last executing test programs: 5m16.701025891s ago: executing program 2 (id=904): r0 = socket$inet6(0xa, 0x2, 0x3a) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000440)=0x3, 0x4) r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000100), 0x4, 0x0) setsockopt$IP_VS_SO_SET_STOPDAEMON(r1, 0x0, 0x48c, &(0x7f0000000140)={0x1, 'erspan0\x00'}, 0x18) sendmmsg$inet6(r0, &(0x7f0000000b80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB], 0x18}}], 0x1, 0x20010080) unshare(0x0) r2 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) sendfile(r2, r2, 0x0, 0x7ffff000) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nbd(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$NBD_CMD_STATUS(r3, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x90, r4, 0x20, 0x70bd2d, 0x25dfdbfe, {}, [@NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x20}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x6}, @NBD_ATTR_BACKEND_IDENTIFIER={0x9, 0xa, '\')($]'}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r1}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r1}}]}, @NBD_ATTR_SOCKETS={0x28, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r1}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r1}}]}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x5}]}, 0x90}, 0x1, 0x0, 0x0, 0x800}, 0x10) r5 = socket$key(0xf, 0x3, 0x2) dup3(r0, r2, 0x80000) r6 = openat$vcs(0xffffffffffffff9c, &(0x7f00000000c0), 0x444000, 0x0) read$FUSE(r6, &(0x7f00000031c0)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x207f) timer_create(0x2, &(0x7f0000000000)={0x0, 0x4, 0x2, @tid=r7}, &(0x7f0000000080)) sendmsg$key(r5, &(0x7f00000001c0)={0x500, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYRESDEC=r5], 0x50}}, 0x200c405a) r8 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$sock_int(r8, 0x1, 0x32, &(0x7f00000001c0)=0x7, 0xfe71) ioprio_set$pid(0x2, 0x0, 0x0) 5m15.740866808s ago: executing program 2 (id=912): mount(&(0x7f0000000080)=@sr0, &(0x7f0000002000)='./file0\x00', &(0x7f0000000000)='erofs\x00', 0x4400, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x1, &(0x7f0000002240)=ANY=[@ANYBLOB="f0a6ff0700000000000054b0e2f2eed00fbfe22c7b60077fd75f9e78b764a323b5b26d4f8ca6b78f19aecc1fa0e866f21724d6117c3842fc79037f3356b70d405834c0eb2095f3c4376a00421205c790146f", @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,usereid=', @ANYRESDEC=0x0, @ANYRESOCT=0x0, @ANYRESDEC=0x0, @ANYBLOB=',\x00']) read$FUSE(r0, &(0x7f0000006e80)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2082) write$FUSE_INIT(r0, &(0x7f0000004300)={0x50, 0x0, r1, {0x7, 0x29, 0x0, 0x11812410, 0x0, 0x0, 0x81}}, 0x50) syz_fuse_handle_req(r0, &(0x7f0000000000)="03684a7b99a4fde940f3ec0d105ea2c8267323117153aa4a4f099c3835a607cd5cbd77b83cc33d13bbb6c6bcae59db739af84a4b5d34bffc145f3cc27ed3d4f9d9b3103699a1e1cc4ddfb6c1afd07ddfc18e358cd62649479724ce867fefc0a15041bee9f6084842fb982d5c2cf1488d668b741c64f0a6fd2643e729ac5a56462a6b64d5a0a751fda4fadf63ba0dc2fd14ecbf546918db77095545b41ab170e5d6e8ec8bf9ce9b8d53b832e90c701fe52af7999f8fd509577ead1be27891ada8564167f2c7d2eea1c1c9c65d8e151c58ddee43ec34e74d330ec50cbbb2bb21892c7ca995066e3cbea8a69d94dc6bcef5f3c0ef630e774d092ea58627f3e09c66a9c7d1abcf4f8f8af87f4269df288aca9bbf758275ce9695256e764d185a91a7570fca3aab16c75ecaff6b8dda371c3226d6ec6e55c5c4d8cfc5c33892bacc956a3613bcfa849da1b5e070a7911d7488b3e628d9339718e8b821f1bb5d5c45f0316bb563d0a442801412dfd5a4d61ca657e04d6686f7d5863d57954400aeee8e79be8f3cc4cbb3d4b91269df039c3d3543e500b90a2bdc6eb60cc7afab7b5187d88fbd76e6212ea29e872b73f925287bdc808b4a4f8ec7f8aa08bc90b29e217c3eef69d8deae4141f4f9bd110b7bde9320e7b45f422e9a6111bcaf99c9911e46e219d3bab477926bd5d2e78d4cd0eca133c232b1e863fd7799dbf609f3670b323e5518e8f4bd36e9b3da2c68a28eaec9cac688b4dd0b73adc24a8c7acc264399b7facbc2f43e8e40b6cae9f8e956d1dbfe259f12bae75ad362c354050ffdd6e954f2d7615fafce888bd6f672a81c9fd4318caba765069c0a425e898bf7611b77f0fe61c27d318159dba42f011900246c64557d27b77aef928ab04a147baca37863cf998a2ac30b903c0314449ddb218887c309ec7184c8c733f5d4e7b2d79516e9531c9a5becf8294d6ccd777f285b13160e1c949d3069c6c66c0daa62bac679bc9b69825398d1c290d765e882fa2c8708b20ccec885ab6785dc22696b61c109ff84bc5407932c3e5bf12069a68b8e3333a26d3dd390ef9bc01b86013fbcb5c28a1f4d2b8084f1502fccc4027a124c3629d8f4a8befd14b597cebda5f94f36050a31b95087cbac347788a71a90e87f2187fae600aa42719c05c2859cb30ae0fd58a7bba681f7a6027a00583071def2c9a94456e5d9acb9fd2d11fdea524582489c02377bf7f590948985c769b3822cb6366681d79113c6a6c752f2475caba77b7b2e8f293d7fd9b991f63e254c98dec94f4f3def4fee9cdb56ff3ba7fe6a718cbe9a7f04710e257ea8a49d6605266048fc122d4f3173d4b04b3e282bd3c5198d7fcb72ec38e0b07dd8a541b2807e601e5a0a01f07a281e0e1a261c65977088a54597efd0997c59647aeebb2605a89705eeff3ec780e302e24b23a0cbe4f81367c3f118545f01328d22eb8e802667389143166a9db9477c9b58eb5c76a19b8f8b2692b0d356003f08ae54dfc820d8e357ecbf91fb7e212cbef1262171abaf2f613a5bb59b783cad476fec50d16ca0ac13c08a59a3097e6e3fde700a4b987d10311fc22d4aa210956cd859799f78010e4c0f25b715876aa253df15009490f71be3b0022875161f537c70b14bdb9e2d87a5a11b414a1198533c7de6fc4d22228133bc26b19d9f1e7627b14c72e3c39d3fa2186a42e50a0d1867dc312f94c7209d51475ed4aa80b2ccb0557a40422bf7317de2fdf3296727723a2d23babd5e23f7c3edf4942bb485b95a122e6aba41b8f80f684f84605462448d5a4fd66dfe9bbf80590b9999b4780d4f4f189a20f4400b2975df85b584c8c8f9fa3095f13aede1f52dac98be358b0a0d72bed4df71cd23973e326179580268c4e5d1be4b2ae2e1e2dba913998faa6088af128fc8fd3ae26203a898882b67d86d63f6ee8f8e216337330db6d928facf9d0ca273845ee5b33a0a136aeb48b7c52d3b95fe73efaf06197ec8753ee0349f19db8730917d0f18a2de9602d3b887bc583ff64dfee67e2bdf4d5cc1c341b89acd3dd5176d2c15ec2a77120b8a49591ca438ae36c52845e5dca550e539da9ba2a2eda49be316f3d6d4b7c83666bd4759940347c29dedd273adac722630a940e104316b4806553ded47132be4e31a50600f5a4dd56825b245b7aae853f56f79e0ec31f7b5db945ee3bb92865acb0d8828598e77446ee50ecd8bf5e7ccbd963445a09e3be215709b0b3bff2e9d12e6549924338f236b4ff973682e2e03fbf6b167e3b3a0f8c3f3c1e8d0e21a71937c918cabab50dd74c011a1a5531cfcf88a5df5fa58f17715f7c7b3a64d9dab6f20a596288969191420ed71daccbae7c1ec88bf74811b5e1f4bd306f3d810c4f3600df2903ffdf8db40ac7153fd93327a1065cf2c4590c8ba9f9391eb6aa600cb42aff8793e4721afeb3d470beda45dad9adfc6f4fdb24eafc63792f5015c656ca37cee82b7ee382bda31d786d6e03d4c8611c4ca464e2360ca747815c9eebd38c8fc7d5eea2db96b29d771a96dc5c884029077125bcc31980564555d21ecce5d0388e1bc1e618c7dfb31b02b1a6730db7eda387dd4ceb96f65178bb088e81133e5086f73c458f84139685ef930945a51979faeab539e4964244709dcb8b38f575d3a3ec1328a0df65fb34241db7cb3250b8ae0dbc44670d2b5cc3a1785d8d281c05256ef2beee3b202d8bce053e55ce1fb2bb208e65d488ae24484b00c2e343fc3544ca546406688022db6e29ceca9539ec095a2a2cfc5f516230f75fc961c5de1e8d33222331f57db02cac5f9208029c6114d041bb1cc7f959f77511f5790a564600c018afc253e5ecd5010bd769b45a04296ca09e87fb63bf3d3b51dd8b3f6d4426a03c0944d09dff654c5718ab1fef063caba34029be6811502e8bb785011dd1e34b0c192915adeeb40faad0725a8f9a62acf61b944a271d20567f350cdee22d76e3cc5966ba742d9c43823af19ba74c60da0df0c5f4e7e26af7224147774a1f8ae09f929066e1769ffb3c40ba9fed13d2670b9e865a155426ed5c83648c0ad34e46f5308b455e0835730fe529668b606f3f52b0d04534d0e14bc0ff0f742359550e6980ac9978455adb3de0f292af12a3700453e035a49eafe98fc0d7f26e42a6c41f380448607b7c96291f98fa6bbd7e32c249a49171f8fa81762a490a1ce5c39d66d35c6ed6c0679440c06197c2e24d48e1de81c711164c02820816afb5393d3d6c801c3c062ac46d1494f52c45ca36faf94894eec9d71e1be6c7256f4aee8dc080156b28623c821ef8d1826ebf0a41332620f42589270e142561374c825e828e2bd9ae41fd34959db48319d54ffe7a1b58ae8f7361cbaee8e26e0e7e1b7f125f8cd99788825efd01c38ec987904190a0ad52bc20cd36cc7209f9269ac87b2fa44d2456661d3056d893cf912c69ae6b2b83d0c781a6d6c33df1910867b71257ab74e244e3ebbac07445069418fe2e440a384e16feedf8e3165676e67866430eb6a8a5334620d8c2cda15b0328bb0c50630886353f95241cf4f3b647a4ff812c70e1b074c4befdc70fbfdbf868bcc81652034b5bfa831f1b686724046dcd17ac91ace83711e9ec7465d14c9d508bce93676a58ef7dae37221436865ad34ac2fd691e3b3e12aee6736dbdeec9b1c05fcedf8b9ced547259a1a40471ebe8b4bfda69d2f884da025e2809fb9f159150bbcb331ca3c502012a7fe76b4fc2771976aeb624ad7f2d72c707f5f19d8ded84581ac5afa697ff99d27d88c9588fe769839c9cc9d6786a0f814667527c53b6253b1825bfe17e7d734d96d61da0ae7349d0922774fa9b4baf332a4568e32cafa417ec659c4ad72cd656a1e2c59c8dee38890ed3acd8b4f8657de41f670106c38c38ba1a553f0f589a57c61f5105d70e0c0953459383cb9337ca972cda1d2cd3056eb07f21c1f5b995a04997fecf501bb201c67fd2afe4d44fedea595969b6b3706087b0f59d2ddbb099d60436a94f0ba33282b29f6e914fe92add4b33cf70b680b905cfa2b2ccb00b9967f99806e8d69783fd35a2d7fbb424e9fde2647609aecb0208bc3864bf95f05e50ba12123edaca8de927b338dfcb3cc597947c606c08315061a7fec98c48f480e2febd26fcc8dc12289aeb0adefa2c2be1766a5bc74ef1aab6c2cdbdfbf1810d956bc889c8e614b7b933ff6e336bb208db5b592775fe71c3ebfad5f47e0d074e1c0cb36761481ec677794f23c3698bd35875719f242e3fc939bc3668f9723f31effe189dabdf4ebbed073eab952c88f13059eee22230bc7724d7266b15726a0b0898cdd274e3e56d0a356166b5d16456249e9e92e84e39f61c0ecdf99ec2cd230440c03fd21cf68f27306628d35ea47367775f39d20a07f3959b38d49e3674061fc1018b647047ad39f77027878badd29927c5806f95aebde5f070fed28ed34052550678d3c6b677a3b5a46f76a98264c42206bf62caa95df5437092b68e025ee9ce2ad733b6db3ec97fd33cdc3b2f77ee90dd86d8bd289ae1a437c86f4153ddcff5e846347bfecc1499bb42980e4fa91790faee1b1991dfead5d7c460348631f0469b2b9e8f65207a00985511e0c41f441d9a3154f5a0298c172fd7135d4bf95c11cdf1769db1cc55f392aec309037599327a7c53c10a56d1ace8ad19186a2fc75dfa9d657c114eae99c1c1a6b4a58440718bea82290bd1c2a67048938c381648ea2b2c7110d748c9c8d782f20430b1427b51d7036e55b0997c6f75717db67a82c88d3647ee036b49392f0467d6010b32f9de3e5e79ef082c5bb975d11d2bf76a97f7159c11a7753db8a065d3126ccda9abbebd2c54374e389942c24b27435868fadb45bb060d3c1084b211e2afa8dfaa2d8dab8dc47fe10e6c32afece7c4976176a7c66d704125c0948c238c843b41b0246be1f50f8e07884cfe7ae8885ca06339a339c8d5978b079e0eb78facfa1dc67ca70733dfefc6c868ca149e0661b70e0134870a3107c8c46711fed14f892d6fc66d95306838688f13b19e904416a8d161cc33527878b38ad10b1c08db21457b2075608be7300d39748e4fcebe02b190f3e8ed32a0ef734b11ca43a21f5f809bba795f5aa0ea01050021d0f5213620af5b08fda6421a42b7c82804a20a6ef6d471babf76f46538327f943476d1d109a3f0dc531233d6f93d8dc27f4745735085f92adf63d617b373fba24f289035710e69eb80da12d36e8eaec22620ffaabadfb824bd5fc309a2c74959505856b5b890bba8f22bc571a9d87e93ba3b9aba6dcf26f7076c0c2e271641835ea25fd49d96c69d4fb8bb8731bd2cbc75146aed10d269f9060462339cde8830b535920be3dbf143eace0f1ea9469b95a64fbd7e5057eb880d4422cbf97cfc3f7140251d4923580ca2113f345cf24a66499ceffd2e39dc4fd74cf448638962957b409f0d218c165c13ffe107aa1dd1d9a02092cd46cf2b353dd2d2ca7b8a7ae8eda0ee18bba269bbffed0c7d400497aee4da0896cf6329d76ccea098fbef9075412d1c2a3644cf0f202b884303d204314ae92c56217b2feb5e7c1e15a99fbdd655fb8f6bbc3ab1259bf03b2ee17c5b7e9443695177ec5040eeff3fc36ceafe143393d76a3d735cfe6c9b632e52dbe64dc1265961e8a27ee9f76c0add9e0581e474d7678214f5b64c932903715befc6b766611f1d7e495573b9a3e009cfcb0ffef7ac57c3561badbfa41c119e541180aa2364de61a601699cd1bf3de01d15794b728e1444efd6ffa1e57d95489c8df91fbc057b66dd6d9f3a01b19f36bc99f0b54ed1f9905067dd1608bce47f5ff1981a25184aacd39e331d8ff3dfa7c012d7e667a69249cb4803b23f7eeaab8ed29c69ba3d2a1b88821ffefc5825650c53b6364f38e0a178312f5d29d5375423cceabc8e1c4e51a566ba3f9b176b858c8860440ff8ebdde725640d2dff6b9160bb69f188755b0ff766b410704cda4c33e1ae2c73b5799a00d2f55de73109728b350302b64df2ce3eaf2e0c6561009b60c2701ac493076305e97ed20c3b42f40b2bc7f13bba4ab8181e2085b07930c6f5579205dff696902be824e65ddc774e886e8d261fe74712a31e406b0f7725b4559d7ad0f27a1a870261aa5bb8a720e7c89ba933770d48821416de070df1abcc6eee1147c20bda090d940aeee2bd48c0f3d94675d9b9cf1a62ba50e31a7af0714dd8325d5fb7142e88c4d22ddb8f0278ee6ba88e361524e291b6d000f6523ad4188b021da9ef4a634ed09eb2002b9c726746c9ffc32f261edb448106aa1e2daaed865255fd1d296fedbbb2de3f7c1f15935e52006492b632ad125aa1e000c9d71bdb945792668e16b26122a3fd7cba1a40db8083068c5c48fd2aaa621c87d9f5621bba442fc26839030dbe4e37fda4046d6503bb03e0f928de25d4cd4e2a40ec93c9021dfcbb25f6e2c943cc85eba8123340d6364949581e8c8c2913d59dafe4297672c0b9e7418485f00cbcf672a588904beb3c074bebf339815b91c7c374ceed5a701e1ade8f5d87ca536120116307ac259577a8e12958425317c482d2c7089bf3d83e12318d1526107a050f3c094492de7255b22e18ca2ff261b3ed197f2f8e67b71b1c5a6a04b99158b58e9baad75201aabe13254617d0de0a9073af62491c67fc18d1ccbf7686a85a99b39e9d7d9c85a0777e47c9fd0e10c932c20f13ef287b44b9b706ec818aa0c48a10caac58a9b8355e84bc820698c2501f0c12e1b67df701cfcbe72dc47a2c87d43753ebfdb24cc838507e241d9fcd3d4955a373209ccda903a3ffced05e4232f2cca9bba197fdba8a9357cb1d6da6d9b4095027dc03e17d59ebc2d358e171da0044df102b193c79390ebcb58023b40c621df71e064b0056bfcf1eaee1eca85357cd1ac78feaa54bbbd85596977ba85003ea60d8685f4e3b756e4f81453077396590fa214f672929e81569442023667b798c24e06ee20dbf64cfccb51b2bca4e2a5b0df137bb37ab3e2854dc7e1b879866a72a5809b563596cc9fd3e53abdbccfd5dbc60662252ddc5c290d72230d79b7504b40fdb45ded2f02e926652c1e04ea4c1c488025ad1098adeebe98e385ab1caec4b9eb4d3bbd5ef3ddf1fd0d72784604a989558fd37f6d4fee20609090b3331e254fec98414a2c54589ee01c9429b7cb574b9167efede1d966a227bf2a8e422f38680d77d3c555cf1117e7d7e804ad730c36a78b7846473d6481bd0839bd3e6982ed47246c370a90b76e5b88de202346fb20b8b6b5ecb6a90b8478d17b175a1821df75b48ecc34866fe5c8960bf64d5ff92831bb9357474bec65e0dd1699b0f0340ee5ac5e9e9d3df66edca20201371fc21ad80aacd49c6b0abcfee9c876c15edcfccde823b55b61cb7b254487ef8c8781a22043f4adaf25df34580a6b3904fd014b50c59fa90eff75fa5fd32aaec9aa10df8a2b9b824952e475c964533942bbe30f4167a11fc15d548e0a31f911030569722f0c67e79e90483f6f0bee1c7f80face1a1b0f940c891be688cb16394f6c07fd29b5f248c211d1f76ec1292755d8bd963e191b3a8851472fbbd2cb732f4fd9fef3a8fb29aea097328173fdeaf56fa2279e86fb954306b040c960d0b601b3a741c96cf1f0bd1172f848585cb3b57d7d2e2a84914526f5a6f9895cf5aa4425b4dbf9f59037756a0321bba204a737e36277e86fd268f6047921f4f8fab69dfee137c07874f12f89084e7117e2c9221690a27f880f17d08d56f9dbc96ffef3920b55fb773dde72e1ba35f3e0c9872e339508281426ab04941df4885f7e0293149f1642c2573e2b6594b8fd953ae2468cf917cdaa0692cf461e3628860935def39af78af5e1540147ab1c70c3ab7f7c76abea0d8541feb43e632d7a2cc7bef15a4700304048ecf135968d0a9644ce899aad05b186a2224bab3836248cc6137472203ebceb29b3e87610df12417ee722f309c54b2e65591d8b929440f3ec43ee9ff8f7b7710668e4312610d1591303d5270394da0ab61e4515af5215dc81137f0dc90f951972731f8d98ceb8b4ea38da7d8dc153ccbae5068781eaf9a4a7b11b4319090261b61aa65a8536292eb5392020eb285b2db07f81e7f764d65037050f1e3748593474c6c1dc11cfcb56e1c916157280098a437265e1c682cbfed717e7275bc6c3bb6c6ef7f0f9fdd19ef82ff2c82284c3a061f57b21d3705aff97710108a7d1217a7ea3feda021d20f1fdca94bbef67e0aeaa3db6ccc2d060f7b33707fe19cb2d0232f1239373bb38e666cbbbf3a697c6d0e957ec6730f56034440e789a7a37304d09eb742f21019a77c608cf578162a55d0aea113c051b110b5281ed8b6638d2b31604e965cb019f2f106bc4e96d1313c70612f1ff18afdce7926270dd242c49cc53792f160d1e143e04d7eb3ca40828b153fac466bc53a084281987b47b806a4ef668859eb9035ef68e9c20bd6bb790fdf6f921569b4e97fae5b7edc761b4944c1d6d90f4df40bc3203ed838d4c61cdeb7a9bbb68d59b2cc00125eecaf06b759ac1b9dd68028225d0a60efa499e4436962362727011eef6cc55962dd4ffe2fd3892907e837045883cc9ba8892ab265a31924f3055d4dee68feff05d9f10ebdf1e8c1c1e7001b5b02a7fe26b9c0641e054ae37854187fb1bb6e9fae05b09e85a1e0e14bc801f2d8b9a178a9a72b147e137e0d83192664a88a3aca4fb6a4f0c5787b20c31bc5975dfbc8bcff8987573bd14b1ca434d93452e67ed01c60be99e535bb3f848888d224520b61cfc1de2d6b2ebef9f24674c31aada52784a0b7b60f351653c71d546cf951e6b4a0d917ac6afd0a713f41833f9f74a3a7d3c19b523299666da2b48676ca7aafebadef05b3bbf4b6b62834046f51d3d4582fb4c9de27a3f5e992853368e4f17f9dba27c8c4438307fc7405f53fb27cc81c1521452a1a5edb0cabdf7a73b1cab0675b619fd5a0fadb7147776e74695c042d9d8bfda045bcef7542b42249f34c7590605d0201a762390f2fee5f3cdb488426609c663c9fc4dc2a5277f3f589a14e6dcc202dfcd89bb148a368ff1792d230c19934143d2c260dbdfb334af863b856e415febd22fba01c568d8f48dba6d92f493cd1164a376f006d55db609cc2c9532a9f56da3b06e3db2a05f797eed57892e2fb677541324bcd763cf4669e7a871e322d0cc6e21befe3c767976f058dbe7a059d673c94c7ac5d49178bf19d32907b6fe66a92cc8ea30a858da43f74354390d6e97021da50812c59a78915e5b33221531bfa054c594ce3a2300e5a7d712773181901dfcf6922e980566fa62b1f2b669a27fbecce29e9be6d22058463e350163f33d18ce92a72d1b470857b6a37998aec5672521a8f0d66ab2bd01de516036ec47d1f63b95b437dc6d5a0168189d5a963cb0a80a9a5f20b03515396e3525f0ab13b0c1e5dd051b4c930da6d57ab6f7dd94ab3e689e0355af0b34871296152a76cce170d7b14d471ee4d9daa93de4ed755f30d45344f724288c17e4b22583158f1305ff55fecf7d526e207fa609886e14c9a168bf364b049409f63590f18a5515de8c1fd8c5a9710b6e33d2ecd01466b799f14be787612b8f17df0c05483a16097c0a504880249e28f1e067663c640a550a8c7ad9d090f7b2e902c5c20936869a5f3d3a014817f90babf847b43cf67ec23f120ae4abc63a418d1d99f359fc2c33a5bb34e1f5780576111a88c5ede834bc41e498548ddd128f9e884f4cd3e1bf1aaa1204079ce74e709306f38f2d6859128fc35d3a74c534ff1dccadfc8fe41f1be9510349af8710eb6d2dbc758be12b65622dad1cf48abc2fc409f5ed6a3af8d0b6548643c46dfba9db4e5827475e6e317c9c018a4dd5de391cc9cca85ec527537e26949e5091baca4f0b563d4c3969f15115e5ccdeb9e40788fe12f9d32d9488a70ae53b819726e4483ea6bbcb76f99775ca5e4f93c76edae462c08d596209f985aa55ef5e786701edcee8d831dd6dc0fee9ad01b6bdd63e886a5e55bdc593390c81e18dfd8c685b81306bad6b7a19a86b2bab5cbf4754708422e99f8f2497d798b3db565e709bcbba4c376c1c60b22b994fe8fdcb25215d505511cc1927f6a35344023d5da0a3ac0830e6aa80f5f7f0d94a67c99c6b22717078aecba2a599daa2acc054cda25e3965172e5fef464ec19aa71de5e84b6de30cc673fbab8c441ea37bfb3fc321a504371bc0996702e9be38db762e339ad7ad66dc2caa887e4ab60272d7963f85b14c941d31e545b85c640427302efe7142f0e0897a8c623ce57da213fbc2d1f90677142fd48cafca0b2934e572833ed6473218d0513dd1f6ecc578e5a1109ddae552b3be0cfe7246d7682a59fe9ae783a0f318d1800d5c466c80c5fd3facd0340f455f081068dd2cda5cda744018d902217152b6c05d37c090f8348b0471053152c2a4570fbab3f6dc30c8e49a63b88a00b3aac75180a633692e35ea976821694e133eb8bb4d31237d002fce1dd2ce55528dafcef2f0e00690562d144bb0e19576ce6ab72deac22067d8edac916b1b07e4eb57ff0b885b1b79f37dcf88135eedc17ffd948b61e4df4985033bcf891dd5b1448c8668947a271d93d03ce31216810a6bb45a6c5a12e290d97a60ad4b5c7384cf19421ac1ca64d346b50771e0b50e5caf1d9dfe056e8da247aa502ff04c8e29ca810a1d3ec7a89bc17dba2936f03a80228171f7999b3f2768617970efe57b14011c80666ac4999a568ebef74e2ca14df0ff6f0fcd47c538be96aaca1e65b53b98447101e49672b48167c0afc1afffe669b0f9718bd3305805c292db9738740b362564e4691cbdf061db1ed3f9db1f8bed82939f835d14f46818e3eb4e25f7a8d77d9d0d7913c45d8a81115c1a5e37b1d3bd1b7b5e6afaaefc81d9700bf83506fbf15457bc0f59f7008cc803efdcb6d39e388f6b28e80d47134265cc5438804b12d50e61a489da829dca05792d2ac182ba747331e88a7118f7dd38067f7d38f37be362260effacbc33863bb47aeebbadeae648a1090718266eedd2ed5a2c23f168759198aa92b2ac45c2a68ff212f29260e641a38541b066d39df4e95cd1c8e7e6ffae1b8017e6f629db3910b07496c8a81e4e66ac2321fd9e7ebfecf5bf6e922d7a79fb710a2d42dad1916c9b186c2c50c818fdb1afa19be867d943ee98f732fe3a01364281c0f6d0eb64a278721dc7bff5316256b0f4251abbd9b8ba7c7c12a3bf02a1fbc9ca94b965588fbc82343d07df8e06eaa5ed2137fec129351d80a9048a7d78b31ffaf2e388864a763c4af7aa53000e0bb2eb8ac0e4272cbb79dc6a7d65890f125c523c7cfddacdedbe87938aca915c92c807dab26be7d748827d4e3188676312ef1ac8460b29e8e715f4075e33104ce82e6785aadf17a7cf82d2a705e9f2d0fd25810ba33d76e54b48eda3effc01f37c89db38af81922fadc8c3361fe74ed51eac5e4437108106ffdedb339b406c082d62a8bf718989846d23f966e1ea39103010f767b3a6f0a0a2041b1dafcb787e69ffad75ed2a0081b92a4136ad5ae557c55a4b6219a390103428181ab36f329ad182a92957495c", 0x2000, &(0x7f0000006dc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006640)={0x90, 0x0, 0x6, {0x3, 0x0, 0x20, 0xfffffffffffffff9, 0x400, 0xc, {0x1, 0x9, 0x8, 0x1, 0x1, 0x4, 0x8, 0x123, 0xdab5, 0xa000, 0x0, r2, r3, 0x6, 0xffff}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) setxattr$security_capability(&(0x7f00000000c0)='./cgroup\x00', &(0x7f0000000100), &(0x7f0000000140)=@v3={0x3000000, [{0xffffffff, 0x3}, {0x2, 0x7fff}], r2}, 0x18, 0x2) 5m15.624266555s ago: executing program 2 (id=914): r0 = creat(&(0x7f0000001380)='./file0\x00', 0x4) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000280)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_P2P_DEVICE(r0, &(0x7f0000000340)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x28, 0x0, 0x300, 0x70bd25, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x7ff, 0x48}}}}, ["", "", "", "", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) sendmsg$TIPC_NL_MEDIA_GET(r1, 0x0, 0x2048800) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r4, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000000380)={0x40, r5, 0xb97534d5fe9704cf, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_STA_SUPPORTED_RATES={0x6, 0x13, [{0x4, 0x1}, {0x60, 0x1}]}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_AID={0x6, 0x10, 0x580}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6, 0x12, 0x1}]}, 0x40}, 0x1, 0x0, 0x0, 0x80c1}, 0x0) sendmsg$NL80211_CMD_SET_PMK(r1, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x30, r5, 0x40e6b43aeaacdab9, 0x70bd26, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_PMKR0_NAME={0x14, 0x102, "4b646e90da3041429dbaf7dc2683c01c"}]}, 0x30}, 0x1, 0x0, 0x0, 0x40}, 0x850) 5m15.542721509s ago: executing program 2 (id=916): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x66002, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x5, 0x22052, r0, 0xe) r1 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$sock_x25_SIOCDELRT(r1, 0x890c, &(0x7f0000000140)={@null, 0x3, 'gre0\x00'}) ioctl$BLKCRYPTOGENERATEKEY(r0, 0xc030128a, &(0x7f0000000080)={&(0x7f0000000000)=""/115, 0x73}) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x66002, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x5, 0x22052, r0, 0xe) (async) syz_init_net_socket$x25(0x9, 0x5, 0x0) (async) ioctl$sock_x25_SIOCDELRT(r1, 0x890c, &(0x7f0000000140)={@null, 0x3, 'gre0\x00'}) (async) ioctl$BLKCRYPTOGENERATEKEY(r0, 0xc030128a, &(0x7f0000000080)={&(0x7f0000000000)=""/115, 0x73}) (async) 5m15.415131957s ago: executing program 2 (id=918): openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x66002, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x2b38094, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') r2 = open(&(0x7f0000000000)='.\x00', 0x800000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000800), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',Troup_id=', @ANYRESDEC=0x0]) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x1, &(0x7f0000002280)={{'fd', 0x3d, r4}, 0x2c, {'rootmode', 0x3d, 0x4000}}) ioctl$AUTOFS_IOC_PROTOSUBVER(r2, 0x40049366, 0x0) r5 = syz_open_dev$vcsn(&(0x7f0000001f80), 0x1, 0x0) read$char_usb(r5, 0x0, 0x60ff) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r7, &(0x7f0000000300)=ANY=[@ANYBLOB="1500000065ffff017f000e0800395032303030"], 0x15) r8 = dup(r7) write$FUSE_BMAP(r8, &(0x7f0000000000)={0x18}, 0x18) getpid() write$FUSE_DIRENTPLUS(r8, &(0x7f00000003c0)=ANY=[@ANYBLOB="b0"], 0xb0) r9 = openat$fuse(0xffffffffffffff9c, &(0x7f00000003c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r9, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r9, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r8, &(0x7f0000000200)={0x50, 0x0, r10, {0x7, 0x29, 0x20200, 0x0, 0x0, 0x0, 0x1836, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}}, 0x50) mount$9p_fd(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={'trans=fd,', {'rfdno', 0x3d, r6}, 0x2c, {'wfdno', 0x3d, r8}}) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x0) 5m14.338965464s ago: executing program 2 (id=923): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f00000000c0)={'lo\x00', &(0x7f0000000080)=@ethtool_eee={0x45, 0x81, 0x6, 0x100, 0xe, 0x5, 0x47, 0x1, [0x3, 0x2d5]}}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x22052, r0, 0x93774000) 4m59.154735386s ago: executing program 32 (id=923): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f00000000c0)={'lo\x00', &(0x7f0000000080)=@ethtool_eee={0x45, 0x81, 0x6, 0x100, 0xe, 0x5, 0x47, 0x1, [0x3, 0x2d5]}}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x22052, r0, 0x93774000) 2m53.18401659s ago: executing program 1 (id=1594): r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x88801) (async) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000040)=0x0) migrate_pages(r1, 0x2, &(0x7f0000000080)=0x2, &(0x7f00000000c0)=0x5) (async) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), r0) (async) close_range(r0, r0, 0x0) setsockopt$inet_sctp_SCTP_AUTH_DEACTIVATE_KEY(r0, 0x84, 0x23, &(0x7f0000000140)={0x0, 0x3}, 0x8) r3 = socket$kcm(0x29, 0x0, 0x0) ioctl$FS_IOC_GETFSMAP(r0, 0xc0c0583b, &(0x7f0000000180)={0x0, 0x0, 0x2, 0x0, '\x00', [{0x5, 0x1, 0x1, 0x2, 0x3, 0x6}, {0xfffffff9, 0xfffff47e, 0x2, 0x5, 0x9, 0xffffffffffffff81}], ['\x00', '\x00']}) (async) bind(r3, &(0x7f00000002c0)=@l2tp6={0xa, 0x0, 0x2, @private1, 0x5, 0x3}, 0x80) (async) r4 = openat$cgroup_ro(r0, &(0x7f0000000340)='blkio.throttle.io_service_bytes_recursive\x00', 0x0, 0x0) ioctl$SIOCSIFMTU(r4, 0x8922, &(0x7f0000000380)={'dvmrp0\x00', 0x7fc000}) (async) sendmsg$TIPC_NL_LINK_GET(r0, &(0x7f0000000640)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000600)={&(0x7f0000000400)={0x1fc, r2, 0x4, 0x70bd2d, 0x25dfdbfe, {}, [@TIPC_NLA_MEDIA={0xa8, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x44, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}]}, @TIPC_NLA_MEDIA_PROP={0x44, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1000}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x200}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfe}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}]}]}, @TIPC_NLA_PUBL={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x8}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x2}]}, @TIPC_NLA_PUBL={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x476563bb}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x8}]}, @TIPC_NLA_MON={0x24, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0xfffffffe}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x4}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xe}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x2}]}, @TIPC_NLA_SOCK={0x38, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x8}, @TIPC_NLA_SOCK_CON={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x8000}]}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7}, @TIPC_NLA_SOCK_REF={0x8}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x6}]}, @TIPC_NLA_BEARER={0x98, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1c}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_BEARER_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7fffffff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x240000}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e24, @broadcast}}, {0x20, 0x2, @in6={0xa, 0x4e21, 0x74d9, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0xd6b}}}}, @TIPC_NLA_BEARER_NAME={0x17, 0x1, @l2={'eth', 0x3a, 'bridge_slave_0\x00'}}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7fff}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xff}]}, @TIPC_NLA_PUBL={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xfffffffd}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x9}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x3}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0xbea9}]}]}, 0x1fc}, 0x1, 0x0, 0x0, 0x20008000}, 0x24008000) (async) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(r4, 0x84, 0x6b, &(0x7f0000000680)=[@in={0x2, 0x4e22, @broadcast}, @in6={0xa, 0x4e20, 0x100, @dev={0xfe, 0x80, '\x00', 0x26}, 0xb9bd}, @in={0x2, 0x4e24, @local}, @in={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x1, 0x0}}, @in={0x2, 0x4e22, @rand_addr=0x64010100}], 0x5c) (async) r5 = epoll_create1(0x80000) ioctl$SIOCRSGCAUSE(r4, 0x89e0, &(0x7f0000000700)) sendto$phonet(r4, &(0x7f0000000740)="704d7f5e8e6dc60977fd8c51a6440002728857a61d941e92751c26556b0a74679f17216604961b97755f71afece037e0a75e432071a3d942024d0a82ca817dcdf63e1426c0eb8fb17624711be188730522c4248e9b2bd6ae2660eb36648834256a8cd9d557c473f55bf01b4ff80ee143757fe37b12eb34088555fadf147bb7afac77b3a97688815af54c47266b0b978c105b239bd1900b75220e7566d848fa91992289c598ef99f8016ff8f291c0e7cb68cc1c79f18a732ef28863b587f75c32923bf86f328bfbaf57bf734ec6716f1e0fe0747a428d59bedeb907971aa1", 0xde, 0x14, 0x0, 0x0) (async) fcntl$setownex(r5, 0xf, &(0x7f0000000840)={0x3, r1}) ioctl$FICLONERANGE(r0, 0x4020940d, &(0x7f0000000880)={{r0}, 0x7fffffff, 0x4, 0x9}) (async) write$cgroup_subtree(r0, &(0x7f00000008c0)={[{0x2b, 'io'}, {0x2b, 'blkio'}, {0x2d, 'blkio'}, {0x2b, 'pids'}, {0x2d, 'net_prio'}, {0x2d, 'cpu'}]}, 0x27) (async) socket$packet(0x11, 0x3, 0x300) (async) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000900)={0x4, 0x18, 0x0, 