last executing test programs: 34.966674722s ago: executing program 2 (id=2796): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) mount$9p_fd(0x0, 0x0, &(0x7f0000000180), 0x4080, 0x0) setreuid(0xee01, 0xee01) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='mountinfo\x00') read$FUSE(r2, 0x0, 0x0) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, 0xffffffffffffffff) r3 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x0, 0x0}) fcntl$setstatus(r3, 0x4, 0x40000) syz_pidfd_open(0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000040)) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x200000000) r4 = dup2(r0, r0) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000400)={0x0, 0x0, 0x0, &(0x7f00000004c0)=""/132, 0x0, 0x2000}) ioctl$VHOST_VSOCK_SET_RUNNING(r4, 0x4004af61, &(0x7f0000000000)=0x5) read$FUSE(r4, &(0x7f0000004d80)={0x2020}, 0x2020) write$vhost_msg_v2(r4, &(0x7f0000000380)={0x2, 0x0, {&(0x7f0000000140)=""/116, 0xfccf, 0x0, 0x1, 0x2}}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x13, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="bd0000000000000079110000000000009500050000000000ddab49b00621ef83eaa9b87d91feb18721"], 0x0, 0x2, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff}, 0x94) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r5, 0xaf01, 0x0) 34.68151084s ago: executing program 2 (id=2798): sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4000000) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, &(0x7f0000000080)={0x0, 0x1, 0x0, &(0x7f00000009c0)=""/251, 0x0, 0x4000}) bpf$MAP_CREATE(0x0, 0x0, 0x48) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$IOCTL_VMCI_CTX_SET_CPT_STATE(0xffffffffffffffff, 0x7b2, &(0x7f0000001680)={&(0x7f0000000680)=[0x100000, 0x8, 0x0, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x40000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, 0x0, 0x2, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x2e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x70, 0xffffffff, 0xf2e, 0x0, 0x0, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x4, 0x7, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x4, 0x0, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x30, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x8f1, 0x0, 0x40000000, 0x0, 0x0, 0x0, 0x0, 0x40000000, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x9, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0xc97, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x401, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x4, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x2, 0x6d1, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe02e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x8000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x9, 0xcf, 0x0, 0x5, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x0, 0x3ff, 0x0, 0x7ff, 0x0, 0x4, 0x7, 0x800, 0x0, 0x0, 0x7, 0xfffffffd, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x413f, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0xc4c, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x101, 0x0, 0xd, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x22, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa32, 0x0, 0x9, 0xfffffffc, 0x789], 0x1, 0x400}) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) syz_usbip_server_init(0xf66eabed157452f) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000180)="420fc7bc4898580000640f01c50f01c566baf80cb864c95782ef66bafc0cec67670f1b0166b8fb008ec046d9c3c442b90a2c81c442812852fcc744240012000000c74424020b000000ff1c24", 0x4c}], 0x1, 0x0, 0x0, 0x0) openat$ttyS3(0xffffffffffffff9c, 0x0, 0x401, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000240)={[0x5836, 0x5, 0x7, 0xe51, 0x1, 0x5479, 0x103d, 0x6, 0x0, 0x32a, 0xfffffffffffffffe, 0xffffffff, 0x1, 0x40000000009, 0x5, 0x6a], 0x2000, 0x808d6}) write$rfkill(0xffffffffffffffff, &(0x7f0000000000)={0x3, 0x2, 0x0, 0x0, 0x1}, 0x8) ioctl$LOOP_CONFIGURE(0xffffffffffffffff, 0x4c0a, &(0x7f00000013c0)={0xffffffffffffffff, 0xa, {0x0, 0x0, 0x0, 0x5, 0x80, 0x0, 0x4, 0x1f, 0x10, "339f020bbe82b398000000000000000000000d0ec0c1b4e9b1c4369d03740250ceaac594b1b3d741dd17c1c50d38ef2a565ef1e83323691c58d66500757c00", "143939c787a16c1ca43f80026d1a8554fe581b59dee430e04d528539f3d3289737f0374c72a964a02447a75df8a69ea917deb7ba193b3e7772fd29f35239d200", "24431a1e77a68e1700000004000800", [0x83, 0x200000000000]}}) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = creat(&(0x7f0000000100)='./bus\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x1000f4) r6 = open(&(0x7f0000000080)='./bus\x00', 0x147842, 0x49) preadv2(r6, &(0x7f0000000040)=[{&(0x7f0000001200)=""/4096, 0xfffffdef}], 0x1, 0x0, 0x0, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={0x0}, 0x1, 0x0, 0x0, 0x10000082}, 0x80) socket$netlink(0x10, 0x3, 0xc) r7 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r7, 0x6, 0x210000000013, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r7, 0x6, 0x13, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) 30.642159012s ago: executing program 2 (id=2810): r0 = socket$packet(0x11, 0x7, 0x300) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x21008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000180)=0x8000000000000002) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) fallocate(r0, 0x0, 0x3b0d6865, 0x1de) lseek(r1, 0x0, 0x3) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff}) ioctl$sock_SIOCSIFVLAN_GET_VLAN_INGRESS_PRIORITY_CMD(r2, 0x8983, &(0x7f00000000c0)) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_IP(r1, &(0x7f0000000300)={0x3, 0x40, 0xfa00, {{0xa, 0x4e24, 0x4, @remote, 0x5}, {0xa, 0x4e21, 0x5a6, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x1ff}, 0xffffffffffffffff, 0x3}}, 0x48) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f000001aa40)=""/102400, 0x19000) r4 = syz_open_procfs(0x0, &(0x7f0000000580)='net/sockstat6\x00') getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r1, 0x84, 0x70, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e21, @private=0xa010100}}, [0x8000, 0x0, 0x8, 0x5d, 0x8000, 0xc, 0xf1e, 0x8001, 0xff, 0x4, 0x9, 0x8, 0x2, 0xa, 0x9]}, &(0x7f0000000100)=0x100) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r4, 0x84, 0x77, &(0x7f0000000400)={r5, 0x1ff}, &(0x7f0000000440)=0x8) getdents(r4, &(0x7f0000001f80)=""/4096, 0x1000) r6 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r6, 0x0, 0x0) ioctl$sock_SIOCGPGRP(r6, 0x8904, &(0x7f0000000140)=0x0) prctl$PR_SET_PTRACER(0x59616d61, r7) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, 0x0, 0x0) setsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(0xffffffffffffffff, 0x84, 0x8, &(0x7f0000000080)=0x8, 0x4) openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) memfd_create(&(0x7f00000009c0)='y\x105\xf3\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xe7a\x9b\x11x\x0e\xa1\xcf\x1a\x98S7\xc9\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x04\x879\xa24\xa9am\xde\xb2\xd3\xcbZJoa\xc4\x1acB\xaa\xc1\xfb Q\xd4\xf4\x01\xa52\xe2DG\xd4\xbd{\x9f\xa9\x97\x9b@\xdbU\xb1\xe1br\xb6\x008\xe3\x10\xff\xc2\x9d\r2\x9e\x8e\x04sW\x1b\xb7\xb3\xa2\xc9&@\xca\xda\xdc\xe2/\x97X\xac\b\xb0\xc2<\x80E\x1a\xbc\xc7W\xda9VsA\xaf\xc6\x90i\xa1\xb5M\xa2\x85\xa6y\xc4J\xf1\xf7\xfcD\x95\xe3\xeb\xc7\xbc\x91\xb0\xa8\x9eo\xebF(\x9dL\x01vRk\xaacB\x04\xa7I\v\x86EZ\x96\xd5\x14O\xf8\xb5C\x1f\xb6b8b\x06A2@D\\\xe8R\xe4\xcd\xec\xcc\xd1\x0fre\xe86\xcd\xeb\xc4$\x98\x06J\xd6dD\x8d_U`ji{\xab\x97\xaf;l\x1f\xaf\xb38U\xcb\xfa\xb3j\x92\f\x81\xa0\xa2-g\b\x99\x0e\x8d\x8d\x16\x05\x00\x00\x00\x00\x00\x00\x00\'\x93\xef\x1d\xa0H\xd9\xbd\xd9\xaf\x12$\x8d\x16%\x8b\x00\x88\xd1\x1eQB\x18\xc1-\xc4\x8fK\xf8\xfa\xb6\xf8\v;\xaa\x8fW\xcc\n\x17\x7f\x98\xb7\xcdqV\xd4\xf0)\xfa\x0fG\xc8\xbf\xfd\xe8>K\f\xcd+\xb0\x99Q\xba/\xa8\xb9`k\b\xd1\xcc\xfc\xeaA\"\v=\x83fC\x90%\xa1d\x91\xf8:\x16<\xad\xc2\x18\xdf\x01\xe2\x96\xfcj\xe9\xa4\x065m\x03\x05Np\xda\"\xf1\xb6\xbcP\x8fP\x8d\x89%\xf2\x12T\xd0\xc3\x15W\x9c\x87\x1b\x8c\xc9\xd9\xc6\xad\x96-d\xa2wFB\xcaB\xa5\x15\xf8,\x04\x1c*\xd98\x8bG\x90\x81`\x03\xe0\xde\x9c\x9a\x0f\x1b\x8f\xd2%*&$Wc\xb3\xa6\xc4TK1}2\xb3\xab\xf4\xb7\xb7\x85\apa\xaf\x1c\x10i\xb9\x9f\x06\xff4%\"7f \x0e\xf5Bk\r\xac\"\x13tNx\xc0$\x85\x9f', 0x2) r8 = syz_open_dev$sndctrl(&(0x7f0000000e00), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_INFO(r8, 0x800455d1, 0xfffffffffffffffd) mount(&(0x7f00000003c0)=@nullb, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000300)='udf\x00', 0x200480, 0x0) 30.019641604s ago: executing program 2 (id=2812): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount$afs(0x0, &(0x7f00000003c0)='./file0\x00', &(0x7f00000002c0), 0x5, &(0x7f0000000140)=ANY=[@ANYBLOB='dyn']) chdir(&(0x7f0000000340)='./file0\x00') link(&(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x3) ioctl$TIOCSTI(r0, 0x5412, &(0x7f00000000c0)=0x3a) r1 = bpf$MAP_CREATE(0x0, 0x0, 0x48) r2 = socket(0x1e, 0x1, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, &(0x7f0000000040)=@req={0x3fc, 0x3, 0x0, 0x8}, 0x10) r3 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r3, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10) sendmmsg(0xffffffffffffffff, &(0x7f00000030c0)=[{{0x0, 0x0, &(0x7f0000000400)=[{&(0x7f00000000c0)="96", 0x1}], 0x1}}], 0x1, 0x9200000000000000) sendmmsg(r2, 0x0, 0x0, 0x200000e1) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mkdir(&(0x7f0000000300)='./file0\x00', 0xfffffffffffffffe) mount(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000004c0)='cgroup2\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000240), 0x0, &(0x7f00000001c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}, {@verity_on}], [], 0x2f}) r5 = openat(r1, &(0x7f0000000080)='./file0\x00', 0x0, 0xd3) openat$cgroup_ro(r5, &(0x7f0000000040)='cpu.stat\x00', 0xf000, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r7, &(0x7f0000000840)=[{{&(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x0, &(0x7f0000000280)=[{&(0x7f00000005c0)="62711d423b13f08f5e6077f0a72b9881601617509a17d5abb59766cc938afc9958f987834e0b57af2317dcde0b061488f2b166cc16083ad3b0e6edf6e59ab099614f108541304d"}, {&(0x7f0000000180)="f9f463916719ec"}, {&(0x7f0000000700)="e2da368568156056c6abdefa8e47cca67025448ccacd1d242f7bf8165df06f526431f443e949fc9d35b9a584fbfe41015c5a91ada07a7039acfab6f7a3ccd4f11681e00fe52a10cc6c213b770e2d903e035b4972f2d5a2bfc6eee55bae49ab5392c07e9b1d446597489e7aa91dea98d9b6cd1a140b9b1115a842e115ed35da00"/143}], 0x0, &(0x7f0000000800)=[@cred={{0x0, 0x1, 0x2, {0xffffffffffffffff}}}], 0x0, 0x4000}}], 0x3d4, 0x200040c1) r8 = syz_open_dev$sndpcmp(&(0x7f0000000100), 0xca8, 0x4702c0) ioctl$SNDRV_PCM_IOCTL_HWSYNC(r8, 0x4122, 0x0) recvmmsg(r6, 0x0, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) recvmmsg$unix(r2, &(0x7f00000043c0)=[{{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000002c0)=""/240, 0x101d0}], 0x1}}, {{0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0) 28.516539605s ago: executing program 2 (id=2816): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4801}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2340, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000000)={{0x87, @loopback, 0x4e24, 0x1, 'none\x00', 0x1, 0x32bd, 0x9}, {@loopback, 0x4e20, 0x2, 0x7f, 0x4, 0x12d5c}}, 0x44) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x1) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f00000002c0)={0x0, 0x2, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) sched_setaffinity(0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_open_dev$MSR(0x0, 0x0, 0x0) read$msr(r5, &(0x7f000001b000)=""/102400, 0x19000) socket$key(0xf, 0x3, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000020000/0x18000)=nil, &(0x7f0000000300)=[@text16={0x10, &(0x7f0000000840)="baf80c66b82e9a188166efbafc0ced660f3807d00f01980000650fbaff0266b9800000c00f326635000400000f302e0f1c422a66b94a0b000066b80d00000066ba000000000f303e653e2e660fc776770f050f07", 0x54}], 0x1, 0x69, 0x0, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r3, 0x4010ae67, &(0x7f0000000180)={0x0, 0x10d000}) syz_emit_ethernet(0x3e, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaa0f"], 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) ioctl$SIOCSIFHWADDR(r1, 0x8943, &(0x7f0000002280)={'syzkaller0\x00', @random}) close(0x3) 27.708047291s ago: executing program 2 (id=2819): r0 = socket$packet(0x11, 0x3, 0x300) syz_emit_ethernet(0xa2, &(0x7f0000000340)=ANY=[@ANYBLOB="aaaaaaaaaaaa00000000000086dd603000bb006c2b00fc020000000000000000000000000000fe800000030000000000000000000064907802000000000000000000000082f63de64f6ce2ee11028289aefdb3449391a823213e6336516748a7949bb108402fa83b1d461c18462075368a186092391b"], 0x0) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f00000000c0)={0x3, 0x1000}, 0x4) socket(0x2a, 0x80000, 0xa) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) syz_open_dev$tty20(0xc, 0x4, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100009dea7840b418fbff7bdc0102030109021200b7d20000000904010000a01f71"], 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f000001b000)=""/102400, 0x19000) ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000180)={{0x1, 0x1, 0x18}, './file0\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000000)='./file1\x00', &(0x7f0000000080), 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="000000544a55c4a917cde0c7940bbbd04aed778074065490adcaa5be414ec46f838ad4949492930827f2160fb1ca7466733c46651ffc75998875b1d4702ae93d89dda242e88a152b"]) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl(r2, 0x8b2c, &(0x7f0000000040)) ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, 0x0) openat$audio1(0xffffffffffffff9c, 0x0, 0x40, 0x0) mremap(&(0x7f000000d000/0x4000)=nil, 0x4000, 0x3000, 0x7, &(0x7f0000ffb000/0x3000)=nil) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r3, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000140)="b9ff0300600d698cff9e14f086dd", 0x0, 0x5f, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a}, 0x1c) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) 27.069390939s ago: executing program 32 (id=2819): r0 = socket$packet(0x11, 0x3, 0x300) syz_emit_ethernet(0xa2, &(0x7f0000000340)=ANY=[@ANYBLOB="aaaaaaaaaaaa00000000000086dd603000bb006c2b00fc020000000000000000000000000000fe800000030000000000000000000064907802000000000000000000000082f63de64f6ce2ee11028289aefdb3449391a823213e6336516748a7949bb108402fa83b1d461c18462075368a186092391b"], 0x0) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f00000000c0)={0x3, 0x1000}, 0x4) socket(0x2a, 0x80000, 0xa) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) syz_open_dev$tty20(0xc, 0x4, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100009dea7840b418fbff7bdc0102030109021200b7d20000000904010000a01f71"], 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f000001b000)=""/102400, 0x19000) ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000180)={{0x1, 0x1, 0x18}, './file0\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000000)='./file1\x00', &(0x7f0000000080), 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="000000544a55c4a917cde0c7940bbbd04aed778074065490adcaa5be414ec46f838ad4949492930827f2160fb1ca7466733c46651ffc75998875b1d4702ae93d89dda242e88a152b"]) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl(r2, 0x8b2c, &(0x7f0000000040)) ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, 0x0) openat$audio1(0xffffffffffffff9c, 0x0, 0x40, 0x0) mremap(&(0x7f000000d000/0x4000)=nil, 0x4000, 0x3000, 0x7, &(0x7f0000ffb000/0x3000)=nil) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r3, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000140)="b9ff0300600d698cff9e14f086dd", 0x0, 0x5f, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a}, 0x1c) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) 9.641287823s ago: executing program 0 (id=2873): timer_create(0x3, 0x0, &(0x7f0000044000)) r0 = syz_open_dev$audion(0x0, 0x1ff, 0x0) ioctl$LOOP_SET_FD(r0, 0x80044d76, 0xffffffffffffffff) timer_settime(0x0, 0x1, &(0x7f0000040fe0)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) syz_usb_connect(0x3, 0x34, 0x0, 0x0) r1 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r1, 0x7a7, 0x0) ioctl$IOCTL_VMCI_INIT_CONTEXT(r1, 0x7a0, &(0x7f0000000100)={@my=0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000001e80)=ANY=[], 0x48) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000009c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000300)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$IOCTL_VMCI_DATAGRAM_RECEIVE(r1, 0x7ac, &(0x7f00000002c0)={0x0, 0x0, 0x2}) 8.610703893s ago: executing program 4 (id=2876): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x50, 0x0, 0x0) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, &(0x7f0000000140)={0x2, 0x1}, 0x2) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(0xffffffffffffffff, 0x40a85323, &(0x7f0000000380)={{0x3, 0x81}, 'port0\x00', 0x41, 0x20010, 0x2, 0x1ff, 0x8000, 0xfffffffe, 0x8, 0x0, 0x4, 0xf5}) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r2 = landlock_create_ruleset(&(0x7f0000000000)={0x1ae1, 0x2, 0x1}, 0x18, 0x2) landlock_restrict_self(r2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0xaee2, 0x0, 0x3, 0xbfdffff8}, &(0x7f0000000000)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f0000000040)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r3, 0x0, 0x0, 0x0, 0x40}) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x0, &(0x7f0000389000/0x4000)=nil) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=@newlink={0x44, 0x10, 0x503, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x14615}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @erspan={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GRE_OFLAGS={0x6, 0x3, 0x8}, @IFLA_GRE_IFLAGS={0x6, 0x2, 0x5}]}}}]}, 0x44}}, 0x10) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_PRIVFLAGS_SET(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000007c0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="01003fbd7000fedbdf250e00000004000180180001801400020076657468315f746f5f68737200"], 0x30}, 0x1, 0x0, 0x0, 0x20048844}, 0x48040) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r9, 0x8b19, &(0x7f0000000140)={'wlan1\x00', @random="0300000000eb"}) r11 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000340)={0x30, r11, 0x8d61ddcfedb48df, 0x0, 0x0, {}, [@ETHTOOL_A_FEATURES_WANTED={0x4}, @ETHTOOL_A_FEATURES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'dummy0\x00'}]}]}, 0x30}}, 0x0) sendmsg$ETHTOOL_MSG_COALESCE_SET(r10, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x24, r11, 0x400, 0x70bd27, 0x25dfdbfe, {}, [@ETHTOOL_A_COALESCE_PKT_RATE_LOW={0x8, 0xd, 0xe}, @ETHTOOL_A_COALESCE_RX_MAX_FRAMES_HIGH={0x8, 0x14, 0x1824}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004}, 0x80) 7.707294222s ago: executing program 1 (id=2878): socket(0x2c, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x17, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x3ff}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000d40)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a30000000004c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a30000000000800054000000021100011800c000100636f756e74657200400100000c0a01010000000000000000070000000900020073797a31000000000900010073797a3000000000140103801001008008000340000000020301"], 0x1d4}, 0x1, 0x0, 0x0, 0x8000}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r4}, 0x10) mkdirat(0xffffffffffffff9c, 0x0, 0x10) socket(0x2a, 0x2, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/profiling', 0xa0042, 0x0) 6.944480025s ago: executing program 4 (id=2879): socket$nl_route(0x10, 0x3, 0x0) socket(0x80000000000000a, 0x2, 0x0) r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000080)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000000)={@my=0x0}) ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(r0, 0x7a5, &(0x7f0000000040)={{@any, 0xf}, 0x0, 0x1, 0x9}) ioctl$IOCTL_VMCI_CTX_GET_CPT_STATE(r0, 0x7b1, &(0x7f0000000140)={0x0, 0x6, 0x0, 0x8}) r1 = creat(&(0x7f0000000280)='./file0\x00', 0x81) write$binfmt_elf32(r1, &(0x7f0000000780)=ANY=[@ANYBLOB="7f454c4604070003040000000000000002000300030000000903000038000000ce0000000e0000000b0020000100050005000000000000000300000008000000f30000007f0000000402000004002000e10c00000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dbe992e686e65800"/607], 0x258) close(r1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000007880)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4000000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x8, 0xf, &(0x7f0000000200)=ANY=[@ANYRESDEC, @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7020000000000008500000051000000bf0900000000000055"], 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) r5 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x2001) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) ioctl$LOOP_CONFIGURE(r5, 0x4c0a, &(0x7f00000002c0)={r6, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0xb, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "f4bd000000801900", [0x0, 0xffffffff9673e35d]}}) r7 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={0x0, r7}, 0x18) execve(&(0x7f0000000400)='./file0\x00', 0x0, 