28xx 9-1:0.0: Disconnecting em28xx [ 1849.535237][ T31] em28xx 9-1:0.0: Registering input extension [ 1849.536223][ T9816] em28xx 9-1:0.0: Closing input extension [ 1849.723061][ T9816] em28xx 9-1:0.0: Freeing device [ 1849.994985][ T10] usb 3-1: new full-speed USB device number 25 using dummy_hcd [ 1850.073774][T14997] comedi comedi3: comedi_config --init_data is deprecated [ 1850.172415][ T10] usb 3-1: not running at top speed; connect to a high speed hub [ 1850.173799][ T10] usb 3-1: config 1 has an invalid descriptor of length 215, skipping remainder of the config [ 1850.173821][ T10] usb 3-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 1850.173840][ T10] usb 3-1: config 1 has no interface number 1 [ 1850.173887][ T10] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 1850.173924][ T10] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 180, changing to 4 [ 1850.173947][ T10] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid maxpacket 4432, setting to 1023 [ 1850.231667][ T10] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1850.231695][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1850.231713][ T10] usb 3-1: Product: syz [ 1850.231726][ T10] usb 3-1: Manufacturer: syz [ 1850.231739][ T10] usb 3-1: SerialNumber: syz [ 1850.309403][ T5891] usb 9-1: new high-speed USB device number 39 using dummy_hcd [ 1850.529594][ T5891] usb 9-1: device descriptor read/64, error -71 [ 1850.542476][ T10] usb 3-1: 2:1 : no or invalid class specific endpoint descriptor [ 1850.807116][T15004] FAULT_INJECTION: forcing a failure. [ 1850.807116][T15004] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1850.807171][T15004] CPU: 1 UID: 0 PID: 15004 Comm: syz.1.1590 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 1850.807193][T15004] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1850.807205][T15004] Call Trace: [ 1850.807214][T15004] [ 1850.807222][T15004] dump_stack_lvl+0x189/0x250 [ 1850.807252][T15004] ? __pfx____ratelimit+0x10/0x10 [ 1850.807275][T15004] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1850.807299][T15004] ? __pfx__printk+0x10/0x10 [ 1850.807319][T15004] ? __might_fault+0xb0/0x130 [ 1850.807355][T15004] should_fail_ex+0x46c/0x600 [ 1850.807384][T15004] _copy_from_user+0x2d/0xb0 [ 1850.807405][T15004] __sys_bpf+0x1ed/0x870 [ 1850.807429][T15004] ? __pfx___sys_bpf+0x10/0x10 [ 1850.807447][T15004] ? preempt_schedule_irq+0xde/0x150 [ 1850.807500][T15004] __x64_sys_bpf+0x7c/0x90 [ 1850.807520][T15004] do_syscall_64+0xfa/0x3b0 [ 1850.807543][T15004] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1850.807559][T15004] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 1850.807576][T15004] ? clear_bhb_loop+0x60/0xb0 [ 1850.807598][T15004] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1850.807615][T15004] RIP: 0033:0x7fc13ca9ebe9 [ 1850.807631][T15004] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1850.807647][T15004] RSP: 002b:00007fc13acc4038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1850.807673][T15004] RAX: ffffffffffffffda RBX: 00007fc13ccd6180 RCX: 00007fc13ca9ebe9 [ 1850.807687][T15004] RDX: 0000000000000020 RSI: 0000200000000140 RDI: 0000000000000012 [ 1850.807699][T15004] RBP: 00007fc13acc4090 R08: 0000000000000000 R09: 0000000000000000 [ 1850.807712][T15004] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1850.807723][T15004] R13: 00007fc13ccd6218 R14: 00007fc13ccd6180 R15: 00007ffe999a3e98 [ 1850.807754][T15004] [ 1851.559351][ T5891] usb 9-1: new high-speed USB device number 40 using dummy_hcd [ 1851.614633][ T10] usb 3-1: USB disconnect, device number 25 [ 1851.692546][ T5891] usb 9-1: device