0x2, "fd77b522faa9e179b5c50aee4614d8b956b8a3959107ab136531ac168ab80311"}) (async) lsetxattr$trusted_overlay_upper(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980), &(0x7f00000009c0)={0x0, 0xfb, 0x10d, 0x3, 0x0, "4b5ab3b6fbe13f1bfb78f06c404bc0e5", "581a4faaaa1acb75c64157ec9b16a816cf8b41324ca9342f784725332071dbfce90c402268ba2793a31382e31eb1b619a74f9904338733e50663c5204bda2d41210c668719afe93d3a1ca05b42e69966073b3086fa3c5ce6280ebd4408f0a28eed19fd1604f9644e4e8634f966ada875a6c592112ff5b91964e77c6241cee4a295bc0008dd489d6a7d9a01f73cd2eb42a62905e74be7c490299a30564c2da9022bffef5e667f64afe215fb3cb9673284d46fd31cea4595a260cedf9eba9af188a284cb56035de9650edbe0c22014092a60e9ed1bbba4c2265f13847909a445d2d77548b4881e6544d287def64d8308d059979c64e065c210"}, 0x10d, 0x2) openat$fuse(0xffffffffffffff9c, &(0x7f0000000b00), 0x2, 0x0) (async) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r4, 0xc0105303, &(0x7f0000000b40)={0x8, 0x9, 0xf}) faccessat(r4, &(0x7f0000000b80)='./file0\x00', 0x0) (async) syz_init_net_socket$nfc_raw(0x27, 0x3, 0x0) r6 = socket$inet_sctp(0x2, 0x1, 0x84) (async) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r4, 0x84, 0x6c, &(0x7f0000000bc0)={0x0, 0x1000, "651dd07a72bbf5bd00fb68f068627e541f346c16d7620ec211188125e2de263f00eeb6baffa318a0b7396086e3e52e56a42689c8e5e5ec5e2dd795576f8cfcf24952558779830e5ce429e059807fb6230fc5f77bc7810b403fb6e9e5edb81f43f439fd958636f1d5db62d86f7132ec88a1e98fc313215c3b7c1f5fd7ee65a3ad42d7fa2c65ca8de55a36400ccebdd12c3ae385e30cc5d32d5a867a2ecae18be01197d171062668f25231f351780349ca2d0f22e4fda510d395a6b336545e384528540a8f68078f5189f0c68caf9c95853a013c84331d8c1f0957b8013ef5e4c99bee31ac7728ae011b7192b7110b761b1050c082562aaf4517d9df1c1e14e99694ae94dac6828912ea27f1d1cd9f4d2fe54e2a119ddb761d51a40febd48613346ec683061b0bea41a8187c47452eb8538121fa1c41195201def15600e225ccc8bdac61b94edf22494556e6539c777d9f80376b529e7e7c72ab33af1452e72d5e99b58b898cf776c559a49e65482e8604e58af5fe9e647e8f3f59fcda66ad05d7cb471394ab5f0920cba5ba8f2d3a934daf6ed7e98acb4af1953c4c3b48872404b00e5358fff60b68d0ba5459cd857c7c69b41c9dc709835158610dd413991752f58ef810ffb949d3f9f4ba38af5e037d17ffca5344f026f5955c78a482fc1f9d569399d8e913824f2f000616bdfc698eea4d665a9db457e54c8c70e13cd24a40281b940fda852ac4f0a11bd822b727b3e82005a176ee1b7b6d85abd083111be2a7b3c842c6e252a6acbd8f1eff52c74daf1f5c6c9821ae6b671fdfc7d8ce46aff9b3cd7ab1bbbb65a0a323cfd2d0a3abd0564097992c9ad1f3f1f0642ff15fe2bc51b1de0e943b7d6e14231776d13c4c9305cc62ec9bb988dedac981436e6e86f39c45f5a1b60436c99fe0e0c09503a9fd550ff87a98be37f861fd291c292cdca005f5516d99282e1b7596ccbbfeab33caa8891bda0b364b1eb9a04111edc871b66749a2d3b9de5fb431d07f07ff21b83c84520c315bf4c5f259cba89d530c4555122c301ed1d6802bd568466254285a81dc77a59ebc41ddd6aa2ed1f749dd7b26bbbf6c8006a7aa1740dde9e4869c784f4bff92b4eb59bf6aa4d86f375afc5008f3b06ea90640a56c34115a6d189755e4e338fb5f53025bfe64bece13e41b633ce0ccd4944723cadcfad7f1d34ee957ffb93623a46000d33e7fbf41e3bb66385965300619233e84f9e4c3be037c214430e6634fb985b18d217efff89e8a05aa12160ce76ed7dc62a15a210faffcc1efa8eeb8870ff3b8e2281f9fc2058c5dc0565e0e5ed89ce1038ddeb49aa099c8ad140c5893cfea0bd462cb89e9b4e85d44e95532161251d18ff0bd1fe87098f1aefbac65e70652481db9b00b372c0cd7ed004f18fd6b3b7cc06bade9f8e331a1bcb32cfbb6fb68c36bbc7811b1ce8659d968d435769caa2511982b04fc5673c64630425986760457000b2415f182fcd99107485bff4bfebe52b424dc87ce3ad81450d347f45ecffbd501e4d894578db6eee97dbc210fe2a3325b047a7ccb7d7206b1a23a6a89ec2c6f564ddb14c31e8e127294c910a9cf25f1755957e2f90a6f4f585e07a6f5359fac0aa5b546d01f5fc8f8f8282a320b2c5d4ab19cff4a65d8b4c96f83a5091c4243828122f9def6acbaa375686a42cb5958864bee7292a9372e1696f5a88a726dd4f47e42e38b007b85ffc5ea67270b677ae885e200baf034f149b5b81eb1ccdaaf6aba3e6356df1ee54a41a2069e0b8911bc9990cbcc30b6d442104893952972742269d60522100e41c1a97e694f2497dee05345ccb079b92381f2ef0f82d3f644cb386c16e91fe57cad79e52c4054640b31dba31cf1a4b5151559548c5a40c3b1ac7fcd7adbda802d267c0365c5355027ab6a2b3ae880e737cb60235bde50bf79dd8ad571c5a8f999c2700fbb70319643b03436c09a6097de5d72267efb028f8f954dc98f3df65b784308ccb0ac35da0be01b00225f677543ab30f4887d34672ac2097fb0e366c91494964417ec2ce71e3e5972f548c84dab74da990dcb429e97d7458dd22ef9e19093479c0fccc8f767b9b73c4660ac45ab6b6214a4ecd99889f9e87e818abf9a4707569d26f58e2f7b098cc9ee5f18cfc6d303c8b1fa56eeb1315c5c965729f10c33516e202f762cff52d603779feabe224e1a3c4d535bf8f9a96a3cf9b50ebda378b30902615363e601eb21ddaedbcde0291361ec7f88721dbc3c13d028c992b6652e56c0c7d7012f5e9578b0ab7c96345a2232ffce89a00d9fbc1cfac14159500b00d7c005036258a4e1862ce58bef29db1bf785c0c831a168c526b9bc73f29e26b871727cba5543b472d498ca160aab4b8bfd2b80a80bdcf0b9af57af16555fc16852036b2166c22f3c864b2d556c7ab7cf01ce04199c3d6b196d3613d7dac0403deb42dcf03413f12f2886dd9d493aef9aed92456b75010c6efe0c66bf743da4948d47b01937e33b96e7c8e6627364b78afba64337d2b1fd2c86a8e40bd2733c3b6d0a7c53af74fd20ceef3f8f5708a329faf8939d4b217d95ba8f771a70bee738816458bad6e17f8c6af6e9e9ff075831d2bbce3b02cea0404e78bdcdc01822cb1a00f8089a2fb74d08e001de9ed5c6adc1ece9394c2398359b9ac1b9be58ddd88b822465688160e489cc737b65db42fb105993fb472e9011f86f4bca089da3c14737da24d3637d0ce1175d728908f77a45ccb3406b01c382ecaf724b4431274ff0c260d0cfb6461cf398d7964d20c0e4c330542b9a444d05ae4bf326ee2feac68b71ff9a5d4c72a2d90897aab6383366bbe6446b80c960babf667d38168d43bc4b9ac71f77551d0c905d74db03206e981d0a7b1744f9edba46ca2faf7708fbfba2e7d22a56100a6f21cf7032b7474dd549394d1beb87ba8bf2fce92120eb4f3f39c6c18b0404d8badc1a3cbcc6db20fcdd6e3df144d0c9fd0df4b58431075df558c849fdb70c5a6a2eae908c93931cea7d1457e6bacc8b14e36009f2ebd12635cdf16316399ffa9cac3a847fdb0c721a26dede1d5f12eb9cdd3edb301ede8f4cfd71acf7e24919b2efa64b19ab31b004adc7c04c4290a090dc0ae0f028ef364e3b0da4b56fca973b33982c097f9f535a4ebf4c01dd6e736216b5da31e6592197a5c834b7833f25d33294d7e350ca4ae14c4b3a313cc511985c957b8949dcf0a4d938a199af343c3552897c87e3611840e7cc42d2fb670ecc644073ca3ac488c09b882ce2d97436730574209c2a2ed8fcc9a6006e68c22978a635a74af2f78538172529812edcb7e311cf9a325b0f863dd17e32368d1073d7c742d9b1fa6a70ae448d8774d57f66b0c6f45729e9e892589c9b001caeb438e11213b962ffd0cf8af4fa68065bb7ec5a0323f061fa8efb212d618eaf37b735b42b2455f53dc345f37f7f99b4fedf9e5692c728db38760f6207ccadafc58389682aac740b32cdfdca05a6d05a7bfadda870dde97ec5ef9cf83b2447f0d807ff32d5f451ea625d77dfdc7325b4833d52fd2f89303f0d295432f139c47be514511e437d5fdf80f38b921926700d94bad2f3b0ba080591405736718c780c9b72b728e5c5d4c0b90ab10903489c1289428402653bd6c1ebfaa94bf1f0b3c7262679e4bef99b0ecb14f5636ec9415dbbda6403803de05d82255e411f5c91a94b8f9776498e08b0c09ecbd2d8999ea98caa1d04353b1eddd168028eb8bfa4cc6ec23aad7bf5a4ce31e4e435406ec6562cb9245ab0834571aa4ca518c34215538d1542de56ec44104d4ace34e8efec92b3107111ce68e11bd15ec02262bc71de84c8dcac4a474c59e3956c682a50ca64bc20eeb716ba38079f4eb77adf5c8c8a26070ec1097ad0d550ec246ae99e3b808fd3a4ab6d5a742df7d5789ebdba9084c66fd9303b0bba4e1d9c7552a49e30a7c4ffc640c48e970a1031f83959d972b39e354baffe91aa30f4c88e92431542e8d733adeac111cf545f0d64ffc94f497a80fca49ab83f6dbd1b0c924e1425a737064cfaab7995ddebd915f641afa8fa7d23cd72c098fcc7293973ca3779c0f640de88c4ea00c516eb12d9deb39e1b6c9a119b778144a90558a15a299e16e5a27d40a43540229b91cefd0ae0addb41dd2f185632ca8f57cd37692f84bd3eecc4442f45f854aef11fa01fd387a0b21a2679a327e73854a819db85410c04afea31465deb79a3a0a271354275ee08042a6c7818f50201cacf1d37d76ed8ac754762e842126111e4f9dccb644b0d52cc774d7237c487d0cfc24fb1f03cc9f71e576f8e6464c56cf864e6f2c52dff7c1e514df62a4e67f0ec399ac9d80efcfddf2933eead7bdebb8de70f6f1f91c0c9b78b051af0d66683de12fc32b2d7ec4172ee03ccb8d3fad423e87f7ae7703f8388d9a18d4b586a3e29d8755edf65a70f681fb68f38f5c0237ba101586991a93bc4f2cd92b395b1aaafd586d0f6c3e3e1fb3a2df5dc959edcbd1b6af1534ba61a8ecaacc8a4ba89f43abdaa5de3f26d4f771c9f98097d59b30870b4505dc770a31acf960fd4c7bb42e3b7a1df3eeba55f3951c3b223c12b1c747285eb4488d0c5c453b69f099898f4984570a31a26aa2e77ca8199323c4fb2840f41c7847d869cee8b9af0fe85f1b8fd29092a153280f541b80a0183a9d65638b0dd2010b15e2bb48f35f35740100fb445beca88319529cde8b50a1718057daa254039189089dc596cb45af5bb3ce7365dbd605b43fca968f20b95ee9481d3dd523ff3072a76aafb0373c93c920436dfde369d175cc2e321b881658c12982fcdc1e38690d79f01e8dad254c483a5bfb425d1f620f823ed5106daa4c5617f72bb7f29e5dd5bc3ac3045b5adf2812f561c2ad885fee59abb3f3502b2159f66028a17a98372d9331cf7729ac3657c3ef2afcf99eec427feea641010749899b1bb07faa2b3b91d9e437aa5ebd44e9a426fc57aca27466d26e6aa66d1f7443ed8ba8f2a136dadfad4867055f999ef6407df0a5247aaf6083bc489b3d0ca35f6d9a0a91dc929fe9cd3330f6731ae286be12aff528c63621cb60e15e5d693ded0e4b1b1257a003f763a99543a61ceff1919d04dc85d18a7f13dfe23bc54f66d57cd21e1132821ac6996c820b6654359756451962d04302fd02194016a91d72d01fefc9ac5d1fbca17d9e1356fafabb3f4028568678bbc948cd47f2b1cc980cfa23f32a7c494f187e0c2da785721ca7a2be45e84b8b1dbbdc99c359b33116d81ec55533e9ba5bff53d692295e0c24d0b7fdd90dbff7589e91ae89b3cad01d2b9269fb993b128027f6e63c3dc32a3c409494361918dca99769cfe997ea89bc76aec77008a306b1e73ec87b4b1562f76b1ce3313783a87f6601a494ba30fee031749170f4fbfa2a47167ac55941fc3a492f139bd574afc0814a3fc0d84d31a556f5387569c843ed0eb32e27a61cc85df2b77c47cf622c89427eaa5b264d5d4940a4fcc9ee08f8fe1962e8d2c8abeac527b5f0fcb4beb3e3d542c5ed7802bb7e8ec30cc9c02744e14e18efbd523375ee9183e10b2415990592d6040a7caeb7ac6c4b972adaaa9a1a34c1d692eebdf76bf3b0c8a758f6424f035848a2acd84ec0f5efcfec2b1c4abb806337397390efc4eff852234327539bd1cb8218bdb16464f5fa3afab51bf850660881cd0760f01c6565ee653de65a749fba35cb4c9b6d6682589bbffe0ba73a8f439492fdf34558d499942932b63b669030da8c7eab309441517d1bd2a22bdfad0933741be3ed25480563bc7dfe9ad67cc70"}, &(0x7f0000001c00)=0x1008) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r6, 0x84, 0x1f, &(0x7f0000001c40)={r7, @in6={{0xa, 0x4e21, 0x7, @ipv4={'\x00', '\xff\xff', @multicast2}}}, 0x0, 0x6}, &(0x7f0000001d00)=0x90) (async) ioctl$TIOCGETD(r4, 0x5424, &(0x7f0000001d40)) 2m53.135232944s ago: executing program 1 (id=1595): socket$nl_netfilter(0x10, 0x3, 0xc) (async) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)={0x44, 0x9, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x10040047}, 0x240008c4) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)={0x38, 0x9, 0x6, 0x201, 0x0, 0x0, {0x1}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x10, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x10048047}, 0x4000050) sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[], 0x38}, 0x1, 0x0, 0x0, 0x10048047}, 0x4000050) creat(&(0x7f0000001380)='./file0\x00', 0x4) mount(&(0x7f0000001400)=@rnullb, &(0x7f0000001440)='./file0\x00', &(0x7f0000000000)='omfs\x00', 0x0, 0x0) 2m53.044530943s ago: executing program 1 (id=1596): r0 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000000), 0x22003, 0x0) close(r0) mount(&(0x7f0000000000)=@rnullb, &(0x7f00000000c0)='./cgroup\x00', &(0x7f0000000040)='hpfs\x00', 0x208002, 0x0) 2m53.037928138s ago: executing program 1 (id=1597): ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wg2\x00'}) (async) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wg2\x00'}) mount(&(0x7f0000000100)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000240)='udf\x00', 0x808000, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(0xffffffffffffffff, 0x4058534c, &(0x7f0000000080)={0x3f2, 0xfff, 0xffffffff, 0x9, 0x4, 0x3}) 2m52.976207134s ago: executing program 1 (id=1598): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x66002, 0x0) r1 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = syz_kvm_setup_syzos_vm$x86(r2, &(0x7f0000c00000/0x400000)=nil) syz_kvm_add_vcpu$x86(r3, 0x0) syz_kvm_add_vcpu$x86(r3, &(0x7f0000000180)={0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="14000000000000001800000000000000020000000900000014000000000000001800000000000000ffffffff450300000a0000000000000074000000000000003e653e0f35c4610159900020000066bad104b8f4ffffffef66bad004b0f5eec744240000000100c7442402b6100000c7442406000000000f011424b9600800000f3266b810010f00d00f01cb0f01c566baf80cb8be64db8bef66bafc0c66b8060066efc31400000000000000180000000000000001000000060000000a00000000000000590000000000000066f3410f09f264f7990700000066450feb35006800000f35430f00d1c4c37bf0e9f1c744240004840000c74424026e000000c7442406000000000f011424470f17230f07470f01dfc346000000000000002000000000000000080000000000000010000000000000000a000000000000005b000000000000000f210bf04008bad40000000f01c42e410f01c2b9800000c00f3235001000000f302ef2430f060f01d548b803000000000000000f23c80f21f8350000c0000f23f8c48229bc6020660f35c332000000000000001800000000000000fc0a000000000000460000000000000020000000000000000000000000000000ffffffffffffff7f320000000000000018000000000000009a0000400000000032000000000000001800000000000000c70900000000000014000000000000001800000000000000020000005c000000d11af8fb91ce773349fe81afb44b9ec17d04785293f45895663e3524c6c16f5450fdd99982fa9458"], 0x210}) r4 = socket$rxrpc(0x21, 0x2, 0x2) setsockopt$inet6_IPV6_IPSEC_POLICY(r4, 0x110, 0x22, 0x0, 0x0) r5 = socket$nl_rdma(0x10, 0x3, 0x14) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x4010, r5, 0x2000) mkdir(&(0x7f0000000200)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000140)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') r6 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', 0x0) r7 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r7}, &(0x7f0000000300)) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="043e1f1b"], 0x22) r8 = inotify_init() readv(r8, &(0x7f0000000140)=[{&(0x7f0000000340)=""/263, 0x107}], 0x1) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) fsetxattr$trusted_overlay_redirect(r5, &(0x7f00000000c0), &(0x7f0000000100)='./file1\x00', 0x8, 0x0) fcntl$setstatus(r8, 0x4, 0x42800) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x0, 0x0) ioctl$AUTOFS_IOC_PROTOSUBVER(r6, 0x40049366, 0x0) r9 = socket$inet_icmp_raw(0x2, 0x3, 0x1) sendto$inet(r9, 0x0, 0x0, 0x0, &(0x7f0000001200)={0x10, 0x2}, 0x10) ioctl$BLKRRPART(r0, 0x125f, 0x0) 2m51.637722556s ago: executing program 1 (id=1602): r0 = socket$inet6(0xa, 0x3, 0x6) fstat(r0, &(0x7f00000000c0)) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x40241, 0x0) getsockopt$IP_VS_SO_GET_VERSION(r0, 0x0, 0x480, &(0x7f0000000080), &(0x7f00000001c0)=0x40) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) write$vhost_msg(0xffffffffffffffff, &(0x7f0000001300)={0x1, {&(0x7f0000000300)=""/4096, 0x1000, &(0x7f0000000140)=""/69, 0x1, 0x2}}, 0x48) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cpuacct.stat\x00', 0x0, 0x0) write$dsp(r2, &(0x7f0000000240)="10551919cda206e020395dc2dadb6544abae7856aae631e521751892bd9e01c929a1ae4932f2030000c4a6db275246ff6bff6e79866a4c261f290eb5fc01ce2354f9c81ae10462c0f8a65a5c76a8a12881b8bd4ee2dac99b0f2d9da9208f4f9df0ffb583699d6f69fee7f8dfefbb239b28c4c3fdb70eb3b9134ddd745e97474403461da6ec9fce2abdb0750329e1b1abfb347be9cb9489d613985167efda7a", 0x9f) socket$kcm(0x2, 0xa, 0x2) ioctl$F2FS_IOC_START_ATOMIC_WRITE(r2, 0xf501, 0x0) 2m36.564305363s ago: executing program 33 (id=1602): r0 = socket$inet6(0xa, 0x3, 0x6) fstat(r0, &(0x7f00000000c0)) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x40241, 0x0) getsockopt$IP_VS_SO_GET_VERSION(r0, 0x0, 0x480, &(0x7f0000000080), &(0x7f00000001c0)=0x40) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) write$vhost_msg(0xffffffffffffffff, &(0x7f0000001300)={0x1, {&(0x7f0000000300)=""/4096, 0x1000, &(0x7f0000000140)=""/69, 0x1, 0x2}}, 0x48) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cpuacct.stat\x00', 0x0, 0x0) write$dsp(r2, &(0x7f0000000240)="10551919cda206e020395dc2dadb6544abae7856aae631e521751892bd9e01c929a1ae4932f2030000c4a6db275246ff6bff6e79866a4c261f290eb5fc01ce2354f9c81ae10462c0f8a65a5c76a8a12881b8bd4ee2dac99b0f2d9da9208f4f9df0ffb583699d6f69fee7f8dfefbb239b28c4c3fdb70eb3b9134ddd745e97474403461da6ec9fce2abdb0750329e1b1abfb347be9cb9489d613985167efda7a", 0x9f) socket$kcm(0x2, 0xa, 0x2) ioctl$F2FS_IOC_START_ATOMIC_WRITE(r2, 0xf501, 0x0) 2m33.962268718s ago: executing program 3 (id=1659): r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/rcu_normal', 0x2, 0x2) write$FUSE_NOTIFY_STORE(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB='-', @ANYRESDEC], 0x28) creat(&(0x7f0000001380)='./file0\x00', 0x12c) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x30, r2, 0x1, 0x70bd2a, 0x25dfdbfe, {{}, {}, {0x14, 0x19, {0x0, 0xbbb, 0x7}}}}, 0x30}, 0x1, 0x0, 0x0, 0x4000100}, 0xc000) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) pipe2(&(0x7f0000000040)={0xffffffffffffffff}, 0x0) sync_file_range(r3, 0x1, 0x9, 0xd) mount(&(0x7f0000001400)=@rnullb, &(0x7f0000001440)='./file0\x00', &(0x7f0000000000)='omfs\x00', 0x8002, 0x0) 2m33.812129725s ago: executing program 3 (id=1660): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) (async) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) ioprio_set$pid(0x1, 0x0, 0x0) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) (async) r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r2 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r2, 0x0, 0x60, &(0x7f0000000b80)={'filter\x00', 0xb001, 0x4, 0x3a8, 0xe8, 0xe8, 0x2c0, 0x2c0, 0x2c0, 0x2c0, 0x7fffffe, 0x0, {[{{@uncond, 0xc0, 0xe8}, @unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x9, 0x9}}}, {{@uncond, 0xc0, 0xe8, 0x0, {0x0, 0x1e03}}, @unspec=@AUDIT={0x28}}, {{@arp={@loopback, @dev={0xac, 0x14, 0x14, 0x2d}, 0xff000000, 0xffffff00, 0xf, 0x9, {@empty, {[0x0, 0xff, 0x20ebd73230e7e6c7, 0xff, 0x0, 0xff]}}, {@empty, {[0xff, 0xff, 0xff]}}, 0x8, 0x9, 0x7, 0x81, 0x3, 0x3, 'bond0\x00', 'syz_tun\x00', {}, {}, 0x0, 0x20}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x3f8) read$FUSE(0xffffffffffffffff, &(0x7f0000001180)={0x2020, 0x0, 0x0}, 0x2020) getresuid(&(0x7f0000000040), &(0x7f00000000c0)=0x0, &(0x7f0000000100)) stat(&(0x7f00000031c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) write$FUSE_CREATE_OPEN(r1, &(0x7f0000000200)={0xa0, 0x0, r3, {{0x3, 0x1, 0x7, 0x984, 0x6, 0xff, {0x2, 0x80000001, 0xe69, 0xb, 0x44d0, 0x4, 0x6, 0x7, 0x8, 0x8000, 0x5, r4, r5, 0x7, 0x9}}, {0x0, 0xa}}}, 0xa0) sendfile(r0, r0, 0x0, 0x7ffff000) (async) sendfile(r0, r0, 0x0, 0x7ffff000) 2m32.88429456s ago: executing program 3 (id=1665): mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x2, 0x4000172, 0xffffffffffffffff, 0x0) r0 = open$dir(&(0x7f0000000000)='.\x00', 0x0, 0x20) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_IRQCHIP(r2, 0x8208ae63, &(0x7f0000000840)={0x1, 0x0, @ioapic={0x6000, 0x2, 0x80000000, 0xc6, 0x0, [{0xf, 0xe3, 0x81, '\x00', 0x2}, {0x7, 0x2, 0xf9}, {0x26, 0x3, 0x0, '\x00', 0xd}, {0x38, 0x8, 0x9, '\x00', 0xfa}, {0x0, 0x5, 0x1, '\x00', 0x5}, {0xa8, 0x5, 0xff, '\x00', 0xd1}, {0x4, 0x2, 0x9, '\x00', 0x8b}, {0x7, 0x3, 0x6d, '\x00', 0xb0}, {0x1, 0x9, 0x8, '\x00', 0x3}, {0x3, 0xe7, 0x1, '\x00', 0x2}, {0x0, 0x40, 0x6, '\x00', 0x2}, {0x2, 0x20, 0x1, '\x00', 0x1}, {0x80, 0x4, 0x6, '\x00', 0x1}, {0x38, 0x5, 0xfd, '\x00', 0xac}, {0x8, 0x2, 0x5, '\x00', 0x89}, {0x4, 0x9, 0x2, '\x00', 0xf}, {0x8, 0x80, 0xc0, '\x00', 0x8}, {0x0, 0x9, 0x3, '\x00', 0xed}, {0x6, 0xb, 0xe, '\x00', 0x3}, {0x4, 0x3, 0xc7, '\x00', 0x80}, {0x3, 0x0, 0x8, '\x00', 0x8}, {0x4d, 0xff, 0xff, '\x00', 0xb4}, {0x3, 0x7, 0x8, '\x00', 0xff}, {0x3, 0x4, 0x6, '\x00', 0xf2}]}}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x15, 0x7, 0x0, 0x180, 0x4, 0x10, 0xf1, 0x0, 0x7fffffffffffe, 0x5, 0x0, 0x9, 0x0, 0x5, 0x0, 0xbdb], 0x1, 0x3c4210}) ioctl$KVM_SET_IRQCHIP(r2, 0x8208ae63, &(0x7f0000000280)={0x1, 0x0, @pic={0x1, 0xc, 0x1, 0x3, 0x4d, 0x6, 0x20, 0x6, 0x0, 0x7, 0x0, 0xa8, 0x94, 0x50, 0xf8, 0xde}}) ioctl$AUTOFS_IOC_SETTIMEOUT(r2, 0x80049367, &(0x7f00000004c0)=0x2) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) r7 = dup2(r6, r4) ioctl$KVM_GET_DEVICE_ATTR(r7, 0x4018aee2, &(0x7f00000000c0)=@attr_other={0x0, 0x0, 0x6, 0x0}) sendmsg$RDMA_NLDEV_CMD_PORT_GET(r7, &(0x7f0000000300)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x50, 0x1405, 0x300, 0x70bd26, 0x25dfdbfe, "", [{{0x8}, {0x8, 0x3, 0x4}}, {{0x8, 0x1, 0x1}, {0x8, 0x3, 0x3}}, {{0x8, 0x1, 0x2}, {0x8, 0x3, 0x1}}, {{0x8, 0x1, 0x1}, {0x8, 0x3, 0x3}}]}, 0x50}, 0x1, 0x0, 0x0, 0x4}, 0x8000) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000180)={0x1aa1, 0x8000, 0x4, 0x8, 0x5, 0x200}) r8 = openat(r0, &(0x7f0000000080)='./cgroup\x00', 0x404302, 0x0) socket$unix(0x1, 0x2, 0x0) write$FUSE_NOTIFY_DELETE(r8, &(0x7f0000000340)={0xc1, 0x6, 0x0, {0x5, 0xffffffffffffffff, 0x98, 0x0, 'squ(\x91\x00\x00\x17J\xfe\x89P\xa3\x8b\x12H\a\xda\xf0\x98\xfc+\t\x00\x03]\xc0\xb0V\xa2\xa2\xe4\\|\x1e@\xbc\xda\x1b5\x1c\x06\r%\t\x9a\xce\x95\x1e\x97\xc0\x9c\x1c\x8a\x87\xcb\xd7u\xd0i|\xfe\xd6\x04\x0e\x14-.\xdem?=\x7f\xb8\x82E5\xe6m\x1d\xc1#\xd6\xb4T\xa1Q<\x05z\xa0\x9fD\xf1d\x15\x86\xce\xcd^\xf4\xad\\\xe6\xd1m\x00S\xd0\xa8\x1a\x1cxK\x06-@V\xbcv\x1f)J+\xaa\xa8\x00'/152}}, 0xc1) r9 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet6_int(r9, 0x29, 0x5, 0x0, 0x0) setsockopt$WPAN_WANTLQI(r8, 0x0, 0x3, &(0x7f0000000100), 0x4) bind$bt_l2cap(r7, &(0x7f0000000140)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0xffff, 0x2}, 0xe) syz_usb_connect(0x2, 0x24, &(0x7f0000000640)={{0x12, 0x1, 0x201, 0x42, 0x41, 0xee, 0x10, 0x4dd, 0x9050, 0x4382, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x9, 0x2, 0x10, 0xdb, [{{0x9, 0x4, 0x44, 0x2, 0x0, 0x2, 0x6, 0x0, 0xf9}}]}}]}}, &(0x7f00000002c0)={0x0, 0x0, 0x1a, 0x0}) io_cancel(0x0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x5, 0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x2}, 0x0) mount(&(0x7f0000000000)=@rnullb, &(0x7f00000000c0)='./cgroup\x00', &(0x7f0000000040)='squashfs\x00', 0x300002, 0x0) 2m31.244958682s ago: executing program 3 (id=1672): r0 = socket$kcm(0x10, 0x2, 0x4) close(r0) (async) close(r0) socket$kcm(0x10, 0x2, 0x0) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) close_range(r1, r1, 0x0) sendmsg$inet(r0, &(0x7f0000000040)={0x0, 0x3, &(0x7f00000011c0)=[{&(0x7f0000000140)="5c00000013006bcc9e3be35c6e17aa31076b876c1d0000007ea60864160af36514000cc00800020006000c00060006000364bc24eab556a705251e618294ff0051f60a84c9f4d4938037e786a6d0001000000e4509c5bbcd72c6c953", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async) sendmsg$inet(r0, &(0x7f0000000040)={0x0, 0x3, &(0x7f00000011c0)=[{&(0x7f0000000140)="5c00000013006bcc9e3be35c6e17aa31076b876c1d0000007ea60864160af36514000cc00800020006000c00060006000364bc24eab556a705251e618294ff0051f60a84c9f4d4938037e786a6d0001000000e4509c5bbcd72c6c953", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) r2 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$TIOCGSID(r2, 0x5429, 0x0) openat$comedi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/comedi4\x00', 0x60080, 0x0) (async) r3 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/comedi4\x00', 0x60080, 0x0) ioctl$COMEDI_BUFINFO(r3, 0xc02c640e, &(0x7f0000000140)={0x0, 0xffff, 0x5, 0xd0b, 0x6, 0x5, 0xb}) (async) ioctl$COMEDI_BUFINFO(r3, 0xc02c640e, &(0x7f0000000140)={0x0, 0xffff, 0x5, 0xd0b, 0x6, 0x5, 0xb}) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000001c0), 0x46742, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) r7 = syz_io_uring_complete(0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(0xffffffffffffffff, 0x80047c05, &(0x7f0000000300)=0xffffffffffffffff) ioctl$VIDIOC_QUERYBUF(r4, 0xc0585609, &(0x7f0000000340)=@multiplanar_fd={0xcbe5, 0xb, 0x4, 0x100000, 0x3cf4, {r5, r6/1000+60000}, {0x0, 0xc, 0x2, 0x3, 0x5, 0x2, 'qIy-'}, 0x8, 0x4, {&(0x7f0000000280)=[{0x1, 0xdbb45d8a, {r7}, 0x5}, {0x3, 0x7f, {}, 0xa}]}, 0x9, 0x0, r8}) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r10 = socket$kcm(0x2, 0x3, 0x2) syz_open_dev$vim2m(&(0x7f0000000580), 0x3, 0x2) (async) r11 = syz_open_dev$vim2m(&(0x7f0000000580), 0x3, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r11, 0xc0145608, &(0x7f0000000100)={0x410000, 0x2, 0x2}) (async) ioctl$vim2m_VIDIOC_REQBUFS(r11, 0xc0145608, &(0x7f0000000100)={0x410000, 0x2, 0x2}) ioctl$vim2m_VIDIOC_S_FMT(r11, 0xc0d05605, &(0x7f0000000080)={0x2, @vbi={0xfff, 0xf, 0x1fe, 0x32314d59, [0x4, 0x6fe], [0x7, 0x8], 0x108}}) ioctl$SIOCSIFHWADDR(r10, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) r12 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r12, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) (async) bind$inet(r12, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) write$tun(r9, &(0x7f0000001240)={@val={0x8, 0x800}, @val={0x7, 0x0, 0x0, 0xffff, 0x14}, @ipv4=@udp={{0x5, 0x4, 0x3, 0x1b, 0x2c, 0x66, 0x0, 0x40, 0x11, 0x0, @private=0xa010102, @empty}, {0x4e20, 0x4e20, 0x18, 0x0, @wg=@data={0x4, 0x2, 0x8}}}}, 0x3a) mount(&(0x7f0000000000)=@rnullb, &(0x7f00000000c0)='./cgroup\x00', &(0x7f0000000040)='squashfs\x00', 0x208002, 0x0) 2m30.620507415s ago: executing program 3 (id=1673): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000140), 0x8900, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000140), 0x2001, 0x0) clock_adjtime(0xffffffd3, &(0x7f0000000440)={0x7fff, 0x0, 0x8000008c1f, 0x800000000, 0x0, 0xbc, 0x400, 0x6, 0x0, 0x0, 0x81, 0x80000000000, 0x7125, 0x1, 0x102, 0x200, 0xfffffffffffffffc, 0x1, 0x3, 0x4, 0x1, 0xffff, 0x0, 0x8, 0x0, 0x80000000000000}) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x300000a, 0x22052, r0, 0x93771000) 2m30.38618938s ago: executing program 3 (id=1674): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x155340, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r2, 0x4048aec9, &(0x7f0000000740)={0x3, 0x0, @ioapic={0x2, 0x296a, 0xf7c, 0x3, 0x0, [{0x98, 0x27, 0x81, '\x00', 0x7f}, {0x1, 0xc, 0x81, '\x00', 0xf5}, {0xeb, 0x4, 0x9, '\x00', 0xe}, {0x6, 0x8, 0x3, '\x00', 0x8f}, {0xff, 0x7c, 0xb1, '\x00', 0x7}, {0xf, 0x2, 0x8, '\x00', 0xaa}, {0x7f, 0x8, 0x1, '\x00', 0x8}, {0x0, 0x3, 0x2, '\x00', 0x67}, {0x2, 0x7, 0x91, '\x00', 0x8}, {0x8, 0x3, 0x43, '\x00', 0x80}, {0xfc, 0x2, 0x4, '\x00', 0x3}, {0x2, 0x3, 0x3, '\x00', 0x8}, {0x6, 0x6, 0xc, '\x00', 0xa6}, {0x8, 0x0, 0x8, '\x00', 0x9}, {0x4, 0x4e, 0x9}, {0xe0, 0x5f, 0x4, '\x00', 0x3}, {0x5, 0x5, 0x7, '\x00', 0x5}, {0x0, 0x3, 0x3, '\x00', 0xff}, {0x5, 0x0, 0xf, '\x00', 0x3}, {0x4, 0x6, 0xb, '\x00', 0x3}, {0x7e, 0x5, 0x7, '\x00', 0x4}, {0x7, 0x40, 0x9, '\x00', 0x10}, {0x2, 0x8, 0x1, '\x00', 0x7}, {0x2, 0x7f, 0x92, '\x00', 0x8}]}}) r3 = syz_open_dev$loop(&(0x7f0000000080), 0x3, 0x62000) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x5, 0x12, r3, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000380), 0x4000000004882, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f00005a9000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f00004b0000/0x4000)=nil) ioctl$KVM_SET_PIT2(r2, 0x4070aea0, &(0x7f0000000440)={[{0x3, 0x0, 0x9, 0xc4, 0xdf, 0xb, 0x7, 0x2, 0x2, 0x8, 0xe3, 0x1, 0x3}, {0x2, 0x5e5, 0x4, 0x8, 0x2, 0x7, 0x3, 0x3, 0x8, 0x5, 0x35, 0x81, 0xa}, {0x8, 0xfffb, 0x2, 0x7, 0xaa, 0x7b, 0x9, 0x5, 0x81, 0x9, 0xc, 0xd, 0x4}], 0x70b}) io_setup(0x1, &(0x7f00000004c0)=0x0) io_submit(r5, 0xf3, &(0x7f00000000c0)=[&(0x7f0000000140)={0x3a0012fb, 0x2759, 0x7, 0x1, 0x0, r4, &(0x7f0000000000)="98", 0x3e8000072a, 0x1000000, 0x0, 0x10}]) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f00000003c0)={&(0x7f0000659000/0x4000)=nil, &(0x7f000007b000/0x2000)=nil, &(0x7f00006d5000/0x1000)=nil, &(0x7f0000241000/0x4000)=nil, &(0x7f000002d000/0x3000)=nil, &(0x7f0000770000/0x2000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x6000)=nil, &(0x7f0000549000/0x4000)=nil, &(0x7f00003b2000/0x4000)=nil, &(0x7f00005f6000/0x3000)=nil, &(0x7f0000000180)="b3c3719a6cc946804c142d0a6be55ac8e0cf61f4254d5ab6be683ad331a343b5760694105acfd47e7f0037844a648fb2aab5cf98576874cc46d2070a68afa1a9d1539e5b2d4b57c8168926171a49118dc84a16d2de0232ba4252ee656ef7a04ecade4dd9d82b5a661c34c409b9bf5757157d0a1da9838e4cc65c3d666879408d9ff76de7dbb9ccaaf150a352c9bb08066bdca0b5096efa1636e7bc6b379677c2d7191958328d50429932d0bfb66e0e68dc245b471ae8bbca484b6d339b6cbba76f5488e8962b0946f1663bd318a4222e0a8df188a066", 0xd6, r0}, 0x68) preadv(r0, &(0x7f0000000080)=[{&(0x7f0000000280)=""/212, 0xfffffed3}], 0x1, 0xffeffffb, 0x1007) openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x155340, 0x0) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) (async) ioctl$KVM_SET_IRQCHIP(r2, 0x4048aec9, &(0x7f0000000740)={0x3, 0x0, @ioapic={0x2, 0x296a, 0xf7c, 0x3, 0x0, [{0x98, 0x27, 0x81, '\x00', 0x7f}, {0x1, 0xc, 0x81, '\x00', 0xf5}, {0xeb, 0x4, 0x9, '\x00', 0xe}, {0x6, 0x8, 0x3, '\x00', 0x8f}, {0xff, 0x7c, 0xb1, '\x00', 0x7}, {0xf, 0x2, 0x8, '\x00', 0xaa}, {0x7f, 0x8, 0x1, '\x00', 0x8}, {0x0, 0x3, 0x2, '\x00', 0x67}, {0x2, 0x7, 0x91, '\x00', 0x8}, {0x8, 0x3, 0x43, '\x00', 0x80}, {0xfc, 0x2, 0x4, '\x00', 0x3}, {0x2, 0x3, 0x3, '\x00', 0x8}, {0x6, 0x6, 0xc, '\x00', 0xa6}, {0x8, 0x0, 0x8, '\x00', 0x9}, {0x4, 0x4e, 0x9}, {0xe0, 0x5f, 0x4, '\x00', 