0x0) openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000500)=ANY=[@ANYBLOB="1201000000000010ac0544b30000000000019b7809022400010000000009040000000300020009210000000122000009058103000000000082e41be17296be064e8959f762c2f0fdc8616110445caaccc038e67a0731e2c5036bc81e6b91968a63fca041cecac7d1bcdb9ed40460b1071a96f5d4a58c4f4ad1320b50c4219ec07269cc89469bfec2ae53df977988c036eb00000000000000000000000000000000dd3b5617fccfc389c3047479fa4ff0dc4367e55de3a48c2776d9c1339c5ba54884f35d5c98ca2db20ff20ed438062bed31bd4dc7827383522d837dbc902d7dd08e7003337cf98a8326d4c93a72a853808b6f4cc0ceb9a31d5551f8a6022b8f35283a3a50f94e450b77e0b9af22b5bf67b8a4cdfc1ec19ae93a09af3c0ea1e8965bfcfe00c2f81e808c9ead25000ccb7eb066206454139531cfb8e1630eb1a7f04bff7268b0067ca43a4cf22618522d9131e3e4ea0c64f120b7ff196e3da43610f6773a5424c6269daa217419a829a6b317d06261d36495d3c80d96a7cf46f5ad3e66ce55628d14a3a05d25a3967fbcce55e6cf"], 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 6.634995194s ago: executing program 1 (id=2880): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x2d}}, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0x106}, 0x1c) r1 = fcntl$dupfd(r0, 0x0, r0) getsockopt$SO_TIMESTAMP(r1, 0x1, 0x40, &(0x7f0000000400), &(0x7f0000000440)=0x4) bind$inet(r1, &(0x7f00000003c0)={0x2, 0x4e22, @empty}, 0x10) 6.163900948s ago: executing program 0 (id=2881): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x102}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000280)='sched_switch\x00', r0}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x6) r3 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) bind$802154_dgram(r3, &(0x7f0000000040)={0x24, @long={0x3, 0x0, {0xaaaaaaaaaaaa0102}}}, 0x14) connect$802154_dgram(r3, &(0x7f0000000240)={0x24, @long={0x3, 0x0, {0xaaaaaaaaaaaa0202}}}, 0x14) 6.121317664s ago: executing program 1 (id=2882): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) mount$9p_fd(0x0, 0x0, &(0x7f0000000180), 0x4080, 0x0) setreuid(0xee01, 0xee01) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='mountinfo\x00') read$FUSE(r2, 0x0, 0x0) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, 0xffffffffffffffff) r3 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x0, &(0x7f0000000100)}) fcntl$setstatus(r3, 0x4, 0x40000) syz_pidfd_open(0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000040)) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x200000000) r4 = dup2(r0, r0) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r4, 0x4004af61, &(0x7f0000000000)=0x5) read$FUSE(r4, &(0x7f0000004d80)={0x2020}, 0x2020) write$vhost_msg_v2(r4, &(0x7f0000000380)={0x2, 0x0, {&(0x7f0000000140)=""/116, 0xfccf, 0x0, 0x1, 0x2}}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x13, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="bd0000000000000079110000000000009500050000000000ddab49b00621ef83eaa9b87d91feb18721"], 0x0, 0x2, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff}, 0x94) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r5, 0xaf01, 0x0) 5.492996444s ago: executing program 1 (id=2883): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$radio(&(0x7f0000000100), 0x2, 0x2) r1 = syz_open_dev$vbi(&(0x7f0000000000), 0x3, 0x2) ioctl$VIDIOC_S_CTRL(r1, 0xc008561c, &(0x7f00000000c0)={0xf0f041}) close_range(r0, 0xffffffffffffffff, 0x1000000) 5.336373764s ago: executing program 1 (id=2884): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="701500003c0007010300000000000000017c0000040042800c00018006000600655800004c150280081511"], 0x1570}, 0x1, 0x0, 0x0, 0x20000000}, 0xc800) 5.23836913s ago: executing program 0 (id=2885): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x7, '\x00', 0x0, 0x0}, 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000080)={r0}, 0x4) sigaltstack(&(0x7f0000000200)={0x0, 0x0, 0xfffffca4}, 0x0) sigaltstack(0x0, &(0x7f00000001c0)={0x0}) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) sched_setaffinity(0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) openat$mixer(0xffffffffffffff9c, &(0x7f00000018c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000480)={0xffffffffffffffff, 0x0, 0x25, 0x2, @val=@uprobe_multi={0x0, 0x0, 0x0, 0x7fff, 0x0, 0x1}}, 0x40) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0xaf01, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000002000000b704000000000000850000005700000095"], 0x0}, 0x94) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="17000000000000000400000003"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r3], 0x0}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000180)='sys_enter\x00', r4}, 0x10) fchmodat(0xffffffffffffff9c, &(0x7f0000000300)='.\x00', 0xffffffd3) r5 = eventfd(0xfffffff9) ioctl$VHOST_SET_LOG_FD(r2, 0x4004af07, &(0x7f0000000240)=r5) ioctl$VHOST_SET_VRING_KICK(r2, 0x4008af20, &(0x7f0000000040)={0x1, r5}) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/56, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/231, &(0x7f00000000c0)=""/87, &(0x7f0000000480)=""/70, 0x100000}) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x0, 0x0, &(0x7f0000000000)='GPL\x00'}, 0x94) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f0000000680)) ioctl$VHOST_SET_VRING_ERR(r2, 0x4008af22, &(0x7f00000002c0)={0x1, r5}) ioctl$VHOST_VSOCK_SET_RUNNING(r2, 0x4004af61, &(0x7f0000000000)=0x1) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x3, 0x11, &(0x7f0000000700)=ANY=[@ANYBLOB="180200000000000000000000030000008500000017000000b7080000000000007b8af8ff00000000b7080000ffffffff7b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000000000950000000000000000000000bb554300003c8f165e10bb02"], &(0x7f0000000080)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r6, 0x0, 0xe, 0x0, &(0x7f0000000100)="b34715ecd04550d3abc89b6f7bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 5.148215852s ago: executing program 3 (id=2886): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000700)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000000000c02000000000000000000000e0000000000005f"], 0x0, 0x34}, 0x20) socket$key(0xf, 0x3, 0x2) openat$sysfs(0xffffffffffffff9c, 0x0, 0x88102, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0100000004970000000000000000000001000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000300), &(0x7f0000000200), 0x2, r0}, 0x38) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x44810}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r2, 0x0, 0x4000080) syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), 0xffffffffffffffff) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, 0x0, 0x0, 0x0) keyctl$KEYCTL_WATCH_KEY(0x20, 0x0, 0xffffffffffffffff, 0x73) write$FUSE_BMAP(0xffffffffffffffff, &(0x7f0000000100)={0x18, 0x0, 0x0, {0x3}}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000004c00)=""/102392, 0x18ff8) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r5 = syz_io_uring_setup(0xa0, &(0x7f0000000100)={0x0, 0x200089bb, 0x80, 0x5, 0x1c3}, &(0x7f0000000240)=0x0, &(0x7f0000000440)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r6, r7, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x40, 0x2007, @fd=r4, 0xc000000, &(0x7f0000000000)=[{&(0x7f0000001600)=""/4096, 0x1000}], 0x1, 0x1e}) io_uring_enter(r5, 0x32dc, 0x0, 0xe, 0x0, 0x0) 5.12554493s ago: executing program 1 (id=2887): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000080), 0x3, 0x2) r2 = syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="120100009dea7840b418fbff7bdc01020301090212000100000000090401"], 0x0) syz_usb_control_io$cdc_ecm(r2, 0x0, &(0x7f00000008c0)={0x1c, &(0x7f0000000100)=ANY=[@ANYBLOB="00000100000001"], 0x0, 0x0}) r3 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$I2C_RDWR(r3, 0x707, &(0x7f0000000200)={&(0x7f0000000280)=[{0xd2f3, 0xe3b61685ee249bb1, 0x0, 0x0}, {0xfd, 0x3000, 0x0, 0x0}], 0x2}) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r4, 0x84, 0x66, &(0x7f0000000240)={0x0, 0x6}, &(0x7f0000000280)=0x8) ioctl$VIDIOC_SUBDEV_DV_TIMINGS_CAP(r1, 0xc0905664, &(0x7f0000000d00)={0x0, 0x0, '\x00', @raw_data=[0x25, 0x0, 0x7d7, 0x8, 0x80000001, 0x0, 0x2, 0x2, 0x6, 0xa, 0x1, 0x9, 0x9, 0x6, 0x1ff, 0x6, 0x2, 0x7fffffff, 0xa, 0x4, 0x1ad4f416, 0x3, 0x6, 0xc3, 0x7, 0x3, 0xd23f, 0x9, 0xfffffb20, 0x8, 0x1, 0x5]}) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2000, 0x0) madvise(&(0x7f0000e95000/0x4000)=nil, 0x4000, 0x66) prctl$PR_SET_IO_FLUSHER(0x43, 0x1) prctl$PR_SET_IO_FLUSHER(0x43, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000002c0)=ANY=[@ANYRES32, @ANYRES32, @ANYBLOB="050066329cecff4f460e000610df6900", @ANYRES32, @ANYBLOB, @ANYRES64=0x0], 0x10) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x1) ioctl$BTRFS_IOC_QUOTA_RESCAN(r7, 0x4040942c, &(0x7f0000000040)={0x0, 0x100000000, [0xae, 0x3ff000000000000, 0x3, 0x0, 0x1, 0xfffffffffffffff9]}) ioctl$KVM_SET_MSRS(r7, 0x4008ae89, &(0x7f00000000c0)=ANY=[@ANYBLOB="010000000000e5ff054d564b"]) mkdirat(0xffffffffffffff9c, &(0x7f00000021c0)='./file0\x00', 0x3a) ioctl$KVM_REGISTER_COALESCED_MMIO(r6, 0x4010ae67, &(0x7f0000000100)={0xdddd1000, 0x10000, 0x1}) mount$tmpfs(0x0, &(0x7f0000002040)='./file0\x00', &(0x7f0000002200), 0x1000000, &(0x7f0000000000)={[{@noswap}]}) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) r8 = syz_open_procfs(0x0, &(0x7f0000000240)='fd/3\x00') r9 = syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) mount$9p_fd(0x0, &(0x7f0000000100)='.\x00', &(0x7f0000000040), 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="7485616e733d66642c7266646e6f3d313f3acdc9547e4974e3278e275c2fd14552d168609540a6f961089053e6acf9ae7bc81d030cedc19d739ed4c363ee377ddbc5c28241119a347d2edbd54040ca4abb98f2cbfacbf06f83ba81099dfbf158799f79c48513099b4749d37a5bf66394b8a30d36ca9296b999d6c753d8e9c38b8905f8e48d128e8c05df35c9f9b5cfbce75b41455e653fdd8a62e7c5ebe2cb329bff0c977184112eea5c344a7831ac67c9", @ANYRESHEX=r8, @ANYBLOB=',wfdno=', @ANYRESHEX=r9, @ANYBLOB=',\x00']) mount$tmpfs(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2b00ad, &(0x7f0000000200)=ANY=[@ANYBLOB="6e6f73776105ffff41764a9c5f6e7465726c656176653d7374617469632d00"]) socket(0x10, 0x80002, 0x0) ioctl$sock_SIOCGIFVLAN_GET_VLAN_EGRESS_PRIORITY_CMD(r0, 0x8982, &(0x7f0000000180)) 4.930968558s ago: executing program 3 (id=2888): r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0xa800) read$FUSE(0xffffffffffffffff, &(0x7f0000002700)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) sendmsg$nl_route_sched_retired(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x40895}, 0x40801) r2 = openat$cuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r3, 0x0) r4 = fsopen(0x0, 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000280)='gid', &(0x7f0000000580)='0\x00#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xeaEb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D-\x98\x9f\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xb8\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6\xd7\x80Y\xc2\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\xa7\xfa\xdb\x1ce\xc1\x03\x86J\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\x81\x14l7u\x95\x96t\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xe39\xc6b\x905\xf8\xc9@h\x01\xf5\xcb\x88\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?\x839\x85N\x1c\xc1\xcb\xfc\x85\xd2\n\x02\"\xf2\x81g\x90\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9a\x84\'\xa3\xf1\xd9<\xb9k\x00', 0x0) r5 = add_key$keyring(&(0x7f0000000100), &(0x7f0000000140)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$get_persistent(0x16, 0xffffffffffffffff, r5) keyctl$clear(0x7, r5) add_key$keyring(&(0x7f0000000040), &(0x7f0000000100)={'syz', 0x3}, 0x0, 0x0, r5) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(r1, 0x2, &(0x7f0000000340)=0x8) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r8, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROYPROPBLOB(r0, 0xc00464be, &(0x7f0000000000)) ioctl$DRM_IOCTL_MODE_DIRTYFB(r0, 0xc01864b1, &(0x7f0000000240)={0x0, 0x2, 0x8, 0x0, &(0x7f0000000080)}) prctl$PR_SET_MM(0x23, 0x7, &(0x7f0000ffb000/0x4000)=nil) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0)) mmap(&(0x7f0000946000/0x2000)=nil, 0x2000, 0xb635773f06ebbee2, 0x8031, r2, 0x8a72000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) mincore(&(0x7f0000000000/0xc00000)=nil, 0xc00000, &(0x7f0000000140)=""/142) 3.985282286s ago: executing program 3 (id=2889): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000018c0)=ANY=[@ANYBLOB="0a000000d2cf00003d36000002"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180), 0x3, r0}, 0x38) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000000380)={r0, &(0x7f0000001940), &(0x7f00000002c0)=""/187}, 0x20) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000000)={0x0, 0x0}) prlimit64(r1, 0x3, &(0x7f0000000080)={0xab4, 0x611}, &(0x7f00000000c0)) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(r0, 0xd000943d, &(0x7f00000003c0)={0xfff, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0}], 0x77, "501c41b575604a"}) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r0, 0xd000943e, &(0x7f0000001900)={0x0, r2, "a8125c41f28047fc481734ce4798be0958ba5a898b2ed0c62cec555b1b9c4206588d6998f40f29f68444c956762d37ddbdf12b8420727938e2494cd7f22e92506db5f723b7dafb09c633709b4d3d7cef427e3d08e557b5e5cd8fa0ed4536f2cbacd28142b78a50e2c1071b55aa6afa81f4f55e844290e23b4b80eef989553ce7a71ff5a91a8cf693de0c13377420e377138b3260bf780f3e70aac7deec91fcada553a9124d4eeb1c5b8e1fcea3f9fcad38a5f3841d7c22b6435d0fda06a9107bc4553992ca6a5ce1bcfeaf9e43786d7f62ba86d8f33d7c19eb561b170e6b9d61f3098140aaa16eb97c4e0535d14dd298875cd2662f51262fa973ff69b53f466b", "24c374ee3213ce027164083117f0dd37f2c71cbb8cd26c4c8bc9bf109dc93f0ebff110f08c57edb4fdd2f8e7ea064c2c2e3396cba1c2df06e825fe56a230c4df337dc5d8939aae19b8cdb966def9924e5c3fa1da44859c3ffaadf6cde4a3d5dd1f55e64bd276a5511c41eb4c8e1a682e8c195c33ac38891223464790b897ffe9a49448442a8eb62519e5deee81102d7979bb9a07721855458424a5d941a8906c9a7f2d7bc5e6c0a242ce3eb58e33d8939bbf6d56058916e0989a970afc96ac7892aac629399107de43201ec4d337932e758b4438bfca0f08e0a65de5ffb1d2b782a55f4002716411aacf5d31bf53b642ec86de9765eb9cd0fa0fa22c1d2e80a56b37956720966f395b7bb6221eaac6ad3641866622f54232a0cb463e7913b3f42addb6417ceb14b67ec81615b30854373a019b1ea8c153f4bfac9fa08be5f49a1e8732ef4d482323fef43930d69e8ab6bd839a068d08fbf97c6eecdd0ff056d441dc879d225cb96a86926bff259efe5f694e25ac77bfcb006db883f1a51c8400229c4352b7f001df88507e244da9c3840a160e802774db8e1847782f5b3607513053b6a3cda689f192c1a1951cbfe59851f13413495487aee878c10a6260b41a4a250f4f170ca56c8a039519fff1f431bb228c0175b9800068985d066bf22d3d480281d817ccde467c0089d4f98ae33376fbb49eb1ad3843fe3bcc0bd612fcc9903b72faf3f30b6b74f40c4f65c22105c3e8594caa7da5493f048b31e774e45978a09d682321a5e1751839c5a0339a8ce7685ad02dd3062cc5e9667709bc8a95e2dc6f559bf7c788c60d7f3828e8b85aca6fad6299c1488dd93e3aa586aff9ae793172cc1a5c0b6c5d859f04ceec28489b5e97136f8fa8453345a309c965adbd507a3fb2046574c9d366a06ef7f148b234b868e41597f6ea0486a720551188f601d0efa11bd68d935bd2ae5629ed856390d12efb296ae5839e888e8539f19d05ee373d0789eea6a3f0d4c55024cb8e4134a659bc88a01fc8b3d2934db1ffdb99c50467b7902bdf99e64687df16986ba7f9e309f4f16d11626b22d9ca7c89f67eb2a3777a8471507b113cf15a3eaea59889fd9177830ad3a4050cff08e6123bb3af891293ddb15ce86a5ec85e697ba25ae5bdd85d3332298587d3fe397672ea1d3147a95d4192e5b1fb221b25cbc0fe761cc073d44138c8c19869399d66a98d24925fd7cef809faa3088f60584f4c5d2ff0ff9895c25d8eac38a4c3181781e1532651a014ff8445270d4a5b56111e9de8bfeb98e774585a337672072c53ec8c673966a8b52d39bbf5de3eb77dbfdfc7467a9cd67caa16cf0a0148afbd477fc1c740186f5157e3d46c160a88b4243750075414e4b4c655ef145c73c56a6ca8ccb0dd77f911ac8a7fa71931f6e0f77483e6b0d3848f2b6cbaf7e05f76e2161eea9cfaaf86d79a7a5ea4240cb8f68a62224770e7b6c0ce0b1f38f3d34654baf3c9efbd994da88429775ea79b25fefadb43f7d63b8a874d5db2c481c864345097b8eb5c6695f0291179a68611a8f7c35aa66018e6e55a0a7ad5e3edc72ef237c7898fb18fba67c84da33cb6a5b99e6087ae510cebab814b9e5239a794c147cc34a6d6d08e68bbb7673e04c57269644cb20dc9bb8021cde706b00a1173c264129bb480c42f4134df3be12140f5aa2f140c4756d7e7c9427675c7943318e33d2db98e4177ec68f1d8b6822d8fa14c7daa70c85d25d72cdee0ff2808b1b913521ad2f5a18193c6e81a3b1ec37afde2bd5bb55b0069465c0fa9a374842ec0524cf17f6b85b69f75a065b9ff16ca8eb6a0d09b827a6d29abb0417ffefd2db392f2e72768107fadee3faf75af100db8236a1f4835fe961755d548a3f12a303ae8d6fdd67408fb3df21bb22df6980b08a77bcdbc3eb2ce655a865d3b74e4c960dc2481bad95803906069cb5af5e720de216ca1dc5f138c42063e719bf1a948b5ad9fb19b3b5dda1e7f8933a786bd9770f22bc26f8e8b93a9ec9beee1edc6d8c3abe0d736cf3f1064dd635fccb7ab2d2c988d241111d0403704826ca7fd7a8a7a9310d9a230d9b6aeb5c14b7119d0249371338a8be97f4010822a4e6763bbd152b964ff8bc4eeafc5eb2b62252735530d102571b8bab58d1a7b3a40756e9435812935aae81c956612fb8948649853c3e53e112bb9c6e5218d1b20b634c3015e794cfe209262c293dc7a029316ec1508b667b72a382fbc246362b5949e890b83d3228f13ebf913769028025fc84b0b5c261bdf4a81bc24dc7fcc1e876c25d7f781ebbe99b7583961553df501bcdf99f182566687a3024a40ba502f75eb93e8ba6632dc5f6bcc1dacd9eb8a68e8fa99446db3a87af492119965a5cde7e56c0886fca443c27b5aeaf2289915ad678874d780bb6e3b7d97e825f5bfe8de35b0a4725b1fd055aea0c35ffb9ecccf10e3b31f4319f39887f33cc46230015f9eaac064e6db3e683061b90da8cc39928d6c282d3bb706170c557f6fd193d332133038a9157122c025387ee4ce4e5a762196af8ae0b13e42f13ef37d305472ff0ff9cc6ba7236bcbb9fa3ed28a7ef4d6396252a2abf7f66ee8f08899bfbb5a02bb1f9ece1b0882891fd9b050eb4b7df1b361040966907e446eeb6359d29fd1a5d44d79cbae720c5fb60673c3522032d78783ef66ae22bc591b32c6620d057e7500ba0c4c84743e8ef0b481f82ff9ffa524fba0a1ded152259569633501af332e59122ad42d43b17eeffd8e4f8c8058fbde7e77112e787100002d28504daff750214c51d5b3a53c2815d69b78865f8a42d31dd08394c8c0acb4c12c06663a1068c1ba2b68cce3ca8fd4e5ce5b44ec63a9e65b423156119dadf6bcf462f944ba1a805344ecd81c8e3ce74b65e44c34f3a0e9be5d6442a29534d2f679b6e851bb02739b212a1df08ae172caf5a232f19fe318df1d60dddbadf7b4393b4e55b4cd5b39f533a45c10f68232d69f4d85eb1e8029f172abde407a3a44d467cacc268cf25f479786339c3b6661045275545ce7363e27105f09c09ec6259c2800df72d6679a89e169b2ac424fbcdec5a3dc0f98956115c2c2b43b9e77bdacd9e45be48e9e2e307f73c36de53e1ea8dff35d030ffc79656e50ef0d8e323b13da0e1caa08c520b676f9fdec112858398f7d8d43b0b430ba3ed42c1a2ce02a5f1655c9b5d576d6bcd736b670272b79d26d06f1f1a2f8625aff991c745dbf22e57e330112d34815efe13fd59ad41908e0af1dfc0ff122a2f52bc4a747580bd3cf715ba3341328508e31b98313f744d495567555b521cbe527ba6444108912d5af8f57d234513d8ed943043b1c43de586e46e41b8e475ac862226f5c622702d7b24570e1591d31b0619b871c0101a072c2b93519279cae890fd2773772de2ca5558183c9c75bf72f0a93b883758b58c1636fb27fd34910c9ec2c8d60a91a2a3f4477855f371253b4ffe4decb36c4be516dfdc530d8d641ff3339e50442b2542a8101b2922fa9e34af3301dc3fc6c4538aed72c2e4e818f480f1c241bb9452d5a1f9b9c830cb8b06e3c07c2486ba81c94ac58454ec85af971765db6080895bc95dc076fb6251ffc0b8c2f2cdccdf34cbdb0350ab35a0db2c78d0010b7479ad4463031fdcdf360136ff4cbdf69e4706de16f48f7ba2e77e6452011c68144bfac05019cbdaf651de286109087470ea05df7a30ad34335de3899d10a9a16d9ca399b4dd04028d5a9c8ae0c4ffb8bea9f0e4e3d9792a5d4f907f00ec6dd2ab235d396ec79a286d4291049aa3aef68c25350f69af7b47569ab73d74d6a7193306c4091fcb2c4664c2f8305fc91889e562c4d01de91fd707db73c4427abc31e45710893b838c9ebbdcb368997b96d813fa814587df7560e7965e70b5b533add62c292e160afb69f05b51c192a78cfd05e08010b20c278ac1ba119c630ffbbfde7e266c96e91b32add66892af1ea2124ed46b46575cf6572c522996179dd1e3a6bff2e6097be51b4bc202d683d86fdfcc970f30dd6aebe407da890cdadc8f7f996c49bcdf8c411ac90a44da31d57c836a970397f73088dae525e803d85a9acfca5cec24375d70ce6177ef3277b10e034eaf2d21a4b6bcd4f1af84cbdd9d1f742e3f673debf983bc7b8fd4a9522c74af122f60a69ed61cf57a7a00e38040f7e00f1d429ff85f2c9e8c6a7394d1b51a68dd60fc5aed8e0cd53aea7f7e5286cedebc6590300474f72578eaf679ee0aec7c520e5e4cb4cee51f0886b55455b0ef1df5f6b4d69d900c11d697194f29e13d6af68ba83f650122f89e8157e0945b8d978eb88474583a522afbf6f5619aa0fcaf1c2a534d4c733c28c001e66bd64d6ee63d7417136662761951ca86c8d9296a11aa6b038dd37c4eca0364c683d8461a2b641f6ca12a97331cbf82e16cdd5701163a2b35947253d13d9078916c401d460d0cc66051587e2beb3ce4f690d6cb2867af0f28b72787f8b66f4c94581288bc727cfbe39024b4838c1b02d674189b83bdbb351d7e226b653693f9f436aa7e8488eb0cefc0b05aa1135758a261fc88c568da04fcbcd095936fec6ff410a57b5677f5710aa127f1809a3fd7655033523f7d88bd5a84097daf4475196a07664bdd97afaf37cd045ef75261999b5ff804a76b433af61e8608d752ac8dd48e15d10a6071ca84b80a814797bb86c1b7b9bce5630a5388a26d78116a067fbb47dc46e2d0f62ca39ed0c901f7f5736a8fd76d1582e0ceb9aee2dbc36dbfa03b4c7e0cc7403dd3992998ced63f156536593b6543100bf4302ebd522204c6d12f547cc906df845087dc8d8d867f04091b407ae23f84e1781cb7ae5ec5583d568b1e3eb8aecf27a1e532331ca3447862232820725889198c2cc10b10a88b66941fb150a80b2d1a04e1ecfa63863e30e8d4261c26f1ff1feea4d6f1492596393f5c8abc97589fc5b639241a4163f4d7cba27bd1b38ea5171292af57e4c68239b49342ed52c66dbcefeb368d9d3a2ad449b2cc23dafaefb70055c693114461cc628d1b90efe4b68895cafe7da29763cd2022a6333039d7d16e156236076682823af5243e789ba1d8aa938d2764ad8a54fcf9a942c8c334df5469686db5e81a8eaac7c030c68b0b79a5a5473eeeed99f4c8ff652dab77cdcbd612fe2acbb774c07d45caa4c90cd1c8907898690f7d2dfbcc32ca05697822f9e7add44fb9b64670fa74e18dd9d87cf9089b731a24781712c41f5437a8ca593a3b3fb8ae71d6a6b93ef5fb6e3aadcca8763d57683e2d581e5800ed0851be35585f995430db9116b6c245144352340eb580400d452d24528b3fc02345d50ef79efe7d60ac12f7c3317c13b4f48e360b910aa2c763eb70d1851038bbde71008192ca6e1da1e2c3ce14c8706d4aa863d5fc96d11621442"}) 3.830868836s ago: executing program 3 (id=2890): r0 = socket$alg(0x26, 0x5, 0x0) ioctl$AUTOFS_IOC_FAIL(r0, 0x9361, 0x3ff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeec, 0x8031, 0xffffffffffffffff, 0xffffc000) sync() socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000480)=@abs={0x0, 0x0, 0x8004e24}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket(0x28, 0x805, 0x4) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x400}) r6 