descriptor read/64, error -71 [ 1851.770179][T14998] i2c i2c-0: Invalid block read size 255 [ 1851.799674][ T5891] usb usb9-port1: attempt power cycle [ 1851.947250][T14163] udevd[14163]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1852.199283][ T5891] usb 9-1: new high-speed USB device number 41 using dummy_hcd [ 1852.245127][ T5891] usb 9-1: device descriptor read/8, error -71 [ 1852.667378][ T5891] usb 9-1: new high-speed USB device number 42 using dummy_hcd [ 1852.690370][ T5891] usb 9-1: device descriptor read/8, error -71 [ 1853.593078][ T5891] usb usb9-port1: unable to enumerate USB device [ 1855.088116][T15029] autofs: Unknown parameter '/dev/comedi4' [ 1859.473342][T15057] FAULT_INJECTION: forcing a failure. [ 1859.473342][T15057] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1859.473376][T15057] CPU: 0 UID: 0 PID: 15057 Comm: syz.2.1605 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 1859.473397][T15057] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1859.473409][T15057] Call Trace: [ 1859.473417][T15057] [ 1859.473425][T15057] dump_stack_lvl+0x189/0x250 [ 1859.473454][T15057] ? __pfx____ratelimit+0x10/0x10 [ 1859.473478][T15057] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1859.473501][T15057] ? __pfx__printk+0x10/0x10 [ 1859.473521][T15057] ? __might_fault+0xb0/0x130 [ 1859.473556][T15057] should_fail_ex+0x46c/0x600 [ 1859.473584][T15057] _copy_from_user+0x2d/0xb0 [ 1859.473605][T15057] ___sys_sendmsg+0x158/0x2a0 [ 1859.473632][T15057] ? __pfx____sys_sendmsg+0x10/0x10 [ 1859.473693][T15057] ? __fget_files+0x2a/0x420 [ 1859.473715][T15057] ? __fget_files+0x3a6/0x420 [ 1859.473748][T15057] __x64_sys_sendmsg+0x1a1/0x260 [ 1859.473775][T15057] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1859.473808][T15057] ? __pfx_ksys_write+0x10/0x10 [ 1859.473834][T15057] ? do_syscall_64+0xbe/0x3b0 [ 1859.473859][T15057] do_syscall_64+0xfa/0x3b0 [ 1859.473879][T15057] ? lockdep_hardirqs_on+0x9c/0x150 [ 1859.473900][T15057] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1859.473918][T15057] ? clear_bhb_loop+0x60/0xb0 [ 1859.473939][T15057] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1859.473957][T15057] RIP: 0033:0x7f2b777febe9 [ 1859.473973][T15057] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1859.473988][T15057] RSP: 002b:00007f2b75a45038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1859.474007][T15057] RAX: ffffffffffffffda RBX: 00007f2b77a36090 RCX: 00007f2b777febe9 [ 1859.474021][T15057] RDX: 00000000000052cc RSI: 0000200000000040 RDI: 0000000000000004 [ 1859.474033][T15057] RBP: 00007f2b75a45090 R08: 0000000000000000 R09: 0000000000000000 [ 1859.474045][T15057] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1859.474056][T15057] R13: 00007f2b77a36128 R14: 00007f2b77a36090 R15: 00007fffa6cfde68 [ 1859.474086][T15057] [ 1859.982583][ T5849] Bluetooth: hci3: unexpected cc 0x203c length: 9 > 1 [ 1859.982615][ T5849] Bluetooth: hci3: unexpected event for opcode 0x203c [ 1860.249349][ T9816] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 1860.409422][ T9816] usb 3-1: Using ep0 maxpacket: 16 [ 1860.412088][ T9816] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 1860.412116][ T9816] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1860.415250][ T9816] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1860.415275][ T9816] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1860.415293][ T9816] usb 3-1: Product: syz [ 1860.415307][ T9816] usb 3-1: Manufacturer: syz [ 1860.415320][ T9816] usb 3-1: SerialNumber: syz [ 1860.593848][ C1] vkms_vblank_simulate: vblank timer overrun [ 1860.600261][ T9816] usb 3-1: config 0 descriptor?? [ 1860.606936][ T9816] em28xx 3-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1860.606965][ T9816] em28xx 3-1:0.0: Audio interface 0 found (Vendor Class) [ 1860.757257][ C1] vkms_vblank_simulate: vblank timer overrun [ 1860.803712][ C1] vkms_vblank_simulate: vblank timer overrun [ 1860.920023][ C1] vkms_vblank_simulate: vblank timer overrun [ 1860.926960][ T5857] usb 8-1: new high-speed USB device number 32 using dummy_hcd [ 1861.084801][ T5857] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1861.084928][ T5857] usb 8-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 1861.084950][ T5857] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1861.339373][ T5857] usb 8-1: config 0 descriptor?? [ 1861.475155][ T5857] pwc: Askey VC010 type 2 USB webcam detected. [ 1861.498236][ T9816] em28xx 3-1:0.0: unknown em28xx chip ID (0) [ 1861.510230][ T9816] em28xx 3-1:0.0: Config register raw data: 0xfffffffb [ 1861.888226][T15068] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1611'. [ 1861.888258][T15068] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1611'. [ 1861.990484][ T5857] pwc: recv_control_msg error -32 req 02 val 2b00 [ 1861.995262][ T5857] pwc: recv_control_msg error -32 req 02 val 2700 [ 1862.146943][ T9816] em28xx 3-1:0.0: Unknown AC97 audio processor detected! [ 1862.151506][ T9816] em28xx 3-1:0.0: couldn't setup AC97 register 2 [ 1862.151896][ T9816] em28xx 3-1:0.0: couldn't setup AC97 register 4 [ 1862.152218][ T9816] em28xx 3-1:0.0: couldn't setup AC97 register 6 [ 1862.152577][ T9816] em28xx 3-1:0.0: couldn't setup AC97 register 54 [ 1862.152896][ T9816] em28xx 3-1:0.0: couldn't setup AC97 register 56 [ 1862.243662][T15079] fuse: Bad value for 'fd' [ 1862.274418][ T9816] usb 3-1: USB disconnect, device number 26 [ 1862.849611][ T5857] pwc: recv_control_msg error -71 req 04 val 1000 [ 1862.850827][ T5857] pwc: recv_control_msg error -71 req 04 val 1300 [ 1862.854500][ T5857] pwc: recv_control_msg error -71 req 04 val 1400 [ 1862.856105][ T5857] pwc: recv_control_msg error -71 req 02 val 2000 [ 1862.860749][ T5857] pwc: recv_control_msg error -71 req 02 val 2100 [ 1862.861442][ T5857] pwc: recv_control_msg error -71 req 04 val 1500 [ 1862.862314][ T5857] pwc: recv_control_msg error -71 req 02 val 2500 [ 1862.869006][ T5857] pwc: recv_control_msg error -71 req 02 val 2400 [ 1862.994155][ T5857] pwc: recv_control_msg error -71 req 02 val 2600 [ 1863.016181][ T5857] pwc: recv_control_msg error -71 req 02 val 2900 [ 1863.039076][ T5857] pwc: recv_control_msg error -71 req 02 val 2800 [ 1863.046913][ T5857] pwc: recv_control_msg error -71 req 04 val 1100 [ 1863.047410][ T5857] pwc: recv_control_msg error -71 req 04 val 1200 [ 1863.098671][ T5857] pwc: Registered as video103. [ 1863.108951][ T5857] input: PWC snapshot button as /devices/platform/dummy_hcd.7/usb8/8-1/input/input36 [ 1863.131564][ T5857] usb 8-1: USB disconnect, device number 32 [ 1863.562672][ C1] vkms_vblank_simulate: vblank timer overrun [ 1864.270533][ C1] vkms_vblank_simulate: vblank timer overrun Stopping sshd: stopped /usr/sbin/sshd (pid 5599) OK [ 1865.318621][T15097] No control pipe specified Stopping crond: [ 1865.982825][T15113] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1621'. stopped /usr/sbin/crond (pid 5581) OK [ 1866.658891][ T5849] Bluetooth: hci2: unexpected cc 0x203c length: 9 > 1 [ 1866.658922][ T5849] Bluetooth: hci2: unexpected event for opcode 0x203c [ 1867.064162][T15113] vxlan0: entered promiscuous mode [ 1867.072871][ T8519] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1867.074925][ T7692] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1867.075158][ T7692] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1867.076007][ T7692] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1869.047482][ T1322] ieee802154 phy0 wpan0: encryption failed: -22 [ 1869.047555][ T1322] ieee802154 phy1 wpan1: encryption failed: -22 Stopping dhcpcd... [ 1869.381973][ T5849] Bluetooth: hci0: unexpected event for opcode 0x1003 no /sbin/dhcpcd found; none killed [ 1869.711930][ T5849] Bluetooth: hci3: unexpected cc 0x203c length: 9 > 1 [ 1869.711961][ T5849] Bluetooth: hci3: unexpected event for opcode 0x203c [ 1869.729349][T11316] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 1869.919323][T11316] usb 4-1: Using ep0 maxpacket: 32 [ 1869.922253][T11316] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 1869.926769][T11316] usb 4-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 1869.926838][T11316] usb 4-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 1869.926859][T11316] usb 4-1: Product: syz [ 1869.926872][T11316] usb 4-1: Manufacturer: syz [ 1869.926886][T11316] usb 4-1: SerialNumber: syz [ 1870.028407][T15168] FAULT_INJECTION: forcing a failure. [ 1870.028407][T15168] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1870.028429][T15168] CPU: 1 UID: 0 PID: 15168 Comm: syz.7.1636 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 1870.028441][T15168] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1870.028448][T15168] Call Trace: [ 1870.028452][T15168] [ 1870.028457][T15168] dump_stack_lvl+0x189/0x250 [ 1870.028475][T15168] ? __pfx____ratelimit+0x10/0x10 [ 1870.028488][T15168] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1870.028502][T15168] ? __pfx__printk+0x10/0x10 [ 1870.028513][T15168] ? __might_fault+0xb0/0x130 [ 1870.028532][T15168] should_fail_ex+0x46c/0x600 [ 1870.028549][T15168] _copy_from_user+0x2d/0xb0 [ 1870.028560][T15168] ___sys_sendmsg+0x158/0x2a0 [ 1870.028576][T15168] ? __pfx____sys_sendmsg+0x10/0x10 [ 1870.028607][T15168] ? __fget_files+0x2a/0x420 [ 1870.028621][T15168] ? __fget_files+0x3a6/0x420 [ 1870.028638][T15168] __x64_sys_sendmsg+0x1a1/0x260 [ 1870.028653][T15168] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1870.028671][T15168] ? __pfx_ksys_write+0x10/0x10 [ 1870.028682][T15168] ? rcu_is_watching+0x15/0xb0 [ 1870.028703][T15168] ? do_syscall_64+0xbe/0x3b0 [ 1870.028728][T15168] do_syscall_64+0xfa/0x3b0 [ 1870.028748][T15168] ? lockdep_hardirqs_on+0x9c/0x150 [ 1870.028768][T15168] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1870.028785][T15168] ? clear_bhb_loop+0x60/0xb0 [ 1870.028806][T15168] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1870.028821][T15168] RIP: 0033:0x7f581889ebe9 [ 1870.028839][T15168] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1870.028848][T15168] RSP: 002b:00007f5816b06038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1870.028860][T15168] RAX: ffffffffffffffda RBX: 00007f5818ad5fa0 RCX: 00007f581889ebe9 [ 1870.028867][T15168] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000003 [ 1870.028874][T15168] RBP: 00007f5816b06090 R08: 0000000000000000 R09: 0000000000000000 [ 1870.028881][T15168] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1870.028887][T15168] R13: 00007f5818ad6038 R14: 00007f5818ad5fa0 R15: 00007ffc86a76c78 [ 1870.028903][T15168] [ 1870.058239][T11316] usb 4-1: config 0 descriptor?? [ 1870.059349][T15155] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1870.322569][T15159] could not allocate digest TFM handle blake2s-128-generic Stopping network: [ 1870.644973][T11316] usb 4-1: USB disconnect, device number 18 [ 1871.109624][ T7516] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 1871.249567][ T7516] usb 3-1: device descriptor read/64, error -71 [ 1871.489391][ T7516] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 1871.619253][ T7516] usb 3-1: device descriptor read/64, error -71 [ 1871.799302][T15188] ================================================================== [ 1871.799327][T15188] BUG: KASAN: slab-use-after-free in xfrm_state_find+0x2c72/0x53e0 [ 1871.799363][T15188] Read of size 1 at addr ffff88805cca47f0 by task syz.7.1640/15188 [ 1871.799383][T15188] [ 1871.799397][T15188] CPU: 1 UID: 0 PID: 15188 Comm: syz.7.1640 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 1871.799423][T15188] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1871.799437][T15188] Call Trace: [ 1871.799446][T15188] [ 1871.799456][T15188] dump_stack_lvl+0x189/0x250 [ 1871.799485][T15188] ? __kasan_check_byte+0x12/0x40 [ 1871.799512][T15188] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1871.799538][T15188] ? lock_release+0x4b/0x3e0 [ 1871.799567][T15188] ? __virt_addr_valid+0x4a5/0x5c0 [ 1871.799596][T15188] print_report+0xca/0x240 [ 1871.799621][T15188] ? xfrm_state_find+0x2c72/0x53e0 [ 1871.799654][T15188] kasan_report+0x118/0x150 [ 1871.799682][T15188] ? xfrm_state_find+0x2c72/0x53e0 [ 1871.799715][T15188] xfrm_state_find+0x2c72/0x53e0 [ 1871.799745][T15188] ? rcuref_put+0x208/0x210 [ 1871.799765][T15188] ? __pfx_rcuref_put+0x10/0x10 [ 1871.799786][T15188] ? xfrm_state_find+0x2bf/0x53e0 [ 1871.799816][T15188] ? __pfx_xfrm_state_find+0x10/0x10 [ 1871.799840][T15188] ? xfrm4_get_saddr+0xd5/0x140 [ 1871.799867][T15188] ? __pfx_xfrm4_get_saddr+0x10/0x10 [ 1871.799902][T15188] xfrm_resolve_and_create_bundle+0x768/0x2f80 [ 1871.799937][T15188] ? __pfx_xfrm_resolve_and_create_bundle+0x10/0x10 [ 1871.799959][T15188] ? rcu_read_unlock_special+0x35b/0x470 [ 1871.799985][T15188] ? irqentry_exit+0x74/0x90 [ 1871.800010][T15188] ? __pfx_rcu_read_unlock_special+0x10/0x10 [ 1871.800041][T15188] ? __rcu_read_unlock+0x84/0xe0 [ 1871.800069][T15188] ? xfrm_sk_policy_lookup+0x9d/0x750 [ 1871.800093][T15188] ? xfrm_expand_policies+0x41f/0x6a0 [ 1871.800116][T15188] xfrm_lookup_with_ifid+0x2a7/0x1a90 [ 1871.800142][T15188] ? __pfx_xfrm_lookup_with_ifid+0x10/0x10 [ 1871.800169][T15188] xfrm_lookup_route+0x3c/0x1c0 [ 1871.800190][T15188] udp_sendmsg+0x142e/0x2170 [ 1871.800218][T15188] ? __pfx_ip_generic_getfrag+0x10/0x10 [ 1871.800248][T15188] ? __pfx_udp_sendmsg+0x10/0x10 [ 1871.800271][T15188] ? trace_irq_disable+0x37/0x110 [ 1871.800294][T15188] ? preempt_schedule_irq+0xde/0x150 [ 1871.800323][T15188] ? irqentry_exit+0x74/0x90 [ 1871.800355][T15188] ? sock_rps_record_flow+0x19/0x410 [ 1871.800377][T15188] ? inet_sendmsg+0x29c/0x370 [ 1871.800397][T15188] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1871.800421][T15188] __sock_sendmsg+0x19c/0x270 [ 1871.800444][T15188] ____sys_sendmsg+0x534/0x820 [ 1871.800473][T15188] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1871.800505][T15188] ? import_iovec+0x74/0xa0 [ 1871.800528][T15188] ___sys_sendmsg+0x21f/0x2a0 [ 1871.800556][T15188] ? __pfx____sys_sendmsg+0x10/0x10 [ 1871.800599][T15188] ? __fget_files+0x2a/0x420 [ 1871.800625][T15188] ? __fget_files+0x3a6/0x420 [ 1871.800666][T15188] __sys_sendmmsg+0x22d/0x430 [ 1871.800698][T15188] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1871.800733][T15188] ? preempt_schedule_irq+0xde/0x150 [ 1871.800772][T15188] __x64_sys_sendmmsg+0xa0/0xc0 [ 1871.800799][T15188] do_syscall_64+0xfa/0x3b0 [ 1871.800827][T15188] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1871.800849][T15188] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 