0x3}, {0x5, 0x5, 0x7, '\x00', 0x5}, {0x0, 0x3, 0x3, '\x00', 0xff}, {0x5, 0x0, 0xf, '\x00', 0x3}, {0x4, 0x6, 0xb, '\x00', 0x3}, {0x7e, 0x5, 0x7, '\x00', 0x4}, {0x7, 0x40, 0x9, '\x00', 0x10}, {0x2, 0x8, 0x1, '\x00', 0x7}, {0x2, 0x7f, 0x92, '\x00', 0x8}]}}) (async) syz_open_dev$loop(&(0x7f0000000080), 0x3, 0x62000) (async) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x5, 0x12, r3, 0x0) (async) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) (async) openat$nullb(0xffffffffffffff9c, &(0x7f0000000380), 0x4000000004882, 0x0) (async) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) (async) mremap(&(0x7f00005a9000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f00004b0000/0x4000)=nil) (async) ioctl$KVM_SET_PIT2(r2, 0x4070aea0, &(0x7f0000000440)={[{0x3, 0x0, 0x9, 0xc4, 0xdf, 0xb, 0x7, 0x2, 0x2, 0x8, 0xe3, 0x1, 0x3}, {0x2, 0x5e5, 0x4, 0x8, 0x2, 0x7, 0x3, 0x3, 0x8, 0x5, 0x35, 0x81, 0xa}, {0x8, 0xfffb, 0x2, 0x7, 0xaa, 0x7b, 0x9, 0x5, 0x81, 0x9, 0xc, 0xd, 0x4}], 0x70b}) (async) io_setup(0x1, &(0x7f00000004c0)) (async) io_submit(r5, 0xf3, &(0x7f00000000c0)=[&(0x7f0000000140)={0x3a0012fb, 0x2759, 0x7, 0x1, 0x0, r4, &(0x7f0000000000)="98", 0x3e8000072a, 0x1000000, 0x0, 0x10}]) (async) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f00000003c0)={&(0x7f0000659000/0x4000)=nil, &(0x7f000007b000/0x2000)=nil, &(0x7f00006d5000/0x1000)=nil, &(0x7f0000241000/0x4000)=nil, &(0x7f000002d000/0x3000)=nil, &(0x7f0000770000/0x2000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x6000)=nil, &(0x7f0000549000/0x4000)=nil, &(0x7f00003b2000/0x4000)=nil, &(0x7f00005f6000/0x3000)=nil, &(0x7f0000000180)="b3c3719a6cc946804c142d0a6be55ac8e0cf61f4254d5ab6be683ad331a343b5760694105acfd47e7f0037844a648fb2aab5cf98576874cc46d2070a68afa1a9d1539e5b2d4b57c8168926171a49118dc84a16d2de0232ba4252ee656ef7a04ecade4dd9d82b5a661c34c409b9bf5757157d0a1da9838e4cc65c3d666879408d9ff76de7dbb9ccaaf150a352c9bb08066bdca0b5096efa1636e7bc6b379677c2d7191958328d50429932d0bfb66e0e68dc245b471ae8bbca484b6d339b6cbba76f5488e8962b0946f1663bd318a4222e0a8df188a066", 0xd6, r0}, 0x68) (async) preadv(r0, &(0x7f0000000080)=[{&(0x7f0000000280)=""/212, 0xfffffed3}], 0x1, 0xffeffffb, 0x1007) (async) 2m15.180681341s ago: executing program 34 (id=1674): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x155340, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r2, 0x4048aec9, &(0x7f0000000740)={0x3, 0x0, @ioapic={0x2, 0x296a, 0xf7c, 0x3, 0x0, [{0x98, 0x27, 0x81, '\x00', 0x7f}, {0x1, 0xc, 0x81, '\x00', 0xf5}, {0xeb, 0x4, 0x9, '\x00', 0xe}, {0x6, 0x8, 0x3, '\x00', 0x8f}, {0xff, 0x7c, 0xb1, '\x00', 0x7}, {0xf, 0x2, 0x8, '\x00', 0xaa}, {0x7f, 0x8, 0x1, '\x00', 0x8}, {0x0, 0x3, 0x2, '\x00', 0x67}, {0x2, 0x7, 0x91, '\x00', 0x8}, {0x8, 0x3, 0x43, '\x00', 0x80}, {0xfc, 0x2, 0x4, '\x00', 0x3}, {0x2, 0x3, 0x3, '\x00', 0x8}, {0x6, 0x6, 0xc, '\x00', 0xa6}, {0x8, 0x0, 0x8, '\x00', 0x9}, {0x4, 0x4e, 0x9}, {0xe0, 0x5f, 0x4, '\x00', 0x3}, {0x5, 0x5, 0x7, '\x00', 0x5}, {0x0, 0x3, 0x3, '\x00', 0xff}, {0x5, 0x0, 0xf, '\x00', 0x3}, {0x4, 0x6, 0xb, '\x00', 0x3}, {0x7e, 0x5, 0x7, '\x00', 0x4}, {0x7, 0x40, 0x9, '\x00', 0x10}, {0x2, 0x8, 0x1, '\x00', 0x7}, {0x2, 0x7f, 0x92, '\x00', 0x8}]}}) r3 = syz_open_dev$loop(&(0x7f0000000080), 0x3, 0x62000) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x5, 0x12, r3, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000380), 0x4000000004882, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f00005a9000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f00004b0000/0x4000)=nil) ioctl$KVM_SET_PIT2(r2, 0x4070aea0, &(0x7f0000000440)={[{0x3, 0x0, 0x9, 0xc4, 0xdf, 0xb, 0x7, 0x2, 0x2, 0x8, 0xe3, 0x1, 0x3}, {0x2, 0x5e5, 0x4, 0x8, 0x2, 0x7, 0x3, 0x3, 0x8, 0x5, 0x35, 0x81, 0xa}, {0x8, 0xfffb, 0x2, 0x7, 0xaa, 0x7b, 0x9, 0x5, 0x81, 0x9, 0xc, 0xd, 0x4}], 0x70b}) io_setup(0x1, &(0x7f00000004c0)=0x0) io_submit(r5, 0xf3, &(0x7f00000000c0)=[&(0x7f0000000140)={0x3a0012fb, 0x2759, 0x7, 0x1, 0x0, r4, &(0x7f0000000000)="98", 0x3e8000072a, 0x1000000, 0x0, 0x10}]) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f00000003c0)={&(0x7f0000659000/0x4000)=nil, &(0x7f000007b000/0x2000)=nil, &(0x7f00006d5000/0x1000)=nil, &(0x7f0000241000/0x4000)=nil, &(0x7f000002d000/0x3000)=nil, &(0x7f0000770000/0x2000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x6000)=nil, &(0x7f0000549000/0x4000)=nil, &(0x7f00003b2000/0x4000)=nil, &(0x7f00005f6000/0x3000)=nil, &(0x7f0000000180)="b3c3719a6cc946804c142d0a6be55ac8e0cf61f4254d5ab6be683ad331a343b5760694105acfd47e7f0037844a648fb2aab5cf98576874cc46d2070a68afa1a9d1539e5b2d4b57c8168926171a49118dc84a16d2de0232ba4252ee656ef7a04ecade4dd9d82b5a661c34c409b9bf5757157d0a1da9838e4cc65c3d666879408d9ff76de7dbb9ccaaf150a352c9bb08066bdca0b5096efa1636e7bc6b379677c2d7191958328d50429932d0bfb66e0e68dc245b471ae8bbca484b6d339b6cbba76f5488e8962b0946f1663bd318a4222e0a8df188a066", 0xd6, r0}, 0x68) preadv(r0, &(0x7f0000000080)=[{&(0x7f0000000280)=""/212, 0xfffffed3}], 0x1, 0xffeffffb, 0x1007) openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x155340, 0x0) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) (async) ioctl$KVM_SET_IRQCHIP(r2, 0x4048aec9, &(0x7f0000000740)={0x3, 0x0, @ioapic={0x2, 0x296a, 0xf7c, 0x3, 0x0, [{0x98, 0x27, 0x81, '\x00', 0x7f}, {0x1, 0xc, 0x81, '\x00', 0xf5}, {0xeb, 0x4, 0x9, '\x00', 0xe}, {0x6, 0x8, 0x3, '\x00', 0x8f}, {0xff, 0x7c, 0xb1, '\x00', 0x7}, {0xf, 0x2, 0x8, '\x00', 0xaa}, {0x7f, 0x8, 0x1, '\x00', 0x8}, {0x0, 0x3, 0x2, '\x00', 0x67}, {0x2, 0x7, 0x91, '\x00', 0x8}, {0x8, 0x3, 0x43, '\x00', 0x80}, {0xfc, 0x2, 0x4, '\x00', 0x3}, {0x2, 0x3, 0x3, '\x00', 0x8}, {0x6, 0x6, 0xc, '\x00', 0xa6}, {0x8, 0x0, 0x8, '\x00', 0x9}, {0x4, 0x4e, 0x9}, {0xe0, 0x5f, 0x4, '\x00', 0x3}, {0x5, 0x5, 0x7, '\x00', 0x5}, {0x0, 0x3, 0x3, '\x00', 0xff}, {0x5, 0x0, 0xf, '\x00', 0x3}, {0x4, 0x6, 0xb, '\x00', 0x3}, {0x7e, 0x5, 0x7, '\x00', 0x4}, {0x7, 0x40, 0x9, '\x00', 0x10}, {0x2, 0x8, 0x1, '\x00', 0x7}, {0x2, 0x7f, 0x92, '\x00', 0x8}]}}) (async) syz_open_dev$loop(&(0x7f0000000080), 0x3, 0x62000) (async) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x5, 0x12, r3, 0x0) (async) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) (async) openat$nullb(0xffffffffffffff9c, &(0x7f0000000380), 0x4000000004882, 0x0) (async) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) (async) mremap(&(0x7f00005a9000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f00004b0000/0x4000)=nil) (async) ioctl$KVM_SET_PIT2(r2, 0x4070aea0, &(0x7f0000000440)={[{0x3, 0x0, 0x9, 0xc4, 0xdf, 0xb, 0x7, 0x2, 0x2, 0x8, 0xe3, 0x1, 0x3}, {0x2, 0x5e5, 0x4, 0x8, 0x2, 0x7, 0x3, 0x3, 0x8, 0x5, 0x35, 0x81, 0xa}, {0x8, 0xfffb, 0x2, 0x7, 0xaa, 0x7b, 0x9, 0x5, 0x81, 0x9, 0xc, 0xd, 0x4}], 0x70b}) (async) io_setup(0x1, &(0x7f00000004c0)) (async) io_submit(r5, 0xf3, &(0x7f00000000c0)=[&(0x7f0000000140)={0x3a0012fb, 0x2759, 0x7, 0x1, 0x0, r4, &(0x7f0000000000)="98", 0x3e8000072a, 0x1000000, 0x0, 0x10}]) (async) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f00000003c0)={&(0x7f0000659000/0x4000)=nil, &(0x7f000007b000/0x2000)=nil, &(0x7f00006d5000/0x1000)=nil, &(0x7f0000241000/0x4000)=nil, &(0x7f000002d000/0x3000)=nil, &(0x7f0000770000/0x2000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x6000)=nil, &(0x7f0000549000/0x4000)=nil, &(0x7f00003b2000/0x4000)=nil, &(0x7f00005f6000/0x3000)=nil, &(0x7f0000000180)="b3c3719a6cc946804c142d0a6be55ac8e0cf61f4254d5ab6be683ad331a343b5760694105acfd47e7f0037844a648fb2aab5cf98576874cc46d2070a68afa1a9d1539e5b2d4b57c8168926171a49118dc84a16d2de0232ba4252ee656ef7a04ecade4dd9d82b5a661c34c409b9bf5757157d0a1da9838e4cc65c3d666879408d9ff76de7dbb9ccaaf150a352c9bb08066bdca0b5096efa1636e7bc6b379677c2d7191958328d50429932d0bfb66e0e68dc245b471ae8bbca484b6d339b6cbba76f5488e8962b0946f1663bd318a4222e0a8df188a066", 0xd6, r0}, 0x68) (async) preadv(r0, &(0x7f0000000080)=[{&(0x7f0000000280)=""/212, 0xfffffed3}], 0x1, 0xffeffffb, 0x1007) (async) 31.120487324s ago: executing program 6 (id=2206): syz_usb_connect(0x2, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x19, 0x9c, 0x4f, 0x20, 0x7c9, 0xe, 0x5d4f, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0xd6, 0x2, 0x0, 0xff, 0xff}}]}}]}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$IPVS_CMD_GET_CONFIG(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)={0xf4, 0x0, 0x300, 0x70bd2a, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_SERVICE={0x5c, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x6}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x4, 0x1}}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0xc}, @IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e22}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e20}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e22}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x1}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@empty}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xffff}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x2}, @IPVS_CMD_ATTR_DEST={0x3c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_INACT_CONNS={0x8}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x8}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x380}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x6}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0xfffffffb}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e24}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x8}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xfff}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e23}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@remote}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x8}]}]}, 0xf4}, 0x1, 0x0, 0x0, 0x800}, 0x1) connect$bt_l2cap(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0x0, @none, 0x4, 0x2}, 0xe) mount(0x0, &(0x7f0000000240)='.\x00', &(0x7f000015bffc)='nfs\x00', 0x800, &(0x7f0000000000)) r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000300)={0x0, @empty, @empty}, 0xc) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)={0x48, r4, 0x5, 0x0, 0x0, {{0x12}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @from_mac=@device_b}, @NL80211_ATTR_HT_CAPABILITY={0x1e}]}, 0x48}}, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) sendfile(r1, r1, 0x0, 0x7ffff000) 27.832301526s ago: executing program 6 (id=2219): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nfc(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NFC_CMD_LLC_SET_PARAMS(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r1, 0x400, 0x9, 0x25dfdbfe, {}, [@NFC_ATTR_LLC_PARAM_RW={0x5, 0x10, 0x6}, @NFC_ATTR_LLC_PARAM_LTO={0x5, 0xf, 0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x94}, 0x804) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000180), r0) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f00000001c0)=0x0) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000200)=0x0) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000240)=0x0) sendmsg$NFC_CMD_LLC_GET_PARAMS(r0, &(0x7f0000000340)={&(0x7f0000000140), 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x48, r2, 0x4, 0x70bd29, 0x25dfdbfe, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r3}, @NFC_ATTR_FIRMWARE_NAME={0x8, 0x14, 'nfc\x00'}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r4}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r5}, @NFC_ATTR_FIRMWARE_NAME={0x8, 0x14, 'nfc\x00'}, @NFC_ATTR_FIRMWARE_NAME={0x9, 0x14, '\'&.{('}]}, 0x48}, 0x1, 0x0, 0x0, 0x800}, 0x20000814) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r7, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x70, 0x0, 0x1, 0x3, 0x0, 0x0, {0x2, 0x0, 0x3}, [@CTA_MARK_MASK={0x8, 0x15, 0x1, 0x0, 0x1}, @CTA_LABELS={0x8, 0x16, 0x1, 0x0, [0x3]}, @CTA_MARK_MASK={0x8, 0x15, 0x1, 0x0, 0x4}, @CTA_MARK={0x8, 0x8, 0x1, 0x0, 0x2cb1}, @CTA_ZONE={0x6, 0x12, 0x1, 0x0, 0x1}, @CTA_HELP={0x14, 0x5, 0x0, 0x1, {0xf, 0x1, 'netbios-ns\x00'}}, @CTA_LABELS_MASK={0x20, 0x17, [0x1, 0x0, 0x8, 0x8, 0x4, 0x1ff, 0x2]}]}, 0x70}}, 0x20080) r8 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000004c0), 0x20000, 0x0) ioctl$SG_GET_LOW_DMA(r8, 0x227a, &(0x7f0000000500)) r9 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r8, &(0x7f0000000540)={0xa, 0x4e23, 0x1, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, 0x800}, 0x1c) write$nci(r8, &(0x7f0000000580)=@NCI_OP_CORE_INIT_RSP={0x0, 0x0, 0x2, 0x1, 0xa, {{0x0, 0x9, 0x10, "22c0272ed7d8c5258ed4cc19505bd8fb"}, {0x9, 0x511, 0x2, 0x1, 0x3}}}, 0x24) r10 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000600), r6) ioctl$sock_SIOCGIFINDEX_802154(r6, 0x8933, &(0x7f0000000640)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(r0, &(0x7f0000000740)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000700)={&(0x7f0000000680)={0x50, r10, 0x20, 0x70bd2c, 0x25dfdbfd, {}, [@NL802154_ATTR_MIN_BE={0x5, 0x11, 0x4}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r11}, @NL802154_ATTR_MAX_BE={0x5, 0x10, 0xff}, @NL802154_ATTR_MIN_BE={0x5, 0x11, 0x7}, @NL802154_ATTR_MIN_BE={0x5, 0x11, 0x4}, @NL802154_ATTR_MIN_BE={0x5, 0x11, 0x7}]}, 0x50}}, 0x4000000) r12 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r8, &(0x7f0000000880)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000840)={&(0x7f00000007c0)={0x6c, 0x0, 0x10, 0x70bd2b, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x7}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0xfffff125}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x48, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x3a}}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @remote}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @empty}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x40000}, 0x4000004) r13 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000900), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r0, &(0x7f0000000a00)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x48, r13, 0x200, 0x70bd29, 0x25dfdbfc, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r11}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x1}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xaaa2}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0x1000}, @IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x48}, 0x1, 0x0, 0x0, 0x8000}, 0x1) fcntl$getflags(r8, 0xb) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r8, 0x89f2, &(0x7f0000000b00)={'tunl0\x00', &(0x7f0000000a40)={'gre0\x00', 0x0, 0x0, 0x700, 0xa2, 0xffffffff, {{0x20, 0x4, 0x1, 0x8, 0x80, 0x65, 0x0, 0xf6, 0x4, 0x0, @dev={0xac, 0x14, 0x14, 0x38}, @initdev={0xac, 0x1e, 0x1, 0x0}, {[@timestamp={0x44, 0x20, 0xf6, 0x0, 0xe, [0x8, 0x8, 0x6741881f, 0x2, 0x4, 0x800, 0x9]}, @lsrr={0x83, 0x17, 0x9, [@private=0xa010101, @initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010102, @rand_addr=0x64010101, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @timestamp={0x44, 0xc, 0xfc, 0x0, 0x1, [0xffffffff, 0x81]}, @timestamp_addr={0x44, 0xc, 0xd5, 0x1, 0x1, [{@local, 0x10000}]}, @timestamp={0x44, 0x8, 0x1c, 0x0, 0x8, [0x1]}, @cipso={0x86, 0x13, 0x2, [{0x1, 0xd, "df99069c261ceaca2c838f"}]}]}}}}}) ioctl$sock_inet6_SIOCSIFADDR(r9, 0x8916, &(0x7f0000000b40)={@private0, 0x50, r14}) recvfrom(r8, &(0x7f0000000b80)=""/2, 0x2, 0x40000020, &(0x7f0000000bc0)=@nl=@proc={0x10, 0x0, 0x25dfdbfb, 0x80000000}, 0x80) ioctl$SNDRV_RAWMIDI_IOCTL_DRAIN(r8, 0x40045731, &(0x7f0000000c40)=0x4) sendmsg$NFC_CMD_LLC_SET_PARAMS(r12, &(0x7f0000000d40)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000d00)={&(0x7f0000000cc0)={0x34, r2, 0x800, 0x70bd2a, 0x25dfdbfb, {}, [@NFC_ATTR_LLC_PARAM_MIUX={0x6, 0x11, 0x53d}, @NFC_ATTR_LLC_PARAM_LTO={0x5, 0xf, 0x1}, @NFC_ATTR_LLC_PARAM_RW={0x5, 0x10, 0x1}, @NFC_ATTR_LLC_PARAM_LTO={0x5, 0xf, 0x6}]}, 0x34}}, 0x0) syz_usb_control_io$uac1(0xffffffffffffffff, &(0x7f0000001400)={0x14, &(0x7f0000001300)={0x20, 0x7, 0x8, {0x8, 0x3, "e23712ff61f2"}}, &(0x7f0000001340)={0x0, 0x3, 0x80, @string={0x80, 0x3, "eada8cf8e3ffd2d046e0ba4122cd86ee805e0922942f1b859294a070d1dc9b51be277536b03ac8666356d3f396e91f906307199f2c4be0f11d8baea816a51e3a24232cd6ecf7109fd7bc2eb3aa8bcb807b872a7160b1da84b16ccc08f83db1300b4697c2935403982b20fb018d9ace6fc8cee0d5d94f4640364b6db0ed4e"}}}, &(0x7f0000001640)={0x44, &(0x7f0000001440)={0x40, 0x10, 0x13, "bb8f6b7140d82826de712656ca6fa65a2b0787"}, &(0x7f0000001480)={0x0, 0xa, 0x1, 0x4}, &(0x7f00000014c0)={0x0, 0x8, 0x1, 0xd}, &(0x7f0000001500)={0x20, 0x81, 0x3, "6b8d3a"}, &(0x7f0000001540)={0x20, 0x82, 0x1, "a4"}, &(0x7f0000001580)={0x20, 0x83, 0x3, "df96ea"}, &(0x7f00000015c0)={0x20, 0x84, 0x4, "d99269b4"}, &(0x7f0000001600)={0x20, 0x85, 0x3, "ca1560"}}) 27.088405081s ago: executing program 6 (id=2223): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x28200, 0x0) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWFLOWTABLE={0x40, 0x16, 0xa, 0x1, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x14, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x6}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x6}]}]}, @NFT_MSG_DELFLOWTABLE={0x40, 0x18, 0xa, 0x101, 0xb00, 0x0, {0x1}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x14, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x101}]}]}], {0x14, 0x10}}, 0xc8}}, 0x40044) mmap(&(0x7f000078a000/0x11000)=nil, 0x11000, 0x5a051feb1f984a1d, 0x202812, r0, 0x7dfff000) 26.928985988s ago: executing program 6 (id=2224): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2125099, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$bind(0x0, &(0x7f0000000140)='./file0/file0\x00', 0x0, 0x80000, 0x0) move_mount(r0, &(0x7f00000000c0)='./file0\x00', r0, &(0x7f00000001c0)='./file0\x00', 0x100) mount(&(0x7f0000000080)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000000)='btrfs\x00', 0x4400, 0x0) 26.697810816s ago: executing program 6 (id=2225): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0x2c, 0x0, &(0x7f0000000140)) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x66002, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x22052, r1, 0x2000) 24.656309028s ago: executing program 6 (id=2229): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x38, 0x1, 0x20, 0x25dfdbfe, {0xb}}, 0x14}, 0x1, 0x0, 0x0, 0x200000c0}, 0x40010) mount$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) ioctl$FS_IOC_FSSETXATTR(r1, 0x401c5820, &(0x7f00000008c0)={0xc0}) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) r2 = open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) mknodat$loop(r2, &(0x7f0000000240)='./file1\x00', 0x400, 0x0) chdir(&(0x7f0000000100)='./bus\x00') link(&(0x7f0000000000)='./file1\x00', &(0x7f00000001c0)='./file0\x00') mount$bind(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x41020, 0x0) 24.124161301s ago: executing program 35 (id=2229): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x38, 0x1, 0x20, 0x25dfdbfe, {0xb}}, 0x14}, 0x1, 0x0, 0x0, 0x200000c0}, 0x40010) mount$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) ioctl$FS_IOC_FSSETXATTR(r1, 0x401c5820, &(0x7f00000008c0)={0xc0}) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) r2 = open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) mknodat$loop(r2, &(0x7f0000000240)='./file1\x00', 0x400, 0x0) chdir(&(0x7f0000000100)='./bus\x00') link(&(0x7f0000000000)='./file1\x00', &(0x7f00000001c0)='./file0\x00') mount$bind(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x41020, 0x0) 18.38275839s ago: executing program 4 (id=2239): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) (async) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000040)) (async) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f0000000180)={[{0xc6, 0x9, 0x3, 0x8, 0x4d, 0x1, 0x4, 0x8, 0x1, 0x6, 0xa, 0x0, 0x3}, {0xfffe, 0xa, 0x9c, 0x4, 0x4, 0xfa, 0x0, 0x7, 0xa6, 0x1, 0x53, 0xff, 0x25f4ec2f}, {0x8, 0x7, 0xa5, 0x2, 0x2b, 0x6, 0x5, 0x9, 0x6, 0x7, 0x4, 0x1, 0xac81}], 0x9}) (async) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f0000000100)={[{0x5, 0x7, 0x3, 0x9, 0x4, 0x4, 0x3, 0x0, 0xf8, 0x1, 0x42, 0xf8, 0xfffffffffffffff7}, {0x7, 0x4, 0x8, 0xdb, 0x9, 0x9, 0x1, 0x9, 0x9, 0x1, 0x9, 0xf2, 0xc27e}, {0x401, 0x9, 0x40, 0x9, 0x7, 0x2, 0xc0, 0x6, 0x4, 0x36, 0x1, 0xd, 0x6b}], 0x5f}) (async) fanotify_init(0x0, 0x80000) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) r3 = socket$l2tp(0x2, 0x2, 0x73) setsockopt$EBT_SO_SET_ENTRIES(r3, 0x0, 0x80, &(0x7f00000017c0)=@filter={'filter\x00', 0xe, 0x5, 0x90, [0x0, 0x200000000080, 0x20000000097e, 0x2000000014a2], 0x0, 0x0, &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}, {0x0, '\x00', 0x3, 0xfffffffffffffffc}]}, 0x108) (async) r4 = syz_open_dev$usbfs(&(0x7f0000000100), 0xeeb, 0x101301) ioctl$USBDEVFS_CLEAR_HALT(r4, 0x80045503, &(0x7f0000000540)={0x1, 0x1}) r5 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)={0x6c, 0x19, 0x1, 0x0, 0x0, {0x1d, 0xd601, 0x9}, [@nested={0x4d, 0x12, 0x0, 0x1, [@typed={0x8, 0x121, 0x0, 0x0, @uid}, @generic="428184a477201ac90f24d8c531680464a01e08554baff2279134e2a452c739471e1c7bd4aef903f973120a8762bddc1900f269ce3068ee8401e0199c9cf16ed3db"]}, @nested={0x8, 0x5, 0x0, 0x1, [@nested={0x4, 0x75}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x5}, 0x804) (async, rerun: 64) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (rerun: 64) r7 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000280), r6) sendmsg$NL802154_CMD_SET_MAX_FRAME_RETRIES(r6, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r7, @ANYBLOB="577c2cbd7000ffdbdf250f0000000c0006000100000001000010"], 0x20}}, 0x4008800) (async, rerun: 32) ioctl$TUNSETIFF(r2, 0x400454da, &(0x7f0000000080)={'batadv0\x00'}) (async, rerun: 32) r8 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) (async) r9 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) kcmp(r9, r8, 0x5, 0xffffffffffffffff, 0xffffffffffffffff) prlimit64(r8, 0x4, &(0x7f0000000140)={0x8, 0x80000000000}, 0x0) (async) r10 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r10, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000300)="2e00000011008108090f9becdb4cb92e0a4831371400000069bd6efb2502eaf60d000300020400bf050005001201", 0x2e}], 0x1}, 0x0) syz_clone3(&(0x7f00000034c0)={0x200000000, 0x0, 0x0, 0x0, {0x23}, 0x0, 0x0, 0x0, 0x0}, 0x58) (async) r11 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x28200, 0x0) preadv(r11, &(0x7f0000000080)=[{&(0x7f0000000280)=""/212, 0xfffffed3}], 0x1, 0xffeffffb, 0x1007) r12 = syz_usb_connect$cdc_ncm(0x5, 0x9c, &(0x7f00000000c0)={{0x12, 0x1, 0x250, 0x2, 0x0, 0x0, 0xff, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x8a, 0x2, 0x1, 0x4, 0x0, 0x6, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x9, 0x24, 0x6, 0x0, 0x1, "c2324a57"}, {0x5, 0x24, 0x0, 0x2}, {0xd, 0x24, 0xf, 0x1, 0xff, 0x2, 0x6, 0x9}, {0x6, 0x24, 0x1a, 0x2, 0x3b}, [@mbim={0xc, 0x24, 0x1b, 0x8, 0x8, 0xd6, 0x34, 0x8, 0x8a}, @acm={0x4, 0x24, 0x2, 0xa}, @obex={0x5, 0x24, 0x15, 0x8000}, @mdlm={0x15, 0x24, 0x12, 0x7}]}, {{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x1, 0x2, 0x3}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x10, 0xe, 0x21}}, {{0x9, 0x5, 0x3, 0x2, 0x8, 0xe, 0x1, 0x2}}}}}}}]}}, &(0x7f0000000680)={0xa, &(0x7f0000000000)={0xa, 0x6, 0x201, 0x7, 0x6, 0x5, 0x10, 0x9}, 0xc5, &(0x7f0000000180)={0x5, 0xf, 0xc5, 0x3, [@ext_cap={0x7, 0x10, 0x2, 0x0, 0x5, 0xb, 0x81}, @generic={0xb6, 0x10, 0x9, "ca07c25a40683017e8225126bef2d45147cd4dca8d09bc48c4f50d49e4d8e100136d663151de6b788c5844553cf0a6249e63349dabee9e3d1785b1ddcc766e1bdb5498b9db7d4be25cef6e1ec1351bea5c3f74423511cebee787323eb6d791de8accc8e2b5dd33a80351f3cdce189a64569b0688b05a7341c05751a14fcfc624bb0c442e6f075cd31a11f219e2b1818450d76d1913f2afdd67b7c5b397ec4fc5cc01d7c9f9ad66e2adca32e963b55ef293d6ea"}, @ptm_cap={0x3}]}, 0x8, [{0x83, &(0x7f0000000380)=@string={0x83, 0x3, "ba6b8a24cae0eae797311e0811ea047d5d7b502aacdd64db8e8410f586fcc267fb93bc4eb6c323076a6dc7fae693a90b7f65624e8c119b9850b56339958bac6e86610e6b4e32952f2f9af2df7c1d8ddc61637478547525ed6112d8a70f7df34457e552500833b61dd5c92b2f5f01d6d6569d694685af96256b629efc7b51db8cf6"}}, {0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x1009}}, {0x4, &(0x7f0000000480)=@lang_id={0x4}}, {0x1e, &(0x7f00000004c0)=@string={0x1e, 0x3, "46b9add445983c0e9e03d004adbabc643f7e2db31db7e7835be98e27"}}, {0x35, &(0x7f0000000500)=@string={0x35, 0x3, "c4c6214adbc33b6eb426594e50d831291b61e1bb1c9b1f5bd5e9907b4f0cd0d2d1f8c2341b967567cde9e66d73d99668c24a0b"}}, {0x4, &(0x7f0000000540)=@lang_id={0x4, 0x3, 0x1407}}, {0x4, &(0x7f0000000580)=@lang_id={0x4, 0x3, 0x180c}}, {0xa9, &(0x7f00000005c0)=@string={0xa9, 0x3, "d9c19190a1b160a536118f7ffa7dd4f2d66ee49bdf73558f96d0eb3fb016f188fc6fd104065cb21d5bf3c4c8309935d22c44685e89020b1d4f26bf9008ffb8aee408c5249339e65b21b00f478bba3261aee01e4c2c70c05143f0b93990a6d4787b52b3fad631fb09ba35314eb1b7afe767288a834f49087ab0e0910e17e14feee5204811346eab177dd78848379fb2deb8d7dfe31c61209dc3c60b1732c401d735c280f2e2c716"}}]}) syz_usb_control_io$cdc_ncm(r12, &(0x7f0000000800)={0x14, &(0x7f0000000700)={0x0, 0xf, 0xb5, {0xb5, 0x30, "0a925eed22ed7c27a07fdadcaabbd5a3b6dcf15dcb483188bc2f93c09b1c6ec794c080a2b69da1a7ba2511598cc57f734cc418fbfa6e10e97d7411e80de382a93e7e274f56e24b1f3a792bfc18c043e0268f12861c0de92061f3d04778433f2f03d97234d7b17df52862b16af80eb9e532d673ef0a89334853c17254d623d6d96838f23838f608ec3d3681403a848f6d2794d9a4faae95159bce79bc7f88ab282387d8403820150e781308b0e1cfb2e41ada78"}}, &(0x7f00000007c0)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000ac0)={0x44, &(0x7f0000000840)={0x40, 0x14, 0x8a, "675056c3a2b465c5a4daadfc276c563e64a2039ddd1255e0b3055fea31cf1ee7454f431d335cea383c4231a872bb35137b6e50c850ad45bb248e5d31faabdd6b07c6e36f88c24cf8b8c8f9552eb87dcb1c6b06fda0e0c17f86d12be4dd71f278800821bdcc1f08de5a99d9454ab39333f65f7c1e08782e9e40f5e2f04546e2e474e60b9c4127bebdc30c"}, &(0x7f0000000900)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000000940)={0x0, 0x8, 0x1}, &(0x7f0000000980)={0x20, 0x80, 0x1c, {0x5, 0x6, 0x7, 0xa8d5, 0xdc, 0x8, 0x1, 0x6, 0x4, 0x0, 0x1000, 0x5}}, &(0x7f00000009c0)={0x20, 0x85, 0x4, 0x3}, &(0x7f0000000a00)={0x20, 0x83, 0x2, 0x1}, &(0x7f0000000a40)={0x20, 0x87, 0x2, 0x21e9}, &(0x7f0000000a80)={0x20, 0x89, 0x2}}) 15.339054086s ago: executing program 4 (id=2242): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x60a00, 0x0) r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0xe8f, 0x12, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xa0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x1, 0x0, {0x9, 0x21, 0x0, 0x2, 0x1, {0x22, 0xe5f}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0xc, 0x0, 0x7}}}}}]}}]}}, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r1, &(0x7f00000003c0)={0x2c, &(0x7f0000000100)={0x0, 0x4, 0x6, {0x6, 0x6, "a7ea3163"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x20011, r0, 0xf648a000) (async) renameat2(0xffffffffffffffff, 0x0, 0xffffffffffffffff, &(0x7f0000000200)='.