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70ad2d, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0x4}, {0xffff, 0xffff}, {0x0, 0x5}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x1}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000}, 0x800) r8 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000700)=@newtfilter={0x5c, 0x2c, 0xd27, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0xb, 0xfff2}, {}, {0x7}}, [@filter_kind_options=@f_basic={{0xa}, {0x4}}, @TCA_RATE={0x6, 0x5, {0x78, 0xfa}}, @filter_kind_options=@f_flow={{0x9}, {0xc, 0x2, [@TCA_FLOW_MASK={0x8, 0x6, 0x200}]}}, @TCA_CHAIN={0x8, 0xb, 0x2}]}, 0x5c}, 0x1, 0x0, 0x0, 0x10}, 0x800) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ed5696c5820fae0000000000000080beef911d564c90c200", 0x18) accept4(r0, 0x0, 0x0, 0x800) dup(0xffffffffffffffff) r9 = socket$alg(0x26, 0x5, 0x0) bind$alg(r9, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r9, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3be7d", 0x7) r10 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x800) sendmmsg$alg(r10, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000280)="5841e4dcf78d9c838fff48f3be1d1aeecd1d65dee3bb91187e23cd0730d39070e569fed94f22f36499361191f177397d6ffc76eb97ac73c5ec9045a8677dee5ab6dcab3f013cc1b12b35d1009a70", 0x4e}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xce}], 0x3, &(0x7f0000000600)=ANY=[@ANYBLOB="180000000000000017010000030000000000000000000000b0000000000000001701000002000000950000002079339db0e8f7c1582520f8858f9dac3e8da3fed2da40f6497a9d9d49a34cdccdb691de2743746cc69bbd3016b13e7a29da6d17656eb2d38c946976385eaafe17c83a7c585606b1cb84a44913c10eb73f82748b2467908f1188d405dbcd8a9251ff831b0cc1f0bdb66107de8711ee76bcae06efdcc4ed40d25a1f127642d84c1918a74f75e809b86436735a98521ca6af4828d31e0000000000000018000000000000001701000004000000e1f50000000000001800000000000000170100000300"/248], 0xf8, 0x8840}], 0x1, 0x0) recvmsg(r10, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}, {0x0}], 0x2}, 0x0) syz_emit_vhci(&(0x7f0000009c40)=ANY=[@ANYBLOB="0414"], 0x17) 3.829096501s ago: executing program 4 (id=2891): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x2d}}, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0x106}, 0x1c) r1 = fcntl$dupfd(r0, 0x0, r0) bind$inet(r1, &(0x7f00000003c0)={0x2, 0x4e22, @empty}, 0x10) 3.522766549s ago: executing program 4 (id=2892): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) mount$9p_fd(0x0, 0x0, &(0x7f0000000180), 0x4080, 0x0) setreuid(0xee01, 0xee01) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='mountinfo\x00') read$FUSE(r2, 0x0, 0x0) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, 0xffffffffffffffff) r3 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x0, &(0x7f0000000100)}) fcntl$setstatus(r3, 0x4, 0x40000) syz_pidfd_open(0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000040)) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x200000000) r4 = dup2(r0, r0) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r4, 0x4004af61, &(0x7f0000000000)=0x5) read$FUSE(r4, &(0x7f0000004d80)={0x2020}, 0x2020) write$vhost_msg_v2(r4, &(0x7f0000000380)={0x2, 0x0, {&(0x7f0000000140)=""/116, 0xfccf, 0x0, 0x1, 0x2}}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x13, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="bd0000000000000079110000000000009500050000000000ddab49b00621ef83eaa9b87d91feb18721"], 0x0, 0x2, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff}, 0x94) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r5, 0xaf01, 0x0) 3.430109599s ago: executing program 0 (id=2893): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r0 = socket(0x400000000010, 0x3, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x80) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f000000c3c0)=@delchain={0x24, 0x66, 0x221, 0x70bd25, 0x25dfdbff, {0x0, 0x0, 0x0, r4, {0xd, 0xfff2}, {0x0, 0xfff1}, {0xb, 0xfff3}}}, 0x24}, 0x1, 0x0, 0x0, 0x8848}, 0x20004800) (fail_nth: 5) 3.011870168s ago: executing program 3 (id=2894): r0 = syz_open_procfs(0x0, &(0x7f0000000200)='task\x00') readv(0xffffffffffffffff, &(0x7f0000000100)=[{0x0}], 0x1) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) sendto$inet(r1, &(0x7f0000000000), 0xfffffffffffffd74, 0x40004, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000300)='bbr', 0x3) recvfrom$inet(r1, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) socket$nl_netfilter(0x10, 0x3, 0xc) connect$unix(r0, &(0x7f0000000000)=@abs={0x1, 0x0, 0x4e20}, 0x6e) io_uring_setup(0xbbc, 0x0) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x40041, 0x0, 0x0) ioctl$SNDCTL_SEQ_RESETSAMPLES(r0, 0x40045109, &(0x7f0000000140)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) r2 = openat$dsp1(0xffffffffffffff9c, &(0x7f00000000c0), 0x109801, 0x0) r3 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) read$dsp(r3, &(0x7f00000000c0)=""/108, 0x6c) r4 = dup(0xffffffffffffffff) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_GET_NESTED_STATE(r4, 0xc080aebe, &(0x7f0000000480)={{0x5, 0x0, 0x80, {0x3000, 0x6000, 0x3}}, "ddc3df96c0d41d296de62e08999a912994608946d01c607768511a904f6441bb6d3b68a420cb7b9938f7a97d0e8daf82c18da41be3811b9fd3849f5297b4eecbb54ecad3c8ad07ecbed400fefc96af0443fb579e28a57b19fc50274fd1ae277ec1df10ec39c4cf6cbf90b7cdfcf94f1a845c907ce71da5bb68a14ae20ed9c04d0d40af10ef3084bb022bd9f135fc5f713151126552aa641d540a44993a28f8d35738312382fe5e1d0745da32ee3ed4807c63d3e8ae71c3abd42ea2c53b3d63eeaf4f7f2c9253d729197df8c22104906fd3316f96331c8d3c3bb146332514b4b6697386f93fa7631158ecc5cf9dd6e28e3378df81e8dc984280e831516c775d15f5b1ec3e57fa3171f3dec0cfe824950e6f6939441e2b1c4a4d7f0c2326d1a3b45b75b55e537c7e7f182ced389fefa82b2270496c7338339da4c9493d3be3b1f85545988fe8f0e1b19e82350fb6f60666adb374204a10d09655a86c21f80ba686ef7fe1b854251c2254b5df577993f5a0b89f0f81df69b1b5ba40e9e956f6c4c1e422ba94f995ea45fa1388b304b2dc56cc8c8eacb049dbbb88b1c743425147228bb8cc7867be044d72a8cc680a70b8521f7c1a5de512efb133c7132194be1e2a33a0b87ea6889867a005a60a091982ee6437a8b016077a292d131e7beeeb9ffa82d9733a6b5d7213610adcb5622bd4e0057c55d2c004f9b460fb8fe89a9214ed650bded236a1d5f52cb5b51c77423b1d652cdb80747504832f546c2ea8aaf003de4eabd46dc191e32b0dbeb7496bcf51b61eae7dd00a9125b32f96eed22b1e6105f142d81b16bec43da0ca6aad8fa69d6565d1283982d19f4a9547bbbd5848e42a8d4935f567393d7d83b006bb89353be678c5b1d4b49d85736e452fbcba4e62db20442f4c5a02eaad63bef7770678854e893d9d151535beca99662068f27d91a5965f5759b735999089b0c4d9f2568a1de357f51ee2d8019d9af79d1732ee7a3130685422b47faf42ea940f1be4d9a287c31da09b4b430109eae7b5e3ca668f2f144798e19bc27c54070453784d5dd04c953ec5e4d07ac71da5a416de5afe2c18379fd7d11e2201fa3a2e7d266f12905039f38c43fa4da923cf7af15ada31ea6de4586dd44b9f1e0028178d323819c3344de5dff1fafdcc947140e3ccfd2138c53d17ee25331cea1279fe33c4b5b951d9e5732ab5b4593ead6ff236e20aa59c4f52a429236bf3c47e0a652fdf5266b84d63d1686011b287bc8aa7d6d85f3d90b09cd7192e5334b5b160a6e41f64e571d3248db76880f7a6b3f6a1f9da28fececae719258ef7c6d440ffa91c166f582b441ab6aa67294e8b41fcaaa8cf7f78450aff9bac1a3a042db67df171310cd3a61941b147bdd36939ef2bd4eb06dfa5bec54157163686903e14919eeb67c021331bbdc1f8e1bc564b2e1c4a47a4bf6fe889190da684e91ded6fea0eaf8796ad1ea8339484eac0d055c80d5cc23c4599453108b79914db62edafcada840adcc9952216956f744f75cd311fa40579d2339c9da788513c640d5fd77026a20fa0dd26b41a0fd7f31ee87ce5a16199c5d8a21f5db8b7aacc8aaa85f4638c69791d280ac82bd3199f28ee2218ea390dd9cf564407f8383f29f2f5dd947a42f041a7b1f3af5f19a724bf79e7e4484e79103dc5eb6315fda9ce264434477e614e8981c664349c0f53a75f97116a88ba66745f5383b88e4fac12a167cc0ff203663105bb5fbdd0b17060b7c0779cfbadad2c7f6eaec75e71fea2c0bd169dad234bf27e65f44802de6d2b6b445ad87ab206dee551c6c97b151ab01756e7d4dee0243afa4a8dcbe10e2b885ceaba87678825e17511de4e1187b638696f12405d1d77a715e820084ea853e458dc6bd79780bd4e716cf9aa69ae760a37cbcad436721c53d7a38032dc6d6d21b72b2b057c8704fd0eccf65e54f2e1f6151fe2b7141e8808d869f2585044fba51934ce556e54e644aa0895ef2198a7643e46ef4b2f786b46f3938a92ecd8293927be894fd55e0eee63e07630c74d3edb40aa8b60e37b132ec98f9fd0d740b25d2765f2a439b544582e1e16b6d8c633be9b23161bcfb799b9db18a0e68af6afbdc5292456b6c8dbc56f956bfb94e9dfc3946d72d842e0cd1212f142d35415d97f9a67710d3ea7fe74f04d30db61286d64f240855a8197c875371196e080267c44ffa298e47f86b0a4b240548c678d29668d89a03879d9b931b41c2a1f00594489a2a25f3e144923574cd3ad616065dfda7596f1fd7583e87e6fa488b76b628f336183f9e61f7d17dcc2bf2c993f82f1563ea59b16132b0e9baa2c7529f2d8dca1c76ae8f013d65acda11e9afb10ea59d60807e3992ff25fc30e402aab84900df6da0c770eef34f23d799030321a3e158d478696fa75786eaecb8a9591409e405dc4bd902dc17d41ecd1e9ec5788820d3d08ad595530a32e618139e74189f1655badbe3b0054dc91690f1f1f991ec920a2b2a3be9f98a60a83766245ca153c0e9f3d7c51ba27bcf00ad8fd5458d1fde3ffc3cfaeef6f8c30803a5581cdebb4d0ccfc04aa0d14e80c28c9bac9242f2c391eaccbb18ae7e5b8b55f12fd243ed7eee12705259ce6270539a063e48891fffc0447b9400d62603ba2bd411caf40cd914a1fd06e6cb07c61cdcf366e04cc8612a7894857d7c643b71226508b0ea86b0b4d40f92d039e390d84ac897b86b0a8114611daaa460d8b7e70b5c227e9a464cfb1b374de7b19ed41d02f07ea9459fb9b45c2a4e1ad810c88c9e0fac20d9f885fccb9738c12827a757c7bc1e8e9832195557da674a44c49851a56c3413d9c83272772d602c7a916e7d86a162908d93156a4a19c096b79c02385fc9ab20c72480347613cf293fda6946e63ed930c1854184f49c9dc35363bebba9a77ce2c99845b0b64b673e8a4b3e55e9e510c5a931f736cef121f79c5aea2e7406aa0541bdfeafe47d0216853c3aa274bcb0d920e1d9b834e99dd687cb33a182ae337399e6a7e966cb8c67eb460d42cefed1d7dd8ad32838aa42af00378f298de6617ef2a49cb1149222dd65e76e86a527bddf39bd1d298d6e132a6dc586ac2a1d7a97ce0f532b3e97118bf9031e2cb446223874e833e4548a47254fe016bb175b8bf55f6e92efcc8bb8a002b99e84a890d93029090de9e72548aa03e901620a9f0ebdac160c35dc06696887aa7162738f1bf5228f55a302e566f32ba09daf61894c2ad99e72830b019abf9a06bfe9c162dcdcd4a87d54bcef737680c6b5560f8f87fd4ab58b2dc0cd9f69eb27727bca387cf57aea6c264b9bd0ba38cd21566988592954bf97a202a2b1374565718b2076004be1d3b829da1066fba0f5e46218a909622ce1cbdd9ffa05405256dbe12167f3b0837826a42651aa7360be4e00f8271bb0832a8792f8734b23fd810a1bb52a88b471b636777ddfbac14bc172c477c50a01bca8ab2f99efc7d18cee2910b2585603a7cdcfa796c297e7a1fccd39f0c60126455dfce5d15b71022d05fcf3be7e3bc8cdb0990b84520935144e3ac0f9b141b3c6e9bde1f989f5729d94b15c3a925779b83d2a6d5376aada413f917cce95fda63b6f8a70da40dd1881ffcda0afd02291ca9352cead491c72d052834df97d83a6c55aa548fbe5a0ab9e282e8d022e0e102f640ae3083817d43e738927e80e5c56bdad6cd343abc85b5ba74ab7f7dc18e6bc7a29d1cbd34968c3579dc144cb96d76062082e3d994996d61a4cca90f1e9cae77e76b06a2dcd58a4010285889e4acd48d938ecff8d8034ce9f1437f608ecb4e28a5146941a7ae77ee7bf7e225f2fca6270662af48fe6300d7663e77128ae2ae39660d01937c64facc08fabcee5dbeffa4fa72663233a732dbf4f9c38d29deea12876358023fa8149bc3f8ada1ffd2e6d5a71bdada72f6f2c82c4eff8a7807b70d4134b501ca453481440db69b53a15791b6868f4750293ed5f5c45c2e0de728e7f53df0b21762cf8a8bad4fc2bd582005d831f4a65f92f3c7ee73beed2adbcafd3449c6e448fb4849f8a291c00ebba363ba9d6e961a09f8eafe5fca6f4037ed613506fc8aaaee40be946ac3143f6f2752efd24e36692d36f83416f2421a86b7fddc6b50da10fca6d9b605c5a18ef2470729c378e0997a870268cdcbe0583c5a7b4ff7478c037b901ffe57db04f2241748a2c53f94541c04cf062dfe422ab11ae1a9a303b5b8b9725e1d88c907a8adb1cbf63f0da1e7818a688a1a103c2a65f5810e3dd881da6ab217bc047c35483210938cb6eb8db47e80243c7e4a562c46ee4a3d1ef8d58787b309f474cb4f2a93d241c03ad2b17ee313161350333bfc8d1d348b2ff3b8c5cb490ba995d1bc41723c08b55252a7c339332f59c695337e493429969177143ab0d7d773fd0ed309674966dc54e1653c72d5935fbb4cb637a93f76098fd5d944be1cf101ca492a49a3eee50842ab0a5c330e3d999f68c63e5b185c7fdaa7e0fe97335e2d13adcb7c86dc62516c2aabe5cade28c18727a68391e888b65946fa5ddc62bf94e64eb1a5c417304983320312b93604ca7ed59d935eebb9e5bf83732be1527dab1b79b8afa0b83a648c7d974f251a162bc797e7a357249837fde2e97771c19a90e3a3f5e8fef2890fdd35b0852653a35a3b640a01975bb5a8f5f8933c2c6cfb1c1ea43d53d36df5aced67f739875f19486c875532d9cd384fc1ce4f1679b01b10d03f90fafb3218a7f1622760f8a63d046d23fb9a2b84c46b0e55914fd7d4f62707679406651edb45706bea0b2c790325728886dbc0748a9a9155acab70f31aa115569f588f3bf5fd99d62503829412b65ef95711728be322f8f5c26c2bbd99eae861251f5e61f18e73800772f15e21d1eb00d8a7478410ab185073a72d14d7ca5248356127f4a32625f0600356c7601f5e558ee992254c37450edcf15378cb6e8e93140cbbb1db8c33f6eca162da86939e5d943e679e95a6b5678e94f5ffd11bf06925d9eb5f4e5cafdd7b64fe7429685cc3fc3142794280576a392c154552fb3640572e18dffd7be88a4db040fb73291a61ceef6db51699b0a21fb0ace67da111733002e4a4c3785c63b5d0a0e23b35210c69f6f07d40557f723c91130f624180a26b2dabbf107b579c0910d0fc1175725d94dbf4b05cfa3d46f371be356d78f0c2b31aad0235c56d43d490be87076ad451532c76c3c625f0529cf14c8d3da8871a3ac94e7a403675a0b8fb9f5b175f801ce06e5388f7820687bab849c8d11fe0be0a3ff0ad60648c7d8ce57cc1739316097fdfa09dfe32fbff351f2048c82b69899e32d7782e8fe2506a10ff90116ad654d170251730b63413f483d4c0079a406ada1b1bc9f001d0614c58721dc0584396ecb6c27315a7a2a93b58c6be080fb60d68c04873c2c5b35a7df2621910d0d1d3d3b61ad2c5bdfe5bb62f02bea78ea3d3116fa7a819a21648f245cac2124439f81787277cdcc15a46da27913b721ed916f568e9798d1e8b30f763e4b7699ea68ba3038860680674ead8367dcc193019afb16848ea5d4962357f7ad0d87ed9ff45f48ce7e652f793bc5a4d40da98d7a9654c4e5e8e6ab78717b394978a92abcb82b5664e12e64e8b07f090d096831ec71522468d2fcd68eef092e7314ded44a76699cbb37b48f2ba3928fdd9966388eab6610f1a969a98092102b7b333fe2624c09b10bdbb9b2784a4bc95ce987bfaccfb732fd116a6a4373b86e5e1f692f39b1911219f2c75085243087a6c4ae813a079f814aa65993a9803ad911f27de676545f6fbe6", "d3904bd06a2e889e63e6e08e68f65ff8b3ebfd1809895246ec3712790d3d4ece09a5dce7449cde03ad5ed203e675d88c9ed6aad99bbba4cee2d64738e22bfae489c45c0ca937b39fdffebabce386dc5091c19a1932f0f53492e89e1e1d5e830dec81e52b614d798f4d2f48d831ab5faf5a498cfa2f7b10b9e4135b3dcc9fe4ea2ac3a9c6a4facb134d37b060265f8e3dea9517c08ce10bf57c5cf017f7e9290bafe162511d9fc5de075b8147cee941b5358ec9e784e00137da3de2d8d3e1bb8beaa6124f45f0dc85415e8ae98bfdf110c73ca05cf1e5f8fb16ad6ac7b7c999ad2bf1f4d0aeb31672b2a55802cf00910285de29843be0ddff1d205999b2a9989539cd22ced9e85247f00478ce7314248d593da04b607c985ef2345605a699ac940ca76fd1d9112492b0c6522d43fd3e1f2f56fd4f0505f422999a159576fc1d7b36da2f7097a4cb5bdc4b9690aba5f0ad3e06b7bf26b9078473b2b4d48fa844dbac47f09dd7da7f9807a35746c636019956dec7b0ee7392b38865b66f550d6cb9f534711e36a29ae9cfd97b44b659be6f1a22278e7e0d99719ef13b39c18e650228c3cc958da61225a52ec4390154338c402f5b33299b79c424fce7682e20e0d5728fdc09c11cb7aa9c268b41663d9942a39d3baad9d89ca708f7c5d9fb714c7d17b7cc70f27404bf1139f4f8f68432879ebed9251d9cf8bed94c700c7d17f34b3baedc021b9e69c8b57f2f742f4c41a2b63c85d501d80f77088b1536890e3ba83115d36ee4dc76645a6664281c4d3de3d0928d51c86b04bfabc1e8f159b805916238d06a99ee18959c92aebffb1037b57ee36b4e97760b30a0d3467d2656adc43d8ad722edae576b6a53411ccaeea1f8c6a95ffa2729206bcf191c658315050b3f32c60c4ccd7640115b689de52e990b90a00d0ddada717dbf17115d6fb13d4734772ed0c531ad786f58ad1ec09edff6c3c2dcff8682daa40d444ce19884621f0d255bbd81a32bc6f36cd518148dcf3a1eff8a0b85d1d69cbdf86358e04a28c3064c64dfa4a4ebe9dfb857eb388aaf37132f785952fd6a811c0250ebe22090e2680110f6c4e37aff195a933ef5bfcd28d9049561e31cd6430598570255ead82b49c98bcbc6dd5e51d69275a0347b1f02e5d272c554ddd88c11c52d1bf2b5fb69d5c4623b05dedeb76504c3b7f2eaba8b6f8cbc0c4a77ed35b5f52b606893a57183a0b24537eabdfc3419a1ba914ae30702ded6389e860d4a9fc159e8b57782ada0367b380b4bbcd13221465f62c23435613d81cc1141f010da26f1de9902a9cfe5bf10a5b1a5354dc856a8bd02605f7c4eeb365589ccb5202b242d3cc604798b3eb460b4d9061be148658a1318991eb8fed5d649311356b42baadc2a268047c56f901ec1ae1fbba575393c1ab19fba42e52edae2ed3e1689db1af219799e8cd7fadfc506ff65230fafe03b524015acd011c43439913da89efc00c3c25fd5943fb8b50e577e9bc7736a91dabe40ef2d7bc9847364a3628566489b6c711280f937bab143653a599ce9c505bd24a0243d9928aee980d7fd9cb803d61041cee536f53a4c8fd7aab33fa3b5e56a5aadaa365cad0875b31e4761c588494f2bc9cdf3151cd64dba1415eb68b003e97535f35a52402d8744a4100a68931a13a0186853976d32a71bba2ad68ca389e6ecefd1b828b3510ea81bbdd5d6210fd4ce13b0249c07260e2404e13720746c41f72b67fc40359daf87ddfa71eafa65ca0e291ea55eebc4e12317a75368109348c259bf8bd8657c9df89c1f9d7bbc8696abccefe6eeb914fea0149ab686e28939b2b75995509ad6de4c88d90a3053fcc2d4d6a335baf66c81b5dcbd049c0bd119d74f2f0fb33f43c193295437846bcee9ba0969b234c82e6318098e4c651fa086a4fbc1b70c66330b9662a4dab9ec16f19f443006a59a38a4ae6452fdb612971505019c0e0ffacfad72f381f7443c0ce8c04586d57f2639d33c917c983758fdea83a7e8cfd8e88f9ba297eca1fd2ede1fdb2b305c3016a3698c2383c7706c57d1068bd2f4c3232a3ef292a8608c82ceea4f7f95423bc865974693d9ba0aefc2ca6519f7b7267bdd5eadaa122bd7e1cd54f76fad159c76b1d6bad39acba30c41c42dd15d53069b6c91f36408b82e8e0172e2c5028f709776224f9dd26d66d26543990b2b6c35daf06a876ccabbe1ab0fc5ffb730e4d304fa8ab852a4ba5296de10da6df55c3390ccb6b3c933712f46e8fc3f5797f47e435d0470b3e5f9acbea7e99b5ac3ab9862a31051562018277f11b900428798b1eb2c390bfb85b48999286831b5f100186ace7236ec0cf1f9b6d65974da95dbc7c508272b0dbbf461d616ca29af73029f039a9e779e17e3e0d2c46efc03a01f8a8a2bf4d5fb34d66703ec02bf0068ca84de0024418abf3bcb467c98a0ecc1c82e0fb201e8a6d14c1571ec2998f9b6f2ef443e19b58df49f42533eee93320c0dd4fcc89873c2967bdcdbcb428aeac90056cafdf57bcbdd025ebe20e1dc9624f5c03842874b1e3a945bb875ed61b37d2b43c2a61e3e0c73a88e75a633574a30c8735be8156e69a4ea2f4dec07f167b4711a71b38268b2c38eb5b760ed39f8125347f872efcd5a1d9b81c38eaa55ffe36f59fbe155a18f5060b6335553b58a40b165ad604324eb0ca7fab0b9c37159d7d73388ca78c2e505b608865cfc3fd5eaacf784ec844ef3f0a8fccbd0ada8a3ea491b0a879b507f44405f2fc0d1d39262a7cacd67b2a806ea7c0280596969bdbbac86be96c15779d5edc27ef48b47f0070e64bd83ae889387764e625b829a3cfad1c2febd24f5699d1688215aac6f1ecf351829187aab31252cf7403dc1957c02e5f563986a2f606493a9bafaa66ebb47fa17f9348a18fe934e6fb68f266caf8ae818ea77351af47fc6172aa3c46df6f5b9f3a959ecb117c67d98513f0c4c4f01574350b995c081947cccfda2e3769e7d51e7cb486e55027e679bf67c8ebe974c19eeb4896554d5134b2a8235706f588f5407cf1e30f373fcb6331b77ee5fe0f6758b5617e8b0eea7ee520a76b87ba23eabdc2e1282ca66a0574ce696376a35311e3cc33b9f4d826520eee4c70f053f98688d780ff74e3579f1fe07185b2b963efa096ddeb809c81f11fc133a5aacf1566c98b3f8a1bcdd2e5f87ebe7264139f11f79332fba9b9484812c24bbcf5c2f18c197cb25e932b05efeed9eec835be2216f39b2c78f18c21505ffbcaf3ac5359b8d6f21586d656436cb9695bdbaa6d685ccd8171d7514d83a5f94ec4e30122e78b9f8cbec5fdbec40943804543bbe23e8e5fe31c30e79a6b609d1d73fd33f585cd6540ce92d5756fc7058973f2dce409fd31be5c1c33a3305dd25bbd75924e38c0d52313cd5848e6a6f049f6f9724ed83d216adee5c3c661b8a2cda4fce388fa969d1746b865155d9d73c3e1167202f13591c90b07b358ef5550fadd3cf2f7c897817aeb309fa6b1de6e37d8f1c0ee9aff1646eceb0879f962f24535acee56b48a4a86ab003a4166f1ac2b5d7abb383c989f5632bba86c29336e6e4e726fb2ce5e8a465b87eae8b3c814dfcd26473477933cc1e66766876f0bd2ead6fbf16be8aeb3ca1656f96033e1786582519f780e2224c05e2afe73b52f94a8a2105aaade5ea895cc6a5099b4e88c1ef6ee86d0dff3ab7b5f0e2c97802c8b692b0c45a8e59010e16ac6e409fd2ae490f99d44f413d5239ec76198dbbe9a62b533daee9153ab6cd4f6fdac2ce817593b5e24408afcba4f8c96756c90355829aa764dd8e19a7767c6f9aa07403e4b4db6ce69b1e3ae7ecba8a092b08e6d1a5d4de2287069e80fb2564fe067eb3f6914b8b3c92667c96782ca11407df0db6486919eeff749e3db6c1829fc1238355ca4b9b42baaedce1d4fabf5260f14b04c124386e524df22fa5b808e6f620261ae01c7c1b515c2c4b21acdf05050013ab2b66140cd8a40baf07acdb16b5ace167efc547089a5655b893591b596e37b5153b2bc0b3d10a4eed7bd644a69f8c159bdae431b1633e9ccc5f1eb817613a8d1d7bad7cbfcb1885cf9706dd9f22932877f066a2160ca67bfd92b4d5a6c53155a5d16af8495e0aebcfad73925adc7dc3877f3ce80de4856ee113ceebc583b3fc2d1661e2e5f5728068c470e429424209978e86eee3230076fea5a83f7e14472b0cb58b1b3f25f47a103bf8a3b7618104562a3d140cf0c7a5719ce0e628393a84911b4c23e46075f289e8aa68779896497dbbe8d9b012ecf8715463b0dfdc283f0e81a49a6a7a495746b2486546a4b5cb234000359f8e82614b4b3568831b84167c298ef04b4bcee5a562d05fe8ff701efa8fa9f5311bc253fd14757a8b9d5543118c422015ee069ef960fe091efe84a7cfd7f0026c6655d3d8e2de01fe2d62204b81becc58ac8f248471c4d637c5ed760f6a7880e1331292b99bb66d54079984e5a69dd6622dca30673a3319443dc8706d2b2a901141dfec0e1bb356414218d0bdd2095eeeb8926a596b709490ce1f0284ee06d0cb520372bb207a60c7f3bb45d24e2137b33eb159780cbc55aebfb319da56c424f08e6732cd4a286fbc451d6bab817d7bc2f506025c3fec4fc1ea07bbf924d12f67ed10419781b211bf409beccc17624cb63e2c936fedc3fd5154df0cf3eaed8a3688b53044003d52914e8a8770f71f22bca52d025c70b0346f01cf7aa7c7b5ca82b2c7645dd104e467c70d276663a898f4a5b9ff09bf97153caf21aa0d5c2785dac4cae872f320506a104a8968f30f5e55b959847990eac4f81f547c0068fdda1eb4d9da463050cadb38d998a2757f8458853ec2996577cc2301e90173abeda671b88283c4c0558d877cf2ddab98ecdd621c8fcd68e45f59f5cd57b3aaa203bbc12c545fc9772487f6cb5c3d7d326bc59be4d8d209c2fd19835b1b333639f137445abaaeec2ce2631adf1458eb444f0d83fa7a36e040dc824b3a08a5eae86a8b5f4764e8152a2ab1d374e634d15a07b725da6e78050866dc54024a337a52064570b7b52a39172c4212987fecc27e052db02b02c56c3da4f5b31253e1b1ae0c2b13844b9e9f3c57d86da9856196f4eb9a2bf8a5504d073a7b7dfe118ae24e3c58aae19e2a536d6f76f164ee2f2cb1f791ff231c109bbb5967f520db6dc96928aeedd81ba4d0aef96ee07c35d0a68f594925ec9a7e3d169039c94c56d3274b6bb09f1bd93cd60fe0026a7844fb8db6cb039477577be4c2ca738b0c23c2b49b9b5844b7f068af46e55d8757eea335696f5c675051d9d08e4d5b4ce3426ba7f6b24cf9ad76926ebf2f52211de001d9d30f54650f8b21e8204526a0e24f818415d5614e62e7885293961dc4630ac677f4465844f2b2bd5385bfbb80f2776b23d82bd20a284c2a987f682dcf0f471d829b89b98422112d37f56ddb01c5b2594286a3f5bc175ecf1094ac613ad07dff632f29cf201a86a7de8b8c18c275657f85682453883c393dd1ff19f9bc19eadda2459bf297d7750d17176bc1cad071e11a1a3c2d19b5546011d80deab580a84c65e88ce5541ada771581e36870b0f7dd975b5adbfcec51f75041fbf700d774bd36d0e35f56591ae2fb6e241db18b225157b43ba5c85e60ca6f05133483d6958cb5c3faf0129d3c69f89a0ade7ddbd3ef0c32438d10402b970920592993267ce4e1277a0bd2386f0ff7e58b52530a1e53acc77a800de7924fe13eaecda293bffb1a70f3377dde2f4f6cb1ed8ceb1c16b5697aaf088599517c34770cb586dc2ff59d8e9dc6b6e2fb56ec9698"}) ioctl$TUNATTACHFILTER(r4, 