1871.800870][T15188] ? clear_bhb_loop+0x60/0xb0 [ 1871.800894][T15188] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1871.800914][T15188] RIP: 0033:0x7f581889ebe9 [ 1871.800933][T15188] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1871.800952][T15188] RSP: 002b:00007f5816ac4038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1871.800977][T15188] RAX: ffffffffffffffda RBX: 00007f5818ad6180 RCX: 00007f581889ebe9 [ 1871.800995][T15188] RDX: 000000000800001d RSI: 0000200000007fc0 RDI: 0000000000000005 [ 1871.801011][T15188] RBP: 00007f5818921e19 R08: 0000000000000000 R09: 0000000000000000 [ 1871.801025][T15188] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1871.801039][T15188] R13: 00007f5818ad6218 R14: 00007f5818ad6180 R15: 00007ffc86a76c78 [ 1871.801063][T15188] [ 1871.801072][T15188] [ 1871.801077][T15188] Allocated by task 13068: [ 1871.801095][T15188] kasan_save_track+0x3e/0x80 [ 1871.801119][T15188] __kasan_slab_alloc+0x6c/0x80 [ 1871.801141][T15188] kmem_cache_alloc_noprof+0x143/0x310 [ 1871.801167][T15188] xfrm_state_alloc+0x24/0x2f0 [ 1871.801188][T15188] __find_acq_core+0x8a7/0x1c00 [ 1871.801211][T15188] xfrm_find_acq+0x8f/0xd0 [ 1871.801235][T15188] xfrm_alloc_userspi+0x6b3/0xc90 [ 1871.801253][T15188] xfrm_user_rcv_msg+0x7a3/0xab0 [ 1871.801270][T15188] netlink_rcv_skb+0x205/0x470 [ 1871.801291][T15188] xfrm_netlink_rcv+0x79/0x90 [ 1871.801308][T15188] netlink_unicast+0x843/0xa10 [ 1871.801327][T15188] netlink_sendmsg+0x805/0xb30 [ 1871.801348][T15188] __sock_sendmsg+0x219/0x270 [ 1871.801366][T15188] ____sys_sendmsg+0x508/0x820 [ 1871.801390][T15188] ___sys_sendmsg+0x21f/0x2a0 [ 1871.801414][T15188] __x64_sys_sendmsg+0x1a1/0x260 [ 1871.801438][T15188] do_syscall_64+0xfa/0x3b0 [ 1871.801461][T15188] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1871.801480][T15188] [ 1871.801485][T15188] Freed by task 5891: [ 1871.801496][T15188] kasan_save_track+0x3e/0x80 [ 1871.801515][T15188] kasan_save_free_info+0x46/0x50 [ 1871.801532][T15188] __kasan_slab_free+0x5b/0x80 [ 1871.801552][T15188] kmem_cache_free+0x195/0x510 [ 1871.801575][T15188] xfrm_state_gc_task+0x54e/0x6d0 [ 1871.801594][T15188] process_scheduled_works+0xade/0x17b0 [ 1871.801616][T15188] worker_thread+0x8a0/0xda0 [ 1871.801646][T15188] kthread+0x711/0x8a0 [ 1871.801672][T15188] ret_from_fork+0x3f9/0x770 [ 1871.801695][T15188] ret_from_fork_asm+0x1a/0x30 [ 1871.801714][T15188] [ 1871.801720][T15188] The buggy address belongs to the object at ffff88805cca4480 [ 1871.801720][T15188] which belongs to the cache xfrm_state of size 992 [ 1871.801740][T15188] The buggy address is located 880 bytes inside of [ 1871.801740][T15188] freed 992-byte region [ffff88805cca4480, ffff88805cca4860) [ 1871.801762][T15188] [ 1871.801769][T15188] The buggy address belongs to the physical page: [ 1871.801789][T15188] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88805cca4480 pfn:0x5cca4 [ 1871.801816][T15188] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 1871.801838][T15188] flags: 0x80000000000040(head|node=0|zone=1) [ 1871.801859][T15188] page_type: f5(slab) [ 1871.801880][T15188] raw: 0080000000000040 ffff8881426bcc80 dead000000000122 0000000000000000 [ 1871.801897][T15188] raw: ffff88805cca4480 00000000800e000d 00000000f5000000 0000000000000000 [ 1871.801916][T15188] head: 0080000000000040 ffff8881426bcc80 dead000000000122 0000000000000000 [ 1871.801934][T15188] head: ffff88805cca4480 00000000800e000d 00000000f5000000 0000000000000000 [ 1871.801952][T15188] head: 0080000000000002 ffffea0001732901 00000000ffffffff 00000000ffffffff [ 