\x02\x00', 0x0) (async) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1) (async) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) (async) ioctl$KVM_GET_DIRTY_LOG(0xffffffffffffffff, 0x4010ae42, &(0x7f0000000000)={0x10201, 0x0, &(0x7f0000ffb000/0x3000)=nil}) (async) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) 12.176655602s ago: executing program 4 (id=2249): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_WOL_GET(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)={0x14, r2, 0x1, 0x0, 0x25dfdbfc, {0x1b}}, 0x14}}, 0x2000c000) r3 = syz_usbip_server_init(0x5) sendfile(r3, r0, 0x0, 0x7ffff000) ioctl$VFAT_IOCTL_READDIR_SHORT(r0, 0x82307202, &(0x7f0000000000)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) 9.033248455s ago: executing program 4 (id=2258): r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a6c000000060a0b04000000000000000002000005400004803c0001800a0001006c696d69740000002c00028008000340000000220c000240000000000000800108000440000000010c000140fffffffffffffffc0900010073797a30000000000900020073797a32"], 0x94}, 0x1, 0x0, 0x0, 0x850}, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) r5 = socket$inet(0x2, 0x2, 0x1) bind$inet(r5, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000fe5000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0xe79b04dd2a128718, 0x0, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000905010073797a300000000068000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a300000000008000540000000212c0011800c000100636f756e746572001c0002800c000240000000000000e4010c0001400000000000000002140000001000011000000000000000000084000a"], 0xb0}, 0x1, 0x0, 0x0, 0x8000}, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, &(0x7f0000000000)="0f080fae04a200400f01c426660f3a15e6160fc76bdbf08666350f2170260fed9c000066b9230b00000f32", 0x2b}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x4, 0x11, r0, 0x100000000) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000d40)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000a40)=ANY=[@ANYBLOB="7c00000000000000000000000700000044140001ac1414aa00000000ac1414000000000000441c0003e0000001000000007f000001000000000000000000000000442c00000000000000000f883816814100000000000000000000000000000000000000000000000000000000000000000000440c0001000000000000000000000000000000a400000000000000000000000700000044280000000000000000000000000000000000000000000000000000000000000000000000000000071700e0000002ac1414bb00000000e0000002ac1414bb018616000000000010c986d78e6c4b9394b247217b87cb00830b00000000007f000001861f0000000000020010421487f84baabcbcfb42a4d90bab000748c68c4c31001089ca45d9612e5b5c11f12bc78a41000000000000006c000000000000000000000007000000441c0003ffffffff000000000000000000000000e00000010000000044340001ac1414bb0000000000000000000000000000000000000000ac1414aa00000000ac1414aa00000000ac1e000100000000830b0000000000e000000200000000001c000000000000000000", @ANYRES32=0x0, @ANYBLOB="ac1414aa00000000000000001400000000000018000000000200000000000000000000001c000000000000000000000008000000", @ANYRES32=0x0, @ANYBLOB="7f0000017f00000a0000000800"/28, @ANYRES32, @ANYBLOB="7f000001ac141400000000011c0e0000000000000000000007006fc946f1f569c01801"], 0x230}, 0x40) r7 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r7, &(0x7f0000000000)={0x0, 0xffffff0a, &(0x7f0000000080)=[{&(0x7f0000000040)="c018030033000b12d25a80648c2594f90124fc60100c03400f000000053582c137153e370248078000f01700d1bd", 0x33fe0}], 0x1}, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)) openat$rnullb(0xffffffffffffff9c, &(0x7f0000000140), 0x88980, 0x0) r8 = accept4$phonet_pipe(r1, 0x0, &(0x7f0000000040), 0x80000) bind(r8, &(0x7f0000000280)=@phonet={0x23, 0x2, 0x3, 0x8}, 0x80) r9 = socket$alg(0x26, 0x5, 0x0) bind$alg(r9, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r9, 0x117, 0x1, &(0x7f0000000000)="adcd1a9a3fc36e961ed00fe41b0cd695", 0x20) r10 = accept4$alg(r9, 0x0, 0x0, 0x0) sendmmsg(r10, &(0x7f000000af40)=[{{0x0, 0x0, &(0x7f0000000440)=[{&(0x7f00000001c0)="7c4ca1be2fde97c23ebec48e6c16d8c46f54c93856d27076b8eac4048a899647", 0x20}], 0x1}}, {{0x0, 0x0, 0x0}}], 0x2, 0x40080d5) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x800}, 0x0, &(0x7f0000000240)={0x1f, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x8}, &(0x7f0000000280)={0x0, 0x3938700}, 0x0) 5.910042957s ago: executing program 4 (id=2278): prctl$PR_SET_DUMPABLE(0x4, 0x1) prctl$PR_SET_DUMPABLE(0x4, 0x2) prctl$PR_SET_DUMPABLE(0x4, 0x3) prctl$PR_SET_DUMPABLE(0x4, 0x0) prctl$PR_SET_DUMPABLE(0x4, 0x3) prctl$PR_SET_DUMPABLE(0x4, 0x1) prctl$PR_SET_DUMPABLE(0x4, 0x0) prctl$PR_SET_DUMPABLE(0x4, 0x1) prctl$PR_SET_DUMPABLE(0x4, 0x1) prctl$PR_SET_DUMPABLE(0x4, 0x2) prctl$PR_SET_DUMPABLE(0x4, 0x2) prctl$PR_SET_DUMPABLE(0x4, 0x2) prctl$PR_SET_DUMPABLE(0x4, 0x1) prctl$PR_SET_DUMPABLE(0x4, 0x3) prctl$PR_SET_DUMPABLE(0x4, 0x0) prctl$PR_SET_DUMPABLE(0x4, 0x3) prctl$PR_SET_DUMPABLE(0x4, 0x2) prctl$PR_SET_DUMPABLE(0x4, 0x2) prctl$PR_SET_DUMPABLE(0x4, 0x3) prctl$PR_SET_DUMPABLE(0x4, 0x2) prctl$PR_SET_DUMPABLE(0x4, 0x3) prctl$PR_SET_DUMPABLE(0x4, 0x1) prctl$PR_SET_DUMPABLE(0x4, 0x0) prctl$PR_SET_DUMPABLE(0x4, 0x2) prctl$PR_SET_DUMPABLE(0x4, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x18880, 0x12) ioctl$SOUND_PCM_READ_RATE(r0, 0x80045002, &(0x7f0000000040)) prctl$PR_SET_DUMPABLE(0x4, 0x0) prctl$PR_SET_DUMPABLE(0x4, 0x1) prctl$PR_SET_DUMPABLE(0x4, 0x2) 3.1930167s ago: executing program 7 (id=2288): mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x3000009, 0x46031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000bc0000/0x400000)=nil, 0x400000, 0x9) r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x66002, 0x0) futex(&(0x7f0000000000)=0x2000000, 0x0, 0x0, &(0x7f00000003c0), 0x0, 0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x22052, r0, 0x2000) r1 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000040), 0x400002, 0x0) ioctl$DRM_IOCTL_MAP_BUFS(r1, 0xc0186419, &(0x7f0000000180)={0x1, &(0x7f0000000080)=""/128, &(0x7f0000000140)=[{0x86d, 0x4, 0x0, &(0x7f0000000100)=""/4}]}) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x101041) r3 = userfaultfd(0x801) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_COPY(r3, 0xc028aa03, &(0x7f0000000100)={&(0x7f0000800000/0x800000)=nil, &(0x7f0000339000/0x1000)=nil, 0x800000}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000680), 0xffffffffffffffff) r6 = syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2) ioctl$VIDIOC_G_EXT_CTRLS(r6, 0xc0205649, &(0x7f00000000c0)={0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000080)={0x98f909, 0x0, '\x00', @p_u32=0x0}}) sendmsg$ETHTOOL_MSG_PAUSE_GET(r4, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000200)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r5, @ANYBLOB="01dfffffff9a26000000210000000c0001"], 0x20}, 0x1, 0x0, 0x0, 0x4004c00}, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) write$sndseq(r2, &(0x7f00000006c0)=[{0x0, 0x0, 0x0, 0xfd, @tick, {}, {0xe}, @raw8}], 0x1c) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = epoll_create(0x4) r9 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCSETD(r9, 0x5423, &(0x7f0000000000)=0xe) ioctl$TIOCSTI(r9, 0x541b, &(0x7f0000000040)) epoll_ctl$EPOLL_CTL_ADD(r8, 0x1, r7, &(0x7f00000001c0)) sendmsg$nl_generic(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000001b00)=ANY=[@ANYBLOB="f4ffffec7709e5de72f9a8ff2c007000fcdbdf25"], 0x14}, 0x1, 0x0, 0x0, 0x4000d}, 0x20000000) ioctl$BLKRRPART(r0, 0x125f, 0x0) 2.73695451s ago: executing program 4 (id=2290): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000400)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581", @ANYRES8], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io(r1, &(0x7f0000000b00)={0x2c, &(0x7f0000000040)=ANY=[@ANYBLOB="00000f00000009003d140f"], 0x0, 0x0, 0x0, 0x0}, 0x0) r2 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r2, 0x0, 0x0) fchdir(r3) r4 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) write$binfmt_script(r4, &(0x7f0000000a00)={'#! ', './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa', [{0x20, '\xaa\xaa\xaa\xaa\xaa'}]}, 0x105) close(r4) execve(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000040000000160a01000000000000000000010000000900010073797a30000000000900020073797a3000000000140003800800014000000000080002400000000038000000160a0101000b000000000000010000000900020073797a30000000000900010073797a300000000004000380080007"], 0xc0}}, 0x0) r6 = syz_open_dev$hiddev(&(0x7f0000000080), 0x0, 0x0) ioctl$HIDIOCGUSAGE(r6, 0xd01c4813, &(0x7f00000000c0)={0x6, 0x0, 0x0, 0x4, 0x1000, 0x6}) r7 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000680), r8) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x13) lsm_set_self_attr(0x67, &(0x7f0000000180)=ANY=[], 0x20, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r8, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="170900000000000000000100000005003f95872ceb3e95d560339ceef27c564f070000000000080009000000000006000200000000001800ac00"/67], 0x58}, 0x1, 0x0, 0x0, 0x44000}, 0x0) r10 = syz_usb_connect(0x5, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x92, 0xec, 0xc6, 0x20, 0x5ac, 0x77c2, 0xeb3a, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x20, 0x0, [{{0x9, 0x4, 0xc4, 0x1, 0x2, 0xff, 0xfd, 0x1, 0x80, [], [{{0x9, 0x5, 0x2, 0x2, 0x210, 0x2}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r10, &(0x7f0000000100)={0x14, 0x0, &(0x7f00000002c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x4ff}}}, 0x0) syz_usb_control_io(r10, 0x0, &(0x7f0000000b80)={0x84, &(0x7f0000000140)={0x0, 0xc, 0x6, "1693c6a87ad2"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fcntl$setflags(r7, 0x2, 0x0) r11 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x81) openat2(r11, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)={0x240000, 0x102, 0x7}, 0x18) 2.706455259s ago: executing program 7 (id=2291): mount(&(0x7f0000000100)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000240)='udf\x00', 0x208000, 0x0) 2.571161669s ago: executing program 7 (id=2293): mount(&(0x7f0000000000)=@rnullb, &(0x7f00000000c0)='./cgroup\x00', &(0x7f0000000080)='9p\x00', 0x122c826, 0x0) 2.324292275s ago: executing program 7 (id=2295): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CHANGE_NAN_CONFIG(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x38, r1, 0x2, 0x70bd2d, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x0, 0x39}}}}, [@NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x9}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x81}]}, 0x38}, 0x1, 0x0, 0x0, 0x20040000}, 0x20000040) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_CONTROL_PORT_FRAME(r3, &(0x7f00000007c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000780)={&(0x7f00000001c0)={0x59c, r1, 0x100, 0x70bd2a, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x6, 0x29}}}}, [@NL80211_ATTR_CONTROL_PORT_ETHERTYPE={0x6, 0x66, 0xf8}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_CONTROL_PORT_ETHERTYPE={0x6}, @NL80211_ATTR_CONTROL_PORT_ETHERTYPE={0x6, 0x66, 0x19}, @NL80211_ATTR_FRAME={0x550, 0x33, @data_frame={@a_msdu=@type10={{0x0, 0x2, 0x9, 0x1, 0x0, 0x0, 0x1, 0x1}, {0x7}, @initial, @broadcast, @random="ecbf577cc7e5", {0x1}, "", @value={0x4, 0x1, 0x2, 0x1, 0x2}}, @random="3c018745fe6a8dc9663b7f9973bafd3dbb9643af71cae4d5cd3a3eaac3715cedda1e41f8e7f3cd8dedd32ab3631fcb37ea7b5cf8f1c61504a51de62fdc12b104d61718d605778f1bc6c6a586224e916f47fdd8fe96c8312982cec677511897e4dc62c94779ff51f5d918bb2ed5784fa67dff82925d4f8799de0877fbcff5c821f13689400fd50b66253c9a4d1819a8422220ed374913f06cd4dd5d768e4e00e53df281564251704bd6214b1425bd3b877c476d0742bd4cbdd3c5e1a1b987fd84b919322816a325fa975f00254c3c00366c23c1ded3cf52746da89b19a9f62bcadb733d862ad7ec6b57220083ff0aad7454b68c2d1fffe5f6395e17be05028920feba796ae8d9e7fca3164c02d093100ec14b2711ff58fe69fc50b635fbdce81d318c8539dea786bab46db8d18906194ef14e3e99010b3066212a15213499ea7aa255ad4b3b12435602918b0dea6937218e279579c989c79c34c12fe047d6357b41cd369d560949ae6667dc8954f704e8eed279e7eb384f928d5b9a39f822f78e0ec79b24a7f75f99fadb2fd87583c74a381fe07c67038daf620eac90c88ce4c9ccb5ad07e158b1419b4bec80b8615f65bc6263878e9625e646c6a635314b04674a4a43ea4874222c1682e9c5646eea2be48e1bc8899150535d3beb0179ee533941862c2df16b9d85f313ac6a2685d1c9c5ff8233ef2fecc6d2cc5d0775b44fd395c4c7ec89d2c581a3b073769c5c21a6c53de46fbf5cf03c33f69335d46d72de9ed4657639c34ccb0a18098b7787809505239756e4b14e4a58b37a30d7ec06579be0f4ca5ffb2a0d7f2116d579b161cfb9431284af99123bf12e0edb5de4737422166c93e356532ed8b45ba29a4513f111847ca7673adf16e9a4129ffbb0e5de0630cb60dab9c63c65b70efd58c459e10a6abf8deabdfc04b7e10b0ceb27889e6151f5e5f4f71e53750795cfdf59fb2bc6a5b344d01282330f62c33d984f453bc786aadc87df8cfeff02f57bad81f18167cddca139d00d01358d7db8bb2d90db626ecf2a9d95f77690f789031b2131765a2fbd7540e1d87262508a3ab9266a0fbb4655c484607ac3e71ee083c4b03ccc1a02cb0aaad58f984785522dfe9ae0dabff865fb13e456889c341be071d4a3de0260b338468c37ba73a631b382a2515c0842aac12ed11da66c58377a3b85605a0d280d14c944f1646c97df1cd802d15f8933adfa5d9695b5523e30de6f6df234bf4a276bece2bf507e8ee9567f8362457e96bd5b4feef59383a2769ba615ffd62d44cacd6c0a1fe7677bd94397423efb37b8b6fa9f2d13fe9642eef676234817c6f6cabe6fbc935315a4e7dda514d43cf8fc43094e19c1e89bebec17359c37340e416d9615d6721959993bee9da50fff4803f18399986a08dc6566f33c8377c9fa43eb372d2b4559853c88518fffebfe2b08369ecdf12274bd4ed1429c198b27721fcde35ba946c18a8d5312cec91887165eec147ecc02a51b304bb69ce8c5c569dbc0ef8c6438b4c3873594cfc50ee5642e8da4a4e3112acd20105738546b165b8b7599f01b97ef72ca5fad2f8a58f51ed41597e68fc69514e00d7c78faa8969c6ea36d564ed3c8abe674054ce14c910924c1612f39aec968871a60de0018676815eda20d9d384d47fed34d87ad6c9ab7220e29c897179e097e5152f4f811f83e493c6594b269052da51e4bdaea986b2d338aae14c2ea6c0771478222b906e6c175a4aa442d2faa8dad8be7c81a7b3e65d9a2474fdb12d8d1689794b2f7871a690890db41969d21e9e871511ac521d91af028e02e4c7fba611a0b68aa8b2bb1a4df4c06b1502531d7818c6a91e15453ae1cfb54c3e7a845c37f090093bf4a8054f2"}}]}, 0x59c}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r4 = getpid() r5 = syz_open_procfs$pagemap(r4, &(0x7f0000000800)) openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000840), 0x2, 0x0) ioctl$PAGEMAP_SCAN(r5, 0xc0606610, &(0x7f0000000940)={0x60, 0x1, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ff8000/0x3000)=nil, 0xb3, &(0x7f0000000880)=[{0x5, 0x1, 0x8000000000000000}, {0xb45e, 0x23, 0x4}, {0x200, 0xffffffffffff1b1f, 0x6}, {0x3, 0x96d, 0x9}, {0xcc, 0x4667, 0x100}, {0x0, 0x0, 0x9}], 0x6, 0x7, 0xa, 0x0, 0x2c, 0x40}) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f00000009c0), r3) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_INITMSG(r7, 0x84, 0x2, &(0x7f0000000a00), &(0x7f0000000a40)=0x8) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_INTERFACE(r8, &(0x7f0000000b40)={&(0x7f0000000a80), 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x1c, r1, 0x1, 0x70bd2c, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @void}}, ["", "", ""]}, 0x1c}}, 0x44040) sendmsg$ETHTOOL_MSG_EEE_SET(r8, &(0x7f0000000c40)={&(0x7f0000000b80)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x24, r6, 0x8, 0x70bd2d, 0x25dfdbfc, {}, [@ETHTOOL_A_EEE_TX_LPI_ENABLED={0x5}, @ETHTOOL_A_EEE_TX_LPI_TIMER={0x8, 0x7, 0x7000}]}, 0x24}, 0x1, 0x0, 0x0, 0x800}, 0x800) r9 = socket$netlink(0x10, 0x3, 0xa) openat$cgroup_devices(r7, &(0x7f0000000c80)='devices.allow\x00', 0x2, 0x0) fcntl$setsig(r5, 0xa, 0x1a) r10 = syz_genetlink_get_family_id$devlink(&(0x7f0000000d00), r0) sendmsg$DEVLINK_CMD_SB_POOL_SET(r0, &(0x7f0000000e40)={&(0x7f0000000cc0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000e00)={&(0x7f0000000d40)={0x94, r10, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0xfffffff8}, {0x6, 0x11, 0x4}, {0x8, 0x13, 0x1}, {0x5, 0x14, 0x1}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x3}, {0x6, 0x11, 0x4}, {0x8, 0x13, 0xeec}, {0x5}}]}, 0x94}, 0x1, 0x0, 0x0, 0x1}, 0x4080) sendmsg$TIPC_NL_NET_GET(r9, &(0x7f0000000fc0)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x48000000}, 0xc, &(0x7f0000000f80)={&(0x7f0000000ec0)={0x94, 0x0, 0x100, 0x70bd2c, 0x25dfdbfb, {}, [@TIPC_NLA_LINK={0x18, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_SOCK={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x3}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x8}]}, @TIPC_NLA_MEDIA={0x4c, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}]}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xa53}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x975}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}]}]}]}, 0x94}}, 0x40000) ioctl$sock_inet_SIOCSIFPFLAGS(r7, 0x8934, &(0x7f0000001000)={'veth0_virt_wifi\x00', 0xfffffffc}) syz_genetlink_get_family_id$nl80211(&(0x7f0000001040), r3) r11 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001100), 0x2, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000001140)={0x2020, 0x0, 0x0, 0x0}, 0x2020) r13 = getgid() getsockopt$inet6_IPV6_XFRM_POLICY(r7, 0x29, 0x23, &(0x7f0000003180)={{{@in=@multicast2, @in6=@private0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in=@multicast1}}, &(0x7f0000003280)=0xe8) mount$fuse(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x10000, &(0x7f00000032c0)={{'fd', 0x3d, r11}, 0x2c, {'rootmode', 0x3d, 0xc000}, 0x2c, {'user_id', 0x3d, r12}, 0x2c, {'group_id', 0x3d, r13}, 0x2c, {[], [{@euid_gt={'euid>', r14}}, {@euid_eq={'euid', 0x3d, 0xffffffffffffffff}}, {@subj_user={'subj_user', 0x3d, '{'}}, {@subj_type={'subj_type', 0x3d, 'ethtool\x00'}}]}}) sendmsg$IPSET_CMD_RENAME(r9, &(0x7f00000034c0)={&(0x7f00000033c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000003480)={&(0x7f0000003400)={0x54, 0x5, 0x6, 0x5, 0x0, 0x0, {0x77a5fa9d7bd0e507, 0x0, 0x7}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_SETNAME2={0x9, 0x3, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME2={0x9, 0x3, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}]}, 0x54}}, 0x4008014) 2.144767967s ago: executing program 7 (id=2297): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1, 0x11, r0, 0xf648b000) (async) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1) (async) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) (async) select(0x40, &(0x7f0000000400)={0x9, 0x3, 0x7ffffffc, 0x0, 0x7, 0x8}, 0x0, 0x0, 0x0) (async) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0x0, 0x2) 2.032458895s ago: executing program 0 (id=2298): mount(&(0x7f0000000000)=@md0, &(0x7f0000000040)='./cgroup\x00', &(0x7f00000000c0)='overlay\x00', 0x634e424e56bea9c6, 0x0) 1.872702416s ago: executing program 7 (id=2299): r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x22, &(0x7f00000000c0)=0x100000001, 0x4) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x3, 0x6576, 0xd, 0x0, 0x0}) syz_usb_connect(0x5, 0xfffffffffffffe82, &(0x7f00000002c0)={{0x12, 0x1, 0x110, 0x2b, 0x4b, 0x6e, 0x8, 0xccd, 0x10b2, 0x2448, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x131, 0x2, 0xa2, 0x0, 0x0, 0x3f, [{{0x9, 0x4, 0x1e, 0x4, 0x3, 0xf6, 0xf5, 0x78, 0x5b, [@uac_control={{0xa, 0x24, 0x1, 0xa, 0x6}, [@extension_unit={0xc, 0x24, 0x8, 0x5, 0x6, 0x7, "0d0a329ce2"}]}], [{{0x9, 0x5, 0x86, 0x10, 0x400, 0xf4, 0x8, 0x4}}, {{0x9, 0x5, 0x0, 0x0, 0x40, 0x81, 0x3, 0xff, [@uac_iso={0x7, 0x25, 0x1, 0x3, 0x10, 0x6000}]}}, {{0x9, 0x5, 0x9, 0x1b, 0x8, 0xc, 0x27, 0x80, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0x1, 0x2}, @generic={0xad, 0x6, "857005b8925a7fa191c625076eefa48185edd442fcf1e9a92ce1e37532656b7fcdac9d1a7bc4c9a0c310148d20d4bf03a31d9519fe3fb616b0e0b7d9ac3533b6ac98a9dae6b15d1c069d91e05131c77e20d69bbec1f907ced87906b763ac6a2a765223d423227659bde6a0917af5b70f8dc3b662a9cca8e74b458ea6c45ed77ee9ddec32c19b2fd4f6a42568446f230ee7498876b3ce0c4f35fcb0737ae7aaa5c4d6547365d86655caeaf1"}]}}]}}, {{0x9, 0x4, 0x36, 0x1, 0x4, 0x68, 0x45, 0x5b, 0x3, [], [{{0x9, 0x5, 0x9, 0x0, 0x400, 0x3, 0x0, 0x4}}, {{0x9, 0x5, 0x2, 0x2, 0x200, 0xf7, 0x81, 0x6}}, {{0x9, 0x5, 0x3, 0x3, 0x3ff, 0x8, 0x40, 0x4, [@generic={0x7, 0x5, "a6c6415a9f"}]}}, {{0x9, 0x5, 0x85, 0x3, 0x40, 0xb, 0x2, 0xb}}]}}]}}]}}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="58000000020605000000000000000000000000000c00078008001340000000000500010006000000050005000200000005000400030000000900020073797a310000000011000300686173683a6e65742c6e65740000"], 0x58}}, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x4, 0x11, r1, 0x100000000) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f00000000c0)={r2}) r4 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000100), 0x20802, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000a, 0x22052, r4, 0x5708e000) socket$inet_smc(0x2b, 0x1, 0x0) (async) setsockopt$inet_tcp_int(r0, 0x6, 0x22, &(0x7f00000000c0)=0x100000001, 0x4) (async) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x3, 0x6576, 0xd}) (async) syz_usb_connect(0x5, 0xfffffffffffffe82, &(0x7f00000002c0)={{0x12, 0x1, 0x110, 0x2b, 0x4b, 0x6e, 0x8, 0xccd, 0x10b2, 0x2448, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x131, 0x2, 0xa2, 0x0, 0x0, 0x3f, [{{0x9, 0x4, 0x1e, 0x4, 0x3, 0xf6, 0xf5, 0x78, 0x5b, [@uac_control={{0xa, 0x24, 0x1, 0xa, 0x6}, [@extension_unit={0xc, 0x24, 0x8, 0x5, 0x6, 0x7, "0d0a329ce2"}]}], [{{0x9, 0x5, 0x86, 0x10, 0x400, 0xf4, 0x8, 0x4}}, {{0x9, 0x5, 0x0, 0x0, 0x40, 0x81, 0x3, 0xff, [@uac_iso={0x7, 0x25, 0x1, 0x3, 0x10, 0x6000}]}}, {{0x9, 0x5, 0x9, 0x1b, 0x8, 0xc, 0x27, 0x80, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0x1, 0x2}, @generic={0xad, 0x6, "857005b8925a7fa191c625076eefa48185edd442fcf1e9a92ce1e37532656b7fcdac9d1a7bc4c9a0c310148d20d4bf03a31d9519fe3fb616b0e0b7d9ac3533b6ac98a9dae6b15d1c069d91e05131c77e20d69bbec1f907ced87906b763ac6a2a765223d423227659bde6a0917af5b70f8dc3b662a9cca8e74b458ea6c45ed77ee9ddec32c19b2fd4f6a42568446f230ee7498876b3ce0c4f35fcb0737ae7aaa5c4d6547365d86655caeaf1"}]}}]}}, {{0x9, 0x4, 0x36, 0x1, 0x4, 0x68, 0x45, 0x5b, 0x3, [], [{{0x9, 0x5, 0x9, 0x0, 0x400, 0x3, 0x0, 0x4}}, {{0x9, 0x5, 0x2, 0x2, 0x200, 0xf7, 0x81, 0x6}}, {{0x9, 0x5, 0x3, 0x3, 0x3ff, 0x8, 0x40, 0x4, [@generic={0x7, 0x5, "a6c6415a9f"}]}}, {{0x9, 0x5, 0x85, 0x3, 0x40, 0xb, 0x2, 0xb}}]}}]}}]}}, 0x0) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="58000000020605000000000000000000000000000c00078008001340000000000500010006000000050005000200000005000400030000000900020073797a310000000011000300686173683a6e65742c6e65740000"], 0x58}}, 0x0) (async) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x4, 0x11, r1, 0x100000000) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f00000000c0)={r2}) (async) openat$rnullb(0xffffffffffffff9c, &(0x7f0000000100), 0x20802, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000a, 0x22052, r4, 0x5708e000) (async) 1.85307631s ago: executing program 0 (id=2300): r0 = syz_open_dev$video(&(0x7f0000005580), 0x7, 0x0) ioctl$VIDIOC_G_PARM(r0, 0xc0cc5615, &(0x7f0000000140)={0x9, @output}) (async) ioctl$VIDIOC_G_PARM(r0, 0xc0cc5615, &(0x7f0000000140)={0x9, @output}) mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000400)='cramfs\x00', 0xc400, 0x0) 1.692466159s ago: executing program 0 (id=2301): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x400800, 0x0) r1 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000700), 0xa00, 0x0) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) ppoll(&(0x7f0000000100)=[{r0, 0x8}, {r1, 0x41}, {r1, 0x80dc}], 0x3, &(0x7f0000000180)={r2, r3+10000000}, &(0x7f0000000280)={[0x10]}, 0x8) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r4, 0x0) ioctl$VIDIOC_STREAMOFF(r4, 0x40045613, &(0x7f0000000300)=0xff) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000740)=0x7f) (async) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000740)=0x7f) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x20011, r1, 0xc3a51000) futex(&(0x7f000000cffc)=0x4, 0x0, 0x4, 0x0, 0x0, 0x0) (async) futex(&(0x7f000000cffc)=0x4, 0x0, 0x4, 0x0, 0x0, 0x0) futex(&(0x7f0000000080), 0x1, 0x3, 0x0, &(0x7f0000048000)=0x1, 0x0) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='net/arp\x00') preadv(r5, &(0x7f0000000600)=[{&(0x7f00000004c0)=""/26, 0x1a}], 0x1, 0x4000ffe, 0xfffffffc) (async) preadv(r5, &(0x7f0000000600)=[{&(0x7f00000004c0)=""/26, 0x1a}], 0x1, 0x4000ffe, 0xfffffffc) mknod(&(0x7f0000000000)='./bus\x00', 0x1000, 0x0) (async) mknod(&(0x7f0000000000)='./bus\x00', 0x1000, 0x0) ioctl$UI_SET_PROPBIT(r5, 0x4004556e, 0x1a) ioctl$vim2m_VIDIOC_S_CTRL(r5, 0xc008561c, &(0x7f00000002c0)={0x10, 0x2}) (async) ioctl$vim2m_VIDIOC_S_CTRL(r5, 0xc008561c, &(0x7f00000002c0)={0x10, 0x2}) mount$9p_rdma(&(0x7f00000001c0), &(0x7f0000000200)='./bus\x00', &(0x7f0000000240), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="7472616e7340aee667a230303030742c00"/31]) r6 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(r6, &(0x7f0000000580)=ANY=[], 0xfe33) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) (async) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) 1.553218986s ago: executing program 0 (id=2302): r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x80400, 0x0) write$fb(r1, &(0x7f0000000080)="9980e66c14965ae065fe3d96c9642d2cbff17dd3b72c3be2c8de640d61cea457eda7f4edd31cd9248c268636839752d8ad5be9312c25341958e1dd4e0787faaf07fa593bb8a4c0571e76b16f984982858bf74d0e77d5f410f264da4fa2e3a8360c6926cf73872e87a8d36400b2fdd3a02ead5bc1458ee21c60494ade52", 0xfd35) setsockopt$ARPT_SO_SET_REPLACE(r0, 0x0, 0x60, &(0x7f0000001280)={'filter\x00', 0x7, 0x2, 0x3e8, 0x0, 0x300, 0x0, 0x300, 0x300, 0x300, 0x4, 0x0, {[{{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@local, @empty, @multicast1, @broadcast, 0x1}}}, {{@uncond, 0xc0, 0x108}, @unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x8, 'syz0\x00', {0x3}}}}, {{@arp={@remote, @multicast2, 0x0, 0x0, 0x40, 0x10, {@mac, {[0x0, 0x0, 0x0, 0x0, 0xff]}}, {}, 0x4, 0x0, 0x0, 0x2, 0x0, 0x0, 'pim6reg\x00', 'vcan0\x00', {}, {}, 0x0, 0x280}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x438) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r3 = userfaultfd(0x801) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000140)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x0, &(0x7f0000000180), 0xc06620, 0x4) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) fadvise64(r4, 0x92, 0x5, 0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000003, 0x22052, r4, 0xe62e5000) 1.380590814s ago: executing program 5 (id=2304): creat(&(0x7f0000001380)='./file0\x00', 0xbb) get_mempolicy(0x0, 0x0, 0x6, &(0x7f0000075000/0x4000)=nil, 0x1) flock(0xffffffffffffffff, 0x1780f9c373410dea) cachestat(0xffffffffffffffff, 0x0, 0x0, 0x0) mount(&(0x7f0000001400)=@rnullb, &(0x7f0000001440)='./file0\x00', &(0x7f0000000000)='omfs\x00', 0x0, 0x0) 1.218474275s ago: executing program 5 (id=2305): syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x822b01) (async) r0 = socket$inet_sctp(0x2, 0x5, 0x84) (async) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x4e22, @loopback}]}, 0x0) (async) getsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f00000010c0)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000100)={r2, @in={{0x2, 0x4e20, @empty}}, 0x1, 0x2b}, 0x90) pipe2$9p(&(0x7f00000000c0), 0x4080) (async) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x42002) (async) r4 = socket$netlink(0x10, 0x3, 0x13) bind$netlink(r4, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfb, 0x4000000}, 0xc) (async) getsockopt$netlink(r4, 0x10e, 0x9, &(0x7f0000001100)=""/4096, &(0x7f0000000040)=0x1000) (async, rerun: 32) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r3, 0xc08c5332, &(0x7f00000001c0)={0x0, 0x0, 0x0, 'queue1\x00', 0xafc9}) (async, rerun: 32) write$sndseq(r3, &(0x7f0000000000)=[{0x84, 0x77, 0x0, 0x0, @time={0x80000001, 0x9}, {}, {}, @raw32}], 0x1c) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) (async) r6 = syz_genetlink_get_family_id$wireguard(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x78, r6, 0x1, 0x0, 0x0, {}, [@WGDEVICE_A_IFNAME={0x14, 0x2, 'wg2\x00'}, @WGDEVICE_A_PEERS={0x50, 0x8, 0x0, 0x1, [{0x4c, 0x0, 0x0, 0x1, [@WGPEER_A_PRESHARED_KEY={0x24, 0x2, "2b4d6fad438128ad29351d594fb1e74f5213eafdf0a0eb10edd2980d0b3b28ad"}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @b_g}]}]}]}, 0x78}}, 0x40000) (async) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r3, 0x4040534e, &(0x7f0000000140)={0x16f, @tick=0x7}) (async) r7 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x20011, r7, 0xf648b000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1) (async, rerun: 32) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) (rerun: 32) mbind(&(0x7f0000650000/0x3000)=nil, 0x3000, 0x1, 0x0, 0x2, 0x6) 961.599016ms ago: executing program 5 (id=2306): r0 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000240)={0x0, 0xa, 0x4}) r1 = socket$rxrpc(0x21, 0x2, 0xa) setsockopt$RXRPC_MIN_SECURITY_LEVEL(r1, 0x110, 0x4, &(0x7f00000000c0), 0x4) (async) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) r3 = dup(r2) ioctl$TIOCL_SETSEL(r3, 0x4b6a, 0xffffffffffffffff) (async) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r3, 0x40405515, &(0x7f0000000440)={0x5, 0x0, 0x401, 0x10, 'syz0\x00', 0x2}) (async) listen(r1, 0x3) (async) creat(&(0x7f0000000240)='./file0\x00', 0x0) (async) pipe2$9p(&(0x7f0000001900)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r4, &(0x7f0000000500)=ANY=[@ANYBLOB="1500000065ffff048000000800395032303030"], 0x15) r5 = dup(r4) write$FUSE_BMAP(r5, &(0x7f0000000100)={0x18}, 0x18) (async) ioctl$INCFS_IOC_CREATE_FILE(r1, 0xc058671e, &(0x7f00000003c0)={{'\x00', 0x1}, {0x6}, 0x102, 0x0, 0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='./file0\x00', &(0x7f00000002c0)="2434990acdba1b88de76dbde7f56f35f67743f4a15255fe64664097a2b70fba7e9c68fa290204a8aa33fc5d4f31ae4f358c84e3a728a73a71bc57fd2aa2e2892d0732cdfe4453b760085664128114d1aaec019d9d41672d0abbd2bb8bf8147c850ae3460cd1feb3eb8aff588f7b244592a22a462f0f8436c6075caeb10445365457844bfadf1294a5a168ae95dc9565b1f7816593d981e42290bdb29542cb5f206cb51dbf38fb8ed24023e8a82ef59b6f47bbac4c16184767f6b46ebfb7494beb61ace7ba4", 0xc5, 0x0, &(0x7f0000000540)={0x2, 0x191, {0x0, 0xc, 