0x401054d5, &(0x7f0000000280)={0x5, &(0x7f0000000240)=[{0x6, 0x2, 0x0, 0x5}, {0x0, 0x0, 0x5, 0x5}, {0xf, 0x9, 0x20, 0x10001}, {0x1, 0xe5, 0x2, 0x4ba}, {0x6, 0x6e, 0x5, 0x5f1}]}) write$dsp(r2, &(0x7f0000002000)='`', 0x88020) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x100000001, 0x0, 0x2, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x35b0, 0x650d, 0x2b, 0x0, 0x0) 2.31791995s ago: executing program 5 (id=2820): ioctl$KDFONTOP_GET(0xffffffffffffffff, 0x560f, &(0x7f0000000100)={0x1, 0x1, 0x19, 0x1f, 0xbb, 0x0}) 2.223357117s ago: executing program 4 (id=2895): r0 = socket(0x2, 0x4, 0x10001) mount(&(0x7f00000013c0)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000001400)='./file0\x00', &(0x7f0000001440)='cramfs\x00', 0x4010000, &(0x7f0000001480)='\x00') getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000480)={{{@in6=@mcast1, @in=@empty}}, {{@in6}, 0x0, @in=@private}}, &(0x7f0000000280)=0xe8) getsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000000040)=@assoc_value, 0x0) openat$selinux_context(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000001200), r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x32c, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) rt_sigaction(0x19, 0x0, 0x0, 0x0, 0x0) mlockall(0x2) r3 = shmget$private(0x0, 0x400000, 0x8, &(0x7f000000e000/0x400000)=nil) shmctl$SHM_LOCK(r3, 0xb) shmat(r3, &(0x7f0000ffd000/0x1000)=nil, 0x7000) shmctl$SHM_UNLOCK(r3, 0xc) r4 = syz_open_procfs(0x0, &(0x7f0000000100)='net/rt6_stats\x00') write$uinput_user_dev(r4, 0x0, 0x0) syz_io_uring_setup(0x4d77, &(0x7f0000000180)={0x0, 0xc847, 0x2000, 0xffffffff, 0x44, 0x0, r4}, &(0x7f00000000c0), &(0x7f0000000200)) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r6 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) setsockopt$sock_timeval(r6, 0x1, 0x15, &(0x7f0000000140)={0x0, 0x7530}, 0x10) connect$llc(r6, &(0x7f0000000000)={0x1a, 0x1, 0xff, 0x0, 0x0, 0x0, @multicast}, 0x10) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, 0x0) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000001180)=ANY=[@ANYBLOB="0b00000007000000010001000900000001"], 0x48) 2.117944327s ago: executing program 5 (id=2896): syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) socket$can_raw(0x1d, 0x3, 0x1) r0 = syz_init_net_socket$nfc_raw(0x27, 0x5, 0x0) connect$nfc_raw(r0, &(0x7f0000000140)={0x27, 0x0, 0xffffffffffffffff, 0x7}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000240)=0x100000001, 0x59) connect$inet6(r2, 0x0, 0x0) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f0000000040), 0x4) r3 = socket(0xa, 0x5, 0x0) setsockopt$inet_int(r3, 0x0, 0x15, &(0x7f00000000c0)=0x80000000, 0x4) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x2, &(0x7f0000000b80)=@gcm_256={{0x304}, "76f7bc3e4ae1c84c", "af193cff4810ba5ac120d096eb00b40752095b4285514ca312c52e3a08756735", '8\x00', "bc3a20b10f4ad11e"}, 0x38) socket$nl_netfilter(0x10, 0x3, 0xc) set_robust_list(0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={0x0}, 0x1, 0x0, 0x0, 0x8000}, 0x0) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x1, &(0x7f0000000000)=@ccm_128={{0x304}, "0e921f12e4bf1d9e", "4dd015876bb06c228e912f3f66a133b8", "fccd0810", "ebcf32c21904073f"}, 0x28) r4 = openat$ttyS3(0xffffffffffffff9c, 0x0, 0xc001, 0x0) ioctl$TIOCGSERIAL(r4, 0x541e, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000001780)=""/4070}) bpf$MAP_CREATE(0x0, 0x0, 0x0) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x0) execve(&(0x7f00000190c0)='./file0\x00', 0x0, 0x0) r5 = socket$igmp6(0xa, 0x3, 0x2) sendmmsg$inet6(r5, &(0x7f00000000c0)=[{{&(0x7f00000001c0)={0xa, 0x0, 0x0, @mcast2}, 0x1c, 0x0}}], 0x1, 0x0) sendmsg(r5, &(0x7f00000005c0)={&(0x7f0000000000)=@in={0x2, 0x4e21, @rand_addr=0x64010101}, 0x80, 0x0}, 0x20000010) 2.085806904s ago: executing program 0 (id=2897): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000700)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000000000c02000000000000000000000e0000000000005f"], 0x0, 0x34}, 0x20) socket$key(0xf, 0x3, 0x2) openat$sysfs(0xffffffffffffff9c, 0x0, 0x88102, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0100000004970000000000000000000001000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000300), &(0x7f0000000200), 0x2, r0}, 0x38) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x44810}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r2, 0x0, 0x4000080) syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), 0xffffffffffffffff) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, 0x0, 0x0, 0x0) keyctl$KEYCTL_WATCH_KEY(0x20, 0x0, 0xffffffffffffffff, 0x73) write$FUSE_BMAP(0xffffffffffffffff, &(0x7f0000000100)={0x18, 0x0, 0x0, {0x3}}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000004c00)=""/102392, 0x18ff8) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r5 = syz_io_uring_setup(0xa0, &(0x7f0000000100)={0x0, 0x200089bb, 0x80, 0x5, 0x1c3}, &(0x7f0000000240)=0x0, &(0x7f0000000440)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r6, r7, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x40, 0x2007, @fd=r4, 0xc000000, &(0x7f0000000000)=[{&(0x7f0000001600)=""/4096, 0x1000}], 0x1, 0x1e}) io_uring_enter(r5, 0x32dc, 0x0, 0xe, 0x0, 0x0) 1.105465129s ago: executing program 0 (id=2899): prlimit64(0x0, 0xe, 0x0, 0x0) getrlimit(0x9, &(0x7f0000000040)) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x4) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = openat$dsp(0xffffff9c, &(0x7f00000002c0), 0x60000, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x24040084) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) syz_open_dev$radio(0x0, 0xffffffffffffffff, 0x2) socket$l2tp6(0xa, 0x2, 0x73) socket$inet_udplite(0x2, 0x2, 0x88) r5 = syz_open_dev$sndpcmc(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(r5, 0xc2604110, &(0x7f0000000040)={0x0, [[0x1, 0x0, 0x0, 0x0, 0x0, 0xffffffff], [0x0, 0x3, 0x0, 0x4, 0x3, 0xffffffff, 0x0, 0x1000], [0xfa, 0x0, 0x0, 0x5, 0x0, 0x0, 0x1, 0x800000]], '\x00', [{0x0, 0x5}, {0x0, 0x5}, {}, {}, {0x4000000}, {}, {0x0, 0x8001}, {}, {}, {}, {0x2}, {0x0, 0x2aac}], '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) r6 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000009b768405e0483020b9901e40201090227000100000000090400fb015cc7aa00090509"], 0x0) syz_open_dev$sndpcmp(&(0x7f0000000000), 0x3, 0x183a00) syz_usb_disconnect(r6) ioctl$SOUND_MIXER_WRITE_RECSRC(r3, 0xc0044dff, &(0x7f0000000100)=0x9) 1.102640532s ago: executing program 5 (id=2900): userfaultfd(0x80001) bpf$MAP_CREATE(0x0, &(0x7f0000000e80)=ANY=[@ANYBLOB], 0x50) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/resume', 0x149a82, 0x290) write$cgroup_int(r0, &(0x7f00000000c0)=0x1c3, 0x12) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x1a, r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = inotify_init1(0x80000) r2 = inotify_add_watch(r1, &(0x7f0000000200)='.\x00', 0x10000a0) r3 = dup(r1) io_uring_enter(r0, 0x3b85, 0x5430, 0x44, &(0x7f00000001c0)={[0x8]}, 0x8) bind$rds(r0, &(0x7f00000003c0)={0x2, 0x4e22, @local}, 0x10) inotify_rm_watch(r3, r2) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r4, 0x4b66, &(0x7f0000000000)={0x0, 0x0}) r5 = dup(0xffffffffffffffff) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f0000000040)=r5, 0x4) sched_setscheduler(0x0, 0x2, 0x0) socket$xdp(0x2c, 0x3, 0x0) r6 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000340), 0x802, 0x0) ioctl$UI_ABS_SETUP(r6, 0x401c5504, &(0x7f0000000800)={0x0, {0x1, 0x0, 0x4, 0x0, 0x3, 0x80000001}}) ioctl$UI_DEV_SETUP(r6, 0x405c5503, &(0x7f00000001c0)={{0x0, 0x0, 0xfffd, 0x8001}, 'syz1\x00'}) r7 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r7}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$lock(r8, 0x6, &(0x7f0000002000)={0x1}) fcntl$lock(r8, 0x26, &(0x7f00000031c0)={0x1, 0x0, 0x0, 0x2000000}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) fcntl$lock(r8, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x40000000, 0x3}) write$uinput_user_dev(r6, &(0x7f0000000900)={'syz1\x00', {0x9, 0x0, 0x7}, 0x37b4, [0xfeff, 0x4, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x5, 0x0, 0xfffffffd, 0x100003, 0x100, 0x0, 0x9, 0x0, 0x10004, 0x133, 0x0, 0x5, 0x10000000, 0x0, 0xbffffffe, 0x0, 0x0, 0x4, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x1, 0x0, 0x1, 0x3, 0xffffffff, 0x0, 0xffff, 0x0, 0x20, 0x2c40000, 0x5, 0x0, 0x0, 0xfffffffd, 0x6da47515, 0x2, 0x0, 0x4, 0x6, 0xfffffffd, 0x7, 0x0, 0x4, 0x0, 0x0, 0x20004, 0x0, 0x0, 0x105, 0x0, 0x2], [0x10, 0xffffffff, 0x5, 0x200000, 0xfffffffd, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9876, 0x17, 0x0, 0x0, 0x0, 0xbb, 0x1, 0xfffffffc, 0x5, 0x800, 0x0, 0xfffffffc, 0x0, 0x100, 0x0, 0x103, 0xec6a, 0x5, 0x40000000, 0xffffffff, 0x80000001, 0x7fffffff, 0x10, 0x7fffffff, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffc, 0x0, 0x18c, 0x0, 0x0, 0x2, 0x5, 0x0, 0x0, 0x0, 0x40000000, 0x0, 0x0, 0x3, 0x4000000, 0x80, 0x0, 0x4, 0x0, 0x7, 0x800000, 0x100007], [0x10000, 0x6, 0x0, 0x0, 0x3, 0x1, 0xa000000, 0x3ff, 0x9, 0xffff7fff, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x4f, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x520, 0xc, 0x0, 0x5, 0x0, 0x1ff, 0x0, 0xfffffffd, 0x0, 0xfbfffffc, 0x2af, 0x0, 0x9, 0x0, 0x10000, 0x3, 0x0, 0x0, 0x0, 0x8, 0x3fe, 0x0, 0x400, 0x0, 0x82ce, 0x80, 0x3, 0x0, 0x0, 0xff, 0x4000005, 0x0, 0x4, 0x2, 0x400000, 0x0, 0x1000007, 0x0, 0x0, 0x0, 0xb, 0x40000000], [0xb2a, 0x81, 0x0, 0x6, 0x0, 0x401, 0x0, 0x211, 0x4, 0x0, 0x100, 0x3, 0x0, 0x0, 0x80, 0x0, 0x3, 0x3, 0xe37, 0x5, 0x7fff, 0x0, 0xd, 0x8, 0x0, 0xfffffffe, 0x0, 0x0, 0x4, 0x1b9, 0x40000000, 0x9, 0x3, 0x0, 0x1, 0x6, 0xbfb6, 0x4, 0x4, 0x3, 0x0, 0x0, 0x1, 0xffffffff, 0x100, 0x0, 0x6, 0x3, 0xfffffffd, 0x53591b27, 0xfffffffb, 0x0, 0xfffffffe, 0x5, 0x400, 0x7, 0x9, 0x0, 0x8000, 0x6, 0x1000000, 0x4, 0x3, 0x3]}, 0x45c) 846.094628ms ago: executing program 3 (id=2901): r0 = socket$inet_sctp(0x2, 0x1, 0x84) listen(r0, 0xda8d) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) r1 = syz_open_dev$vbi(&(0x7f0000000340), 0x3, 0x2) ioctl$VIDIOC_S_INPUT(r1, 0xc0045627, &(0x7f00000000c0)=0x3) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r1, 0xc0845657, &(0x7f0000000480)={0x0, @bt={0x3bc277b6, 0x93, 0x1, 0x4, 0xd59f80, 0x19ef, 0x7, 0x19ef, 0x3, 0x3, 0x27fc, 0x2800, 0x7f, 0xbb6, 0x1, 0x2c, {0x8, 0xfffffeff}, 0x5, 0x9}}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_MCAST_MSFILTER(r2, 0x29, 0x30, &(0x7f0000000780)=ANY=[], 0x90) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000002700)=""/102392, 0x18ff8) r4 = syz_io_uring_setup(0x110, &(0x7f00000003c0)={0x0, 0xfad6, 0x800, 0x1, 0x3}, &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) io_uring_enter(r4, 0x133d, 0x0, 0x8, 0x0, 0x0) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) setsockopt$packet_fanout_data(0xffffffffffffffff, 0x107, 0x16, 0x0, 0x0) close(0xffffffffffffffff) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000140)={'ip6gre0\x00', &(0x7f0000000200)={'syztnl1\x00', 0x0, 0x4, 0x1, 0x1, 0x1, 0x1f, @remote, @private1={0xfc, 0x1, '\x00', 0x1}, 0x40, 0x8, 0x8000, 0xa9}}) io_uring_register$IORING_REGISTER_SYNC_CANCEL(r4, 0x18, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0x1, {0x6, 0x6d4}, 0xf0}, 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x3, 0xc, &(0x7f0000000000)=@framed={{0x18, 0x2, 0x0, 0x0, 0x10}, [@call={0x85, 0x0, 0x0, 0x17}, @printk={@i, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x73}}]}, &(0x7f0000000080)='GPL\x00', 0x3, 0x0, 0x0, 0x41100, 0x2}, 0x94) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x40090) sendmsg$NFT_BATCH(r7, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000a00)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x2c, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x54}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) 46.175543ms ago: executing program 5 (id=2902): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x2d}}, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0x106}, 0x1c) bind$inet(0xffffffffffffffff, &(0x7f00000003c0)={0x2, 0x4e22, @empty}, 0x10) 44.223627ms ago: executing program 5 (id=2903): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x18, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_open_dev$usbfs(&(0x7f0000000080), 0x76, 0x101301) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0xb, &(0x7f00000005c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000730000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000040)='contention_begin\x00', r3}, 0x18) r4 = syz_open_dev$video4linux(&(0x7f0000000040), 0x7fff, 0x48b03) ioctl$VIDIOC_SUBSCRIBE_EVENT(r4, 0x4020565a, &(0x7f0000000000)={0x3, 0x9a090a, 0x1}) ioctl$VIDIOC_UNSUBSCRIBE_EVENT(r4, 0x4020565b, &(0x7f00000001c0)={0x0, 0x7ff, 0x2}) 0s ago: executing program 4 (id=2904): r0 = openat$comedi(0xffffff9c, &(0x7f0000000040)='/dev/comedi1\x00', 0x28444, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f0000000080)={'c6xdigio\x00', [0x401, 0x181, 0x2, 0x3, 0x14000000, 0x0, 0xfffffffc, 0x2, 0xffd, 0x7ffe, 0x3, 0x9, 0x404, 0x1, 0x8000013, 0xa7, 0xffffffa7, 0x8000b, 0x34d, 0x6e, 0x0, 0x4000009, 0x200, 0xe2df, 0x9, 0x20000001, 0x4, 0x505e, 0x7, 0xf58, 0x6]}) ioctl$COMEDI_INSN(r0, 0x8028640c, &(0x7f0000000000)={0x4000000, 0x92, 0x0, 0x1, 0x80000000}) (fail_nth: 5) kernel console output (not intermixed with test programs): hanlist[0]=0x0000008d chan=141 range length=2 [ 900.935118][T16192] fuse: Unknown parameter '000000000000000000000x0000000000000004' [ 901.092581][T16193] random: crng reseeded on system resumption [ 901.322780][T16196] netlink: 68 bytes leftover after parsing attributes in process `syz.3.2308'. [ 901.646704][ T1222] usb 3-1: USB disconnect, device number 74 [ 901.976477][T16207] netlink: 'syz.3.2310': attribute type 21 has an invalid length. [ 901.984977][T16207] netlink: 156 bytes leftover after parsing attributes in process `syz.3.2310'. [ 903.467695][T16224] sp0: Synchronizing with TNC [ 903.598273][T11372] usb 5-1: new high-speed USB device number 65 using dummy_hcd [ 903.633207][T16228] lo speed is unknown, defaulting to 1000 [ 904.450822][T11372] usb 5-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 904.460919][T11372] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 904.789980][T11372] usb 5-1: config 0 descriptor?? [ 904.802118][T16241] netlink: 68 bytes leftover after parsing attributes in process `syz.0.2320'. [ 904.935302][T11372] cp210x 5-1:0.0: cp210x converter detected [ 904.975290][T16246] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2322'. [ 904.986500][T16246] openvswitch: netlink: Flow key attr not present in new flow. [ 905.280554][T16251] PKCS7: Unknown OID: [5] (bad) [ 905.285463][T16251] PKCS7: Only support pkcs7_signedData type [ 905.558264][T11372] cp210x 5-1:0.0: failed to get vendor val 0x000e size 3: -32 [ 905.565970][ T5938] usb 4-1: new high-speed USB device number 61 using dummy_hcd [ 905.715985][ T5938] usb 4-1: Using ep0 maxpacket: 32 [ 905.724638][ T5938] usb 4-1: config 0 has no interfaces? [ 905.737193][ T5938] usb 4-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 905.749089][ T5938] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 905.782232][ T5938] usb 4-1: Product: syz [ 905.787413][ T5938] usb 4-1: Manufacturer: syz [ 905.853534][ T5938] usb 4-1: SerialNumber: syz [ 905.866131][T11372] usb 5-1: cp210x converter now attached to ttyUSB0 [ 905.926612][ T5938] usb 4-1: config 0 descriptor?? [ 907.842930][ T5938] usb 5-1: USB disconnect, device number 65 [ 907.886219][T16276] lo speed is unknown, defaulting to 1000 [ 908.389131][ T5938] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 908.433301][ T5938] cp210x 5-1:0.0: device disconnected [ 908.495082][ T5945] usb 4-1: USB disconnect, device number 61 [ 911.076058][ T5948] usb 2-1: new high-speed USB device number 64 using dummy_hcd [ 911.408216][ T5948] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 911.422749][ T5948] usb 2-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 911.441434][ T5948] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 911.466918][ T5948] usb 2-1: config 0 descriptor?? [ 911.518194][ T5948] pwc: Askey VC010 type 2 USB webcam detected. [ 911.530318][ T30] audit: type=1400 audit(1759590321.387:523): avc: denied { read } for pid=16330 comm="syz.4.2342" path="socket:[49985]" dev="sockfs" ino=49985 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=caif_socket permissive=1 [ 911.713245][T16335] PKCS7: Unknown OID: [5] (bad) [ 911.718314][T16335] PKCS7: Only support pkcs7_signedData type [ 911.949251][ T5948] pwc: recv_control_msg error -32 req 02 val 2b00 [ 911.957322][ T5948] pwc: recv_control_msg error -32 req 02 val 2700 [ 911.981797][T10204] usb 5-1: new high-speed USB device number 66 using dummy_hcd [ 911.990735][ T5948] pwc: recv_control_msg error -32 req 02 val 2c00 [ 911.999095][ T5948] pwc: recv_control_msg error -32 req 04 val 1000 [ 912.017140][ T5948] pwc: recv_control_msg error -32 req 04 val 1300 [ 912.024315][ T5948] pwc: recv_control_msg error -32 req 04 val 1400 [ 912.031667][ T5948] pwc: recv_control_msg error -32 req 02 val 2000 [ 912.038823][ T5948] pwc: recv_control_msg error -32 req 02 val 2100 [ 912.046696][ T5948] pwc: recv_control_msg error -32 req 04 val 1500 [ 912.053690][ T5948] pwc: recv_control_msg error -32 req 02 val 2500 [ 912.062601][ T5948] pwc: recv_control_msg error -71 req 02 val 2400 [ 912.072212][ T5948] pwc: recv_control_msg error -71 req 02 val 2600 [ 912.079299][ T5948] pwc: recv_control_msg error -71 req 02 val 2900 [ 912.129621][ T5948] pwc: recv_control_msg error -71 req 02 val 2800 [ 912.159767][ T5948] pwc: recv_control_msg error -71 req 04 val 1100 [ 912.186124][T10204] usb 5-1: Using ep0 maxpacket: 32 [ 912.199901][ T5948] pwc: recv_control_msg error -71 req 04 val 1200 [ 912.220202][T10204] usb 5-1: config 0 has no interfaces? [ 912.227883][ T5948] pwc: Registered as video103. [ 912.360227][ T5948] input: PWC snapshot button as /devices/platform/dummy_hcd.1/usb2/2-1/input/input35 [ 912.406013][T10204] usb 5-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 912.436079][ T5948] usb 2-1: USB disconnect, device number 64 [ 912.932837][T10204] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 912.955862][T10204] usb 5-1: Product: syz [ 912.960138][T10204] usb 5-1: Manufacturer: syz [ 912.966594][T10204] usb 5-1: SerialNumber: syz [ 912.980856][T10204] usb 5-1: config 0 descriptor?? [ 915.182337][ T1222] usb 5-1: USB disconnect, device number 66 [ 915.251014][T16369] lo speed is unknown, defaulting to 1000 [ 916.105876][T10204] usb 2-1: new high-speed USB device number 65 using dummy_hcd [ 916.120609][ T5948] usb 4-1: new high-speed USB device number 62 using dummy_hcd [ 916.256525][T10204] usb 2-1: device descriptor read/64, error -71 [ 916.283075][ T5948] usb 4-1: device descriptor read/64, error -71 [ 916.555950][T10204] usb 2-1: new high-speed USB device number 66 using dummy_hcd [ 916.619956][ T5948] usb 4-1: new high-speed USB device number 63 using dummy_hcd [ 916.767016][T10204] usb 2-1: device descriptor read/64, error -71 [ 916.773493][ T5948] usb 4-1: device descriptor read/64, error -71 [ 916.889119][T10204] usb usb2-port1: attempt power cycle [ 916.900071][ T5948] usb usb4-port1: attempt power cycle [ 917.326553][ T5948] usb 4-1: new high-speed USB device number 64 using dummy_hcd [ 917.334531][T10204] usb 2-1: new high-speed USB device number 67 using dummy_hcd [ 917.430997][ T5948] usb 4-1: device descriptor read/8, error -71 [ 917.441207][T10204] usb 2-1: device descriptor read/8, error -71 [ 917.777360][T10204] usb 2-1: new high-speed USB device number 68 using dummy_hcd [ 917.785065][ T5948] usb 4-1: new high-speed USB device number 65 using dummy_hcd [ 917.809990][T10204] usb 2-1: device descriptor read/8, error -71 [ 917.817243][ T5948] usb 4-1: device descriptor read/8, error -71 [ 918.387574][ T5948] usb usb4-port1: unable to enumerate USB device [ 918.396710][T10204] usb usb2-port1: unable to enumerate USB device [ 918.959873][T16410] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2364'. [ 918.989934][T16412] snd_dummy snd_dummy.0: control 0:0:0:syz0:0 is already present [ 918.990903][T16410] openvswitch: netlink: Flow actions attr not present in new flow. [ 919.071372][T16415] No control pipe specified [ 919.800923][T16422] PKCS7: Unknown OID: [5] (bad) [ 919.806355][T16422] PKCS7: Only support pkcs7_signedData type [ 920.079557][T16286] Bluetooth: hci4: command 0x0406 tx timeout [ 920.134360][ T5938] usb 3-1: new high-speed USB device number 75 using dummy_hcd [ 921.457788][ T5938] usb 3-1: Using ep0 maxpacket: 32 [ 921.468061][ T5938] usb 3-1: config 0 has no interfaces? [ 921.487923][ T5938] usb 3-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 921.505393][ T5938] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 921.736143][ T5938] usb 3-1: Product: syz [ 922.721259][ T5938] usb 3-1: Manufacturer: syz [ 922.726204][ T5938] usb 3-1: SerialNumber: syz [ 922.735522][ T5938] usb 3-1: config 0 descriptor?? [ 922.856043][ T1222] usb 2-1: new high-speed USB device number 69 using dummy_hcd [ 923.277311][ T1222] usb 2-1: config 127 has an invalid interface number: 124 but max is 0 [ 923.285666][ T1222] usb 2-1: config 127 has no interface number 0 [ 923.314408][ T1222] usb 2-1: config 