1871.801969][T15188] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000004 [ 1871.801980][T15188] page dumped because: kasan: bad access detected [ 1871.801991][T15188] page_owner tracks the page as allocated [ 1871.802000][T15188] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 11758, tgid 11755 (syz.0.779), ts 1380603042772, free_ts 1380534613424 [ 1871.802040][T15188] post_alloc_hook+0x240/0x2a0 [ 1871.802064][T15188] get_page_from_freelist+0x2119/0x21b0 [ 1871.802085][T15188] __alloc_frozen_pages_noprof+0x181/0x370 [ 1871.802104][T15188] alloc_pages_mpol+0xd1/0x380 [ 1871.802127][T15188] allocate_slab+0x8a/0x370 [ 1871.802146][T15188] ___slab_alloc+0x8d1/0xdd0 [ 1871.802170][T15188] kmem_cache_alloc_noprof+0xe6/0x310 [ 1871.802191][T15188] xfrm_state_alloc+0x24/0x2f0 [ 1871.802210][T15188] xfrm_add_sa+0x17d1/0x4070 [ 1871.802225][T15188] xfrm_user_rcv_msg+0x7a3/0xab0 [ 1871.802241][T15188] netlink_rcv_skb+0x205/0x470 [ 1871.802259][T15188] xfrm_netlink_rcv+0x79/0x90 [ 1871.802274][T15188] netlink_unicast+0x843/0xa10 [ 1871.802291][T15188] netlink_sendmsg+0x805/0xb30 [ 1871.802310][T15188] __sock_sendmsg+0x219/0x270 [ 1871.802327][T15188] ____sys_sendmsg+0x508/0x820 [ 1871.802348][T15188] page last free pid 11748 tgid 11746 stack trace: [ 1871.802360][T15188] __free_frozen_pages+0xb59/0xce0 [ 1871.802382][T15188] __slab_free+0x2db/0x390 [ 1871.802398][T15188] qlist_free_all+0x97/0x140 [ 1871.802415][T15188] kasan_quarantine_reduce+0x148/0x160 [ 1871.802433][T15188] __kasan_slab_alloc+0x22/0x80 [ 1871.802453][T15188] kmem_cache_alloc_node_noprof+0x14e/0x330 [ 1871.802474][T15188] __alloc_skb+0x112/0x2d0 [ 1871.802493][T15188] alloc_skb_with_frags+0xca/0x890 [ 1871.802515][T15188] sock_alloc_send_pskb+0x863/0x9a0 [ 1871.802530][T15188] __ip_append_data+0x2ce8/0x40c0 [ 1871.802545][T15188] ip_make_skb+0x1e4/0x400 [ 1871.802560][T15188] udp_sendmsg+0x1925/0x2170 [ 1871.802576][T15188] __sock_sendmsg+0x19c/0x270 [ 1871.802591][T15188] ____sys_sendmsg+0x534/0x820 [ 1871.802612][T15188] ___sys_sendmsg+0x21f/0x2a0 [ 1871.802633][T15188] __sys_sendmmsg+0x22d/0x430 [ 1871.802660][T15188] [ 1871.802666][T15188] Memory state around the buggy address: [ 1871.802676][T15188] ffff88805cca4680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1871.802690][T15188] ffff88805cca4700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1871.802703][T15188] >ffff88805cca4780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1871.802712][T15188] ^ [ 1871.802723][T15188] ffff88805cca4800: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 1871.802737][T15188] ffff88805cca4880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1871.802746][T15188] ================================================================== [ 1871.802797][T15188] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 1871.802812][T15188] CPU: 1 UID: 0 PID: 15188 Comm: syz.7.1640 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 1871.802835][T15188] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1871.802847][T15188] Call Trace: [ 1871.802855][T15188] [ 1871.802864][T15188] dump_stack_lvl+0x99/0x250 [ 1871.802890][T15188] ? __asan_memcpy+0x40/0x70 [ 1871.802908][T15188] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1871.802932][T15188] ? __pfx__printk+0x10/0x10 [ 1871.802963][T15188] vpanic+0x281/0x750 [ 1871.802986][T15188] ? preempt_schedule+0xae/0xc0 [ 1871.803008][T15188] ? __pfx_vpanic+0x10/0x10 [ 1871.803030][T15188] ? preempt_schedule_common+0x83/0xd0 [ 1871.803052][T15188] ? preempt_schedule+0xae/0xc0 [ 1871.803073][T15188] ? __pfx_preempt_schedule+0x10/0x10 [ 1871.803098][T15188] panic+0xb9/0xc0 [ 