0xc8, "4cd6c7a16c5ddbad5418f0ccd640cd2048407a146f0420e976992591610083a1ba915166e04648c9ce4042ca945f34daa57bc918482b32229e42365f9ada7a704de66be9fa50af1d7704fe475e9b856882d3c2eb4311ae21a820176f45bb20a0e4948b426272a090b57fef937d5b5efbcd60458d699d1827c94fcf6dab1e37d3a941ae41000a3aa67fc82d6cf476ff1f20cf3c9abc46a8b24ee694e32ad4cd4b2f6806de568bc79dd81b82bbef23101180d5fe44a0b3853194814454e994dc2c43210dffce793310", 0xbc, "b9ebfea0d79bea2ddcc629a00fdb4873a91bcc5f6e0e07b0405d130ce284c7647616e15730a4f8b402abcd7c9eadb0490cf8337bdba66a0c86461c0e1ec10e9d4c87734950250086b4821b8cf3a0ca5ed658326e6db8d4107a045d9fad44b659014c025c63d59e177b1edf91e45d8f828206d0b4eed2f1f1e8914e27a145df0cbb9f38d813fe54937d37bcad1cc5b026c86974e9e2ef6d895632d5348eede2d4b85ab4685053416e0c54790f3ac736013965cd624e1001416285830f"}, 0x61, "450cf51e93edcc46a13472d3769a1407619b510be2cf557e75142ea40efb91bed8aeccda48334ef9bb2b10efa5e52d58be22a525fbb5f7032c65c9570defedf7bc0729601a6867875a6bb4de72fb5917568733ba7164e1ffad37478a874379e4f2"}, 0x1fe}) (async) write$FUSE_NOTIFY_RETRIEVE(r5, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0xc0880, &(0x7f0000000740)=ANY=[@ANYBLOB="a286e6d37472e34a6ff8000000000300e9", @ANYRESOCT=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r5]) chmod(&(0x7f0000000140)='./file0\x00', 0x0) (async) r6 = open$dir(&(0x7f0000000140)='./file0\x00', 0x1, 0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.throttle.io_serviced\x00', 0x275a, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) (async) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) (async) r10 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r10, 0x8933, &(0x7f0000000700)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_SCHED_SCAN(r8, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000280)={0x1c, r9, 0x3186912ff1553e51, 0x70bd2c, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r11}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x801}, 0x40000) ftruncate(r7, 0x5) (async) sendfile(r6, r7, 0x0, 0x7ffff000) (async) mount(&(0x7f0000000080)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000000)='btrfs\x00', 0x4400, 0x0) 740.382597ms ago: executing program 5 (id=2307): r0 = creat(&(0x7f0000000080)='./file0\x00', 0xac) sendmsg$IPVS_CMD_NEW_DAEMON(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='p\x00@\x00', @ANYRES16=0x0, @ANYBLOB="01002abd7000fedbdf250900000008000500be0000001400038005000800ff000000080001"], 0x30}, 0x1, 0x0, 0x0, 0x1}, 0x5) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="200000005200010000000000000000000a0000000c0001000500c690df5d3388befe75b3a4fd0000fffffff9ee6f36f9ffc9c7e92900487dc267ff7c66d29e136870e05b9b94ba648935e21b5726821c8aaa886247c04f4037594cc899172888edfe8f04970e4968e6b51236426d738f377161b7a0444c88062e18fcba6e4f9f"], 0x20}}, 0x40010) r2 = socket(0xa, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000180)=[@in={0x2, 0x0, @private=0xa010101}]}, &(0x7f0000000100)=0x10) ioctl$UI_BEGIN_FF_ERASE(r0, 0xc00c55ca, &(0x7f0000000300)={0x10, 0x5, 0x91a}) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x25, &(0x7f00000000c0)={0x0, @in={{0x2, 0x0, @private=0xa010101}}, 0xfffe}, 0x90) syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), r2) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_MPATH(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010027bd70000000000067db000008000334", @ANYRES32=0x0, @ANYBLOB='\f'], 0x34}}, 0x8080) write$P9_RLOPEN(r0, &(0x7f00000000c0)={0x18, 0xd, 0x1, {{0x0, 0x1, 0x2}, 0x5}}, 0x18) mount(&(0x7f0000000180)=@rnullb, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='jfs\x00', 0x8010, 0x0) 433.080319ms ago: executing program 5 (id=2308): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_int(r0, 0x29, 0x4e, 0x0, 0x47) creat(&(0x7f0000001380)='./file0\x00', 0x4) r1 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r1, &(0x7f0000000bc0)=[{{&(0x7f0000000000)={0xa, 0x0, 0x0, @private1={0xfc, 0x1, '\x00', 0x1}, 0xfffffffc}, 0x1c, &(0x7f0000001080)=[{&(0x7f0000000400)="b8", 0x1}], 0x1}}, {{&(0x7f0000000100)={0xa, 0x4e21, 0xffffff80, @private1={0xfc, 0x1, '\x00', 0x1}, 0x8}, 0x1c, &(0x7f0000000280)=[{&(0x7f0000000140)="e436", 0x2}], 0x1}}, {{&(0x7f00000002c0)={0xa, 0x4e23, 0x1, @local, 0x7}, 0x1c, &(0x7f0000000740)=[{&(0x7f0000000440)='jk', 0x2}], 0x1}}], 0x3, 0x0) shutdown(r1, 0x1) mount(&(0x7f0000001400)=@rnullb, &(0x7f0000001440)='./file0\x00', &(0x7f0000000000)='omfs\x00', 0x0, 0x0) 397.230684ms ago: executing program 0 (id=2309): r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000080)=0xb0000) ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(r0, 0x7a5, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) ioctl$IOCTL_VMCI_QUEUEPAIR_SETVA(r0, 0x7a4, &(0x7f00000001c0)={{@hyper, 0x4}, 0x7fffffffffffffff, 0x1, 0xcd9f, 0x9}) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000fe6000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, &(0x7f0000000000)="66b9800000c00f326635000400000f3067660f38818900000000f3db0e000067f0834f7c0066b80500000066b9002000000f01d9b879000f00d00f01c80f01c26426a009000f01b50740", 0x4a}], 0x1, 0x44, 0x0, 0x0) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000140)={0x100000000000025c, 0x0, [{0xb59, 0x0, 0x8}]}) ioctl$KVM_RUN(r3, 0xae80, 0x0) mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000100)='jfs\x00', 0x35a040, 0x0) r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x1c0, 0x101) openat(r4, &(0x7f00000000c0)='./cgroup\x00', 0xe4040, 0x90) 108.280274ms ago: executing program 5 (id=2310): r0 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x70, r0, 0x800, 0x70bd25, 0x25dfdbfc, {}, [@TIPC_NLA_PUBL={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xfffeffff}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0xff}]}, @TIPC_NLA_NET={0x10, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xfffffffffffffffe}]}, @TIPC_NLA_NET={0x30, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xd}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x8}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x63}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x5}]}]}, 0x70}, 0x1, 0x0, 0x0, 0x20000002}, 0x1) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_LINK_SET(r1, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x78, r0, 0x800, 0x70bd2a, 0x25dfdbfc, {}, [@TIPC_NLA_LINK={0x64, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x13}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x81}]}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffe00}]}]}]}, 0x78}, 0x1, 0x0, 0x0, 0xc006}, 0x1) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_SEC_KEY(r2, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x64, r3, 0x2, 0x70bd26, 0x25dfdbfb, {}, [@NL802154_ATTR_SEC_KEY={0x50, 0x30, 0x0, 0x1, [@NL802154_KEY_ATTR_USAGE_CMDS={0x24, 0x3, "1dc0b5802efec6d643350d3db9268c91d94aaa6f5743bb994332cbe9bbdf1451"}, @NL802154_KEY_ATTR_BYTES={0x14, 0x4, "820d118ebefac78c1488809c1a2506ff"}, @NL802154_KEY_ATTR_BYTES={0x14, 0x4, "20afb45268fa62c1267b056db9bc04be"}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x8080}, 0x1) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r4, &(0x7f0000000580)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000540)={&(0x7f0000000480)={0x88, 0x4, 0x8, 0x3, 0x0, 0x0, {0x3, 0x0, 0x2}, [@CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x88e5}, @CTA_TIMEOUT_DATA={0x14, 0x4, 0x0, 0x1, @tcp=[@CTA_TIMEOUT_TCP_SYN_SENT2={0x8, 0x9, 0x1, 0x0, 0x9}, @CTA_TIMEOUT_TCP_TIME_WAIT={0x8, 0x7, 0x1, 0x0, 0x10001}]}, @CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_DATA={0x2c, 0x4, 0x0, 0x1, @udp=[@CTA_TIMEOUT_UDP_UNREPLIED={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_TIMEOUT_UDP_UNREPLIED={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_TIMEOUT_UDP_UNREPLIED={0x8, 0x1, 0x1, 0x0, 0x7ee6}, @CTA_TIMEOUT_UDP_UNREPLIED={0x8, 0x1, 0x1, 0x0, 0x5}, @CTA_TIMEOUT_UDP_REPLIED={0x8, 0x2, 0x1, 0x0, 0x7}]}, @CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x3a}]}, 0x88}}, 0x4000) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000005c0), 0x143081) write$sndseq(r5, &(0x7f0000000640)=[{0x3d, 0x3, 0xab, 0x2, @time={0x0, 0x5}, {0x1, 0x2}, {0x7f, 0x1}, @time=@time={0x8, 0x1}}, {0x9, 0x9, 0x4, 0x3, @tick=0x100, {0x8, 0x74}, {0xf7, 0x73}, @quote={{0x9, 0x13}, 0x0, &(0x7f0000000600)={0x5, 0xd, 0xe, 0x2, @time={0x3, 0x2}, {0xa, 0x8}, {0x3, 0x7}, @raw8={"abdbc85fe919ab862e23c31e"}}}}, {0x5, 0x79, 0x6, 0x4, @time={0xd, 0x5}, {0x2, 0x7}, {0x9, 0x4}, @addr={0xc, 0xd7}}, {0x6a, 0x7, 0xdb, 0x8, @time={0x151, 0x401}, {0x1, 0x8}, {0x4, 0x2}, @time}, {0x9, 0x9, 0x9, 0xec, @time={0xa, 0xb35}, {0x5, 0x5}, {0x2b, 0x4}, @result={0x68, 0xe}}, {0x40, 0x0, 0x5, 0xc, @time={0xb2a, 0x8}, {0x9, 0xee}, {0x82, 0x2}, @addr={0x19, 0x5}}, {0x80, 0xd0, 0xfd, 0x8, @tick=0x6, {0xa0, 0xc0}, {0x8, 0x3}, @connect={{0x4, 0xc}, {0x4, 0x7}}}], 0xc4) socketpair(0x2a, 0x1, 0x8001, &(0x7f0000000740)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f00000007c0), r1) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000800)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_IBSS(r7, &(0x7f0000000900)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x74, r8, 0x8, 0x70bd2a, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r9}, @val={0xc, 0x99, {0x4, 0x76}}}}, [@NL80211_ATTR_BSS_BASIC_RATES={0xd, 0x24, [{0x6}, {0x5, 0x1}, {0xc, 0x1}, {0x0, 0x1}, {0x3, 0x1}, {0x9}, {0x30}, {0x16}, {0xc, 0x1}]}, @NL80211_ATTR_BEACON_INTERVAL={0x8, 0xc, @random=0x5}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_FREQ_FIXED={0x4}, @NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_CONTROL_PORT={0x4}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x6}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x10}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8}]]}, 0x74}, 0x1, 0x0, 0x0, 0x20000002}, 0x20040440) r10 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./file0\x00', 0x331100, 0x50) ioctl$VIDIOC_G_OUTPUT(r10, 0x8004562e, &(0x7f0000000980)) r11 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000a00), r2) sendmsg$NLBL_MGMT_C_REMOVE(r11, &(0x7f0000000ac0)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a40)={0x30, r12, 0x8, 0x70bd26, 0x25dfdbff, {}, [@NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x5}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @local}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r13 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000b40), r11) sendmsg$IEEE802154_START_REQ(r2, &(0x7f0000000c40)={&(0x7f0000000b00)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000c00)={&(0x7f0000000b80)={0x54, r13, 0x200, 0x70bd2c, 0x25dfdbfb, {}, [@IEEE802154_ATTR_PAGE={0x5, 0x1d, 0x1e}, @IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0x1}, @IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0xf}, @IEEE802154_ATTR_BCN_ORD={0x5, 0x17, 0x4}, @IEEE802154_ATTR_PAGE={0x5, 0x1d, 0xf}, @IEEE802154_ATTR_PAGE={0x5, 0x1d, 0x18}, @IEEE802154_ATTR_BAT_EXT={0x5, 0x1a, 0x1}, @IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0xb}]}, 0x54}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000000) ioctl$sock_inet6_SIOCSIFDSTADDR(r6, 0x8918, &(0x7f0000000c80)={@mcast2, 0x62}) sendmsg$IEEE802154_ASSOCIATE_RESP(r2, &(0x7f0000000d80)={&(0x7f0000000cc0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000d40)={&(0x7f0000000d00)={0x40, r13, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa1}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0102}}]}, 0x40}, 0x1, 0x0, 0x0, 0x80}, 0x40040) ioctl$KVM_CREATE_VM(r10, 0xae01, 0x1c) r14 = syz_open_dev$video(&(0x7f0000000dc0), 0x8, 0x41) ioctl$VIDIOC_S_AUDIO(r14, 0x40345622, &(0x7f0000000e00)={0x7, "f185299bac103de4035b8af9181fabebd70e2a27626648581b9e8b7c827bf9e2", 0x3, 0x1}) pread64(r14, &(0x7f0000000e40)=""/197, 0xc5, 0x100) ioctl$NBD_SET_SIZE_BLOCKS(r10, 0xab07, 0x40) ioctl$SIOCGSKNS(r10, 0x894c, &(0x7f0000000f40)={'\x00', 0x200}) 0s ago: executing program 0 (id=2311): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuset.effective_cpus\x00', 0x275a, 0x0) fcntl$lock(r0, 0x25, &(0x7f0000000000)={0x1}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuset.effective_cpus\x00', 0x275a, 0x0) fcntl$lock(r1, 0x26, &(0x7f0000000380)={0x1, 0x0, 0x7}) r2 = openat$vimc1(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VIDIOC_DECODER_CMD(r2, 0xc0485660, &(0x7f0000000900)={0x1}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuset.effective_cpus\x00', 0x275a, 0x0) fcntl$lock(r3, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x10, 0x3}) r4 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x28200, 0x0) preadv(r4, &(0x7f0000000000)=[{&(0x7f0000000280)=""/212, 0xd4}, {&(0x7f0000000080)=""/259, 0x103}], 0x2, 0xffeffffb, 0x1007) kernel console output (not intermixed with test programs): pport, error: -19 [ 421.711525][T11420] /dev/rnullb0: Can't open blockdev [ 421.799597][ T1603] usb 4-1: USB disconnect, device number 79 [ 422.071157][T11431] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 422.184751][T11437] netlink: 'syz.1.1592': attribute type 4 has an invalid length. [ 422.497065][ T30] audit: type=1326 audit(2000000149.960:1874): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11436 comm="syz.1.1592" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe17858e9a9 code=0x7fc00000 [ 422.779259][T11446] /dev/rnullb0: Can't open blockdev [ 422.826555][T11449] /dev/rnullb0: Can't open blockdev [ 422.875905][T11451] /dev/rnullb0: Can't open blockdev [ 423.864916][T11454] raw_sendmsg: syz.1.1598 forgot to set AF_INET. Fix it! [ 424.020275][T11463] netlink: 212376 bytes leftover after parsing attributes in process `syz.3.1600'. [ 424.097842][T11464] fuse: Bad value for 'user_id' [ 424.102938][T11464] fuse: Bad value for 'user_id' [ 425.331124][T11473] [U] ^C [ 426.273627][ T30] audit: type=1800 audit(2000000153.730:1875): pid=11480 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.1608" name="/" dev="fuse" ino=0 res=0 errno=0 [ 426.369713][T11482] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(4) [ 426.376298][T11482] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 426.388944][T11482] vhci_hcd vhci_hcd.0: Device attached [ 426.398051][T11482] vhci_hcd vhci_hcd.0: port 0 already used [ 426.591881][T11483] vhci_hcd: connection closed [ 426.593993][ T13] vhci_hcd: stop threads [ 426.603337][ T13] vhci_hcd: release socket [ 426.609016][ T13] vhci_hcd: disconnect device [ 426.665488][ T1603] usb 40-1: enqueue for inactive port 0 [ 427.155641][ T1603] usb usb40-port1: attempt power cycle [ 427.276679][T11494] syz.3.1613: attempt to access beyond end of device [ 427.276679][T11494] nbd3: rw=0, sector=0, nr_sectors = 1 limit=0 [ 427.674283][ T92] usb 4-1: new high-speed USB device number 80 using dummy_hcd [ 427.738366][ T1603] usb usb40-port1: unable to enumerate USB device [ 427.847411][ T92] usb 4-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 427.858783][ T92] usb 4-1: config 0 interface 0 has no altsetting 0 [ 427.868829][ T92] usb 4-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 427.878566][ T92] usb 4-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 427.886906][ T92] usb 4-1: Product: syz [ 427.891163][ T92] usb 4-1: Manufacturer: syz [ 427.895873][ T92] usb 4-1: SerialNumber: syz [ 427.902810][ T92] usb 4-1: config 0 descriptor?? [ 427.915150][ T92] usb 4-1: selecting invalid altsetting 0 [ 428.111251][ T1603] usb 4-1: USB disconnect, device number 80 [ 428.604284][ T92] usb 4-1: new high-speed USB device number 81 using dummy_hcd [ 428.774279][ T92] usb 4-1: Using ep0 maxpacket: 32 [ 428.782373][ T92] usb 4-1: config 1 has an invalid interface number: 233 but max is 0 [ 428.791504][ T92] usb 4-1: config 1 has no interface number 0 [ 428.797700][ T92] usb 4-1: config 1 interface 233 has no altsetting 0 [ 428.807033][ T92] usb 4-1: New USB device found, idVendor=04e8, idProduct=ff30, bcdDevice=34.ac [ 428.816421][ T92] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 428.824488][ T92] usb 4-1: Product: syz [ 428.829116][ T92] usb 4-1: Manufacturer: syz [ 428.833744][ T92] usb 4-1: SerialNumber: syz [ 429.044319][T11502] netlink: 'syz.3.1615': attribute type 1 has an invalid length. [ 429.081787][ T92] imon_raw 4-1:1.233: IR endpoint missing [ 429.118647][ T92] usb 4-1: USB disconnect, device number 81 [ 429.159894][T11507] /dev/rnullb0: Can't open blockdev [ 429.564400][ T92] usb 4-1: new high-speed USB device number 82 using dummy_hcd [ 429.724321][ T92] usb 4-1: Using ep0 maxpacket: 32 [ 429.731436][ T92] usb 4-1: config 246 has an invalid interface number: 217 but max is 0 [ 429.739970][ T92] usb 4-1: config 246 has an invalid descriptor of length 218, skipping remainder of the config [ 429.750837][ T92] usb 4-1: config 246 has no interface number 0 [ 429.757386][ T92] usb 4-1: config 246 interface 217 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 429.771108][ T92] usb 4-1: config 246 interface 217 has no altsetting 0 [ 429.783085][ T92] usb 4-1: New USB device found, idVendor=041e, idProduct=0005, bcdDevice=e3.ae [ 429.792363][ T92] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 429.800578][ T92] usb 4-1: Product: syz [ 429.804838][ T92] usb 4-1: Manufacturer: syz [ 429.809458][ T92] usb 4-1: SerialNumber: syz [ 430.029411][T11509] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 430.038411][T11509] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 430.142577][ T92] usb 4-1: USB disconnect, device number 82 [ 430.498334][T11514] /dev/rnullb0: Can't open blockdev [ 430.821197][T11523] /dev/rnullb0: Can't open blockdev [ 430.834052][T11523] /dev/rnullb0: Can't open blockdev [ 430.956412][T11532] /dev/rnullb0: Can't open blockdev [ 432.059253][T11542] tmpfs: Bad value for 'mpol' [ 432.065740][T11542] /dev/rnullb0: Can't open blockdev [ 432.129376][T11544] /dev/rnullb0: Can't open blockdev [ 432.187998][T11546] /dev/rnullb0: Can't open blockdev [ 432.194531][T11547] /dev/rnullb0: Can't open blockdev [ 432.484345][ T5908] usb 4-1: new high-speed USB device number 83 using dummy_hcd [ 432.646390][ T5908] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 432.657749][ T5908] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 432.667617][ T5908] usb 4-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.00 [ 432.676897][ T5908] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 432.689228][ T5908] usb 4-1: config 0 descriptor?? [ 433.103032][ T5908] cp2112 0003:10C4:EA90.0011: unknown main item tag 0x0 [ 433.113868][ T5908] cp2112 0003:10C4:EA90.0011: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.3-1/input0 [ 433.301189][ T5908] cp2112 0003:10C4:EA90.0011: Part Number: 0x00 Device Version: 0x4D [ 433.912392][T11549] cp2112 0003:10C4:EA90.0011: Multi-message I2C transactions not supported [ 433.927700][ T5908] cp2112 0003:10C4:EA90.0011: error reading lock byte: -71 [ 433.948401][ T5908] usb 4-1: USB disconnect, device number 83 [ 433.999404][T11554] loop8: detected capacity change from 0 to 79 [ 434.055188][T11554] loop8: detected capacity change from 79 to 78 [ 434.255342][T11561] /dev/rnullb0: Can't open blockdev [ 434.658583][T11580] sctp: [Deprecated]: syz.3.1642 (pid 11580) Use of int in max_burst socket option deprecated. [ 434.658583][T11580] Use struct sctp_assoc_value instead [ 434.741744][T11582] gfs2: Unknown parameter 'norecoveryard#' [ 435.817461][ T5930] usb 4-1: new high-speed USB device number 84 using dummy_hcd [ 435.994348][ T5930] usb 4-1: Using ep0 maxpacket: 8 [ 436.001561][ T5930] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 436.009230][ T5930] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 436.020846][ T5930] usb 4-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 436.032813][ T5930] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 436.044430][ T5930] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 436.057037][ T5930] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 436.064642][ T5930] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 436.076135][ T5930] usb 4-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 436.087988][ T5930] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 436.100004][ T5930] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 436.112701][ T5930] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 436.120204][ T5930] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 436.131812][ T5930] usb 4-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 436.143571][ T5930] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 436.154953][ T5930] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 436.170930][ T5930] usb 4-1: string descriptor 0 read error: -22 [ 436.177361][ T5930] usb 4-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 436.186565][ T5930] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 436.212113][ T5930] adutux 4-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 436.405516][T11585] netlink: 24160 bytes leftover after parsing attributes in process `syz.3.1643'. [ 436.416225][T11585] netlink: 24160 bytes leftover after parsing attributes in process `syz.3.1643'. [ 436.495600][ T5943] usb 4-1: USB disconnect, device number 84 [ 437.036387][ T92] usb 4-1: new high-speed USB device number 85 using dummy_hcd [ 437.204393][ T92] usb 4-1: Using ep0 maxpacket: 16 [ 437.211251][ T92] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 437.222255][ T92] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 437.233205][ T92] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 437.242963][ T92] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 437.254999][ T92] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 437.269261][ T92] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 437.278389][ T92] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 437.286456][ T92] usb 4-1: Manufacturer: syz [ 437.293832][ T92] usb 4-1: config 0 descriptor?? [ 437.587886][ T92] rc_core: IR keymap rc-hauppauge not found [ 437.594141][ T92] Registered IR keymap rc-empty [ 437.601373][ T92] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 437.625503][ T92] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 437.658011][ T92] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 437.673905][ T92] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input41 [ 437.692072][ T92] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 437.714710][ T92] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 437.734610][ T92] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 437.756750][ T92] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 437.774483][ T92] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 437.794407][ T92] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 437.814451][ T92] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 437.834348][ T92] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 437.853070][T11595] ./cgroup: Can't lookup blockdev [ 437.858550][ T92] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 437.886222][ T92] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 437.908697][ T92] mceusb 4-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 437.918003][ T92] mceusb 4-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 437.954452][ T44] usb 4-1: USB disconnect, device number 85 [ 438.904285][ T92] usb 4-1: new low-speed USB device number 86 using dummy_hcd [ 439.067278][ T92] usb 4-1: config 0 interface 0 altsetting 6 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 439.078626][ T92] usb 4-1: config 0 interface 0 altsetting 6 endpoint 0x81 has invalid maxpacket 1024, setting to 8 [ 439.089663][ T92] usb 4-1: config 0 interface 0 has no altsetting 0 [ 439.096359][ T92] usb 4-1: New USB device found, idVendor=04d9, idProduct=a067, bcdDevice= 0.00 [ 439.105515][ T92] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 439.116135][ T92] usb 4-1: config 0 descriptor?? [ 439.122009][T11612] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 439.554034][ T92] holtek_mouse 0003:04D9:A067.0012: unknown main item tag 0x0 [ 439.573517][ T92] holtek_mouse 0003:04D9:A067.0012: unknown main item tag 0x0 [ 439.594426][ T92] holtek_mouse 0003:04D9:A067.0012: unknown main item tag 0x0 [ 439.604271][ T92] holtek_mouse 0003:04D9:A067.0012: unknown main item tag 0x0 [ 439.611854][ T92] holtek_mouse 0003:04D9:A067.0012: unknown main item tag 0x0 [ 439.629980][ T92] holtek_mouse 0003:04D9:A067.0012: unknown main item tag 0x0 [ 439.644230][ T92] holtek_mouse 0003:04D9:A067.0012: unknown main item tag 0x0 [ 439.662611][ T92] holtek_mouse 0003:04D9:A067.0012: unknown main item tag 0x0 [ 439.689399][ T92] holtek_mouse 0003:04D9:A067.0012: hidraw0: USB HID v0.00 Device [HID 04d9:a067] on usb-dummy_hcd.3-1/input0 [ 439.768807][ T5930] usb 4-1: USB disconnect, device number 86 [ 439.869699][T11615] fido_id[11615]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/report_descriptor': No such file or directory [ 439.940869][ T5852] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 439.955309][ T5852] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 439.959308][ T37] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 439.964992][ T5852] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 439.983296][ T5852] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 439.992965][ T5852] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 440.053870][ T37] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 440.132394][ T37] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 440.200737][ T37] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 440.309579][ T1305] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.398923][T11616] chnl_net:caif_netlink_parms(): no params data found [ 440.568378][ T37] bridge_slave_1: left allmulticast mode [ 440.574095][ T37] bridge_slave_1: left promiscuous mode [ 440.580893][ T37] bridge0: port 2(bridge_slave_1) entered disabled state [ 440.591180][ T37] bridge_slave_0: left allmulticast mode [ 440.597157][ T37] bridge_slave_0: left promiscuous mode [ 440.603423][ T37] bridge0: port 1(bridge_slave_0) entered disabled state [ 440.764948][ T5930] usb 4-1: new high-speed USB device number 87 using dummy_hcd [ 440.899765][ T37] smc: removing net device bridge0 with user defined pnetid SYZ0 [ 440.916748][ T5930] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 440.926086][ T5930] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 440.936536][ T5930] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 440.956646][ T5930] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 440.967988][ T5930] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 440.984061][ T5930] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 441.004351][ T5930] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 441.013195][ T5930] usb 4-1: Product: syz [ 441.017686][ T5930] usb 4-1: Manufacturer: syz [ 441.033194][ T5930] cdc_wdm 4-1:1.0: skipping garbage [ 441.038583][ T5930] cdc_wdm 4-1:1.0: skipping garbage [ 441.060028][ T5930] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device [ 441.067225][ T5930] cdc_wdm 4-1:1.0: Unknown control protocol [ 441.138745][ T37] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 441.151934][ T37] bond_slave_0: left allmulticast mode [ 441.163976][ T37] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 441.178428][ T37] bond_slave_1: left allmulticast mode [ 441.188527][ T37] bond0 (unregistering): Released all slaves [ 441.240072][T11625] cdc_wdm 4-1:1.0: Error submitting int urb - -90 [ 441.256833][T11616] bridge0: port 1(bridge_slave_0) entered blocking state [ 441.264125][T11616] bridge0: port 1(bridge_slave_0) entered disabled state [ 441.275527][T11616] bridge_slave_0: entered allmulticast mode [ 441.283664][T11616] bridge_slave_0: entered promiscuous mode [ 441.297474][T11616] bridge0: port 2(bridge_slave_1) entered blocking state [ 441.305425][T11616] bridge0: port 2(bridge_slave_1) entered disabled state [ 441.312702][T11616] bridge_slave_1: entered allmulticast mode [ 441.322644][T11616] bridge_slave_1: entered promiscuous mode [ 441.329800][ T37] tipc: Disabling bearer [ 441.341410][ T37] tipc: Disabling bearer [ 441.348458][ T37] tipc: Left network mode [ 441.360656][ T5943] usb 4-1: USB disconnect, device number 87 [ 441.492046][T11616] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 441.506667][T11616] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 441.605636][T11616] team0: Port device team_slave_0 added [ 441.698639][T11616] team0: Port device team_slave_1 added [ 