127 interface 124 altsetting 0 endpoint 0x2 has invalid maxpacket 1024, setting to 64 [ 923.328784][ T1222] usb 2-1: New USB device found, idVendor=0c72, idProduct=0013, bcdDevice=1d.4f [ 923.338552][ T1222] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 924.323531][T16473] lo speed is unknown, defaulting to 1000 [ 924.440521][ T5493] peak_usb 2-1:127.124 can0: bit-timing not yet defined [ 924.501566][T10204] usb 3-1: USB disconnect, device number 75 [ 924.519592][ T5948] usb 4-1: new high-speed USB device number 66 using dummy_hcd [ 924.531063][ T5938] usb 1-1: new high-speed USB device number 64 using dummy_hcd [ 924.589504][ T1222] peak_usb 2-1:127.124 can0: unable to request usb[type=0 value=1] err=-71 [ 924.650970][ T1222] peak_usb 2-1:127.124: unable to read PCAN-Chip USB firmware info (err -71) [ 924.686836][ T5948] usb 4-1: device descriptor read/64, error -71 [ 924.878357][ T5938] usb 1-1: device descriptor read/64, error -71 [ 924.897183][T16485] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2380'. [ 924.906321][T16485] openvswitch: netlink: Flow actions attr not present in new flow. [ 925.885133][ T1222] peak_usb 2-1:127.124: probe with driver peak_usb failed with error -71 [ 925.905226][ T1222] usb 2-1: USB disconnect, device number 69 [ 926.009161][ T5938] usb 1-1: new high-speed USB device number 65 using dummy_hcd [ 926.137181][ T5948] usb 4-1: new high-speed USB device number 67 using dummy_hcd [ 926.317112][ T5948] usb 4-1: device descriptor read/64, error -71 [ 926.495873][ T5938] usb 1-1: device descriptor read/64, error -71 [ 926.511602][ T5948] usb usb4-port1: attempt power cycle [ 926.673567][ T5938] usb usb1-port1: attempt power cycle [ 927.035868][ T5938] usb 1-1: new high-speed USB device number 66 using dummy_hcd [ 927.326665][ T5948] usb 4-1: new high-speed USB device number 68 using dummy_hcd [ 927.437510][T15972] usb 3-1: new high-speed USB device number 76 using dummy_hcd [ 927.611547][ T5938] usb 1-1: device descriptor read/8, error -71 [ 927.626634][T15972] usb 3-1: Using ep0 maxpacket: 16 [ 927.640744][T15972] usb 3-1: config 0 has no interfaces? [ 927.773778][ T5948] usb 4-1: device descriptor read/8, error -71 [ 927.803707][T15972] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 927.816207][T15972] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 927.824702][T15972] usb 3-1: Product: syz [ 927.829925][T15972] usb 3-1: Manufacturer: syz [ 927.834662][T15972] usb 3-1: SerialNumber: syz [ 927.927624][T15972] usb 3-1: config 0 descriptor?? [ 929.201507][T16541] PKCS7: Unknown OID: [5] (bad) [ 929.207059][T16541] PKCS7: Only support pkcs7_signedData type [ 929.548796][T16544] trusted_key: encrypted_key: key user:syz not found [ 929.746970][T16503] tmpfs: Unknown parameter 'grpquoðÉa [ 951.374748][T16822] dump_stack_lvl+0x16c/0x1f0 [ 951.374777][T16822] should_fail_ex+0x512/0x640 [ 951.374800][T16822] ? __kmalloc_cache_noprof+0x5f/0x780 [ 951.374833][T16822] should_failslab+0xc2/0x120 [ 951.374858][T16822] __kmalloc_cache_noprof+0x72/0x780 [ 951.374888][T16822] ? legacy_init_fs_context+0x42/0xe0 [ 951.374915][T16822] ? __pfx_legacy_init_fs_context+0x10/0x10 [ 951.374938][T16822] ? legacy_init_fs_context+0x42/0xe0 [ 951.374962][T16822] legacy_init_fs_context+0x42/0xe0 [ 951.374986][T16822] alloc_fs_context+0x54d/0x9c0 [ 951.375014][T16822] path_mount+0xe1b/0x23a0 [ 951.375042][T16822] ? __pfx_path_mount+0x10/0x10 [ 951.375067][T16822] ? kmem_cache_free+0x2d4/0x6c0 [ 951.375085][T16822] ? putname+0x154/0x1a0 [ 951.375113][T16822] ? putname+0x154/0x1a0 [ 951.375134][T16822] ? putname+0x154/0x1a0 [ 951.375162][T16822] ? __x64_sys_mount+0x293/0x310 [ 951.375182][T16822] __x64_sys_mount+0x293/0x310 [ 951.375205][T16822] ? __pfx___x64_sys_mount+0x10/0x10 [ 951.375233][T16822] do_syscall_64+0xcd/0x4e0 [ 951.375260][T16822] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 951.375280][T16822] RIP: 0033:0x7fe42318eec9 [ 951.375298][T16822] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 951.375316][T16822] RSP: 002b:00007fe4240cf038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 951.375335][T16822] RAX: ffffffffffffffda RBX: 00007fe4233e5fa0 RCX: 00007fe42318eec9 [ 951.375347][T16822] RDX: 0000200000000280 RSI: 00002000000002c0 RDI: 0000000000000000 [ 951.375357][T16822] RBP: 00007fe4240cf090 R08: 0000200000000600 R09: 0000000000000000 [ 951.375368][T16822] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 951.375378][T16822] R13: 00007fe4233e6038 R14: 00007fe4233e5fa0 R15: 00007ffff6e76178 [ 951.375405][T16822] [ 951.775855][ T1222] usb 3-1: new high-speed USB device number 86 using dummy_hcd [ 951.917620][ T1222] usb 3-1: device descriptor read/64, error -71 [ 952.049451][ T1222] usb usb3-port1: attempt power cycle [ 952.791463][T16841] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2461'. [ 952.807877][T16841] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2461'. [ 952.816951][ T1222] usb 3-1: new high-speed USB device number 87 using dummy_hcd [ 952.857742][T11376] usb 5-1: USB disconnect, device number 71 [ 952.882768][ T1222] usb 3-1: device descriptor read/8, error -71 [ 953.083410][T16846] lo speed is unknown, defaulting to 1000 [ 953.187882][ T1222] usb 3-1: new high-speed USB device number 88 using dummy_hcd [ 953.218587][ T1222] usb 3-1: device descriptor read/8, error -71 [ 953.416215][ T1222] usb usb3-port1: unable to enumerate USB device [ 953.515399][T16852] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2463'. [ 954.459862][T16860] netlink: 'syz.4.2464': attribute type 1 has an invalid length. [ 954.510891][T16862] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2464'. [ 954.612717][T16860] 8021q: adding VLAN 0 to HW filter on device bond6 [ 954.773840][ T30] kauditd_printk_skb: 58 callbacks suppressed [ 954.773857][ T30] audit: type=1326 audit(1759590364.627:593): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16858 comm="syz.2.2465" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9f4558eec9 code=0x7ffc0000 [ 954.818255][T16872] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2466'. [ 954.833078][T16872] openvswitch: netlink: Flow actions attr not present in new flow. [ 955.069466][ T30] audit: type=1326 audit(1759590364.707:594): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16858 comm="syz.2.2465" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9f4558eec9 code=0x7ffc0000 [ 955.284421][ T30] audit: type=1326 audit(1759590364.717:595): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16858 comm="syz.2.2465" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7f9f4558eec9 code=0x7ffc0000 [ 955.335088][ T30] audit: type=1326 audit(1759590364.927:596): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16858 comm="syz.2.2465" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9f4558eec9 code=0x7ffc0000 [ 955.367711][ T30] audit: type=1326 audit(1759590364.927:597): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16858 comm="syz.2.2465" exe="/root/syz-executor" sig=0 arch=c000003e syscall=81 compat=0 ip=0x7f9f4558eec9 code=0x7ffc0000 [ 955.397176][ T30] audit: type=1326 audit(1759590364.957:598): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16858 comm="syz.2.2465" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9f4558eec9 code=0x7ffc0000 [ 955.421706][ T30] audit: type=1326 audit(1759590364.957:599): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16858 comm="syz.2.2465" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f9f45590de7 code=0x7ffc0000 [ 955.450713][ T30] audit: type=1326 audit(1759590365.117:600): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16858 comm="syz.2.2465" exe="/root/syz-executor" sig=0 arch=c000003e syscall=44 compat=0 ip=0x7f9f45590d5c code=0x7ffc0000 [ 955.777570][T16862] bond6 (unregistering): Released all slaves [ 955.960950][T16880] snd_dummy snd_dummy.0: control 0:0:0:syz0:0 is already present [ 956.364826][T16888] No control pipe specified [ 956.752752][ T30] audit: type=1326 audit(1759590366.607:601): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16884 comm="syz.2.2470" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9f4558eec9 code=0x7ffc0000 [ 957.108926][ T30] audit: type=1326 audit(1759590366.647:602): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16884 comm="syz.2.2470" exe="/root/syz-executor" sig=0 arch=c000003e syscall=229 compat=0 ip=0x7f9f4558eec9 code=0x7ffc0000 [ 957.278134][T16901] PKCS7: Unknown OID: [5] (bad) [ 957.307468][T16904] lo speed is unknown, defaulting to 1000 [ 957.393307][T16901] PKCS7: Only support pkcs7_signedData type [ 958.018950][T11371] usb 5-1: new high-speed USB device number 72 using dummy_hcd [ 958.771064][T16919] trusted_key: encrypted_key: key user:syz not found [ 958.846475][T11371] usb 5-1: Using ep0 maxpacket: 32 [ 958.895993][ T1222] usb 3-1: new high-speed USB device number 89 using dummy_hcd [ 958.897647][T16929] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2480'. [ 958.913487][T16929] openvswitch: netlink: Flow actions attr not present in new flow. [ 959.257944][T11371] usb 5-1: config 0 has no interfaces? [ 959.320044][T11371] usb 5-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 959.329409][ T1222] usb 3-1: Using ep0 maxpacket: 8 [ 959.334508][T11371] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 959.343604][T11371] usb 5-1: Product: syz [ 959.348305][ T1222] usb 3-1: no configurations [ 959.353172][ T1222] usb 3-1: can't read configurations, error -22 [ 959.360042][T11371] usb 5-1: Manufacturer: syz [ 959.376741][T11371] usb 5-1: SerialNumber: syz [ 959.385599][T11371] usb 5-1: config 0 descriptor?? [ 959.402975][T16935] netdevsim netdevsim3 ªªªªªª: renamed from netdevsim0 [ 959.577489][ T1222] usb 3-1: new high-speed USB device number 90 using dummy_hcd [ 959.925819][ T1222] usb 3-1: Using ep0 maxpacket: 8 [ 959.941687][ T1222] usb 3-1: no configurations [ 959.947203][ T1222] usb 3-1: can't read configurations, error -22 [ 959.986643][ T1222] usb usb3-port1: attempt power cycle [ 960.266068][T10204] usb 1-1: new high-speed USB device number 74 using dummy_hcd [ 960.443460][T10204] usb 1-1: New USB device found, idVendor=2304, idProduct=023e, bcdDevice=d7.69 [ 960.455875][ T1222] usb 3-1: new high-speed USB device number 91 using dummy_hcd [ 960.459562][T10204] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 960.473905][T10204] usb 1-1: Product: syz [ 960.474220][T11371] usb 5-1: USB disconnect, device number 72 [ 960.478348][T10204] usb 1-1: Manufacturer: syz [ 960.478371][T10204] usb 1-1: SerialNumber: syz [ 960.495610][ T1222] usb 3-1: Using ep0 maxpacket: 8 [ 960.501509][ T1222] usb 3-1: no configurations [ 960.533713][T16949] ieee802154 phy0 wpan0: encryption failed: -90 [ 960.572207][T10204] usb 1-1: config 0 descriptor?? [ 960.942774][ T1222] usb 3-1: can't read configurations, error -22 [ 960.997451][T16955] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2487'. [ 961.054531][T10204] hub 1-1:0.0: bad descriptor, ignoring hub [ 961.073435][T16955] openvswitch: netlink: Flow actions attr not present in new flow. [ 961.180728][T10204] hub 1-1:0.0: probe with driver hub failed with error -5 [ 961.491169][T10204] dvb-usb: found a 'Pinnacle PCTV Hybrid Stick Solo' in cold state, will try to load a firmware [ 961.903175][T16958] trusted_key: encrypted_key: key user:syz not found [ 961.918656][ T30] kauditd_printk_skb: 21 callbacks suppressed [ 961.918676][ T30] audit: type=1400 audit(1759590371.767:624): avc: denied { firmware_load } for pid=10204 comm="kworker/1:0" path="/lib/firmware/dvb-usb-dib0700-1.20.fw" dev="sda1" ino=414 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:lib_t tclass=system permissive=1 [ 961.927409][T10204] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 962.045617][T10204] dib0700: firmware download failed at 7 with -22 [ 962.089260][T10204] usb 1-1: USB disconnect, device number 74 [ 962.112407][T16970] trusted_key: encrypted_key: key user:syz not found [ 962.317241][T16976] snd_dummy snd_dummy.0: control 0:0:0:syz0:0 is already present [ 962.504037][T16978] No control pipe specified [ 962.781867][T16981] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 962.932184][T16987] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 963.002942][T16981] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 963.116065][T10204] usb 3-1: new high-speed USB device number 93 using dummy_hcd [ 963.558667][T10204] usb 3-1: Using ep0 maxpacket: 16 [ 963.566318][T10204] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 963.619142][T10204] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 963.708301][T10204] usb 3-1: New USB device found, idVendor=05ac, idProduct=9226, bcdDevice=b2.89 [ 963.729465][T10204] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 963.756234][T10204] usb 3-1: Product: syz [ 963.761470][T10204] usb 3-1: Manufacturer: syz [ 963.768277][T10204] usb 3-1: SerialNumber: syz [ 963.845440][T10204] usb 3-1: config 0 descriptor?? [ 965.276094][T17017] lo speed is unknown, defaulting to 1000 [ 965.646682][ T5948] usb 4-1: new high-speed USB device number 71 using dummy_hcd [ 966.088707][ T5938] usb 3-1: USB disconnect, device number 93 [ 966.161068][ T5948] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 966.214991][ T5948] usb 4-1: config 0 has no interfaces? [ 966.513810][ T5948] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 966.555870][T11371] usb 5-1: new high-speed USB device number 73 using dummy_hcd [ 966.586008][ T5948] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 966.613540][ T5948] usb 4-1: config 0 descriptor?? [ 966.691337][T17042] snd_dummy snd_dummy.0: control 0:0:0:syz0:0 is already present [ 966.765937][T17044] No control pipe specified [ 966.812566][T11371] usb 5-1: Using ep0 maxpacket: 8 [ 966.828409][T11371] usb 5-1: no configurations [ 966.833787][T11371] usb 5-1: can't read configurations, error -22 [ 966.866322][T11384] usb 2-1: new high-speed USB device number 77 using dummy_hcd [ 966.908743][T17045] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2507'. [ 967.016827][T11371] usb 5-1: new high-speed USB device number 74 using dummy_hcd [ 967.036226][T11384] usb 2-1: Using ep0 maxpacket: 32 [ 967.133769][T11384] usb 2-1: config 0 has an invalid interface number: 108 but max is 0 [ 967.234138][T11384] usb 2-1: config 0 has no interface number 0 [ 967.278044][T11384] usb 2-1: New USB device found, idVendor=077d, idProduct=0410, bcdDevice=68.96 [ 967.468178][T11384] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 967.477292][T11384] usb 2-1: Product: syz [ 967.481920][T11384] usb 2-1: Manufacturer: syz [ 967.486748][T11384] usb 2-1: SerialNumber: syz [ 967.674565][T11384] usb 2-1: config 0 descriptor?? [ 967.718893][T11384] powermate 2-1:0.108: probe with driver powermate failed with error -22 [ 967.901208][ T5948] usb 4-1: string descriptor 0 read error: -71 [ 968.085452][ T5948] usb 4-1: USB disconnect, device number 71 [ 972.356614][ T1222] usb 4-1: new high-speed USB device number 72 using dummy_hcd [ 972.390825][ T5948] usb 2-1: USB disconnect, device number 77 [ 972.535696][ T1222] usb 4-1: config 127 has an invalid interface number: 124 but max is 0 [ 972.551514][ T1222] usb 4-1: config 127 has no interface number 0 [ 972.560666][ T1222] usb 4-1: config 127 interface 124 altsetting 0 endpoint 0x2 has invalid maxpacket 1024, setting to 64 [ 972.602472][ T1222] usb 4-1: New USB device found, idVendor=0c72, idProduct=0013, bcdDevice=1d.4f [ 972.612990][ T1222] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 972.836541][T15972] usb 5-1: new high-speed USB device number 75 using dummy_hcd [ 972.892268][T17086] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2515'. [ 973.815863][T15972] usb 5-1: Using ep0 maxpacket: 16 [ 973.828211][T15972] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 973.847970][T15972] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 974.138938][ T5493] peak_usb 4-1:127.124 can0: bit-timing not yet defined [ 974.173860][T15972] usb 5-1: New USB device found, idVendor=05ac, idProduct=9226, bcdDevice=b2.89 [ 974.183243][T15972] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 974.220226][T15972] usb 5-1: Product: syz [ 974.233110][T15972] usb 5-1: Manufacturer: syz [ 974.248560][T15972] usb 5-1: SerialNumber: syz [ 974.273529][T15972] usb 5-1: config 0 descriptor?? [ 974.445859][ T5938] usb 2-1: new full-speed USB device number 78 using dummy_hcd [ 974.614635][ T1222] peak_usb 4-1:127.124 can0: unable to request usb[type=0 value=1] err=-71 [ 974.632912][ T1222] peak_usb 4-1:127.124: unable to read PCAN-Chip USB firmware info (err -71) [ 975.108001][ T5938] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 975.145183][ T5938] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 975.157387][ T1222] peak_usb 4-1:127.124: probe with driver peak_usb failed with error -71 [ 975.216724][ T5938] usb 2-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 975.234652][ T1222] usb 4-1: USB disconnect, device number 72 [ 975.317060][ T5938] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 975.370451][ T5938] usb 2-1: config 0 descriptor?? [ 975.387228][ T5938] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 975.444723][ T5938] dvb-usb: bulk message failed: -22 (3/0) [ 975.562855][ T5938] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 975.779044][T15972] usb 1-1: new high-speed USB device number 75 using dummy_hcd [ 975.859844][ T5938] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 975.888763][ T5938] usb 2-1: media controller created [ 975.900240][T17103] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 975.917755][ T5938] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 975.931829][T17103] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 975.956123][T15972] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 975.956790][ T5938] dvb-usb: bulk message failed: -22 (6/0) [ 976.000207][T15972] usb 1-1: can't read configurations, error -61 [ 976.003927][ T5938] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 976.017932][T17103] dvb-usb: bulk message failed: -22 (2/0) [ 976.034840][ T5938] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.1/usb2/2-1/input/input36 [ 976.089179][ T5938] dvb-usb: schedule remote query interval to 150 msecs. [ 976.126033][ T5938] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 976.153734][ T5938] usb 2-1: USB disconnect, device number 78 [ 976.190387][ T5938] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 976.240201][T15972] usb 1-1: new high-speed USB device number 76 using dummy_hcd [ 976.249933][T11384] usb 5-1: USB disconnect, device number 75 [ 976.428313][T15972] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 976.639882][T15972] usb 1-1: can't read configurations, error -61 [ 976.687345][ T5938] usb 5-1: new high-speed USB device number 76 using dummy_hcd [ 976.766422][T15972] usb usb1-port1: attempt power cycle [ 976.875849][ T5938] usb 5-1: Using ep0 maxpacket: 16 [ 976.893967][ T5938] usb 5-1: config 0 has no interfaces? [ 976.937602][ T5938] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 976.954589][ T5938] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 976.976367][ T5938] usb 5-1: Product: syz [ 976.980991][ T5938] usb 5-1: Manufacturer: syz [ 976.986716][ T5938] usb 5-1: SerialNumber: syz [ 976.993909][ T5938] usb 5-1: config 0 descriptor?? [ 977.024948][T17150] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2524'. [ 977.556544][T15972] usb 1-1: new high-speed USB device number 77 using dummy_hcd [ 977.624944][T17135] tmpfs: Unknown parameter 'grpquoðÉa [ 995.773346][T17409] dump_stack_lvl+0x16c/0x1f0 [ 995.773376][T17409] should_fail_ex+0x512/0x640 [ 995.773400][T17409] _copy_from_user+0x2e/0xd0 [ 995.773425][T17409] kstrtouint_from_user+0xd6/0x1d0 [ 995.773441][T17409] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 995.773457][T17409] ? __lock_acquire+0xb97/0x1ce0 [ 995.773489][T17409] proc_fail_nth_write+0x83/0x220 [ 995.773514][T17409] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 995.773543][T17409] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 995.773564][T17409] vfs_write+0x2a0/0x11d0 [ 995.773588][T17409] ? __pfx___mutex_lock+0x10/0x10 [ 995.773610][T17409] ? __pfx_vfs_write+0x10/0x10 [ 995.773634][T17409] ? __fget_files+0x20e/0x3c0 [ 995.773659][T17409] ksys_write+0x12a/0x250 [ 995.773677][T17409] ? __pfx_ksys_write+0x10/0x10 [ 995.773701][T17409] do_syscall_64+0xcd/0x4e0 [ 995.773725][T17409] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 995.773742][T17409] RIP: 0033:0x7f679778d97f [ 995.773757][T17409] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 995.773773][T17409] RSP: 002b:00007f67986d0030 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 995.773790][T17409] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f679778d97f [ 995.773800][T17409] RDX: 0000000000000001 RSI: 00007f67986d00a0 RDI: 0000000000000004 [ 995.773810][T17409] RBP: 00007f67986d0090 R08: 0000000000000000 R09: 0000000000000000 [ 995.773819][T17409] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000002 [ 995.773829][T17409] R13: 00007f67979e6038 R14: 00007f67979e5fa0 R15: 00007fffb2529728 [ 995.773850][T17409] [ 995.961794][ C1] vkms_vblank_simulate: vblank timer overrun [ 996.718538][T17423] netlink: 'syz.2.2589': attribute type 