1871.803121][T15188] ? __pfx_panic+0x10/0x10 [ 1871.803146][T15188] ? _raw_spin_unlock_irqrestore+0xfd/0x110 [ 1871.803174][T15188] ? xfrm_state_find+0x2c72/0x53e0 [ 1871.803196][T15188] check_panic_on_warn+0x89/0xb0 [ 1871.803215][T15188] ? xfrm_state_find+0x2c72/0x53e0 [ 1871.803238][T15188] end_report+0x78/0x160 [ 1871.803259][T15188] kasan_report+0x129/0x150 [ 1871.803282][T15188] ? xfrm_state_find+0x2c72/0x53e0 [ 1871.803308][T15188] xfrm_state_find+0x2c72/0x53e0 [ 1871.803337][T15188] ? rcuref_put+0x208/0x210 [ 1871.803354][T15188] ? __pfx_rcuref_put+0x10/0x10 [ 1871.803373][T15188] ? xfrm_state_find+0x2bf/0x53e0 [ 1871.803399][T15188] ? __pfx_xfrm_state_find+0x10/0x10 [ 1871.803421][T15188] ? xfrm4_get_saddr+0xd5/0x140 [ 1871.803446][T15188] ? __pfx_xfrm4_get_saddr+0x10/0x10 [ 1871.803477][T15188] xfrm_resolve_and_create_bundle+0x768/0x2f80 [ 1871.803511][T15188] ? __pfx_xfrm_resolve_and_create_bundle+0x10/0x10 [ 1871.803531][T15188] ? rcu_read_unlock_special+0x35b/0x470 [ 1871.803553][T15188] ? irqentry_exit+0x74/0x90 [ 1871.803590][T15188] ? __pfx_rcu_read_unlock_special+0x10/0x10 [ 1871.803619][T15188] ? __rcu_read_unlock+0x84/0xe0 [ 1871.803652][T15188] ? xfrm_sk_policy_lookup+0x9d/0x750 [ 1871.803673][T15188] ? xfrm_expand_policies+0x41f/0x6a0 [ 1871.803694][T15188] xfrm_lookup_with_ifid+0x2a7/0x1a90 [ 1871.803716][T15188] ? __pfx_xfrm_lookup_with_ifid+0x10/0x10 [ 1871.803741][T15188] xfrm_lookup_route+0x3c/0x1c0 [ 1871.803760][T15188] udp_sendmsg+0x142e/0x2170 [ 1871.803785][T15188] ? __pfx_ip_generic_getfrag+0x10/0x10 [ 1871.803812][T15188] ? __pfx_udp_sendmsg+0x10/0x10 [ 1871.803833][T15188] ? trace_irq_disable+0x37/0x110 [ 1871.803853][T15188] ? preempt_schedule_irq+0xde/0x150 [ 1871.803880][T15188] ? irqentry_exit+0x74/0x90 [ 1871.803908][T15188] ? sock_rps_record_flow+0x19/0x410 [ 1871.803928][T15188] ? inet_sendmsg+0x29c/0x370 [ 1871.803946][T15188] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1871.803966][T15188] __sock_sendmsg+0x19c/0x270 [ 1871.803986][T15188] ____sys_sendmsg+0x534/0x820 [ 1871.804012][T15188] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1871.804040][T15188] ? import_iovec+0x74/0xa0 [ 1871.804062][T15188] ___sys_sendmsg+0x21f/0x2a0 [ 1871.804087][T15188] ? __pfx____sys_sendmsg+0x10/0x10 [ 1871.804127][T15188] ? __fget_files+0x2a/0x420 [ 1871.804151][T15188] ? __fget_files+0x3a6/0x420 [ 1871.804178][T15188] __sys_sendmmsg+0x22d/0x430 [ 1871.804205][T15188] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1871.804234][T15188] ? preempt_schedule_irq+0xde/0x150 [ 1871.804269][T15188] __x64_sys_sendmmsg+0xa0/0xc0 [ 1871.804294][T15188] do_syscall_64+0xfa/0x3b0 [ 1871.804317][T15188] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1871.804336][T15188] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 1871.804355][T15188] ? clear_bhb_loop+0x60/0xb0 [ 1871.804375][T15188] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1871.804393][T15188] RIP: 0033:0x7f581889ebe9 [ 1871.804409][T15188] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1871.804426][T15188] RSP: 002b:00007f5816ac4038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1871.804447][T15188] RAX: ffffffffffffffda RBX: 00007f5818ad6180 RCX: 00007f581889ebe9 [ 1871.804463][T15188] RDX: 000000000800001d RSI: 0000200000007fc0 RDI: 0000000000000005 [ 1871.804477][T15188] RBP: 00007f5818921e19 R08: 0000000000000000 R09: 0000000000000000 [ 1871.804490][T15188] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1871.804503][T15188] R13: 00007f5818ad6218 R14: 00007f5818ad6180 R15: 00007ffc86a76c78 [ 1871.804525][T15188] [ 1871.804788][T15188] Kernel Offset: disabled