441.809549][T11616] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 441.820148][T11616] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 441.850573][T11616] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 441.934238][ T37] hsr_slave_0: left promiscuous mode [ 441.990876][ T37] hsr_slave_1: left promiscuous mode [ 442.004882][ T37] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 442.022021][T11645] /dev/rnullb0: Can't open blockdev [ 442.044523][ T37] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 442.064381][ T5848] Bluetooth: hci2: command tx timeout [ 442.110508][ T37] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 442.118890][ T37] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 442.150917][ T37] veth1_macvtap: left promiscuous mode [ 442.157096][ T37] veth0_macvtap: left promiscuous mode [ 442.173192][ T37] veth1_vlan: left promiscuous mode [ 442.178819][ T37] veth0_vlan: left promiscuous mode [ 442.549913][T11656] ptm ptm1: ldisc open failed (-12), clearing slot 1 [ 442.729108][T11663] nfs: Unknown parameter 'defcontext' [ 443.434289][ T5943] usb 4-1: new full-speed USB device number 88 using dummy_hcd [ 443.471850][ T37] team0 (unregistering): Port device team_slave_1 removed [ 443.535165][ T37] team0 (unregistering): Port device team_slave_0 removed [ 443.615257][ T5943] usb 4-1: unable to get BOS descriptor or descriptor too short [ 443.624060][ T5943] usb 4-1: not running at top speed; connect to a high speed hub [ 443.633376][ T5943] usb 4-1: config 9 has an invalid interface number: 68 but max is 0 [ 443.642879][ T5943] usb 4-1: config 9 has no interface number 0 [ 443.649381][ T5943] usb 4-1: config 9 interface 68 has no altsetting 0 [ 443.660048][ T5943] usb 4-1: New USB device found, idVendor=04dd, idProduct=9050, bcdDevice=43.82 [ 443.691386][ T5943] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 443.700558][ T5943] usb 4-1: Product: syz [ 443.705257][ T5943] usb 4-1: Manufacturer: syz [ 443.710043][ T5943] usb 4-1: SerialNumber: syz [ 443.963468][ T5943] usb 4-1: bad CDC descriptors [ 443.984889][ T5943] usb 4-1: USB disconnect, device number 88 [ 444.142586][T11616] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 444.151258][ T5848] Bluetooth: hci2: command tx timeout [ 444.153483][T11616] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 444.188964][T11616] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 444.385286][T11616] hsr_slave_0: entered promiscuous mode [ 444.397265][T11616] hsr_slave_1: entered promiscuous mode [ 444.687853][T11699] misc userio: Invalid payload size [ 444.710301][T11700] /dev/rnullb0: Can't open blockdev [ 444.717958][T11698] misc userio: Begin command sent, but we're already running [ 444.776160][T11698] misc userio: Begin command sent, but we're already running [ 444.794330][T11698] misc userio: Begin command sent, but we're already running [ 444.802974][T11706] netlink: 'syz.3.1672': attribute type 2 has an invalid length. [ 444.811805][T11698] misc userio: Begin command sent, but we're already running [ 444.818768][T11706] netlink: 'syz.3.1672': attribute type 6 has an invalid length. [ 444.829106][T11707] netlink: 'syz.3.1672': attribute type 2 has an invalid length. [ 444.830334][T11698] misc userio: Begin command sent, but we're already running [ 444.839188][T11707] netlink: 'syz.3.1672': attribute type 6 has an invalid length. [ 444.856477][T11698] misc userio: Begin command sent, but we're already running [ 444.876600][T11698] misc userio: Begin command sent, but we're already running [ 444.892761][T11698] misc userio: Begin command sent, but we're already running [ 444.916706][T11698] misc userio: Begin command sent, but we're already running [ 444.917958][T11616] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 444.932622][T11705] vim2m vim2m.0: vidioc_s_fmt queue busy [ 444.938052][T11698] misc userio: Begin command sent, but we're already running [ 444.953344][T11705] syzkaller1: entered promiscuous mode [ 444.959973][T11698] misc userio: Begin command sent, but we're already running [ 444.970924][T11698] misc userio: Begin command sent, but we're already running [ 444.972346][T11705] syzkaller1: entered allmulticast mode [ 444.980816][T11698] misc userio: Begin command sent, but we're already running [ 444.993625][T11698] misc userio: Begin command sent, but we're already running [ 445.003078][T11698] misc userio: Begin command sent, but we're already running [ 445.011636][T11616] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 445.023233][T11705] /dev/rnullb0: Can't open blockdev [ 445.027118][T11698] misc userio: Begin command sent, but we're already running [ 445.041422][T11616] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 445.048723][T11698] misc userio: Begin command sent, but we're already running [ 445.057149][T11698] misc userio: Begin command sent, but we're already running [ 445.070951][T11698] misc userio: Begin command sent, but we're already running [ 445.083686][T11698] misc userio: Begin command sent, but we're already running [ 445.091614][T11698] misc userio: Begin command sent, but we're already running [ 445.100465][T11698] misc userio: Begin command sent, but we're already running [ 445.109719][T11698] misc userio: Begin command sent, but we're already running [ 445.119258][T11698] misc userio: Begin command sent, but we're already running [ 445.128019][T11616] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 445.137620][T11698] misc userio: Begin command sent, but we're already running [ 445.156422][T11698] misc userio: Begin command sent, but we're already running [ 445.166708][T11698] misc userio: Begin command sent, but we're already running [ 445.178147][T11698] misc userio: Begin command sent, but we're already running [ 445.188636][T11698] misc userio: Begin command sent, but we're already running [ 445.196867][T11698] misc userio: Begin command sent, but we're already running [ 445.213103][T11698] misc userio: Begin command sent, but we're already running [ 445.234593][T11698] misc userio: Begin command sent, but we're already running [ 445.242061][T11698] misc userio: Begin command sent, but we're already running [ 445.274385][T11698] misc userio: Begin command sent, but we're already running [ 445.282835][T11698] misc userio: Begin command sent, but we're already running [ 445.292068][T11698] misc userio: Begin command sent, but we're already running [ 445.346256][T11698] misc userio: Begin command sent, but we're already running [ 445.358988][T11616] 8021q: adding VLAN 0 to HW filter on device bond0 [ 445.368712][T11698] misc userio: Begin command sent, but we're already running [ 445.392198][T11698] misc userio: Begin command sent, but we're already running [ 445.410660][T11698] misc userio: Begin command sent, but we're already running [ 445.422827][T11616] 8021q: adding VLAN 0 to HW filter on device team0 [ 445.432830][T11698] misc userio: Begin command sent, but we're already running [ 445.451251][ T59] bridge0: port 1(bridge_slave_0) entered blocking state [ 445.458472][ T59] bridge0: port 1(bridge_slave_0) entered forwarding state [ 445.468899][T11698] misc userio: Begin command sent, but we're already running [ 445.478220][T11698] misc userio: Begin command sent, but we're already running [ 445.513517][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 445.520795][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 445.640728][T11616] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 446.161115][T11616] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 446.229431][ T5848] Bluetooth: hci2: command tx timeout [ 446.980951][T11616] veth0_vlan: entered promiscuous mode [ 447.015760][T11616] veth1_vlan: entered promiscuous mode [ 447.138536][T11616] veth0_macvtap: entered promiscuous mode [ 447.163312][T11616] veth1_macvtap: entered promiscuous mode [ 447.208116][T11616] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 447.239976][T11616] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 447.302983][ T13] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 447.316367][ T12] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 447.347011][ T12] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 447.360648][ T12] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 447.475082][ T37] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 447.482982][ T37] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 447.560890][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 447.573009][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 448.034537][ T5930] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 448.208879][ T5930] usb 6-1: Using ep0 maxpacket: 32 [ 448.217991][ T5930] usb 6-1: config 0 has an invalid interface number: 120 but max is 0 [ 448.241794][ T5930] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 448.266653][ T5930] usb 6-1: config 0 has no interface number 0 [ 448.273073][ T5930] usb 6-1: config 0 interface 120 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 448.292126][ T5930] usb 6-1: config 0 interface 120 has no altsetting 0 [ 448.304483][ T5848] Bluetooth: hci2: command tx timeout [ 448.319233][ T5930] usb 6-1: New USB device found, idVendor=0421, idProduct=0475, bcdDevice=41.76 [ 448.337783][ T5930] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 448.358001][ T5930] usb 6-1: Product: syz [ 448.362249][ T5930] usb 6-1: Manufacturer: syz [ 448.383745][ T5930] usb 6-1: SerialNumber: syz [ 448.405525][ T5930] usb 6-1: config 0 descriptor?? [ 448.663028][T11772] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 448.689204][T11772] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 449.268760][ T5930] rndis_host 6-1:0.120: skipping garbage [ 449.303942][ T5930] usb 6-1: bad CDC descriptors [ 449.328718][ T5930] cdc_acm 6-1:0.120: Zero length descriptor references [ 449.347706][ T5930] cdc_acm 6-1:0.120: probe with driver cdc_acm failed with error -22 [ 449.374646][ T5930] usb 6-1: USB disconnect, device number 2 [ 450.644897][T11826] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(6) [ 450.651577][T11826] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 450.676212][T11826] vhci_hcd vhci_hcd.0: Device attached [ 450.695393][T11828] vhci_hcd: cannot find the pending unlink 106 [ 450.707574][T11828] vhci_hcd: connection closed [ 450.711188][ T59] vhci_hcd: stop threads [ 450.737024][ T59] vhci_hcd: release socket [ 450.745734][ T59] vhci_hcd: disconnect device [ 452.177029][T11865] /dev/rnullb0: Can't open blockdev [ 452.654261][ T5836] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 452.784305][ T5836] usb 6-1: device descriptor read/64, error -71 [ 453.024310][ T5836] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 453.164356][ T5836] usb 6-1: device descriptor read/64, error -71 [ 453.276691][ T5836] usb usb6-port1: attempt power cycle [ 453.624351][ T5836] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 453.645935][ T5836] usb 6-1: device descriptor read/8, error -71 [ 453.884525][ T5836] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 453.917392][ T5836] usb 6-1: device descriptor read/8, error -71 [ 454.026493][ T5836] usb usb6-port1: unable to enumerate USB device [ 454.388700][T11891] /dev/rnullb0: Can't open blockdev [ 454.457530][T11894] /dev/rnullb0: Can't open blockdev [ 455.974427][ T5908] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 456.146664][ T5908] usb 6-1: config 0 has an invalid interface number: 117 but max is 0 [ 456.154958][ T5908] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 456.166406][ T5908] usb 6-1: config 0 has no interface number 0 [ 456.172590][ T5908] usb 6-1: config 0 interface 117 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 456.183141][ T5908] usb 6-1: config 0 interface 117 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 456.198895][ T5908] usb 6-1: New USB device found, idVendor=0afa, idProduct=03e8, bcdDevice=99.d0 [ 456.208446][ T5908] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 456.216883][ T5908] usb 6-1: Product: syz [ 456.221079][ T5908] usb 6-1: Manufacturer: syz [ 456.226621][ T5908] usb 6-1: SerialNumber: syz [ 456.239168][ T5908] usb 6-1: config 0 descriptor?? [ 456.856523][T11905] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 456.866355][T11905] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 456.877502][T11905] delete_channel: no stack [ 456.882072][T11905] delete_channel: no stack [ 456.890644][T11905] 9pnet: Unknown protocol version 9 [ 456.899928][ T5943] usb 6-1: USB disconnect, device number 7 [ 458.319689][T11918] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1703'. [ 458.333067][T11918] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1703'. [ 458.343357][T11918] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1703'. [ 458.746795][ T5836] usb 6-1: new full-speed USB device number 8 using dummy_hcd [ 458.916507][ T5836] usb 6-1: config 0 has an invalid interface number: 214 but max is 0 [ 458.928006][ T5836] usb 6-1: config 0 has no interface number 0 [ 458.934740][ T5836] usb 6-1: config 0 interface 214 altsetting 2 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 458.952770][ T5836] usb 6-1: config 0 interface 214 has no altsetting 0 [ 458.968657][ T5836] usb 6-1: New USB device found, idVendor=07c9, idProduct=000e, bcdDevice=5d.4f [ 458.978315][ T5836] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 458.989216][ T5836] usb 6-1: Product: syz [ 458.993423][ T5836] usb 6-1: Manufacturer: syz [ 459.001162][ T5836] usb 6-1: SerialNumber: syz [ 459.015880][ T5836] usb 6-1: config 0 descriptor?? [ 459.024974][T11922] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 459.240286][T11922] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 459.469475][T11922] tap0: tun_chr_ioctl cmd 1074025677 [ 459.475549][T11922] tap0: linktype set to 776 [ 460.404813][ T5836] ax88179_178a 6-1:0.214 (unnamed net_device) (uninitialized): Failed to read reg index 0x0001: -71 [ 460.425371][ T5836] ax88179_178a 6-1:0.214 (unnamed net_device) (uninitialized): Failed to read reg index 0x0006: -71 [ 460.454550][ T5836] ax88179_178a 6-1:0.214 (unnamed net_device) (uninitialized): invalid MAC address, using random [ 460.482644][ T5836] ax88179_178a 6-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x0006: -71 [ 460.520686][ T5836] ax88179_178a 6-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x0005: -71 [ 460.541116][ T5836] ax88179_178a 6-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x0001: -71 [ 460.559134][ T5836] ax88179_178a 6-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x0001: -71 [ 460.580557][ T5836] ax88179_178a 6-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x0001: -71 [ 460.600023][ T5836] ax88179_178a 6-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x0001: -71 [ 460.612784][ T5836] ax88179_178a 6-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x0002: -71 [ 460.625998][ T5836] ax88179_178a 6-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x0001: -71 [ 460.655178][ T5836] ax88179_178a 6-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x0002: -71 [ 460.687031][ T5836] ax88179_178a 6-1:0.214 (unnamed net_device) (uninitialized): Failed to read reg index 0x0001: -71 [ 460.715341][ T5836] ax88179_178a 6-1:0.214 (unnamed net_device) (uninitialized): Failed to read reg index 0x0001: -71 [ 460.746088][ T5836] ax88179_178a 6-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x0001: -71 [ 460.778685][ T5836] ax88179_178a 6-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x001f: -71 [ 460.814512][ T5836] ax88179_178a 6-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x0019: -71 [ 460.845973][ T5836] ax88179_178a 6-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x001f: -71 [ 460.874789][ T5836] ax88179_178a 6-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x000d: -71 [ 460.896531][ T5836] ax88179_178a 6-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x000e: -71 [ 460.925248][ T5836] ax88179_178a 6-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x000d: -71 [ 460.954756][ T5836] ax88179_178a 6-1:0.214 (unnamed net_device) (uninitialized): Failed to read reg index 0x000e: -71 [ 460.974924][ T5836] ax88179_178a 6-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x000d: -71 [ 460.994708][ T5836] ax88179_178a 6-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x000e: -71 [ 461.024704][ T5836] ax88179_178a 6-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x000d: -71 [ 461.044820][ T5836] ax88179_178a 6-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x000e: -71 [ 461.068432][ T5836] ax88179_178a 6-1:0.214 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 461.107032][ T5836] ax88179_178a 6-1:0.214 eth9: register 'ax88179_178a' at usb-dummy_hcd.5-1, AT-UMC2000 USB 3.0/USB 3.1 Gen 1 to Gigabit Ethernet Adapter, e6:e8:7b:0f:75:e3 [ 461.153901][ T5836] usb 6-1: USB disconnect, device number 8 [ 461.175454][ T5836] ax88179_178a 6-1:0.214 eth9: unregister 'ax88179_178a' usb-dummy_hcd.5-1, AT-UMC2000 USB 3.0/USB 3.1 Gen 1 to Gigabit Ethernet Adapter [ 461.467133][ T5852] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 461.478205][ T5852] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 461.486648][ T5852] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 461.496777][ T5852] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 461.505738][ T5852] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 461.684291][ T5836] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 461.864392][ T5836] usb 6-1: Using ep0 maxpacket: 8 [ 461.888595][ T5836] usb 6-1: config 5 has an invalid interface number: 197 but max is 1 [ 461.922038][ T5836] usb 6-1: config 5 has an invalid interface number: 174 but max is 1 [ 461.950901][ T5836] usb 6-1: config 5 has no interface number 0 [ 461.973730][ T5836] usb 6-1: config 5 has no interface number 1 [ 461.993180][ T5836] usb 6-1: config 5 interface 197 has no altsetting 0 [ 462.010101][ T5836] usb 6-1: config 5 interface 174 has no altsetting 0 [ 462.033493][T11958] chnl_net:caif_netlink_parms(): no params data found [ 462.050578][ T5836] usb 6-1: New USB device found, idVendor=05e3, idProduct=0503, bcdDevice=e5.59 [ 462.084374][ T5836] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 462.092436][ T5836] usb 6-1: Product: syz [ 462.124241][ T5836] usb 6-1: Manufacturer: syz [ 462.129070][ T5836] usb 6-1: SerialNumber: syz [ 462.303742][T11958] bridge0: port 1(bridge_slave_0) entered blocking state [ 462.334489][T11958] bridge0: port 1(bridge_slave_0) entered disabled state [ 462.341886][T11958] bridge_slave_0: entered allmulticast mode [ 462.355910][T11952] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 462.382113][T11952] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 462.392746][T11958] bridge_slave_0: entered promiscuous mode [ 462.403936][T11958] bridge0: port 2(bridge_slave_1) entered blocking state [ 462.415275][T11952] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 462.422825][T11958] bridge0: port 2(bridge_slave_1) entered disabled state [ 462.431198][T11958] bridge_slave_1: entered allmulticast mode [ 462.444919][T11952] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 462.446430][T11958] bridge_slave_1: entered promiscuous mode [ 462.469199][T11952] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 462.506715][T11952] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 462.541961][T11952] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 462.591530][T11958] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 462.594470][T11952] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 462.608353][T11958] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 462.640466][T11952] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 462.661679][T11952] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 462.743387][T11958] team0: Port device team_slave_0 added [ 462.802949][T11958] team0: Port device team_slave_1 added [ 463.183038][T11958] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 463.223795][T11958] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 463.340623][T11958] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 463.437338][T11958] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 463.487904][T11958] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 463.597370][ T5852] Bluetooth: hci4: command tx timeout [ 463.674870][T11958] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 463.846677][ T5836] usbhid 6-1:5.174: couldn't find an input interrupt endpoint [ 463.907057][ T5836] usb 6-1: USB disconnect, device number 9 [ 464.108055][T11958] hsr_slave_0: entered promiscuous mode [ 464.139791][T11958] hsr_slave_1: entered promiscuous mode [ 464.155434][T11958] debugfs: 'hsr0' already exists in 'hsr' [ 464.164531][T11958] Cannot create hsr debugfs directory [ 464.445985][T12008] netlink: 16138 bytes leftover after parsing attributes in process `syz.5.1716'. [ 464.932733][T11958] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 464.958547][T11958] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 464.991617][T11958] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 465.020092][T11958] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 465.290698][T11958] 8021q: adding VLAN 0 to HW filter on device bond0 [ 465.361429][T11958] 8021q: adding VLAN 0 to HW filter on device team0 [ 465.385862][T12029] overlayfs: NFS export requires "redirect_dir=nofollow" on non-upper mount, falling back to nfs_export=off. [ 465.416614][T12029] overlayfs: missing 'lowerdir' [ 465.445154][T12029] /dev/rnullb0: Can't open blockdev [ 465.448770][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 465.457737][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 465.486850][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 465.494208][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 465.664500][ T5852] Bluetooth: hci4: command tx timeout [ 466.211203][T11958] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 466.395805][T12051] MTD: Attempt to mount non-MTD device "/dev/rnullb0" [ 466.439335][T12051] /dev/rnullb0: Can't open blockdev [ 466.730431][T12059] /dev/rnullb0: Can't open blockdev [ 467.038482][T11958] veth0_vlan: entered promiscuous mode [ 467.093486][T11958] veth1_vlan: entered promiscuous mode [ 467.218579][T11958] veth0_macvtap: entered promiscuous mode [ 467.227073][T12072] /dev/rnullb0: Can't open blockdev [ 467.238538][T11958] veth1_macvtap: entered promiscuous mode [ 467.288598][T11958] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 467.322090][T11958] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 467.368508][ T37] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 467.413183][ T37] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 467.444633][ T59] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 467.463838][ T59] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 467.646847][ T37] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 467.686067][ T37] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 467.747494][ T5852] Bluetooth: hci4: command tx timeout [ 467.818531][ T37] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 467.838637][ T37] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 468.165275][T12086] /dev/rnullb0: Can't open blockdev [ 468.409318][T12092] QAT: failed to copy from user cfg_data. [ 468.985126][ T5930] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 469.167095][ T5930] usb 6-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 469.210986][ T5930] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 469.269836][ T5930] usb 6-1: config 0 descriptor?? [ 469.309802][ T5930] cp210x 6-1:0.0: cp210x converter detected [ 469.593016][T12116] /dev/rnullb0: Can't open blockdev [ 469.668073][T12117] 8021q: VLANs not supported on syzkaller1 [ 469.740021][ T5930] cp210x 6-1:0.0: failed to get vendor val 0x000e size 3: -32 [ 469.824492][ T5852] Bluetooth: hci4: command tx timeout [ 469.994594][ T5930] usb 6-1: cp210x converter now attached to ttyUSB0 [ 470.050034][T12130] /dev/rnullb0: Can't open blockdev [ 470.082376][T12130] /dev/rnullb0: Can't open blockdev [ 470.371163][ T92] usb 6-1: USB disconnect, device number 10 [ 470.410769][ T92] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 470.449519][ T92] cp210x 6-1:0.0: device disconnected [ 471.082770][T12140] /dev/rnullb0: Can't open blockdev [ 472.094299][ T5930] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 472.302657][ T5930] usb 6-1: New USB device found, idVendor=1a86, idProduct=7522, bcdDevice=35.36 [ 472.334198][ T5930] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 472.364246][ T5930] usb 6-1: Product: syz [ 472.368491][ T5930] usb 6-1: Manufacturer: syz [ 472.397880][ T5930] usb 6-1: SerialNumber: syz [ 472.435968][ T5930] usb 6-1: config 0 descriptor?? [ 472.459142][ T5930] ch341 6-1:0.0: ch341-uart converter detected [ 472.724663][ T92] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 472.894768][ T92] usb 7-1: config index 0 descriptor too short (expected 9, got 0) [ 472.916694][ T92] usb 7-1: can't read configurations, error -22 [ 473.064363][ T92] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 473.226420][ T92] usb 7-1: config index 0 descriptor too short (expected 9, got 0) [ 473.244248][ T92] usb 7-1: can't read configurations, error -22 [ 473.258958][T12161] /dev/rnullb0: Can't open blockdev [ 473.261697][ T92] usb usb7-port1: attempt power cycle [ 473.266733][ T5930] usb 6-1: failed to send control message: -71 [ 473.285380][ T5930] ch341-uart ttyUSB0: probe with driver ch341-uart failed with error -71 [ 473.308985][ T5930] usb 6-1: USB disconnect, device number 11 [ 473.329602][ T5930] ch341 6-1:0.0: device disconnected [ 473.614458][ T92] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 473.653336][ T92] usb 7-1: config index 0 descriptor too short (expected 9, got 0) [ 473.672789][ T92] usb 7-1: can't read configurations, error -22 [ 473.819918][ T92] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 473.870568][ T92] usb 7-1: config index 0 descriptor too short (expected 9, got 0) [ 473.889251][ T92] usb 7-1: can't read configurations, error -22 [ 473.902717][ T92] usb usb7-port1: unable to enumerate USB device [ 474.154448][ T5836] usb 6-1: new full-speed USB device number 12 using dummy_hcd [ 474.326288][ T5836] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 474.337901][ T5836] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 474.350123][ T5836] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 474.362668][ T5836] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 474.391223][ T5836] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 474.416185][ T5836] usb 6-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 474.437362][ T5836] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 474.454250][ T5836] usb 6-1: Product: syz [ 474.458481][ T5836] usb 6-1: Manufacturer: syz [ 474.462938][T12181] gfs2: path_lookup on c::: returned error -2 [ 474.474252][ T5836] usb 6-1: SerialNumber: syz [ 474.490783][ T5836] usb 6-1: config 0 descriptor?? [ 474.592299][T12181] Dead loop on virtual device ip6_vti0, fix it urgently! [ 474.614751][T12181] Dead loop on virtual device ip6_vti0, fix it urgently! [ 474.622624][T12181] Dead loop on virtual device ip6_vti0, fix it urgently! [ 474.644631][T12181] Dead loop on virtual device ip6_vti0, fix it urgently! [ 474.652231][T12181] Dead loop on virtual device ip6_vti0, fix it urgently! [ 474.696030][T12181] Dead loop on virtual device ip6_vti0, fix it urgently! [ 474.711884][ T5836] radio-si470x 6-1:0.0: si470x_get_report: usb_control_msg returned -32 [ 474.743592][ T5836] radio-si470x 6-1:0.0: probe with driver radio-si470x failed with error -5 [ 475.000342][ T5836] usb 6-1: USB disconnect, device number 12 [ 475.730520][T12213] netlink: 52 bytes leftover after parsing attributes in process `syz.5.1750'. [ 475.831044][T12217] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 475.855331][T12217] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 476.046700][ T44] usb 6-1: new full-speed USB device number 13 using dummy_hcd [ 476.137639][T12225] /dev/rnullb0: Can't open blockdev [ 476.234246][ T44] usb 6-1: device