21 has an invalid length. [ 996.845770][ T30] audit: type=1400 audit(1759590406.697:627): avc: denied { ioctl } for pid=17417 comm="syz.4.2590" path="socket:[53893]" dev="sockfs" ino=53893 ioctlcmd=0x89e0 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 997.455832][T11371] usb 5-1: new full-speed USB device number 77 using dummy_hcd [ 997.684905][T11371] usb 5-1: config 0 has an invalid interface number: 128 but max is 0 [ 997.716752][T17452] snd_dummy snd_dummy.0: control 0:0:0:syz0:0 is already present [ 997.724621][T11371] usb 5-1: config 0 has no interface number 0 [ 997.901599][T17454] No control pipe specified [ 998.034319][T11371] usb 5-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 998.046596][T11371] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 998.055548][T11371] usb 5-1: Product: syz [ 998.082801][T11371] usb 5-1: Manufacturer: syz [ 998.087755][T11371] usb 5-1: SerialNumber: syz [ 998.108456][T11371] usb 5-1: config 0 descriptor?? [ 998.136782][T17400] bond3 (unregistering): Released all slaves [ 998.159328][T17423] netlink: 156 bytes leftover after parsing attributes in process `syz.2.2589'. [ 998.222635][T17459] PKCS7: Unknown OID: [5] (bad) [ 998.230852][T17459] PKCS7: Only support pkcs7_signedData type [ 998.387248][T17462] comedi comedi4: bad chanlist[0]=0x0000008d chan=141 range length=2 [ 998.446959][T17462] fuse: Unknown parameter '000000000000000000000x0000000000000004' [ 998.721235][T17471] random: crng reseeded on system resumption [ 998.832985][T11371] usb 5-1: Firmware version (0.0) predates our first public release. [ 998.862101][T11371] usb 5-1: Please update to version 0.2 or newer [ 998.876475][T11371] usb 5-1: Firmware: build [ 998.956722][ T1222] usb 2-1: new high-speed USB device number 80 using dummy_hcd [ 999.147871][T17476] netlink: 'syz.0.2599': attribute type 1 has an invalid length. [ 999.370279][ T1222] usb 2-1: Using ep0 maxpacket: 32 [ 999.569043][T17476] 8021q: adding VLAN 0 to HW filter on device bond3 [ 999.576676][T17418] tipc: Enabling of bearer rejected, failed to enable media [ 999.604186][T17482] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2599'. [ 999.625980][ T1222] usb 2-1: config 0 has no interfaces? [ 999.644904][ T1222] usb 2-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 999.664891][T11371] usb 5-1: USB disconnect, device number 77 [ 999.744066][ T1222] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 999.977255][ T1222] usb 2-1: Product: syz [ 999.981485][ T1222] usb 2-1: Manufacturer: syz [ 1000.112037][ T1222] usb 2-1: SerialNumber: syz [ 1000.151661][ T1222] usb 2-1: config 0 descriptor?? [ 1001.123643][T17497] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2603'. [ 1001.169527][T11384] usb 3-1: new high-speed USB device number 95 using dummy_hcd [ 1001.182329][T17498] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2603'. [ 1001.326536][T11384] usb 3-1: Using ep0 maxpacket: 8 [ 1001.341181][T11384] usb 3-1: config index 0 descriptor too short (expected 30, got 18) [ 1001.351549][T11384] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1001.403658][T11384] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1001.405560][T17482] bond3 (unregistering): Released all slaves [ 1001.424418][T11384] usb 3-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 1001.434853][T11384] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1001.442988][T11384] usb 3-1: Product: syz [ 1001.452193][T11384] usb 3-1: Manufacturer: syz [ 1001.462965][T11384] usb 3-1: SerialNumber: syz [ 1001.493837][T11384] usb 3-1: config 0 descriptor?? [ 1001.566133][T11376] usb 4-1: new high-speed USB device number 74 using dummy_hcd [ 1001.745050][T11376] usb 4-1: Using ep0 maxpacket: 8 [ 1001.790205][ T5938] usb 2-1: USB disconnect, device number 80 [ 1001.802517][T11376] usb 4-1: config 0 has an invalid descriptor of length 174, skipping remainder of the config [ 1001.839835][T11376] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1001.854154][T11376] usb 4-1: New USB device found, idVendor=10c4, idProduct=8644, bcdDevice=dc.00 [ 1001.872309][T11376] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1001.891007][T11376] usb 4-1: Product: syz [ 1001.907548][T11376] usb 4-1: Manufacturer: syz [ 1001.913614][T11376] usb 4-1: SerialNumber: syz [ 1002.048282][T11384] usb 1-1: new high-speed USB device number 85 using dummy_hcd [ 1002.253509][T11376] usb 4-1: config 0 descriptor?? [ 1002.286386][T11384] usb 1-1: Using ep0 maxpacket: 16 [ 1002.301946][T11384] usb 1-1: config 0 has no interfaces? [ 1002.335392][T11384] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1002.377647][T11384] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1002.421335][T11384] usb 1-1: Product: syz [ 1002.425551][T11384] usb 1-1: Manufacturer: syz [ 1002.713898][T11384] usb 1-1: SerialNumber: syz [ 1002.729853][T11384] usb 1-1: config 0 descriptor?? [ 1003.035085][T17506] tmpfs: Unknown parameter 'grpquoðÉa, priority 0 [ 1060.819761][T18254] tipc: Resetting bearer [ 1061.239990][T18253] tipc: Disabling bearer [ 1062.639969][T18297] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2795'. [ 1062.725795][T15972] usb 4-1: new high-speed USB device number 79 using dummy_hcd [ 1062.930009][T18301] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2793'. [ 1062.944634][T18301] netlink: 85 bytes leftover after parsing attributes in process `syz.4.2793'. [ 1063.015744][T15972] usb 4-1: Using ep0 maxpacket: 16 [ 1063.059839][T15972] usb 4-1: config 0 has no interfaces? [ 1063.076208][T15972] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1063.091031][T15972] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1063.101101][T15972] usb 4-1: Product: syz [ 1063.109797][T15972] usb 4-1: Manufacturer: syz [ 1063.130027][T15972] usb 4-1: SerialNumber: syz [ 1063.158071][T15972] usb 4-1: config 0 descriptor?? [ 1063.486727][T18289] tmpfs: Unknown parameter 'grpquoðÉa [ 1064.360475][T18322] dump_stack_lvl+0x16c/0x1f0 [ 1064.360501][T18322] should_fail_ex+0x512/0x640 [ 1064.360526][T18322] should_fail_alloc_page+0xe7/0x130 [ 1064.360550][T18322] prepare_alloc_pages+0x3c2/0x610 [ 1064.360577][T18322] __alloc_frozen_pages_noprof+0x18b/0x2470 [ 1064.360593][T18322] ? arch_stack_walk+0xa6/0x100 [ 1064.360626][T18322] ? stack_trace_save+0x8e/0xc0 [ 1064.360642][T18322] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1064.360658][T18322] ? stack_depot_save_flags+0x29/0x9c0 [ 1064.360696][T18322] ? __kasan_slab_alloc+0x89/0x90 [ 1064.360714][T18322] ? kmem_cache_alloc_noprof+0x250/0x6e0 [ 1064.360729][T18322] ? __pmd_alloc+0xbf/0x8b0 [ 1064.360749][T18322] ? __handle_mm_fault+0xada/0x2aa0 [ 1064.360771][T18322] ? handle_mm_fault+0x589/0xd10 [ 1064.360793][T18322] ? do_user_addr_fault+0x7a6/0x1370 [ 1064.360813][T18322] ? exc_page_fault+0x5c/0xb0 [ 1064.360831][T18322] ? asm_exc_page_fault+0x26/0x30 [ 1064.360846][T18322] ? rep_movs_alternative+0x30/0x90 [ 1064.360861][T18322] ? _copy_from_user+0x98/0xd0 [ 1064.360881][T18322] ? copy_msghdr_from_user+0x98/0x160 [ 1064.360901][T18322] ? ___sys_recvmsg+0xdb/0x1a0 [ 1064.360918][T18322] ? do_recvmmsg+0x2fe/0x750 [ 1064.360936][T18322] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 1064.360962][T18322] ? policy_nodemask+0xea/0x4e0 [ 1064.360986][T18322] alloc_pages_mpol+0x1fb/0x550 [ 1064.361008][T18322] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 1064.361037][T18322] alloc_pages_noprof+0x131/0x390 [ 1064.361059][T18322] pte_alloc_one+0x1e/0x350 [ 1064.361082][T18322] __pte_alloc+0x6d/0x380 [ 1064.361101][T18322] ? __pfx___pte_alloc+0x10/0x10 [ 1064.361122][T18322] ? do_raw_spin_lock+0x12c/0x2b0 [ 1064.361146][T18322] do_pte_missing+0x282c/0x3ba0 [ 1064.361173][T18322] ? do_raw_spin_unlock+0x172/0x230 [ 1064.361195][T18322] ? _raw_spin_unlock+0x28/0x50 [ 1064.361212][T18322] ? __pmd_alloc+0x64f/0x8b0 [ 1064.361236][T18322] __handle_mm_fault+0x1556/0x2aa0 [ 1064.361263][T18322] ? mt_find+0x3e2/0xa20 [ 1064.361287][T18322] ? __pfx___handle_mm_fault+0x10/0x10 [ 1064.361309][T18322] ? __pfx_mt_find+0x10/0x10 [ 1064.361346][T18322] ? find_vma+0xbf/0x140 [ 1064.361363][T18322] ? __pfx_find_vma+0x10/0x10 [ 1064.361385][T18322] handle_mm_fault+0x589/0xd10 [ 1064.361411][T18322] ? __pkru_allows_pkey+0x31/0xb0 [ 1064.361431][T18322] do_user_addr_fault+0x7a6/0x1370 [ 1064.361455][T18322] ? rcu_is_watching+0x12/0xc0 [ 1064.361482][T18322] exc_page_fault+0x5c/0xb0 [ 1064.361502][T18322] asm_exc_page_fault+0x26/0x30 [ 1064.361518][T18322] RIP: 0010:rep_movs_alternative+0x30/0x90 [ 1064.361533][T18322] Code: 83 f9 08 73 25 85 c9 74 0f 8a 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 e9 0d 24 04 00 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 <48> 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 [ 1064.361549][T18322] RSP: 0018:ffffc9001cbbfa58 EFLAGS: 00050206 [ 1064.361563][T18322] RAX: 0000000000000001 RBX: 00002000000055c0 RCX: 0000000000000038 [ 1064.361574][T18322] RDX: fffff52003977f5c RSI: 00002000000055c0 RDI: ffffc9001cbbfaa8 [ 1064.361585][T18322] RBP: 0000000000000038 R08: 0000000000000001 R09: fffff52003977f5b [ 1064.361596][T18322] R10: ffffc9001cbbfadf R11: 0000000000000000 R12: 0000000000000000 [ 1064.361606][T18322] R13: ffffc9001cbbfaa8 R14: ffffc9001cbbfb90 R15: ffffc9001cbbfaa8 [ 1064.361630][T18322] _copy_from_user+0x98/0xd0 [ 1064.361652][T18322] copy_msghdr_from_user+0x98/0x160 [ 1064.361679][T18322] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 1064.361705][T18322] ? __lock_acquire+0x62e/0x1ce0 [ 1064.361729][T18322] ___sys_recvmsg+0xdb/0x1a0 [ 1064.361749][T18322] ? __pfx____sys_recvmsg+0x10/0x10 [ 1064.361774][T18322] ? find_held_lock+0x2b/0x80 [ 1064.361814][T18322] do_recvmmsg+0x2fe/0x750 [ 1064.361837][T18322] ? __pfx_do_recvmmsg+0x10/0x10 [ 1064.361863][T18322] ? __mutex_unlock_slowpath+0x161/0x7b0 [ 1064.361894][T18322] ? __fget_files+0x20e/0x3c0 [ 1064.361919][T18322] __x64_sys_recvmmsg+0x22a/0x280 [ 1064.361942][T18322] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 1064.361972][T18322] do_syscall_64+0xcd/0x4e0 [ 1064.361995][T18322] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1064.362011][T18322] RIP: 0033:0x7f4dcb58eec9 [ 1064.362024][T18322] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1064.362040][T18322] RSP: 002b:00007f4dcc3b6038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 1064.362054][T18322] RAX: ffffffffffffffda RBX: 00007f4dcb7e5fa0 RCX: 00007f4dcb58eec9 [ 1064.362065][T18322] RDX: 000000000400023c RSI: 00002000000055c0 RDI: 0000000000000004 [ 1064.362075][T18322] RBP: 00007f4dcc3b6090 R08: 0000000000000000 R09: 0000000000000000 [ 1064.362086][T18322] R10: 0000000000000300 R11: 0000000000000246 R12: 0000000000000001 [ 1064.362096][T18322] R13: 00007f4dcb7e6038 R14: 00007f4dcb7e5fa0 R15: 00007ffdebf1b4a8 [ 1064.362119][T18322] [ 1066.906542][ T30] audit: type=1400 audit(1759590476.767:646): avc: denied { map } for pid=18346 comm="syz.1.2807" path="socket:[56761]" dev="sockfs" ino=56761 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 1066.951491][T18347] netlink: 'syz.1.2807': attribute type 10 has an invalid length. [ 1067.019539][ T30] audit: type=1400 audit(1759590476.767:647): avc: denied { read } for pid=18346 comm="syz.1.2807" path="socket:[56761]" dev="sockfs" ino=56761 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 1067.078626][ T30] audit: type=1326 audit(1759590476.887:648): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18348 comm="syz.3.2808" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f679778eec9 code=0x7ffc0000 [ 1067.127274][T18347] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 1067.129483][ T30] audit: type=1326 audit(1759590476.887:649): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18348 comm="syz.3.2808" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f679778eec9 code=0x7ffc0000 [ 1067.166290][ T30] audit: type=1326 audit(1759590476.887:650): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18348 comm="syz.3.2808" exe="/root/syz-executor" sig=0 arch=c000003e syscall=240 compat=0 ip=0x7f679778eec9 code=0x7ffc0000 [ 1067.191614][ T30] audit: type=1326 audit(1759590476.887:651): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18348 comm="syz.3.2808" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f679778eec9 code=0x7ffc0000 [ 1067.235584][ T30] audit: type=1326 audit(1759590476.887:652): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18348 comm="syz.3.2808" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f679778eec9 code=0x7ffc0000 [ 1067.591518][ T30] audit: type=1326 audit(1759590476.907:653): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18348 comm="syz.3.2808" exe="/root/syz-executor" sig=0 arch=c000003e syscall=244 compat=0 ip=0x7f679778eec9 code=0x7ffc0000 [ 1067.646759][T18364] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2808'. [ 1067.865832][ T30] audit: type=1326 audit(1759590476.907:654): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18348 comm="syz.3.2808" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f679778eec9 code=0x7ffc0000 [ 1068.690340][T18380] snd_dummy snd_dummy.0: control 0:0:0:syz0:0 is already present [ 1068.779173][T18381] No control pipe specified [ 1069.009763][T18377] overlay: filesystem on verity=on not supported [ 1069.016578][ T30] kauditd_printk_skb: 7 callbacks suppressed [ 1069.016592][ T30] audit: type=1400 audit(1759590478.857:662): avc: denied { mounton } for pid=18375 comm="syz.2.2812" path="/579/file0/file0" dev="afs" ino=6 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=dir permissive=1 [ 1069.048125][T18385] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1069.190983][T18385] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1069.285138][ T1222] usb 2-1: new high-speed USB device number 84 using dummy_hcd [ 1070.226272][T18403] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2818'. [ 1070.410668][ T5938] SELinux: failure in sel_netif_sid_slow(), invalid network interface (70) [ 1070.509718][ T750] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1070.698933][ T750] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1070.732439][T18411] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=6942 sclass=netlink_route_socket pid=18411 comm=syz.3.2823 [ 1070.771093][T18413] snd_dummy snd_dummy.0: control 0:0:0:syz0:0 is already present [ 1071.087894][T18416] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1071.264008][T18418] No control pipe specified [ 1071.308181][ T750] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1071.589751][T18416] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1072.048060][ T750] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1072.504389][T16286] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1072.524459][T16286] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1072.533858][T16286] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1072.546882][T16286] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1072.557996][T16286] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1072.582863][ T30] audit: type=1400 audit(1759590482.427:663): avc: denied { mounton } for pid=18435 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 1072.910869][T18435] lo speed is unknown, defaulting to 1000 [ 1073.999644][T18449] netlink: 'syz.4.2829': attribute type 2 has an invalid length. [ 1074.070534][T18450] openvswitch: netlink: nsh attr 0 has unexpected len 29692 expected 0 [ 1074.079021][T18449] netlink: 'syz.4.2829': attribute type 8 has an invalid length. [ 1074.079042][T18449] netlink: 132 bytes leftover after parsing attributes in process `syz.4.2829'. [ 1074.142250][T18450] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1074.639475][T16286] Bluetooth: hci0: command tx timeout [ 1074.640250][ T5938] usb 1-1: new high-speed USB device number 89 using dummy_hcd [ 1075.352488][ T5938] usb 1-1: Using ep0 maxpacket: 16 [ 1075.373198][ T5938] usb 1-1: config 0 has no interfaces? [ 1075.408415][ T5938] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1075.438205][ T5938] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1075.448196][ T5938] usb 1-1: Product: syz [ 1075.452450][ T5938] usb 1-1: Manufacturer: syz [ 1075.467789][ T5938] usb 1-1: SerialNumber: syz [ 1075.492823][ T5938] usb 1-1: config 0 descriptor?? [ 1075.529572][ T750] bond0 (unregistering): Released all slaves [ 1075.743309][T18452] tmpfs: Unknown parameter 'grpquoðÉa [ 1077.768556][T18517] dump_stack_lvl+0x16c/0x1f0 [ 1077.768581][T18517] should_fail_ex+0x512/0x640 [ 1077.768600][T18517] ? kmem_cache_alloc_node_noprof+0x65/0x770 [ 1077.768619][T18517] should_failslab+0xc2/0x120 [ 1077.768641][T18517] kmem_cache_alloc_node_noprof+0x78/0x770 [ 1077.768656][T18517] ? __alloc_skb+0x2b2/0x380 [ 1077.768678][T18517] ? __alloc_skb+0x2b2/0x380 [ 1077.768695][T18517] __alloc_skb+0x2b2/0x380 [ 1077.768712][T18517] ? __pfx___alloc_skb+0x10/0x10 [ 1077.768732][T18517] ? __pfx_netlink_autobind.isra.0+0x10/0x10 [ 1077.768758][T18517] netlink_alloc_large_skb+0x69/0x140 [ 1077.768781][T18517] netlink_sendmsg+0x698/0xdd0 [ 1077.768805][T18517] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1077.768834][T18517] ____sys_sendmsg+0xa98/0xc70 [ 1077.768858][T18517] ? copy_msghdr_from_user+0x10a/0x160 [ 1077.768877][T18517] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1077.768911][T18517] ___sys_sendmsg+0x134/0x1d0 [ 1077.768931][T18517] ? __pfx____sys_sendmsg+0x10/0x10 [ 1077.768976][T18517] __sys_sendmsg+0x16d/0x220 [ 1077.768995][T18517] ? __pfx___sys_sendmsg+0x10/0x10 [ 1077.769026][T18517] do_syscall_64+0xcd/0x4e0 [ 1077.769045][T18517] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1077.769061][T18517] RIP: 0033:0x7f995058eec9 [ 1077.769074][T18517] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1077.769088][T18517] RSP: 002b:00007f99514f7038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1077.769103][T18517] RAX: ffffffffffffffda RBX: 00007f99507e5fa0 RCX: 00007f995058eec9 [ 1077.769113][T18517] RDX: 0000000020004090 RSI: 0000200000000900 RDI: 0000000000000003 [ 1077.769121][T18517] RBP: 00007f99514f7090 R08: 0000000000000000 R09: 0000000000000000 [ 1077.769130][T18517] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1077.769139][T18517] R13: 00007f99507e6038 R14: 00007f99507e5fa0 R15: 00007ffea856b138 [ 1077.769159][T18517] [ 1077.798846][T18435] bridge0: port 1(bridge_slave_0) entered disabled state [ 1078.055881][T18520] fanotify: failed to encode fid (type=0, len=0, err=-2) [ 1078.763257][T18435] bridge_slave_0: entered allmulticast mode [ 1078.770680][T18435] bridge_slave_0: entered promiscuous mode [ 1078.779625][T18435] bridge0: port 2(bridge_slave_1) entered blocking state [ 1078.819693][T16286] Bluetooth: hci0: command tx timeout [ 1078.826013][T18435] bridge0: port 2(bridge_slave_1) entered disabled state [ 1078.833340][T18435] bridge_slave_1: entered allmulticast mode [ 1079.334562][T18435] bridge_slave_1: entered promiscuous mode [ 1079.604853][ T5945] usb 1-1: new high-speed USB device number 90 using dummy_hcd [ 1080.122327][ T5945] usb 1-1: config 127 has an invalid interface number: 124 but max is 0 [ 1080.138691][ T750] hsr_slave_0: left promiscuous mode [ 1080.159505][ T5945] usb 1-1: config 127 has no interface number 0 [ 1080.168404][ T750] hsr_slave_1: left promiscuous mode [ 1080.178596][ T5945] usb 1-1: New USB device found, idVendor=0c72, idProduct=0013, bcdDevice=1d.4f [ 1080.194337][ T5945] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1080.214291][ T750] veth1_macvtap: left promiscuous mode [ 1080.222663][ T750] veth0_macvtap: left promiscuous mode [ 1080.228817][ T750] veth1_vlan: left promiscuous mode [ 1080.235331][ T750] veth0_vlan: left promiscuous mode [ 1080.584128][ T30] audit: type=1400 audit(1759590490.317:666): avc: denied { append } for pid=18555 comm="syz.4.2850" name="nvram" dev="devtmpfs" ino=622 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 1080.865766][T16286] Bluetooth: hci0: command tx timeout [ 1081.094422][T18555] ALSA: mixer_oss: invalid OSS volume 'DI' [ 1083.877058][T18435] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1083.907165][T18588] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2859'. [ 1083.916378][T18588] openvswitch: netlink: Flow actions attr not present in new flow. [ 1083.940484][ T5945] peak_usb 1-1:127.124 can0: unable to request usb[type=0 value=1] err=-71 [ 1083.956678][ T5945] peak_usb 1-1:127.124: unable to read PCAN-Chip USB firmware info (err -71) [ 1084.107564][T18591] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1084.180466][T18591] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1084.256244][T18435] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1084.280676][ T1222] usb 2-1: new high-speed USB device number 85 using dummy_hcd [ 1084.376521][ T5945] peak_usb 1-1:127.124: probe with driver peak_usb failed with error -71 [ 1084.420946][ T5945] usb 1-1: USB disconnect, device number 90 [ 1084.568053][ T1222] usb 2-1: device descriptor read/64, error -71 [ 1084.601296][T18435] team0: Port device team_slave_0 added [ 1084.734059][T18435] team0: Port device team_slave_1 added [ 1084.866162][ T5945] usb 1-1: new high-speed USB device number 91 using dummy_hcd [ 1085.000430][T18435] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1085.020592][T18435] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1085.056197][ T5945] usb 1-1: device descriptor read/64, error -71 [ 1085.070441][T18435] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1085.085639][T18435] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1085.092888][T18605] ubi: mtd0 is already attached to ubi31 [ 1085.103290][T18435] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1085.929809][T18435] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1085.985892][ T5938] usb 5-1: new high-speed USB device number 86 using dummy_hcd [ 1085.996537][T18614] FAULT_INJECTION: forcing a failure. [ 1085.996537][T18614] name failslab, interval 1, probability 0, space 0, times 0 [ 1086.010070][T18614] CPU: 0 UID: 0 PID: 18614 Comm: syz.0.2863 Not tainted syzkaller #0 PREEMPT(full) [ 1086.010095][T18614] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1086.010106][T18614] Call Trace: [ 1086.010112][T18614] [ 1086.010118][T18614] dump_stack_lvl+0x16c/0x1f0 [ 1086.010146][T18614] should_fail_ex+0x512/0x640 [ 1086.010168][T18614] ? __kmalloc_noprof+0xca/0x880 [ 1086.010196][T18614] should_failslab+0xc2/0x120 [ 1086.010221][T18614] __kmalloc_noprof+0xdd/0x880 [ 1086.010247][T18614] ? lsm_blob_alloc+0x68/0x90 [ 1086.010276][T18614] ? lsm_blob_alloc+0x68/0x90 [ 1086.010299][T18614] lsm_blob_alloc+0x68/0x90 [ 1086.010325][T18614] security_sk_alloc+0x30/0x270 [ 1086.010346][T18614] sk_prot_alloc+0x1c7/0x2a0 [ 1086.010384][T18614] sk_alloc+0x36/0xc20 [ 1086.010404][T18614] bpf_prog_test_run_skb+0x34c/0x2290 [ 1086.010430][T18614] ? __fget_files+0x204/0x3c0 [ 1086.010453][T18614] ? __fget_files+0x20e/0x3c0 [ 1086.010471][T18614] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 1086.010495][T18614] ? fput+0x9b/0xd0 [ 1086.010520][T18614] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 1086.010542][T18614] __sys_bpf+0x1032/0x4980 [ 1086.010563][T18614] ? __pfx___sys_bpf+0x10/0x10 [ 1086.010578][T18614] ? find_held_lock+0x2b/0x80 [ 1086.010607][T18614] ? find_held_lock+0x2b/0x80 [ 1086.010637][T18614] ? __mutex_unlock_slowpath+0x161/0x7b0 [ 1086.010674][T18614] ? fput+0x9b/0xd0 [ 1086.010696][T18614] ? ksys_write+0x1ac/0x250 [ 1086.010714][T18614] ? __pfx_ksys_write+0x10/0x10 [ 1086.010737][T18614] __x64_sys_bpf+0x78/0xc0 [ 1086.010753][T18614] ? lockdep_hardirqs_on+0x7c/0x110 [ 1086.010774][T18614] do_syscall_64+0xcd/0x4e0 [ 1086.010797][T18614] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1086.010815][T18614] RIP: 0033:0x7f995058eec9 [ 1086.010830][T18614] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1086.010847][T18614] RSP: 002b:00007f99514f7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1086.010863][T18614] RAX: ffffffffffffffda RBX: 00007f99507e5fa0 RCX: 00007f995058eec9 [ 1086.010874][T18614] RDX: 0000000000000050 RSI: 00002000000002c0 RDI: 000000000000000a [ 1086.010885][T18614] RBP: 00007f99514f7090 R08: 0000000000000000 R09: 0000000000000000 [ 1086.010894][T18614] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1086.010903][T18614] R13: 00007f99507e6038 R14: 00007f99507e5fa0 R15: 00007ffea856b138 [ 1086.010924][T18614] [ 1086.045765][T18615] block nbd3: Unsupported socket: should be TCP or UNIX. [ 1086.156064][ T5938] usb 5-1: Using ep0 maxpacket: 8 [ 1086.286073][T18626] ieee802154 phy0 wpan0: encryption failed: -90 [ 1086.385554][ T5938] usb 5-1: too many endpoints for config 0 interface 0 altsetting 0: 255, using maximum allowed: 30 [ 1086.399245][ T5938] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1086.413929][ T5938] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1086.420999][T18435] hsr_slave_0: entered promiscuous mode [ 1086.433643][ T5938] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 255 [ 1086.462525][T18435] hsr_slave_1: entered promiscuous mode [ 1086.464618][ T5938] usb 5-1: New USB device found, idVendor=0c45, idProduct=760b, bcdDevice= 0.00 [ 1086.492672][T18435] debugfs: 'hsr0' already exists in 'hsr' [ 1086.501184][T18435] Cannot create hsr debugfs directory [ 1086.558015][ T5938] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1086.605243][ T5938] usb 5-1: config 0 descriptor?? [ 1087.307518][T18642] No control pipe specified [ 1087.613830][T18644] tmpfs: Bad value for 'huge' [ 1087.925050][ T5938] usbhid 5-1:0.0: can't add hid device: -71 [ 1087.932802][ T5938] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 1087.976002][ T5938] usb 5-1: USB disconnect, device number 86 [ 1088.078384][T18435] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 1088.112088][T18435] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 1088.114379][T18652] FAULT_INJECTION: forcing a failure. [ 1088.114379][T18652] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1088.145208][T18652] CPU: 1 UID: 0 PID: 18652 Comm: syz.1.2872 Not tainted syzkaller #0 PREEMPT(full) [ 1088.145234][T18652] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1088.145244][T18652] Call Trace: [ 1088.145250][T18652] [ 1088.145257][T18652] dump_stack_lvl+0x16c/0x1f0 [ 1088.145285][T18652] should_fail_ex+0x512/0x640 [ 1088.145309][T18652] _copy_to_user+0x32/0xd0 [ 1088.145342][T18652] simple_read_from_buffer+0xcb/0x170 [ 1088.145364][T18652] proc_fail_nth_read+0x197/0x240 [ 1088.145388][T18652] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1088.145408][T18652] ? rw_verify_area+0xcf/0x6c0 [ 1088.145424][T18652] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1088.145445][T18652] vfs_read+0x1e1/0xcf0 [ 1088.145467][T18652] ? __pfx___mutex_lock+0x10/0x10 [ 1088.145490][T18652] ? __pfx_vfs_read+0x10/0x10 [ 1088.145515][T18652] ? __fget_files+0x20e/0x3c0 [ 1088.145544][T18652] ksys_read+0x12a/0x250 [ 1088.145562][T18652] ? __pfx_ksys_read+0x10/0x10 [ 1088.145581][T18652] ? fput+0x9b/0xd0 [ 1088.145609][T18652] do_syscall_64+0xcd/0x4e0 [ 1088.145634][T18652] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1088.145657][T18652] RIP: 0033:0x7fe42318d8dc [ 1088.145671][T18652] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 1088.145687][T18652] RSP: 002b:00007fe4240cf030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1088.145704][T18652] RAX: ffffffffffffffda RBX: 00007fe4233e5fa0 RCX: 00007fe42318d8dc [ 1088.145715][T18652] RDX: 000000000000000f RSI: 00007fe4240cf0a0 RDI: 0000000000000004 [ 1088.145725][T18652] RBP: 00007fe4240cf090 R08: 0000000000000000 R09: 0000000000000000 [ 1088.145736][T18652] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1088.145746][T18652] R13: 00007fe4233e6038 R14: 00007fe4233e5fa0 R15: 00007ffff6e76178 [ 1088.145771][T18652] [ 1088.370125][T18435] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 1088.380888][T18435] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 1088.528230][T18435] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1088.558131][T18435] 8021q: adding VLAN 0 to HW filter on device team0 [ 1089.020030][ T60] bridge0: port 1(bridge_slave_0) entered blocking state [ 1089.027221][ T60] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1089.115141][ T3574] bridge0: port 2(bridge_slave_1) entered blocking state [ 1089.122283][ T3574] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1089.501871][T18675] netlink: 'syz.3.2874': attribute type 1 has an invalid length. [ 1089.563022][T18675] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1089.823964][T18669] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2874'. [ 1091.819089][ T30] audit: type=1400 audit(1759590501.637:667): avc: denied { bind } for pid=18706 comm="syz.0.2881" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 1091.895278][ T5945] usb 5-1: new high-speed USB device number 87 using dummy_hcd [ 1092.133643][T18669] bond3 (unregistering): Released all slaves [ 1092.139730][ T30] audit: type=1400 audit(1759590501.637:668): avc: denied { connect } for pid=18706 comm="syz.0.2881" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 1092.265723][ T5945] usb 5-1: Using ep0 maxpacket: 16 [ 1092.290838][ T5945] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 1092.336223][ T5945] usb 5-1: can't read configurations, error -61 [ 1092.370181][T18720] vivid-003: disconnect [ 1092.378755][T18719] vivid-003: reconnect [ 1092.380219][T18435] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1092.467115][T18724] openvswitch: netlink: nsh attribute has 65532 unknown bytes. [ 1092.484966][ T5945] usb 5-1: new high-speed USB device number 88 using dummy_hcd [ 1092.496038][T18724] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1092.666465][ T5945] usb 5-1: Using ep0 maxpacket: 16 [ 1092.673552][ T5945] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 1092.705756][ T5945] usb 5-1: can't read configurations, error -61 [ 1092.724606][ T5945] usb usb5-port1: attempt power cycle [ 1093.045950][ T5948] usb 2-1: new high-speed USB device number 87 using dummy_hcd [ 1093.075981][ T5945] usb 5-1: new high-speed USB device number 89 using dummy_hcd [ 1093.097694][ T5945] usb 5-1: Using ep0 maxpacket: 16 [ 1093.117969][ T5945] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 1093.250205][ T5948] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 1093.511271][ T5945] usb 5-1: can't read configurations, error -61 [ 1093.522717][ T5948] usb 2-1: config 0 has no interface number 0 [ 1093.628024][ T5948] usb 2-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 1093.638710][ T5948] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1093.647251][ T5948] usb 2-1: Product: syz [ 1093.679492][ T5948] usb 2-1: Manufacturer: syz [ 1093.684235][ T5948] usb 2-1: SerialNumber: syz [ 1093.767995][ T5945] usb 5-1: new high-speed USB device number 90 using dummy_hcd [ 1093.796692][ T5948] usb 2-1: config 0 descriptor?? [ 1093.841853][ T5945] usb 5-1: device descriptor read/8, error -71 [ 1093.860075][T18435] veth0_vlan: entered promiscuous mode [ 1093.938197][T18435] veth1_vlan: entered promiscuous mode [ 1094.011011][ T5948] usb 2-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 1094.084497][ T5945] usb usb5-port1: unable to enumerate USB device [ 1094.086245][T18435] veth0_macvtap: entered promiscuous mode [ 1094.102423][T18435] veth1_macvtap: entered promiscuous mode [ 1094.122107][T18435] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1094.136736][ T5948] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1094.167298][ T5948] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 1094.186742][T18435] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1094.204937][ T5948] usb 2-1: media controller created [ 1094.250477][ T3503] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1094.289565][ T3503] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1094.317656][ T5948] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1094.387090][T18771] tmpfs: Unknown parameter 'noswaÿÿAvJœ_nterleave' [ 1094.632024][ T3503] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1094.738758][ T3503] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1094.779677][T18782] FAULT_INJECTION: forcing a failure. [ 1094.779677][T18782] name failslab, interval 1, probability 0, space 0, times 0 [ 1094.793849][T18782] CPU: 1 UID: 0 PID: 18782 Comm: syz.0.2893 Not tainted syzkaller #0 PREEMPT(full) [ 1094.793874][T18782] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1094.793885][T18782] Call Trace: [ 1094.793891][T18782] [ 1094.793898][T18782] dump_stack_lvl+0x16c/0x1f0 [ 1094.793927][T18782] should_fail_ex+0x512/0x640 [ 1094.793948][T18782] ? kmem_cache_alloc_node_noprof+0x65/0x770 [ 1094.793974][T18782] should_failslab+0xc2/0x120 [ 1094.793997][T18782] kmem_cache_alloc_node_noprof+0x78/0x770 [ 1094.794015][T18782] ? __alloc_skb+0x2b2/0x380 [ 1094.794048][T18782] ? __alloc_skb+0x2b2/0x380 [ 1094.794067][T18782] __alloc_skb+0x2b2/0x380 [ 1094.794087][T18782] ? __pfx___alloc_skb+0x10/0x10 [ 1094.794107][T18782] ? __pfx___mutex_trylock_common+0x10/0x10 [ 1094.794131][T18782] ? __pfx___might_resched+0x10/0x10 [ 1094.794160][T18782] netlink_dump+0x19b/0xd30 [ 1094.794187][T18782] ? __pfx_netlink_dump+0x10/0x10 [ 1094.794228][T18782] __netlink_dump_start+0x6d6/0x990 [ 1094.794255][T18782] ? __pfx_tc_dump_chain+0x10/0x10 [ 1094.794278][T18782] rtnetlink_rcv_msg+0xb3e/0xe90 [ 1094.794302][T18782] ? __pfx_tc_dump_chain+0x10/0x10 [ 1094.794327][T18782] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1094.794351][T18782] ? __pfx_rtnl_dumpit+0x10/0x10 [ 1094.794367][T18782] ? __pfx_tc_dump_chain+0x10/0x10 [ 1094.794392][T18782] ? __lock_acquire+0x62e/0x1ce0 [ 1094.794418][T18782] netlink_rcv_skb+0x158/0x420 [ 1094.794442][T18782] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1094.794467][T18782] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1094.794501][T18782] ? netlink_deliver_tap+0x1ae/0xd30 [ 1094.794522][T18782] ? selinux_netlink_send+0x578/0x830 [ 1094.794540][T18782] ? is_vmalloc_addr+0x86/0xa0 [ 1094.794561][T18782] netlink_unicast+0x5a7/0x870 [ 1094.794589][T18782] ? __pfx_netlink_unicast+0x10/0x10 [ 1094.794613][T18782] ? __pfx_netlink_autobind.isra.0+0x10/0x10 [ 1094.794645][T18782] netlink_sendmsg+0x8c8/0xdd0 [ 1094.794674][T18782] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1094.794708][T18782] ____sys_sendmsg+0xa98/0xc70 [ 1094.794736][T18782] ? copy_msghdr_from_user+0x10a/0x160 [ 1094.794758][T18782] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1094.794797][T18782] ___sys_sendmsg+0x134/0x1d0 [ 1094.794820][T18782] ? __pfx____sys_sendmsg+0x10/0x10 [ 1094.794875][T18782] __sys_sendmsg+0x16d/0x220 [ 1094.794898][T18782] ? __pfx___sys_sendmsg+0x10/0x10 [ 1094.794937][T18782] do_syscall_64+0xcd/0x4e0 [ 1094.794963][T18782] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1094.794981][T18782] RIP: 0033:0x7f995058eec9 [ 1094.794996][T18782] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1094.795014][T18782] RSP: 002b:00007f99514b5038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1094.795037][T18782] RAX: ffffffffffffffda RBX: 00007f99507e6180 RCX: 00007f995058eec9 [ 1094.795049][T18782] RDX: 0000000020004800 RSI: 0000200000006040 RDI: 0000000000000005 [ 1094.795059][T18782] RBP: 00007f99514b5090 R08: 0000000000000000 R09: 0000000000000000 [ 1094.795070][T18782] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1094.795081][T18782] R13: 00007f99507e6218 R14: 00007f99507e6180 R15: 00007ffea856b138 [ 1094.795106][T18782] [ 1095.103237][ C1] vkms_vblank_simulate: vblank timer overrun [ 1095.163685][ T5948] i2c i2c-1: ec100: i2c rd failed=-71 reg=33 [ 1095.193188][ T3574] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1095.193205][ T3503] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1095.193219][ T3503] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1095.261108][ T3574] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1095.294917][ T30] audit: type=1400 audit(1759590505.147:669): avc: denied { mounton } for pid=18435 comm="syz-executor" path="/root/syzkaller.mlm2wh/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 1095.299971][ T5948] usb 2-1: USB disconnect, device number 87 [ 1095.357287][ T30] audit: type=1400 audit(1759590505.147:670): avc: denied { mounton } for pid=18435 comm="syz-executor" path="/root/syzkaller.mlm2wh/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=59211 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 1095.384847][ C1] vkms_vblank_simulate: vblank timer overrun [ 1095.427277][ T30] audit: type=1400 audit(1759590505.267:671): avc: denied { mount } for pid=18435 comm="syz-executor" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 1095.449788][ C1] vkms_vblank_simulate: vblank timer overrun [ 1095.471376][ T30] audit: type=1400 audit(1759590505.267:672): avc: denied { mounton } for pid=18435 comm="syz-executor" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 1095.495317][ C1] vkms_vblank_simulate: vblank timer overrun [ 1095.688889][ T30] audit: type=1400 audit(1759590505.547:673): avc: denied { connect } for pid=18795 comm="syz.5.2896" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 1095.711365][ C1] vkms_vblank_simulate: vblank timer overrun [ 1096.442012][ T30] audit: type=1400 audit(1759590505.857:674): avc: denied { sendto } for pid=15 comm="ksoftirqd/0" saddr=fe80::1c daddr=ff02::2 netif=teql0 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:node_t tclass=node permissive=1 [ 1096.617457][ T30] audit: type=1400 audit(1759590505.897:675): avc: denied { setopt } for pid=18792 comm="syz.4.2895" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 1096.857205][T18811] block device autoloading is deprecated and will be removed. [ 1096.911828][ T30] audit: type=1400 audit(1759590506.767:676): avc: denied { lock } for pid=18809 comm="syz.5.2900" path="socket:[59260]" dev="sockfs" ino=59260 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_stream_socket permissive=1 [ 1097.463149][T18777] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1097.569259][ T5825] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1097.580441][ T5825] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1097.590572][ T5825] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1097.598235][ T5825] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1097.606478][ T5825] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1097.626156][ T5945] usb 1-1: new high-speed USB device number 93 using dummy_hcd [ 1097.644817][T18822] lo speed is unknown, defaulting to 1000 [ 1097.897425][T18777] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1097.916229][ T5945] usb 1-1: config index 0 descriptor too short (expected 39, got 27) [ 1097.940771][ T5945] usb 1-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 1097.967946][ T5945] usb 1-1: config 0 interface 0 has no altsetting 0 [ 1097.978757][T18777] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1097.991656][ T5945] usb 1-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1098.023888][ T5945] usb 1-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 1098.086508][ T5945] usb 1-1: Product: syz [ 1098.099951][ T5945] usb 1-1: Manufacturer: syz [ 1098.143887][T18831] FAULT_INJECTION: forcing a failure. [ 1098.143887][T18831] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1098.145391][T18831] [ 1098.145401][T18831] ====================================================== [ 1098.145408][T18831] WARNING: possible circular locking dependency detected [ 1098.145415][T18831] syzkaller #0 Not tainted [ 1098.145424][T18831] ------------------------------------------------------ [ 1098.145430][T18831] syz.4.2904/18831 is trying to acquire lock: [ 1098.145439][T18831] ffffffff8e0d1440 (console_owner){-.-.}-{0:0}, at: console_lock_spinning_enable+0x61/0x80 [ 1098.145489][T18831] [ 1098.145489][T18831] but task is already holding lock: [ 1098.145494][T18831] ffff8880b863a358 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x7e/0x130 [ 1098.145536][T18831] [ 1098.145536][T18831] which lock already depends on the new lock. [ 1098.145536][T18831] [ 1098.145541][T18831] [ 1098.145541][T18831] the existing dependency chain (in reverse order) is: [ 1098.145547][T18831] [ 1098.145547][T18831] -> #4 (&rq->__lock){-.-.}-{2:2}: [ 1098.145568][T18831] _raw_spin_lock_nested+0x31/0x40 [ 1098.145586][T18831] raw_spin_rq_lock_nested+0x29/0x130 [ 1098.145608][T18831] task_rq_lock+0xcf/0x490 [ 1098.145629][T18831] cgroup_move_task+0x81/0x2a0 [ 1098.145643][T18831] css_set_move_task+0x288/0x5f0 [ 1098.145660][T18831] cgroup_post_fork+0x201/0x9d0 [ 1098.145681][T18831] copy_process+0x602d/0x76a0 [ 1098.145702][T18831] kernel_clone+0xfc/0x930 [ 1098.145724][T18831] user_mode_thread+0xc8/0x110 [ 1098.145748][T18831] rest_init+0x23/0x2b0 [ 1098.145770][T18831] start_kernel+0x3f3/0x4e0 [ 1098.145786][T18831] x86_64_start_reservations+0x18/0x30 [ 1098.145802][T18831] x86_64_start_kernel+0x130/0x190 [ 1098.145817][T18831] common_startup_64+0x13e/0x148 [ 1098.145837][T18831] [ 1098.145837][T18831] -> #3 (&p->pi_lock){-.-.}-{2:2}: [ 1098.145857][T18831] _raw_spin_lock_irqsave+0x3a/0x60 [ 1098.145873][T18831] try_to_wake_up+0xb7/0x1870 [ 1098.145893][T18831] __wake_up_common+0x135/0x1f0 [ 1098.145909][T18831] __wake_up+0x31/0x60 [ 1098.145921][T18831] tty_port_default_wakeup+0x2a/0x40 [ 1098.145943][T18831] serial8250_tx_chars+0x68e/0x860 [ 1098.145965][T18831] serial8250_handle_irq+0x761/0xcb0 [ 1098.145987][T18831] serial8250_default_handle_irq+0x9a/0x250 [ 1098.146011][T18831] serial8250_interrupt+0xf5/0x1b0 [ 1098.146033][T18831] __handle_irq_event_percpu+0x236/0x920 [ 1098.146056][T18831] handle_irq_event+0xab/0x1e0 [ 1098.146078][T18831] handle_edge_irq+0x3ca/0x9e0 [ 1098.146099][T18831] __common_interrupt+0xd0/0x2f0 [ 1098.146123][T18831] common_interrupt+0xba/0xe0 [ 1098.146147][T18831] asm_common_interrupt+0x26/0x40 [ 1098.146164][T18831] _raw_spin_unlock_irqrestore+0x31/0x80 [ 1098.146181][T18831] debug_object_activate+0x2ec/0x4c0 [ 1098.146207][T18831] __call_rcu_common.constprop.0+0x35/0xa10 [ 1098.146228][T18831] kmem_cache_free+0x171/0x6c0 [ 1098.146245][T18831] exit_mmap+0x50a/0xb90 [ 1098.146270][T18831] __mmput+0x12a/0x410 [ 1098.146292][T18831] mmput+0x62/0x70 [ 1098.146314][T18831] do_exit+0x7c7/0x2bf0 [ 1098.146330][T18831] do_group_exit+0xd3/0x2a0 [ 1098.146345][T18831] __x64_sys_exit_group+0x3e/0x50 [ 1098.146361][T18831] x64_sys_call+0x150b/0x1730 [ 1098.146384][T18831] do_syscall_64+0xcd/0x4e0 [ 1098.146403][T18831] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1098.146418][T18831] [ 1098.146418][T18831] -> #2 (&tty->write_wait){-.-.}-{3:3}: [ 1098.146443][T18831] _raw_spin_lock_irqsave+0x3a/0x60 [ 1098.146459][T18831] __wake_up+0x1c/0x60 [ 1098.146471][T18831] tty_port_default_wakeup+0x2a/0x40 [ 1098.146492][T18831] serial8250_tx_chars+0x68e/0x860 [ 1098.146513][T18831] serial8250_handle_irq+0x761/0xcb0 [ 1098.146536][T18831] serial8250_default_handle_irq+0x9a/0x250 [ 1098.146560][T18831] serial8250_interrupt+0xf5/0x1b0 [ 1098.146581][T18831] __handle_irq_event_percpu+0x236/0x920 [ 1098.146604][T18831] handle_irq_event+0xab/0x1e0 [ 1098.146627][T18831] handle_edge_irq+0x3ca/0x9e0 [ 1098.146646][T18831] __common_interrupt+0xd0/0x2f0 [ 1098.146666][T18831] common_interrupt+0xba/0xe0 [ 1098.146688][T18831] asm_common_interrupt+0x26/0x40 [ 1098.146703][T18831] _raw_spin_unlock_irqrestore+0x31/0x80 [ 1098.146721][T18831] uart_write+0x2a4/0xb30 [ 1098.146739][T18831] n_tty_write+0x41b/0x11e0 [ 1098.146762][T18831] file_tty_write.constprop.0+0x503/0x9b0 [ 1098.146781][T18831] redirected_tty_write+0xd4/0x150 [ 1098.146800][T18831] vfs_write+0x7d3/0x11d0 [ 1098.146832][T18831] ksys_write+0x12a/0x250 [ 1098.146849][T18831] do_syscall_64+0xcd/0x4e0 [ 1098.146868][T18831] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1098.146884][T18831] [ 1098.146884][T18831] -> #1 (&port_lock_key){-.-.}-{3:3}: [ 1098.146906][T18831] _raw_spin_lock_irqsave+0x3a/0x60 [ 1098.146922][T18831] serial8250_console_write+0x181/0x1890 [ 1098.146946][T18831] console_flush_all+0x801/0xc60 [ 1098.146968][T18831] console_unlock+0xd8/0x210 [ 1098.146990][T18831] vprintk_emit+0x3d7/0x680 [ 1098.147012][T18831] _printk+0xc7/0x100 [ 1098.147028][T18831] register_console+0xc2d/0x11b0 [ 1098.147051][T18831] univ8250_console_init+0x5f/0x90 [ 1098.147069][T18831] console_init+0x14f/0x680 [ 1098.147086][T18831] start_kernel+0x29f/0x4e0 [ 1098.147100][T18831] x86_64_start_reservations+0x18/0x30 [ 1098.147116][T18831] x86_64_start_kernel+0x130/0x190 [ 1098.147132][T18831] common_startup_64+0x13e/0x148 [ 1098.147151][T18831] [ 1098.147151][T18831] -> #0 (console_owner){-.-.}-{0:0}: [ 1098.147172][T18831] __lock_acquire+0x12a6/0x1ce0 [ 1098.147190][T18831] lock_acquire+0x179/0x350 [ 1098.147207][T18831] console_lock_spinning_enable+0x72/0x80 [ 1098.147229][T18831] console_flush_all+0x7aa/0xc60 [ 1098.147250][T18831] console_unlock+0xd8/0x210 [ 1098.147278][T18831] vprintk_emit+0x3d7/0x680 [ 1098.147300][T18831] _printk+0xc7/0x100 [ 1098.147317][T18831] should_fail_ex+0x4e7/0x640 [ 1098.147337][T18831] strncpy_from_user+0x3b/0x2e0 [ 1098.147354][T18831] strncpy_from_user_nofault+0x7f/0x180 [ 1098.147371][T18831] bpf_bprintf_prepare+0xe90/0x13f0 [ 1098.147390][T18831] bpf_trace_printk+0xda/0x190 [ 1098.147409][T18831] bpf_prog_930ede9872f2967c+0x3e/0x44 [ 1098.147423][T18831] bpf_trace_run2+0x236/0x590 [ 1098.147443][T18831] __bpf_trace_contention_begin+0xc9/0x110 [ 1098.147462][T18831] trace_contention_begin.constprop.0+0xde/0x160 [ 1098.147483][T18831] __pv_queued_spin_lock_slowpath+0x109/0xcf0 [ 1098.147504][T18831] do_raw_spin_lock+0x20e/0x2b0 [ 1098.147524][T18831] raw_spin_rq_lock_nested+0x7e/0x130 [ 1098.147547][T18831] __schedule+0x307/0x5de0 [ 1098.147563][T18831] preempt_schedule_irq+0x51/0x90 [ 1098.147580][T18831] irqentry_exit+0x36/0x90 [ 1098.147598][T18831] asm_sysvec_reschedule_ipi+0x1a/0x20 [ 1098.147614][T18831] c6xdigio_write_data.isra.0+0xbb/0x110 [ 1098.147636][T18831] c6xdigio_encoder_insn_read+0x159/0x470 [ 1098.147658][T18831] parse_insn+0xf49/0x1970 [ 1098.147678][T18831] do_insn_ioctl+0x152/0x4e0 [ 1098.147700][T18831] comedi_unlocked_ioctl+0x1618/0x2f00 [ 1098.147723][T18831] __x64_sys_ioctl+0x18e/0x210 [ 1098.147747][T18831] do_syscall_64+0xcd/0x4e0 [ 1098.147766][T18831] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1098.147782][T18831] [ 1098.147782][T18831] other info that might help us debug this: [ 1098.147782][T18831] [ 1098.147788][T18831] Chain exists of: [ 1098.147788][T18831] console_owner --> &p->pi_lock --> &rq->__lock [ 1098.147788][T18831] [ 1098.147811][T18831] Possible unsafe locking scenario: [ 1098.147811][T18831] [ 1098.147816][T18831] CPU0 CPU1 [ 1098.147820][T18831] ---- ---- [ 1098.147825][T18831] lock(&rq->__lock); [ 1098.147834][T18831] lock(&p->pi_lock); [ 1098.147845][T18831] lock(&rq->__lock); [ 1098.147856][T18831] lock(console_owner); [ 1098.147866][T18831] [ 1098.147866][T18831] *** DEADLOCK *** [ 1098.147866][T18831] [ 1098.147870][T18831] 5 locks held by syz.4.2904/18831: [ 1098.147879][T18831] #0: ffff88814c9498f8 (&dev->mutex#4){+.+.}-{4:4}, at: comedi_unlocked_ioctl+0x167/0x2f00 [ 1098.147927][T18831] #1: ffff8880b863a358 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x7e/0x130 [ 1098.147971][T18831] #2: ffffffff8e1c4120 (rcu_read_lock){....}-{1:3}, at: bpf_trace_run2+0x1bc/0x590 [ 1098.148012][T18831] #3: ffffffff8e1b1880 (console_lock){+.+.}-{0:0}, at: _printk+0xc7/0x100 [ 1098.148051][T18831] #4: ffffffff8e1b18f0 (console_srcu){....}-{0:0}, at: console_flush_all+0x158/0xc60 [ 1098.148096][T18831] [ 1098.148096][T18831] stack backtrace: [ 1098.148105][T18831] CPU: 1 UID: 0 PID: 18831 Comm: syz.4.2904 Not tainted syzkaller #0 PREEMPT(full) [ 1098.148126][T18831] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1098.148138][T18831] Call Trace: [ 1098.148144][T18831] [ 1098.148151][T18831] dump_stack_lvl+0x116/0x1f0 [ 1098.148175][T18831] print_circular_bug+0x275/0x350 [ 1098.148195][T18831] check_noncircular+0x14c/0x170 [ 1098.148217][T18831] __lock_acquire+0x12a6/0x1ce0 [ 1098.148241][T18831] lock_acquire+0x179/0x350 [ 1098.148267][T18831] ? console_lock_spinning_enable+0x61/0x80 [ 1098.148293][T18831] ? console_lock_spinning_enable+0x4a/0x80 [ 1098.148319][T18831] console_lock_spinning_enable+0x72/0x80 [ 1098.148343][T18831] ? console_lock_spinning_enable+0x61/0x80 [ 1098.148367][T18831] console_flush_all+0x7aa/0xc60 [ 1098.148394][T18831] ? __pfx_console_flush_all+0x10/0x10 [ 1098.148421][T18831] ? is_printk_cpu_sync_owner+0x32/0x40 [ 1098.148450][T18831] console_unlock+0xd8/0x210 [ 1098.148473][T18831] ? __pfx_console_unlock+0x10/0x10 [ 1098.148497][T18831] ? do_raw_spin_unlock+0x150/0x230 [ 1098.148521][T18831] ? _printk+0xc7/0x100 [ 1098.148540][T18831] ? __down_trylock_console_sem+0xb0/0x140 [ 1098.148563][T18831] vprintk_emit+0x3d7/0x680 [ 1098.148588][T18831] ? __pfx_vprintk_emit+0x10/0x10 [ 1098.148617][T18831] _printk+0xc7/0x100 [ 1098.148635][T18831] ? __pfx__printk+0x10/0x10 [ 1098.148656][T18831] ? __pfx____ratelimit+0x10/0x10 [ 1098.148678][T18831] should_fail_ex+0x4e7/0x640 [ 1098.148700][T18831] strncpy_from_user+0x3b/0x2e0 [ 1098.148720][T18831] strncpy_from_user_nofault+0x7f/0x180 [ 1098.148739][T18831] bpf_bprintf_prepare+0xe90/0x13f0 [ 1098.148760][T18831] ? __pfx_bpf_bprintf_prepare+0x10/0x10 [ 1098.148785][T18831] ? bpf_trace_run2+0x3e1/0x590 [ 1098.148807][T18831] bpf_trace_printk+0xda/0x190 [ 1098.148828][T18831] ? __pfx_bpf_trace_printk+0x10/0x10 [ 1098.148851][T18831] ? bpf_trace_run2+0x3e1/0x590 [ 1098.148878][T18831] bpf_prog_930ede9872f2967c+0x3e/0x44 [ 1098.148892][T18831] bpf_trace_run2+0x236/0x590 [ 1098.148915][T18831] ? __pfx_bpf_trace_run2+0x10/0x10 [ 1098.148942][T18831] __bpf_trace_contention_begin+0xc9/0x110 [ 1098.148962][T18831] ? __pfx___bpf_trace_contention_begin+0x10/0x10 [ 1098.148981][T18831] ? find_held_lock+0x2b/0x80 [ 1098.149008][T18831] ? do_raw_spin_unlock+0x172/0x230 [ 1098.149032][T18831] trace_contention_begin.constprop.0+0xde/0x160 [ 1098.149055][T18831] __pv_queued_spin_lock_slowpath+0x109/0xcf0 [ 1098.149079][T18831] ? __lock_acquire+0xb97/0x1ce0 [ 1098.149098][T18831] ? __pfx___pv_queued_spin_lock_slowpath+0x10/0x10 [ 1098.149125][T18831] do_raw_spin_lock+0x20e/0x2b0 [ 1098.149148][T18831] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 1098.149169][T18831] ? rcu_qs+0x2b/0xe0 [ 1098.149193][T18831] ? rcu_note_context_switch+0x192/0x1e00 [ 1098.149220][T18831] raw_spin_rq_lock_nested+0x7e/0x130 [ 1098.149245][T18831] ? preempt_schedule_irq+0x51/0x90 [ 1098.149272][T18831] __schedule+0x307/0x5de0 [ 1098.149289][T18831] ? trace_sched_exit_tp+0xd1/0x120 [ 1098.149312][T18831] ? __schedule+0x11a3/0x5de0 [ 1098.149335][T18831] ? __pfx___schedule+0x10/0x10 [ 1098.149353][T18831] ? __pfx___schedule+0x10/0x10 [ 1098.149374][T18831] ? mark_held_locks+0x49/0x80 [ 1098.149393][T18831] preempt_schedule_irq+0x51/0x90 [ 1098.149413][T18831] irqentry_exit+0x36/0x90 [ 1098.149433][T18831] asm_sysvec_reschedule_ipi+0x1a/0x20 [ 1098.149451][T18831] RIP: 0010:c6xdigio_write_data.isra.0+0xbb/0x110 [ 1098.149475][T18831] Code: 31 ed 41 83 c5 01 eb 19 e8 d2 15 fb f8 83 c5 01 bf 14 00 00 00 89 ee e8 03 11 fb f8 83 fd 14 74 20 e8 b9 15 fb f8 44 89 ea ec <89> c3 44 89 e6 81 e3 80 00 00 00 89 df e8 23 10 fb f8 44 39 e3 74 [ 1098.149492][T18831] RSP: 0018:ffffc9001d507a90 EFLAGS: 00000293 [ 1098.149506][T18831] RAX: 00000000000000e9 RBX: 0000000000000080 RCX: ffffffff88c01eed [ 1098.149518][T18831] RDX: 0000000000000402 RSI: ffffffff88c01ef7 RDI: 0000000000000005 [ 1098.149529][T18831] RBP: 0000000000000001 R08: 0000000000000005 R09: 0000000000000014 [ 1098.149540][T18831] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000080 [ 1098.149551][T18831] R13: 0000000000000402 R14: 0000000000000050 R15: 000000000000002e [ 1098.149565][T18831] ? c6xdigio_write_data.isra.0+0xad/0x110 [ 1098.149588][T18831] ? c6xdigio_write_data.isra.0+0xb7/0x110 [ 1098.149614][T18831] c6xdigio_encoder_insn_read+0x159/0x470 [ 1098.149639][T18831] parse_insn+0xf49/0x1970 [ 1098.149663][T18831] ? __pfx_parse_insn+0x10/0x10 [ 1098.149683][T18831] ? __might_fault+0xe3/0x190 [ 1098.149700][T18831] ? do_insn_ioctl+0xda/0x4e0 [ 1098.149725][T18831] do_insn_ioctl+0x152/0x4e0 [ 1098.149751][T18831] comedi_unlocked_ioctl+0x1618/0x2f00 [ 1098.149779][T18831] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 1098.149808][T18831] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 1098.149833][T18831] ? do_vfs_ioctl+0x128/0x14f0 [ 1098.149859][T18831] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 1098.149885][T18831] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 1098.149912][T18831] ? hook_file_ioctl_common+0x145/0x410 [ 1098.149940][T18831] ? selinux_file_ioctl+0x180/0x270 [ 1098.149960][T18831] ? selinux_file_ioctl+0xb4/0x270 [ 1098.149981][T18831] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 1098.150007][T18831] __x64_sys_ioctl+0x18e/0x210 [ 1098.150033][T18831] do_syscall_64+0xcd/0x4e0 [ 1098.150055][T18831] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1098.150072][T18831] RIP: 0033:0x7f4dcb58eec9 [ 1098.150086][T18831] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1098.150102][T18831] RSP: 002b:00007f4dcc3b6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1098.150118][T18831] RAX: ffffffffffffffda RBX: 00007f4dcb7e5fa0 RCX: 00007f4dcb58eec9 [ 1098.150129][T18831] RDX: 0000200000000000 RSI: 000000008028640c RDI: 0000000000000003 [ 1098.150141][T18831] RBP: 00007f4dcc3b6090 R08: 0000000000000000 R09: 0000000000000000 [ 1098.150151][T18831] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1098.150162][T18831] R13: 00007f4dcb7e6038 R14: 00007f4dcb7e5fa0 R15: 00007ffdebf1b4a8 [ 1098.150179][T18831] [ 1099.570198][T18831] CPU: 1 UID: 0 PID: 18831 Comm: syz.4.2904 Not tainted syzkaller #0 PREEMPT(full) [ 1099.570220][T18831] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1099.570229][T18831] Call Trace: [ 1099.570240][T18831] [ 1099.570246][T18831] dump_stack_lvl+0x116/0x1f0 [ 1099.570269][T18831] should_fail_ex+0x512/0x640 [ 1099.570288][T18831] strncpy_from_user+0x3b/0x2e0 [ 1099.570305][T18831] strncpy_from_user_nofault+0x7f/0x180 [ 1099.570321][T18831] bpf_bprintf_prepare+0xe90/0x13f0 [ 1099.570341][T18831] ? __pfx_bpf_bprintf_prepare+0x10/0x10 [ 1099.570360][T18831] ? bpf_trace_run2+0x3e1/0x590 [ 1099.570379][T18831] bpf_trace_printk+0xda/0x190 [ 1099.570396][T18831] ? __pfx_bpf_trace_printk+0x10/0x10 [ 1099.570415][T18831] ? bpf_trace_run2+0x3e1/0x590 [ 1099.570436][T18831] bpf_prog_930ede9872f2967c+0x3e/0x44 [ 1099.570448][T18831] bpf_trace_run2+0x236/0x590 [ 1099.570466][T18831] ? __pfx_bpf_trace_run2+0x10/0x10 [ 1099.570487][T18831] __bpf_trace_contention_begin+0xc9/0x110 [ 1099.570504][T18831] ? __pfx___bpf_trace_contention_begin+0x10/0x10 [ 1099.570520][T18831] ? find_held_lock+0x2b/0x80 [ 1099.570542][T18831] ? do_raw_spin_unlock+0x172/0x230 [ 1099.570561][T18831] trace_contention_begin.constprop.0+0xde/0x160 [ 1099.570580][T18831] __pv_queued_spin_lock_slowpath+0x109/0xcf0 [ 1099.570600][T18831] ? __lock_acquire+0xb97/0x1ce0 [ 1099.570616][T18831] ? __pfx___pv_queued_spin_lock_slowpath+0x10/0x10 [ 1099.570637][T18831] do_raw_spin_lock+0x20e/0x2b0 [ 1099.570654][T18831] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 1099.570672][T18831] ? rcu_qs+0x2b/0xe0 [ 1099.570691][T18831] ? rcu_note_context_switch+0x192/0x1e00 [ 1099.570713][T18831] raw_spin_rq_lock_nested+0x7e/0x130 [ 1099.570734][T18831] ? preempt_schedule_irq+0x51/0x90 [ 1099.570750][T18831] __schedule+0x307/0x5de0 [ 1099.570764][T18831] ? trace_sched_exit_tp+0xd1/0x120 [ 1099.570781][T18831] ? __schedule+0x11a3/0x5de0 [ 1099.570800][T18831] ? __pfx___schedule+0x10/0x10 [ 1099.570815][T18831] ? __pfx___schedule+0x10/0x10 [ 1099.570831][T18831] ? mark_held_locks+0x49/0x80 [ 1099.570847][T18831] preempt_schedule_irq+0x51/0x90 [ 1099.570863][T18831] irqentry_exit+0x36/0x90 [ 1099.570879][T18831] asm_sysvec_reschedule_ipi+0x1a/0x20 [ 1099.570895][T18831] RIP: 0010:c6xdigio_write_data.isra.0+0xbb/0x110 [ 1099.570917][T18831] Code: 31 ed 41 83 c5 01 eb 19 e8 d2 15 fb f8 83 c5 01 bf 14 00 00 00 89 ee e8 03 11 fb f8 83 fd 14 74 20 e8 b9 15 fb f8 44 89 ea ec <89> c3 44 89 e6 81 e3 80 00 00 00 89 df e8 23 10 fb f8 44 39 e3 74 [ 1099.570931][T18831] RSP: 0018:ffffc9001d507a90 EFLAGS: 00000293 [ 1099.570945][T18831] RAX: 00000000000000e9 RBX: 0000000000000080 RCX: ffffffff88c01eed [ 1099.570954][T18831] RDX: 0000000000000402 RSI: ffffffff88c01ef7 RDI: 0000000000000005 [ 1099.570963][T18831] RBP: 0000000000000001 R08: 0000000000000005 R09: 0000000000000014 [ 1099.570972][T18831] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000080 [ 1099.570987][T18831] R13: 0000000000000402 R14: 0000000000000050 R15: 000000000000002e [ 1099.570999][T18831] ? c6xdigio_write_data.isra.0+0xad/0x110 [ 1099.571017][T18831] ? c6xdigio_write_data.isra.0+0xb7/0x110 [ 1099.571037][T18831] c6xdigio_encoder_insn_read+0x159/0x470 [ 1099.571058][T18831] parse_insn+0xf49/0x1970 [ 1099.571077][T18831] ? __pfx_parse_insn+0x10/0x10 [ 1099.571095][T18831] ? __might_fault+0xe3/0x190 [ 1099.571108][T18831] ? do_insn_ioctl+0xda/0x4e0 [ 1099.571133][T18831] do_insn_ioctl+0x152/0x4e0 [ 1099.571154][T18831] comedi_unlocked_ioctl+0x1618/0x2f00 [ 1099.571181][T18831] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 1099.571204][T18831] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 1099.571225][T18831] ? do_vfs_ioctl+0x128/0x14f0 [ 1099.571253][T18831] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 1099.571289][T18831] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 1099.571314][T18831] ? hook_file_ioctl_common+0x145/0x410 [ 1099.571342][T18831] ? selinux_file_ioctl+0x180/0x270 [ 1099.571359][T18831] ? selinux_file_ioctl+0xb4/0x270 [ 1099.571375][T18831] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 1099.571396][T18831] __x64_sys_ioctl+0x18e/0x210 [ 1099.571418][T18831] do_syscall_64+0xcd/0x4e0 [ 1099.571436][T18831] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1099.571450][T18831] RIP: 0033:0x7f4dcb58eec9 [ 1099.571461][T18831] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1099.571475][T18831] RSP: 002b:00007f4dcc3b6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1099.571489][T18831] RAX: ffffffffffffffda RBX: 00007f4dcb7e5fa0 RCX: 00007f4dcb58eec9 [ 1099.571498][T18831] RDX: 0000200000000000 RSI: 000000008028640c RDI: 0000000000000003 [ 1099.571507][T18831] RBP: 00007f4dcc3b6090 R08: 0000000000000000 R09: 0000000000000000 [ 1099.571516][T18831] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1099.571528][T18831] R13: 00007f4dcb7e6038 R14: 00007f4dcb7e5fa0 R15: 00007ffdebf1b4a8 [ 1099.571541][T18831] [ 1099.571609][ C1] vkms_vblank_simulate: vblank timer overrun [ 1100.044758][ C1] vkms_vblank_simulate: vblank timer overrun [ 1100.051604][ T5945] usb 1-1: SerialNumber: syz [ 1100.052794][T18777] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1100.068316][ T5825] Bluetooth: hci1: command tx timeout SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 1100.289185][ T5945] usb 1-1: config 0 descriptor?? [ 1100.294499][ T5945] usb 1-1: can't set config #0, error -71 [ 1100.301107][ T5945] usb 1-1: USB disconnect, device number 93 [ 1101.021674][T18777] bond0 (unregistering): (slave wlan1): Releasing backup interface [ 1101.035394][T18777] bond0 (unregistering): Released all slaves [ 1101.370724][T18777] hsr_slave_0: left promiscuous mode [ 1101.388940][T18777] hsr_slave_1: left promiscuous mode [ 1101.397790][T18777] veth1_macvtap: left promiscuous mode [ 1101.403301][T18777] veth0_macvtap: left promiscuous mode [ 1101.410471][T18777] veth1_vlan: left promiscuous mode [ 1101.416324][T18777] veth0_vlan: left promiscuous mode [ 1101.822206][T18777] IPVS: stop unused estimator thread 0... [ 1101.879593][T18777] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1101.933580][T18777] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1101.991690][T18777] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1102.090093][T18777] netdevsim netdevsim3 ªªªªªª (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1102.165158][T18777] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1102.220930][T18777] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1102.282234][T18777] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1102.322090][T18777] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1102.404643][T18777] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1102.483135][T18777] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1102.570779][T18777] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1102.650097][T18777] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1102.758978][T18777] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1102.814549][T18777] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1102.877700][T18777] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1102.948416][T18777] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1103.054696][T18777] bridge_slave_1: left allmulticast mode [ 1103.060578][T18777] bridge_slave_1: left promiscuous mode [ 1103.068003][T18777] bridge0: port 2(bridge_slave_1) entered disabled state [ 1103.077927][T18777] bridge_slave_0: left allmulticast mode [ 1103.083567][T18777] bridge_slave_0: left promiscuous mode [ 1103.089503][T18777] bridge0: port 1(bridge_slave_0) entered disabled state [ 1103.311429][T18777] bond0 (unregistering): Released all slaves [ 1103.380578][T18777] bond1 (unregistering): Released all slaves [ 1103.448817][T18777] bond2 (unregistering): Released all slaves [ 1103.490237][T18777] bond0 (unregistering): Released all slaves [ 1103.532343][T18777] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1103.541730][T18777] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1103.550992][T18777] bond0 (unregistering): Released all slaves [ 1103.775166][T18777] bond0 (unregistering): Released all slaves [ 1103.841483][T18777] bond1 (unregistering): Released all slaves [ 1103.904280][T18777] bond2 (unregistering): Released all slaves [ 1103.966170][T18777] bond3 (unregistering): Released all slaves [ 1104.029566][T18777] bond4 (unregistering): Released all slaves [ 1104.092605][T18777] bond5 (unregistering): Released all slaves [ 1104.262843][T18777] bond0 (unregistering): Released all slaves [ 1104.326717][T18777] bond1 (unregistering): Released all slaves [ 1104.389762][T18777] bond2 (unregistering): Released all slaves [ 1104.950191][T18777] hsr_slave_0: left promiscuous mode [ 1104.960206][T18777] hsr_slave_1: left promiscuous mode [ 1104.971401][T18777] hsr_slave_0: left promiscuous mode [ 1104.977122][T18777] hsr_slave_1: left promiscuous mode [ 1104.982787][T18777] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1104.991300][T18777] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1104.999157][T18777] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1105.007106][T18777] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1105.016606][T18777] hsr_slave_0: left promiscuous mode [ 1105.022311][T18777] hsr_slave_1: left promiscuous mode [ 1105.029851][T18777] hsr_slave_0: left promiscuous mode [ 1105.035342][T18777] hsr_slave_1: left promiscuous mode [ 1105.044140][T18777] veth1_macvtap: left promiscuous mode [ 1105.049667][T18777] veth0_macvtap: left promiscuous mode [ 1105.055155][T18777] veth1_vlan: left promiscuous mode [ 1105.061948][T18777] veth0_vlan: left promiscuous mode [ 1105.067592][T18777] veth1_macvtap: left promiscuous mode [ 1105.073040][T18777] veth0_macvtap: left promiscuous mode [ 1105.078973][T18777] veth1_vlan: left promiscuous mode [ 1105.084176][T18777] veth0_vlan: left promiscuous mode [ 1105.394922][T18777] team0 (unregistering): Port device team_slave_1 removed [ 1105.413567][T18777] team0 (unregistering): Port device team_slave_0 removed