descriptor read/64, error -71 [ 476.484825][ T44] usb 6-1: new full-speed USB device number 14 using dummy_hcd [ 476.544410][ T5836] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 476.644258][ T44] usb 6-1: device descriptor read/64, error -71 [ 476.698700][ T5836] usb 7-1: config index 0 descriptor too short (expected 23569, got 27) [ 476.711119][ T5836] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 476.729699][ T5836] usb 7-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 476.739432][ T5836] usb 7-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 476.752007][ T5836] usb 7-1: Manufacturer: syz [ 476.760832][ T5836] usb 7-1: config 0 descriptor?? [ 476.774620][ T44] usb usb6-port1: attempt power cycle [ 476.854399][ T5836] rc_core: IR keymap rc-hauppauge not found [ 476.864536][ T5836] Registered IR keymap rc-empty [ 476.871496][ T5836] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/rc/rc0 [ 476.890349][ T5836] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/rc/rc0/input44 [ 477.129514][ T44] usb 6-1: new full-speed USB device number 15 using dummy_hcd [ 477.175006][ T44] usb 6-1: device descriptor read/8, error -71 [ 477.179454][T12231] rc rc0: two consecutive events of type space [ 477.434256][ T44] usb 6-1: new full-speed USB device number 16 using dummy_hcd [ 477.455076][ T44] usb 6-1: device descriptor read/8, error -71 [ 477.569211][ T44] usb usb6-port1: unable to enumerate USB device [ 477.617053][ T5836] usb 7-1: USB disconnect, device number 6 [ 478.405453][T12239] /dev/rnullb0: Can't open blockdev [ 479.411988][T12251] /dev/rnullb0: Can't open blockdev [ 480.234128][T12268] netlink: 'syz.0.1766': attribute type 27 has an invalid length. [ 480.671016][T12276] /dev/rnullb0: Can't open blockdev [ 480.923586][T12286] comedi comedi0: pcl816: I/O port conflict (0x2,16) [ 481.074570][ T5836] usb 6-1: new high-speed USB device number 17 using dummy_hcd [ 481.159828][T12289] vivid-000: ================= START STATUS ================= [ 481.174346][T12289] vivid-000: Interlaced VBI Format: false [ 481.193301][T12289] vivid-000: ================== END STATUS ================== [ 481.246298][ T5836] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 481.274883][ T5836] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 481.295140][ T5836] usb 6-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 481.314345][ T5836] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 481.340327][ T5836] usb 6-1: config 0 descriptor?? [ 482.445529][ T5852] Bluetooth: unknown link type 32 [ 482.451380][ T5852] Bluetooth: hci3: connection err: -111 [ 483.185702][T12313] /dev/rnullb0: Can't open blockdev [ 483.531852][T12318] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1782'. [ 483.564275][T12318] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1782'. [ 483.593614][T12318] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1782'. [ 483.627562][T12318] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1782'. [ 483.861749][ T30] audit: type=1326 audit(2000000211.320:1876): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12325 comm="syz.6.1783" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f4b6778e9a9 code=0x0 [ 483.941102][ T5836] usbhid 6-1:0.0: can't add hid device: -71 [ 483.973550][ T5836] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 484.014599][ T5836] usb 6-1: USB disconnect, device number 17 [ 484.589870][T12355] /dev/rnullb0: Can't open blockdev [ 484.712922][T12357] /dev/rnullb0: Can't open blockdev [ 484.922225][T12359] /dev/rnullb0: Can't open blockdev [ 485.253463][T12372] /dev/rnullb0: Can't open blockdev [ 485.406164][T12374] /dev/rnullb0: Can't open blockdev [ 485.894339][ T5836] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 486.056216][ T5836] usb 7-1: config index 0 descriptor too short (expected 65069, got 45) [ 486.064973][ T5836] usb 7-1: config 0 has more interface descriptors, than it declares in bNumInterfaces, ignoring interface number: 0 [ 486.078077][ T5836] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 486.088847][ T5836] usb 7-1: config 0 has no interfaces? [ 486.096680][ T5836] usb 7-1: New USB device found, idVendor=1908, idProduct=1315, bcdDevice= 0.00 [ 486.110795][ T5836] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 486.123921][ T5836] usb 7-1: config 0 descriptor?? [ 486.816438][T12397] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1803'. [ 487.062355][ T5836] usb 7-1: USB disconnect, device number 7 [ 487.193483][T12402] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1804'. [ 487.899603][T12406] /dev/rnullb0: Can't open blockdev [ 487.975263][T12409] /dev/rnullb0: Can't open blockdev [ 488.584235][ T5836] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 488.627400][T12424] netlink: 16402 bytes leftover after parsing attributes in process `syz.0.1811'. [ 488.651812][T12422] netlink: 16402 bytes leftover after parsing attributes in process `syz.0.1811'. [ 488.734444][ T5836] usb 7-1: device descriptor read/64, error -71 [ 489.004880][ T5836] usb 7-1: new high-speed USB device number 9 using dummy_hcd [ 489.134287][ T5836] usb 7-1: device descriptor read/64, error -71 [ 489.244931][ T5836] usb usb7-port1: attempt power cycle [ 489.327840][T12445] comedi comedi3: 8255: I/O port conflict (0x10003,4) [ 489.378826][T12445] comedi comedi3: 8255: I/O port conflict (0x10000,4) [ 489.436837][T12445] comedi comedi3: 8255: I/O port conflict (0x7f,4) [ 489.804672][ T5908] usb 6-1: new high-speed USB device number 18 using dummy_hcd [ 489.954622][ T5908] usb 6-1: device descriptor read/64, error -71 [ 490.164269][ T5836] usb 7-1: new high-speed USB device number 10 using dummy_hcd [ 490.194442][ T5908] usb 6-1: new high-speed USB device number 19 using dummy_hcd [ 490.195046][ T5836] usb 7-1: device descriptor read/8, error -71 [ 490.344432][ T5908] usb 6-1: device descriptor read/64, error -71 [ 490.454806][ T5908] usb usb6-port1: attempt power cycle [ 490.489122][ T5836] usb 7-1: new high-speed USB device number 11 using dummy_hcd [ 490.539404][ T5836] usb 7-1: device descriptor read/8, error -71 [ 490.671142][ T5836] usb usb7-port1: unable to enumerate USB device [ 490.805197][ T5908] usb 6-1: new high-speed USB device number 20 using dummy_hcd [ 490.855433][ T5908] usb 6-1: device descriptor read/8, error -71 [ 491.094321][ T5908] usb 6-1: new high-speed USB device number 21 using dummy_hcd [ 491.110713][T12458] /dev/rnullb0: Can't open blockdev [ 491.125173][ T5908] usb 6-1: device descriptor read/8, error -71 [ 491.234970][ T5908] usb usb6-port1: unable to enumerate USB device [ 491.595155][T12470] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 491.607663][T12470] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 493.097797][T12496] vxcan1: entered allmulticast mode [ 493.534483][ T5930] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 493.744484][ T1603] usb 7-1: new high-speed USB device number 12 using dummy_hcd [ 493.864272][ T5930] usb 6-1: device descriptor read/64, error -71 [ 493.946447][ T1603] usb 7-1: New USB device found, idVendor=055d, idProduct=9002, bcdDevice=31.44 [ 493.960093][ T1603] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 493.975568][ T1603] usb 7-1: config 0 descriptor?? [ 493.996989][ T1603] pwc: Samsung SNC-35E (v3.0) USB webcam detected. [ 494.114282][ T5930] usb 6-1: new high-speed USB device number 23 using dummy_hcd [ 494.254326][ T5930] usb 6-1: device descriptor read/64, error -71 [ 494.368120][ T5930] usb usb6-port1: attempt power cycle [ 495.006851][T12507] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1834'. [ 495.028291][T12507] /dev/rnullb0: Can't open blockdev [ 495.176519][T12510] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 495.195982][T12509] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 496.034618][ T5930] usb 6-1: new high-speed USB device number 24 using dummy_hcd [ 496.042752][ T1603] pwc: recv_control_msg error -71 req 02 val 2b00 [ 496.051846][ T1603] pwc: recv_control_msg error -71 req 02 val 2700 [ 496.175128][ T5930] usb 6-1: device descriptor read/8, error -71 [ 496.181808][ T1603] pwc: recv_control_msg error -71 req 04 val 1600 [ 496.193446][ T1603] pwc: recv_control_msg error -71 req 02 val 2c00 [ 496.203523][ T1603] pwc: recv_control_msg error -71 req 04 val 1000 [ 496.224452][ T1603] pwc: recv_control_msg error -71 req 04 val 1300 [ 496.231652][ T1603] pwc: recv_control_msg error -71 req 04 val 1400 [ 496.252413][T12515] /dev/rnullb0: Can't open blockdev [ 496.259406][ T1603] pwc: recv_control_msg error -71 req 02 val 2000 [ 496.284801][ T1603] pwc: recv_control_msg error -71 req 02 val 2100 [ 496.303407][ T1603] pwc: recv_control_msg error -71 req 06 val 0600 [ 496.335216][ T1603] pwc: recv_control_msg error -71 req 04 val 1500 [ 496.347000][ T1603] pwc: recv_control_msg error -71 req 02 val 2500 [ 496.355264][T12517] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1838'. [ 496.384072][ T1603] pwc: recv_control_msg error -71 req 02 val 2400 [ 496.394978][ T1603] pwc: recv_control_msg error -71 req 02 val 2600 [ 496.401916][T12517] netlink: 'syz.6.1838': attribute type 3 has an invalid length. [ 496.422421][ T1603] pwc: recv_control_msg error -71 req 02 val 2900 [ 496.434710][ T1603] pwc: recv_control_msg error -71 req 02 val 2800 [ 496.441754][T12518] /dev/rnullb0: Can't open blockdev [ 496.466704][ T1603] pwc: recv_control_msg error -71 req 04 val 1100 [ 496.479744][ T1603] pwc: recv_control_msg error -71 req 04 val 1200 [ 496.527032][T12522] /dev/nullb0: Can't open blockdev [ 496.553445][ T1603] pwc: Registered as video103. [ 496.610552][ T1603] input: PWC snapshot button as /devices/platform/dummy_hcd.6/usb7/7-1/input/input45 [ 496.694508][ T1603] usb 7-1: USB disconnect, device number 12 [ 497.143326][T12537] /dev/rnullb0: Can't open blockdev [ 497.147684][T12540] /dev/rnullb0: Can't open blockdev [ 497.485073][ T5930] usb 7-1: new high-speed USB device number 13 using dummy_hcd [ 497.614362][ T1603] usb 6-1: new high-speed USB device number 26 using dummy_hcd [ 497.644256][ T5930] usb 7-1: Using ep0 maxpacket: 32 [ 497.663909][ T5930] usb 7-1: config 0 has an invalid descriptor of length 108, skipping remainder of the config [ 497.696814][ T5930] usb 7-1: New USB device found, idVendor=22b8, idProduct=6027, bcdDevice=c2.80 [ 497.714454][ T5930] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 497.732756][ T5930] usb 7-1: Product: syz [ 497.737161][ T5930] usb 7-1: Manufacturer: syz [ 497.744518][ T1603] usb 6-1: device descriptor read/64, error -71 [ 497.763145][ T5930] usb 7-1: SerialNumber: syz [ 497.776676][ T5930] usb 7-1: config 0 descriptor?? [ 497.795574][ T5930] usb 7-1: bad CDC descriptors [ 497.801631][ T5930] usb 7-1: unsupported MDLM descriptors [ 497.984280][ T1603] usb 6-1: new high-speed USB device number 27 using dummy_hcd [ 498.144495][ T1603] usb 6-1: device descriptor read/64, error -71 [ 498.255365][ T1603] usb usb6-port1: attempt power cycle [ 498.472478][T12564] /dev/rnullb0: Can't open blockdev [ 498.604437][ T1603] usb 6-1: new high-speed USB device number 28 using dummy_hcd [ 498.638421][ T1603] usb 6-1: device descriptor read/8, error -71 [ 498.894363][ T1603] usb 6-1: new high-speed USB device number 29 using dummy_hcd [ 498.925448][ T1603] usb 6-1: device descriptor read/8, error -71 [ 499.044987][ T1603] usb usb6-port1: unable to enumerate USB device [ 500.082790][T12586] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(4) [ 500.089396][T12586] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 500.098079][T12586] vhci_hcd vhci_hcd.0: Device attached [ 500.105654][T12587] usbip_core: unknown command [ 500.110934][T12587] vhci_hcd: unknown pdu 1752524645 [ 500.116165][T12587] usbip_core: unknown command [ 500.122923][ T36] vhci_hcd: stop threads [ 500.133725][ T36] vhci_hcd: release socket [ 500.139446][ T36] vhci_hcd: disconnect device [ 500.396003][ T5930] usb 7-1: USB disconnect, device number 13 [ 500.698638][T12593] syzkaller1: entered promiscuous mode [ 500.714431][T12593] syzkaller1: entered allmulticast mode [ 500.732207][T12593] MTD: Attempt to mount non-MTD device "/dev/rnullb0" [ 500.755967][T12593] /dev/rnullb0: Can't open blockdev [ 500.899071][T12598] /dev/rnullb0: Can't open blockdev [ 501.248590][T12605] binder: 12602:12605 ioctl c0306201 0 returned -14 [ 501.274453][ T92] usb 7-1: new high-speed USB device number 14 using dummy_hcd [ 501.434342][ T92] usb 7-1: device descriptor read/64, error -71 [ 501.568762][T12607] /dev/rnullb0: Can't open blockdev [ 501.684281][ T92] usb 7-1: new high-speed USB device number 15 using dummy_hcd [ 501.749225][ T1305] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.767075][T12613] /dev/rnullb0: Can't open blockdev [ 501.773056][T12614] /dev/rnullb0: Can't open blockdev [ 501.843504][ T92] usb 7-1: device descriptor read/64, error -71 [ 501.976944][ T92] usb usb7-port1: attempt power cycle [ 501.982508][ T5852] Bluetooth: Wrong link type (-57) [ 502.214280][ T5930] usb 6-1: new high-speed USB device number 30 using dummy_hcd [ 502.354487][ T92] usb 7-1: new high-speed USB device number 16 using dummy_hcd [ 502.364281][ T5930] usb 6-1: device descriptor read/64, error -71 [ 502.390048][ T92] usb 7-1: device descriptor read/8, error -71 [ 502.604414][ T5930] usb 6-1: new high-speed USB device number 31 using dummy_hcd [ 502.644270][ T92] usb 7-1: new high-speed USB device number 17 using dummy_hcd [ 502.664990][ T92] usb 7-1: device descriptor read/8, error -71 [ 502.734319][ T5930] usb 6-1: device descriptor read/64, error -71 [ 502.774742][ T92] usb usb7-port1: unable to enumerate USB device [ 502.854502][ T5930] usb usb6-port1: attempt power cycle [ 503.194427][ T5930] usb 6-1: new high-speed USB device number 32 using dummy_hcd [ 503.215207][ T5930] usb 6-1: device descriptor read/8, error -71 [ 503.464287][ T5930] usb 6-1: new high-speed USB device number 33 using dummy_hcd [ 503.485024][ T5930] usb 6-1: device descriptor read/8, error -71 [ 503.604360][ T5930] usb usb6-port1: unable to enumerate USB device [ 503.836411][T12622] /dev/rnullb0: Can't open blockdev [ 504.120597][T12626] vivid-000: disconnect [ 504.592703][T12629] netlink: 348 bytes leftover after parsing attributes in process `syz.0.1875'. [ 505.876332][T12646] /dev/rnullb0: Can't open blockdev [ 506.029115][T12652] /dev/rnullb0: Can't open blockdev [ 508.132679][T12688] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 508.177742][T12688] 9pnet: Limiting 'msize' to 1048576 as this is the maximum supported by transport fd [ 508.177742][T12689] 9pnet: Limiting 'msize' to 1048576 as this is the maximum supported by transport fd [ 508.590678][T12695] /dev/rnullb0: Can't open blockdev [ 508.625011][T12697] /dev/rnullb0: Can't open blockdev [ 509.034507][T12703] /dev/rnullb0: Can't open blockdev [ 509.301437][T12707] /dev/rnullb0: Can't open blockdev [ 509.454502][ T44] usb 7-1: new high-speed USB device number 18 using dummy_hcd [ 509.616512][ T44] usb 7-1: config 0 has an invalid interface number: 117 but max is 0 [ 509.631338][ T44] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 509.652973][ T44] usb 7-1: config 0 has no interface number 0 [ 509.666495][ T44] usb 7-1: config 0 interface 117 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 509.687802][ T44] usb 7-1: config 0 interface 117 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 509.719000][ T44] usb 7-1: New USB device found, idVendor=0afa, idProduct=03e8, bcdDevice=99.d0 [ 509.729409][ T44] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 509.749691][ T44] usb 7-1: Product: syz [ 509.753927][ T44] usb 7-1: Manufacturer: syz [ 509.764543][ T44] usb 7-1: SerialNumber: syz [ 509.782805][ T44] usb 7-1: config 0 descriptor?? [ 510.011868][T12705] vhci_hcd vhci_hcd.0: pdev(6) rhport(0) sockfd(5) [ 510.018461][T12705] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 510.035568][T12705] vhci_hcd vhci_hcd.0: Device attached [ 510.071378][T12717] vhci_hcd: connection closed [ 510.073413][ T44] usb 7-1: USB disconnect, device number 18 [ 510.086949][T12511] vhci_hcd: stop threads [ 510.091276][T12511] vhci_hcd: release socket [ 510.120788][T12511] vhci_hcd: disconnect device [ 510.154094][T12722] fuse: Bad value for 'fd' [ 510.960380][T12738] netlink: 96 bytes leftover after parsing attributes in process `syz.5.1908'. [ 510.969843][ T5908] usb 7-1: new high-speed USB device number 19 using dummy_hcd [ 511.114284][T12746] /dev/rnullb0: Can't open blockdev [ 511.130331][ T5908] usb 7-1: config 0 has an invalid interface number: 156 but max is 0 [ 511.130366][ T5908] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 511.130387][ T5908] usb 7-1: config 0 has no interface number 0 [ 511.130429][ T5908] usb 7-1: config 0 interface 156 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 511.130453][ T5908] usb 7-1: config 0 interface 156 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 511.130495][ T5908] usb 7-1: New USB device found, idVendor=abcd, idProduct=cdee, bcdDevice= 5.b9 [ 511.130520][ T5908] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 511.133435][ T5908] usb 7-1: config 0 descriptor?? [ 511.154931][T12746] /dev/rnullb0: Can't open blockdev [ 511.159857][ T5908] gspca_main: spca561-2.14.0 probing abcd:cdee [ 511.435062][T12757] /dev/rnullb0: Can't open blockdev [ 511.475633][T12758] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 511.500042][T12758] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 511.684496][ T44] usb 6-1: new full-speed USB device number 34 using dummy_hcd [ 511.825707][T12770] netlink: 763 bytes leftover after parsing attributes in process `syz.0.1917'. [ 511.841261][T12770] /dev/rnullb0: Can't open blockdev [ 511.849428][ T44] usb 6-1: config 5 has an invalid interface number: 123 but max is 0 [ 511.858031][ T5908] spca561 7-1:0.156: probe with driver spca561 failed with error -22 [ 511.866985][ T44] usb 6-1: config 5 has no interface number 0 [ 511.880092][ T5908] usb 7-1: Quirk or no altset; falling back to MIDI 1.0 [ 511.887733][ T44] usb 6-1: config 5 interface 123 altsetting 7 has an endpoint descriptor with address 0xEB, changing to 0x8B [ 511.903807][ T5908] usb 7-1: MIDIStreaming interface descriptor not found [ 511.915332][ T44] usb 6-1: config 5 interface 123 altsetting 7 endpoint 0x4 has invalid wMaxPacketSize 0 [ 511.970309][ T44] usb 6-1: config 5 interface 123 has no altsetting 0 [ 512.007588][ T44] usb 6-1: New USB device found, idVendor=3923, idProduct=718a, bcdDevice=d8.d7 [ 512.034507][ T44] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 512.074613][ T44] usb 6-1: Product: syz [ 512.089690][ T44] usb 6-1: Manufacturer: syz [ 512.108422][ T44] usb 6-1: SerialNumber: syz [ 512.173091][T12773] netdevsim netdevsim6: Firmware load for '..' refused, path contains '..' component [ 512.291268][T12775] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1919'. [ 512.360788][ T30] audit: type=1800 audit(2000000239.820:1877): pid=12760 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.1912" name="SYSV00000000" dev="tmpfs" ino=0 res=0 errno=0 [ 512.388234][T12760] MTD: Attempt to mount non-MTD device "/dev/rnullb0" [ 512.423072][T12760] /dev/rnullb0: Can't open blockdev [ 512.487938][ T44] ni6501 6-1:5.123: driver 'ni6501' failed to auto-configure device. [ 512.507454][T12777] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 512.526123][ T44] usb 6-1: USB disconnect, device number 34 [ 512.557505][T12777] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 512.637808][T12783] /dev/rnullb0: Can't open blockdev [ 512.819466][T12791] /dev/rnullb0: Can't open blockdev [ 513.248045][T12802] /dev/rnullb0: Can't open blockdev [ 514.038852][T12833] /dev/rnullb0: Can't open blockdev [ 514.227424][T12837] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 514.399161][T12844] veth1_macvtap: entered allmulticast mode [ 514.420223][T12844] /dev/rnullb0: Can't open blockdev [ 514.705348][T12850] /dev/rnullb0: Can't open blockdev [ 515.050906][T12858] netlink: 'syz.5.1944': attribute type 21 has an invalid length. [ 515.067215][T12858] /dev/rnullb0: Can't open blockdev [ 515.077097][T12855] /dev/rnullb0: Can't open blockdev [ 515.916225][ T5852] Bluetooth: hci4: unexpected event 0x3e length: 283 > 260 [ 515.916263][ T5852] Bluetooth: hci4: unexpected subevent 0x0d length: 282 > 260 [ 515.931648][ T5852] Bluetooth: hci4: adv larger than maximum supported [ 515.931701][ T5852] Bluetooth: hci4: adv larger than maximum supported [ 516.177050][T12874] binder: 12873:12874 ioctl c0046209 0 returned -22 [ 516.222457][T12874] netlink: 148 bytes leftover after parsing attributes in process `syz.5.1949'. [ 516.633764][T12882] /dev/rnullb0: Can't open blockdev [ 516.727944][T12884] /dev/rnullb0: Can't open blockdev [ 517.425038][T12904] /dev/rnullb0: Can't open blockdev [ 517.889511][T12910] /dev/rnullb0: Can't open blockdev [ 518.389220][T12923] /dev/rnullb0: Can't open blockdev [ 518.501194][T12929] /dev/rnullb0: Can't open blockdev [ 518.728471][T12934] netlink: 'syz.6.1970': attribute type 11 has an invalid length. [ 518.740390][T12934] netlink: 28 bytes leftover after parsing attributes in process `syz.6.1970'. [ 518.763872][T12934] netlink: 'syz.6.1970': attribute type 29 has an invalid length. [ 518.777539][T12934] netlink: 'syz.6.1970': attribute type 29 has an invalid length. [ 519.204217][T12924] orangefs_mount: mount request failed with -4 [ 519.306624][T12941] syz.5.1973: attempt to access beyond end of device [ 519.306624][T12941] loop5: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 519.324527][T12941] SQUASHFS error: Failed to read block 0x0: -5 [ 519.334082][T12941] unable to read squashfs_super_block [ 519.336344][T12944] ./cgroup: Can't lookup blockdev [ 519.454583][T12946] netlink: 188 bytes leftover after parsing attributes in process `syz.5.1975'. [ 520.340660][T12969] MTD: Attempt to mount non-MTD device "/dev/rnullb0" [ 520.372759][T12969] /dev/rnullb0: Can't open blockdev [ 520.622100][T12977] vhci_hcd vhci_hcd.0: pdev(6) rhport(0) sockfd(7) [ 520.628783][T12977] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 520.657695][T12977] vhci_hcd vhci_hcd.0: Device attached [ 520.675806][T12978] usbip_core: unknown command [ 520.686028][T12978] vhci_hcd: unknown pdu 731316224 [ 520.701339][T12978] usbip_core: unknown command [ 520.711755][ T4889] vhci_hcd: stop threads [ 520.723444][ T4889] vhci_hcd: release socket [ 520.739436][ T4889] vhci_hcd: disconnect device [ 521.848268][ T1603] usb 6-1: new high-speed USB device number 35 using dummy_hcd [ 522.004328][ T1603] usb 6-1: device descriptor read/64, error -71 [ 522.247207][ T1603] usb 6-1: new high-speed USB device number 36 using dummy_hcd [ 522.384442][ T1603] usb 6-1: device descriptor read/64, error -71 [ 522.504810][ T1603] usb usb6-port1: attempt power cycle [ 522.877929][ T1603] usb 6-1: new high-speed USB device number 37 using dummy_hcd [ 522.907843][ T1603] usb 6-1: device descriptor read/8, error -71 [ 522.989431][T12997] netlink: 'syz.0.1991': attribute type 27 has an invalid length. [ 523.105154][T12999] Attempt to restore checkpoint with obsolete wellknown handles [ 523.164248][ T1603] usb 6-1: new high-speed USB device number 38 using dummy_hcd [ 523.198662][ T1603] usb 6-1: device descriptor read/8, error -71 [ 523.324867][ T1603] usb usb6-port1: unable to enumerate USB device [ 523.753527][T13014] /dev/rnullb0: Can't open blockdev [ 524.266792][T13010] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 524.294678][T13010] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 524.307671][ T5848] Bluetooth: hci0: command 0x0406 tx timeout [ 524.338702][T13010] /dev/rnullb0: Can't open blockdev [ 525.364505][T13030] /dev/rnullb0: Can't open blockdev [ 525.584360][T13036] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 525.604056][T13036] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 525.864272][ T5836] usb 6-1: new high-speed USB device number 39 using dummy_hcd [ 526.024613][ T5836] usb 6-1: Using ep0 maxpacket: 8 [ 526.040912][ T5836] usb 6-1: unable to get BOS descriptor or descriptor too short [ 526.061402][ T5836] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 526.075206][ T5836] usb 6-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 5 [ 526.091716][ T5836] usb 6-1: New USB device found, idVendor=0763, idProduct=1002, bcdDevice=5f.84 [ 526.103913][ T5836] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 526.123727][ T5836] usb 6-1: Product: syz [ 526.138112][ T5836] usb 6-1: Manufacturer: syz [ 526.163528][ T5836] usb 6-1: SerialNumber: syz [ 526.185085][ T5836] usb 6-1: config 0 descriptor?? [ 526.229973][ T5836] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 526.349497][ T5836] snd-usb-audio 6-1:0.0: probe with driver snd-usb-audio failed with error -2 [ 526.440891][ T5836] usb 6-1: USB disconnect, device number 39 [ 526.499089][T10200] udevd[10200]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 526.583021][T13049] /dev/rnullb0: Can't open blockdev [ 526.699198][T13052] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 526.713776][T13052] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 526.731704][T13052] /dev/rnullb0: Can't open blockdev [ 526.744659][T13052] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 526.782525][T13052] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 527.544370][ T5908] usb 6-1: new high-speed USB device number 40 using dummy_hcd [ 527.704937][ T5908] usb 6-1: Using ep0 maxpacket: 32 [ 527.730210][ T5908] usb 6-1: config 0 has an invalid interface number: 156 but max is 0 [ 527.753470][ T5908] usb 6-1: config 0 has no interface number 0 [ 527.788164][ T5908] usb 6-1: config 0 interface 156 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 527.812395][ T5908] usb 6-1: config 0 interface 156 has no altsetting 0 [ 527.834019][ T5908] usb 6-1: New USB device found, idVendor=2040, idProduct=6500, bcdDevice=1c.9d [ 527.856759][ T5908] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 527.877254][ T5908] usb 6-1: Product: syz [ 527.891205][ T5908] usb 6-1: Manufacturer: syz [ 527.911295][ T5908] usb 6-1: SerialNumber: syz [ 527.925290][ T5908] usb 6-1: config 0 descriptor?? [ 527.954381][T13079] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 527.978192][T13079] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 528.240094][ T5908] em28xx 6-1:0.156: New device syz syz @ 480 Mbps (2040:6500, interface 156, class 156) [ 528.270501][ T5908] em28xx 6-1:0.156: Video interface 156 found: isoc [ 528.340615][T13086] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 528.349996][ T5908] em28xx 6-1:0.156: unknown em28xx chip ID (0) [ 528.363287][T13086] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 528.431993][ T5908] em28xx 6-1:0.156: reading from i2c device at 0xa0 failed (error=-5) [ 528.451052][ T5908] em28xx 6-1:0.156: board has no eeprom [ 528.533838][ T5908] em28xx 6-1:0.156: Identified as Hauppauge WinTV HVR 900 (card=10) [ 528.542195][ T5908] em28xx 6-1:0.156: analog set to isoc mode. [ 528.560111][ T1603] em28xx 6-1:0.156: Registering V4L2 extension [ 528.572433][ T5908] usb 6-1: USB disconnect, device number 40 [ 528.580454][ T5908] em28xx 6-1:0.156: Disconnecting em28xx [ 528.822085][ T1603] em28xx 6-1:0.156: Config register raw data: 0xffffffed [ 528.847543][ T1603] em28xx 6-1:0.156: AC97 chip type couldn't be determined [ 528.870140][ T1603] em28xx 6-1:0.156: No AC97 audio processor [ 528.898622][ T1603] em28xx 6-1:0.156: em28xx_v4l2_init: Error while setting audio - error [-19]! [ 528.934075][ T1603] em28xx 6-1:0.156: Binding DVB extension [ 528.957733][ T1603] em28xx 6-1:0.156: no endpoint for DVB mode and transfer type 0 [ 528.999744][ T1603] em28xx 6-1:0.156: failed to pre-allocate USB transfer buffers for DVB. [ 529.030473][ T1603] em28xx 6-1:0.156: Registering input extension [ 529.057859][ T5908] em28xx 6-1:0.156: Closing input extension [ 529.096822][ T5908] em28xx 6-1:0.156: Freeing device [ 529.326839][T13107] /dev/rnullb0: Can't open blockdev [ 529.581983][ T5836] usb 6-1: new high-speed USB device number 41 using dummy_hcd [ 529.702085][T13114] netlink: 'syz.6.2031': attribute type 178 has an invalid length. [ 529.748430][ T5836] usb 6-1: Using ep0 maxpacket: 16 [ 529.764748][ T5836] usb 6-1: New USB device found, idVendor=054c, idProduct=0038, bcdDevice=16.f5 [ 529.773863][ T5836] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 529.804334][ T5836] usb 6-1: Product: syz [ 529.816343][ T5836] usb 6-1: Manufacturer: syz [ 529.825718][ T5836] usb 6-1: SerialNumber: syz [ 529.850651][ T5836] usb 6-1: config 0 descriptor?? [ 529.873415][ T5836] visor 6-1:0.0: Sony Clie 3.5 converter detected [ 530.041168][T13116] netlink: 'syz.0.2032': attribute type 10 has an invalid length. [ 530.285573][T13108] /dev/rnullb0: Can't open blockdev [ 530.301945][ T5836] usb 6-1: clie_3_5_startup: get interface number failed: -71 [ 530.325676][ T5836] visor 6-1:0.0: probe with driver visor failed with error -71 [ 530.353972][ T5836] usb 6-1: USB disconnect, device number 41 [ 531.504233][ T5836] usb 6-1: new high-speed USB device number 42 using dummy_hcd [ 531.522493][T13148] /dev/rnullb0: Can't open blockdev [ 531.676476][ T5836] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 531.689774][ T5836] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 531.711161][ T5836] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 531.738717][ T5836] usb 6-1: New USB device found, idVendor=20d6, idProduct=cb17, bcdDevice= 0.00 [ 531.758230][ T5836] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 531.797449][ T5836] usb 6-1: config 0 descriptor?? [ 532.232354][ T5836] hid-udraw 0003:20D6:CB17.0013: unknown main item tag 0x0 [ 532.251088][ T5836] hid-udraw 0003:20D6:CB17.0013: global environment stack underflow [ 532.322137][ T5836] hid-udraw 0003:20D6:CB17.0013: item 0 0 1 11 parsing failed [ 532.395003][ T5836] hid-udraw 0003:20D6:CB17.0013: parse failed [ 532.401623][ T5836] hid-udraw 0003:20D6:CB17.0013: probe with driver hid-udraw failed with error -22 [ 532.437543][T13137] /dev/rnullb0: Can't open blockdev [ 532.498628][ T5836] usb 6-1: USB disconnect, device number 42 [ 532.500967][T13162] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 532.538698][T13162] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 533.253861][T13171] /dev/rnullb0: Can't open blockdev [ 533.330615][T13169] ./cgroup: Can't lookup blockdev [ 533.557401][T13183] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 533.580064][T13183] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 533.616457][T13183] vhci_hcd vhci_hcd.0: pdev(6) rhport(0) sockfd(7) [ 533.623041][T13183] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 533.651948][T13183] vhci_hcd vhci_hcd.0: Device attached [ 533.678505][T13184] vhci_hcd: connection closed [ 533.680538][ T4889] vhci_hcd: stop threads [ 533.715948][ T4889] vhci_hcd: release socket [ 533.720496][ T4889] vhci_hcd: disconnect device [ 533.833863][T13189] /dev/rnullb0: Can't open blockdev [ 534.663544][T13201] /dev/rnullb0: Can't open blockdev [ 534.754690][ T5908] usb 6-1: new high-speed USB device number 43 using dummy_hcd [ 534.838821][T13205] /dev/rnullb0: Can't open blockdev [ 534.860226][T13195] /dev/rnullb0: Can't open blockdev [ 534.929657][T13203] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 534.942976][ T5908] usb 6-1: config 0 has an invalid interface number: 239 but max is 0 [ 534.958918][ T5908] usb 6-1: config 0 has an invalid interface number: 84 but max is 0 [ 534.977289][ T5908] usb 6-1: config 0 contains an unexpected descriptor of type 0x2, skipping [ 534.991691][T13203] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 534.995514][T13194] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 535.010567][ T5908] usb 6-1: config 0 contains an unexpected descriptor of type 0x2, skipping [ 535.030846][ T5908] usb 6-1: config 0 has 2 interfaces, different from the descriptor's value: 1 [ 535.041221][ T5908] usb 6-1: config 0 has no interface number 0 [ 535.051740][ T5908] usb 6-1: config 0 has no interface number 1 [ 535.059390][ T5908] usb 6-1: config 0 interface 239 altsetting 0 has a duplicate endpoint with address 0xF, skipping [ 535.065588][T13194] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 535.077957][ T5908] usb 6-1: config 0 interface 239 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 16 [ 535.097212][ T5908] usb 6-1: too many endpoints for config 0 interface 84 altsetting 151: 235, using maximum allowed: 30 [ 535.120127][ T5908] usb 6-1: config 0 interface 84 altsetting 151 endpoint 0x1 has invalid maxpacket 1024, setting to 64 [ 535.133033][ T5908] usb 6-1: config 0 interface 84 altsetting 151 has an invalid descriptor for endpoint zero, skipping [ 535.157841][ T5908] usb 6-1: config 0 interface 84 altsetting 151 has a duplicate endpoint with address 0x1, skipping [ 535.176242][ T5908] usb 6-1: config 0 interface 84 altsetting 151 has a duplicate endpoint with address 0x3, skipping [ 535.176963][T13209] /dev/rnullb0: Can't open blockdev [ 535.201423][ T5908] usb 6-1: config 0 interface 84 altsetting 151 has a duplicate endpoint with address 0x3, skipping [ 535.213098][ T5908] usb 6-1: config 0 interface 84 altsetting 151 has a duplicate endpoint with address 0x3, skipping [ 535.236499][ T5908] usb 6-1: config 0 interface 84 altsetting 151 endpoint 0xB has an invalid bInterval 0, changing to 7 [ 535.251174][ T5908] usb 6-1: config 0 interface 84 altsetting 151 endpoint 0xC has invalid maxpacket 512, setting to 64 [ 535.269857][ T5908] usb 6-1: config 0 interface 84 altsetting 151 has an invalid descriptor for endpoint zero, skipping [ 535.282275][ T5908] usb 6-1: config 0 interface 84 altsetting 151 endpoint 0x2 has invalid maxpacket 1023, setting to 64 [ 535.309251][ T5908] usb 6-1: config 0 interface 84 altsetting 151 has 14 endpoint descriptors, different from the interface descriptor's value: 235 [ 535.338514][ T5908] usb 6-1: config 0 interface 84 has no altsetting 0 [ 535.369341][ T5908] usb 6-1: New USB device found, idVendor=0cf3, idProduct=e006, bcdDevice=62.f6 [ 535.381778][ T5908] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 535.400959][ T5908] usb 6-1: Product: syz [ 535.408411][ T5908] usb 6-1: Manufacturer: syz [ 535.413072][ T5908] usb 6-1: SerialNumber: syz [ 535.451553][ T5908] usb 6-1: config 0 descriptor?? [ 535.825101][T13215] binder: 13198:13215 ioctl c0306201 0 returned -14 [ 536.136633][ T5908] usb 6-1: USB disconnect, device number 43 [ 536.339959][T13223] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 536.374753][T13223] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 537.311035][T13240] netlink: 'syz.5.2071': attribute type 3 has an invalid length. [ 537.344959][T13240] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2071'. [ 538.090178][T13247] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 539.014494][ T92] usb 6-1: new high-speed USB device number 44 using dummy_hcd [ 539.176267][ T92] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 539.194493][ T92] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 539.214826][ T92] usb 6-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 539.229551][ T92] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 539.248456][ T92] usb 6-1: SerialNumber: syz [ 539.423973][ T5852] Bluetooth: hci3: ACL packet for unknown connection handle 201 [ 539.507622][ T92] usb 6-1: 0:2 : does not exist [ 539.512841][ T92] usb 6-1: unit 5: unexpected type 0x0d [ 539.619220][ T92] usb 6-1: USB disconnect, device number 44 [ 539.696246][ T9827] udevd[9827]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 540.064985][ T30] audit: type=1326 audit(2000000267.530:1878): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13280 comm="syz.6.2083" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f4b6778e9a9 code=0x0 [ 540.124273][ T30] audit: type=1326 audit(2000000267.550:1879): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13280 comm="syz.6.2083" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f4b6778e9a9 code=0x0 [ 540.438051][T13291] /dev/rnullb0: Can't open blockdev [ 540.658156][T13296] syz.6.2087: attempt to access beyond end of device [ 540.658156][T13296] nbd6: rw=0, sector=0, nr_sectors = 1 limit=0 [ 541.040941][T13305] /dev/rnullb0: Can't open blockdev [ 541.412092][T13315] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 541.450420][T13315] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 542.954415][ T5943] usb 6-1: new high-speed USB device number 45 using dummy_hcd [ 543.133215][ T5943] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 543.152097][ T5943] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 543.174762][ T5943] usb 6-1: Product: syz [ 543.179011][ T5943] usb 6-1: Manufacturer: syz [ 543.193542][ T5943] usb 6-1: SerialNumber: syz [ 543.208069][ T5943] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 543.228368][ T92] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 543.432834][T13344] /dev/rnullb0: Can't open blockdev [ 543.442184][T13343] /dev/rnullb0: Can't open blockdev [ 543.865934][T13333] netlink: 132 bytes leftover after parsing attributes in process `syz.5.2099'. [ 544.464255][ T92] usb 6-1: Service connection timeout for: 256 [ 544.470576][ T92] ath9k_htc 6-1:1.0: ath9k_htc: Unable to initialize HTC services [ 544.555474][ T92] ath9k_htc: Failed to initialize the device [ 544.556227][ T5908] usb 6-1: USB disconnect, device number 45 [ 544.588085][ T5908] usb 6-1: ath9k_htc: USB layer deinitialized [ 545.345245][T13356] /dev/rnullb0: Can't open blockdev [ 545.653801][T13362] /dev/rnullb0: Can't open blockdev [ 545.743595][T13365] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 545.772739][T13365] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 545.795684][T13365] netlink: 16 bytes leftover after parsing attributes in process `syz.6.2113'. [ 546.527978][T13384] /dev/rnullb0: Can't open blockdev [ 546.574223][ T92] usb 6-1: new high-speed USB device number 46 using dummy_hcd [ 546.639348][T13386] /dev/rnullb0: Can't open blockdev [ 546.734312][ T92] usb 6-1: Using ep0 maxpacket: 16 [ 546.742853][ T92] usb 6-1: config 0 has an invalid interface number: 149 but max is 0 [ 546.764315][ T92] usb 6-1: config 0 has no interface number 0 [ 546.774340][ T92] usb 6-1: config 0 interface 149 altsetting 0 endpoint 0x6 has invalid maxpacket 512, setting to 64 [ 546.802282][ T92] usb 6-1: config 0 interface 149 altsetting 0 endpoint 0xB has invalid maxpacket 1024, setting to 64 [ 546.828678][ T92] usb 6-1: New USB device found, idVendor=06f8, idProduct=0001, bcdDevice=7d.3b [ 546.848168][ T92] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 546.864620][ T92] usb 6-1: Product: syz [ 546.874472][ T92] usb 6-1: Manufacturer: syz [ 546.884437][ T92] usb 6-1: SerialNumber: syz [ 546.897332][ T92] usb 6-1: config 0 descriptor?? [ 547.130688][T13380] /dev/rnullb0: Can't open blockdev [ 547.144900][ T92] usb 6-1: USB disconnect, device number 46 [ 547.268427][T13392] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 547.362101][T13394] tmpfs: Unknown parameter 'usrquota!½p' [ 547.475260][T13396] tc_dump_action: action bad kind [ 547.493353][T13396] /dev/rnullb0: Can't open blockdev [ 547.603576][T13398] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 547.617211][T13398] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 547.787948][T13400] /dev/rnullb0: Can't open blockdev [ 548.382535][T13409] netlink: 18128 bytes leftover after parsing attributes in process `syz.5.2130'. [ 548.639569][T13413] /dev/rnullb0: Can't open blockdev [ 548.660159][T13414] Bluetooth: MGMT ver 1.23 [ 548.872458][T13416] /dev/rnullb0: Can't open blockdev [ 550.505193][T13431] /dev/rnullb0: Can't open blockdev [ 550.820556][T13441] /dev/rnullb0: Can't open blockdev [ 551.668720][T13446] /dev/sg0: Can't lookup blockdev [ 552.497486][T13469] /dev/rnullb0: Can't open blockdev [ 552.904283][ T44] usb 6-1: new high-speed USB device number 47 using dummy_hcd [ 553.088193][ T44] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 553.108003][ T44] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 553.215458][ T44] usb 6-1: config 0 descriptor?? [ 553.648123][ T44] ath6kl: Unsupported hardware version: 0x0 [ 553.682893][ T44] ath6kl: Failed to init ath6kl core: -22 [ 553.701031][ T44] ath6kl_usb 6-1:0.0: probe with driver ath6kl_usb failed with error -22 [ 553.850973][T13470] netlink: 20 bytes leftover after parsing attributes in process `syz.5.2153'. [ 553.886648][T13470] 9pnet_fd: Insufficient options for proto=fd [ 553.931972][T13497] binder: 13492:13497 ioctl c0306201 0 returned -14 [ 554.260927][T13502] /dev/rnullb0: Can't open blockdev [ 554.803251][T13506] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 554.835127][T13506] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 554.870117][T13506] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 554.896781][T13506] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 555.531962][ T92] usb 6-1: USB disconnect, device number 47 [ 556.098175][T13524] /dev/rnullb0: Can't open blockdev [ 556.460707][T13528] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2172'. [ 556.867049][ T1603] usb 6-1: new high-speed USB device number 48 using dummy_hcd [ 557.009167][ T5852] Bluetooth: hci3: unexpected Set CIG Parameters response data [ 557.018748][ T5852] Bluetooth: hci3: unexpected event for opcode 0x2062 [ 557.044822][ T1603] usb 6-1: Using ep0 maxpacket: 16 [ 557.053596][ T1603] usb 6-1: config index 0 descriptor too short (expected 1828, got 36) [ 557.077529][ T1603] usb 6-1: config 0 has an invalid interface number: 0 but max is -1 [ 557.096009][ T1603] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 557.130509][ T1603] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 557.162201][ T1603] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 557.190314][ T1603] usb 6-1: New USB device found, idVendor=06cd, idProduct=0115, bcdDevice=1a.1e [ 557.202351][ T1603] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 557.222045][ T1603] usb 6-1: Product: syz [ 557.237126][ T1603] usb 6-1: Manufacturer: syz [ 557.249796][ T1603] usb 6-1: SerialNumber: syz [ 557.280807][ T1603] usb 6-1: config 0 descriptor?? [ 557.297969][ T1603] keyspan 6-1:0.0: Keyspan 2 port adapter converter detected [ 557.317944][ T1603] keyspan 6-1:0.0: found no endpoint descriptor for endpoint 87 [ 557.346207][ T1603] keyspan 6-1:0.0: found no endpoint descriptor for endpoint 7 [ 557.371543][ T1603] keyspan 6-1:0.0: found no endpoint descriptor for endpoint 81 [ 557.389746][ T1603] keyspan 6-1:0.0: found no endpoint descriptor for endpoint 1 [ 557.406955][ T1603] keyspan 6-1:0.0: found no endpoint descriptor for endpoint 2 [ 557.426011][ T1603] keyspan 6-1:0.0: found no endpoint descriptor for endpoint 85 [ 557.444035][ T1603] keyspan 6-1:0.0: found no endpoint descriptor for endpoint 5 [ 557.465746][ T1603] usb 6-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 557.597013][T13530] /dev/rnullb0: Can't open blockdev [ 557.619012][T13532] /dev/rnullb0: Can't open blockdev [ 557.666561][ T1603] keyspan 6-1:0.0: found no endpoint descriptor for endpoint 83 [ 557.694308][ T1603] keyspan 6-1:0.0: unsupported endpoint type 0 [ 557.700625][ T1603] keyspan 6-1:0.0: found no endpoint descriptor for endpoint 4 [ 557.724356][ T1603] keyspan 6-1:0.0: found no endpoint descriptor for endpoint 86 [ 557.744403][ T1603] keyspan 6-1:0.0: found no endpoint descriptor for endpoint 6 [ 557.758771][ T1603] usb 6-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 557.798495][ T1603] usb 6-1: USB disconnect, device number 48 [ 557.856475][ T1603] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 557.899788][ T1603] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 557.920862][ T1603] keyspan 6-1:0.0: device disconnected [ 558.006694][T13541] /dev/rnullb0: Can't open blockdev [ 558.359342][T13557] /dev/net/tun: Can't lookup blockdev [ 558.409963][T13562] /dev/rnullb0: Can't open blockdev [ 558.656434][ T5943] usb 6-1: new full-speed USB device number 49 using dummy_hcd [ 558.790694][T13573] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 558.810504][T13573] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 558.825203][T13573] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 558.835715][ T5943] usb 6-1: not running at top speed; connect to a high speed hub [ 558.850146][ T5943] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 558.871589][T13573] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 558.886526][ T5943] usb 6-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 558.912602][ T5943] usb 6-1: config 1 has no interface number 1 [ 558.926742][ T5943] usb 6-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 558.956602][ T5943] usb 6-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 4 [ 558.983766][ T5943] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 558.998481][ T5943] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 559.027841][ T5943] usb 6-1: Product: syz [ 559.042023][ T5943] usb 6-1: Manufacturer: syz [ 559.055390][ T5943] usb 6-1: SerialNumber: syz [ 559.277638][T13581] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 559.316020][T13560] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 559.316767][T13581] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 559.347248][T13560] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 559.372592][T13560] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 559.396464][T13581] /dev/rnullb0: Can't open blockdev [ 559.402473][T13560] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 559.418489][T13560] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 559.456489][T13560] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 559.493115][T13560] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 559.534815][T13560] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 559.546173][T13560] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 559.568028][T13560] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 559.623379][ T5943] usb 6-1: 2:1 : no or invalid class specific endpoint descriptor [ 559.652647][ T5943] usb 6-1: 2:1 : unsupported format bits 0x2000 [ 559.704405][ T5943] usb 6-1: USB disconnect, device number 49 [ 559.788542][ T9827] udevd[9827]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 560.524260][ T1603] usb 6-1: new high-speed USB device number 50 using dummy_hcd [ 560.676230][ T1603] usb 6-1: Using ep0 maxpacket: 16 [ 560.699045][ T1603] usb 6-1: unable to get BOS descriptor or descriptor too short [ 560.722643][ T1603] usb 6-1: config 1 has an invalid interface number: 130 but max is 2 [ 560.744228][ T1603] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 560.765721][ T1603] usb 6-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 560.784364][ T1603] usb 6-1: config 1 has no interface number 1 [ 560.794268][ T1603] usb 6-1: config 1 interface 130 altsetting 1 endpoint 0xC has an invalid bInterval 249, changing to 7 [ 560.826269][ T1603] usb 6-1: config 1 interface 130 altsetting 1 endpoint 0xD has invalid maxpacket 1023, setting to 64 [ 560.845901][ T1603] usb 6-1: config 1 interface 130 altsetting 1 has an endpoint descriptor with address 0x5A, changing to 0xA [ 560.866272][ T1603] usb 6-1: config 1 interface 130 altsetting 1 endpoint 0xA has invalid maxpacket 26413, setting to 1024 [ 560.894208][ T1603] usb 6-1: config 1 interface 130 altsetting 1 bulk endpoint 0xA has invalid maxpacket 1024 [ 560.914563][ T1603] usb 6-1: config 1 interface 130 altsetting 1 endpoint 0x7 has invalid maxpacket 479, setting to 64 [ 560.934227][ T1603] usb 6-1: config 1 interface 130 altsetting 1 has 5 endpoint descriptors, different from the interface descriptor's value: 4 [ 560.964238][ T1603] usb 6-1: config 1 interface 130 has no altsetting 0 [ 560.983556][ T1603] usb 6-1: New USB device found, idVendor=0af0, idProduct=d058, bcdDevice= 0.00 [ 561.003718][ T1603] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 561.023955][ T1603] usb 6-1: Product: syz [ 561.034074][ T1603] usb 6-1: Manufacturer: syz [ 561.034663][ T5852] Bluetooth: hci3: Controller not accepting commands anymore: ncmd = 0 [ 561.042152][ T5852] Bluetooth: hci3: Injecting HCI hardware error event [ 561.057988][ T5848] Bluetooth: hci3: hardware error 0x00 [ 561.058635][ T1603] usb 6-1: SerialNumber: syz [ 561.101682][T13584] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 561.760592][ T1603] hso 6-1:1.130: Not our interface [ 561.770302][ T1603] usb-storage 6-1:1.130: USB Mass Storage device detected [ 561.860870][ T1603] hso 6-1:1.0: Not our interface [ 561.866703][ T1603] usb-storage 6-1:1.0: USB Mass Storage device detected [ 561.957577][ T1603] usb 6-1: USB disconnect, device number 50 [ 562.035499][ T30] audit: type=1326 audit(2000000289.490:1880): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13590 comm="syz.0.2190" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa4a358e9a9 code=0x7fc00000 [ 562.089067][ T30] audit: type=1326 audit(2000000289.490:1881): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13590 comm="syz.0.2190" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa4a358e9a9 code=0x7fc00000 [ 562.121085][ T30] audit: type=1326 audit(2000000289.490:1882): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13590 comm="syz.0.2190" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa4a358e9a9 code=0x7fc00000 [ 562.149041][ T30] audit: type=1326 audit(2000000289.490:1883): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13590 comm="syz.0.2190" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa4a358e9a9 code=0x7fc00000 [ 562.174025][ T30] audit: type=1326 audit(2000000289.500:1884): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13590 comm="syz.0.2190" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa4a358e9a9 code=0x7fc00000 [ 562.207160][ T30] audit: type=1326 audit(2000000289.500:1885): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13590 comm="syz.0.2190" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa4a358e9a9 code=0x7fc00000 [ 562.240267][ T30] audit: type=1326 audit(2000000289.500:1886): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13590 comm="syz.0.2190" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa4a358e9a9 code=0x7fc00000 [ 562.289329][ T30] audit: type=1326 audit(2000000289.500:1887): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13590 comm="syz.0.2190" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa4a358e9a9 code=0x7fc00000 [ 562.314924][T13595] /dev/rnullb0: Can't open blockdev [ 562.344521][ T30] audit: type=1326 audit(2000000289.500:1888): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13590 comm="syz.0.2190" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa4a358e9a9 code=0x7fc00000 [ 562.414217][ T30] audit: type=1326 audit(2000000289.500:1889): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13590 comm="syz.0.2190" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa4a358e9a9 code=0x7fc00000 [ 562.731675][T13603] netlink: 44 bytes leftover after parsing attributes in process `syz.0.2194'. [ 562.747654][T13605] binder: 13596:13605 ioctl 400c620e 0 returned -14 [ 562.790530][T13605] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2192'. [ 562.859875][T13597] /dev/rnullb0: Can't open blockdev [ 563.104264][ T5848] Bluetooth: hci3: Opcode 0x0c03 failed: -110 [ 563.193288][ T1305] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.655114][ T92] usb 6-1: new high-speed USB device number 51 using dummy_hcd [ 563.762698][T13629] /dev/rnullb0: Can't open blockdev [ 563.854419][ T92] usb 6-1: Using ep0 maxpacket: 16 [ 563.891938][ T92] usb 6-1: New USB device found, idVendor=1a0a, idProduct=0102, bcdDevice=71.c9 [ 563.936725][ T92] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 563.978099][ T92] usb 6-1: Product: syz [ 563.982345][ T92] usb 6-1: Manufacturer: syz [ 564.023878][ T92] usb 6-1: SerialNumber: syz [ 564.050125][ T92] usb 6-1: config 0 descriptor?? [ 564.095028][ T92] usb_ehset_test 6-1:0.0: probe with driver usb_ehset_test failed with error -32 [ 564.173023][T13632] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 564.195273][T13632] /dev/rnullb0: Can't open blockdev [ 564.369438][T13609] /dev/rnullb0: Can't open blockdev [ 564.400344][ T1603] usb 6-1: USB disconnect, device number 51 [ 564.433308][T13636] overlayfs: failed to resolve './file1': -2 [ 564.615017][T13644] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(3) [ 564.621649][T13644] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 564.634511][T13644] vhci_hcd vhci_hcd.0: Device attached [ 564.756474][T13645] vhci_hcd: connection closed [ 564.759649][ T36] vhci_hcd: stop threads [ 564.781991][ T36] vhci_hcd: release socket [ 564.788430][ T36] vhci_hcd: disconnect device [ 564.814416][ T5836] vhci_hcd: vhci_device speed not set [ 564.843986][T13649] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 564.873582][T13649] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 565.157838][T13660] /dev/rnullb0: Can't open blockdev [ 565.269253][ T5848] Bluetooth: hci2: command 0x0406 tx timeout [ 565.800574][T13665] overlayfs: failed to resolve './file1': -2 [ 566.591018][ T5848] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 566.624440][ T5848] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 566.633574][ T5848] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 566.654430][ T5848] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 566.664218][ T5848] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 567.385888][T13681] syz.5.2217 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 567.691651][ T4889] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 567.866467][ T4889] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 567.941852][T13670] chnl_net:caif_netlink_parms(): no params data found [ 568.022959][ T4889] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 568.202501][ T4889] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 568.497095][T13670] bridge0: port 1(bridge_slave_0) entered blocking state [ 568.532017][T13670] bridge0: port 1(bridge_slave_0) entered disabled state [ 568.543043][T13670] bridge_slave_0: entered allmulticast mode [ 568.558028][T13670] bridge_slave_0: entered promiscuous mode [ 568.576398][T13670] bridge0: port 2(bridge_slave_1) entered blocking state [ 568.583713][T13670] bridge0: port 2(bridge_slave_1) entered disabled state [ 568.594796][T13670] bridge_slave_1: entered allmulticast mode [ 568.597765][T13697] overlayfs: failed to resolve './file1': -2 [ 568.603473][T13670] bridge_slave_1: entered promiscuous mode [ 568.704558][ T5848] Bluetooth: hci5: command tx timeout [ 568.848097][T13670] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 568.894846][T13670] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 569.135129][T13699] netlink: 240 bytes leftover after parsing attributes in process `syz.5.2222'. [ 569.210292][T13670] team0: Port device team_slave_0 added [ 569.242253][T13670] team0: Port device team_slave_1 added [ 569.407646][ T4889] bridge_slave_1: left allmulticast mode [ 569.413365][ T4889] bridge_slave_1: left promiscuous mode [ 569.435968][ T4889] bridge0: port 2(bridge_slave_1) entered disabled state [ 569.471023][ T4889] bridge_slave_0: left allmulticast mode [ 569.498408][ T4889] bridge_slave_0: left promiscuous mode [ 569.507117][ T4889] bridge0: port 1(bridge_slave_0) entered disabled state [ 570.007932][ T5908] usb 6-1: new high-speed USB device number 52 using dummy_hcd [ 570.190787][ T5908] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 570.217690][ T4889] dvmrp17 (unregistering): left allmulticast mode [ 570.224613][ T5908] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 570.232673][ T5908] usb 6-1: Product: syz [ 570.247906][ T5908] usb 6-1: Manufacturer: syz [ 570.252576][ T5908] usb 6-1: SerialNumber: syz [ 570.280968][ T5908] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 570.310033][ T44] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 570.721636][ T4889] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 570.735148][ T4889] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 570.749119][ T4889] bond0 (unregistering): (slave wlan1): Releasing backup interface [ 570.760090][ T4889] bond0 (unregistering): Released all slaves [ 570.794557][ T5848] Bluetooth: hci5: command tx timeout [ 570.854870][ T1603] usb 6-1: USB disconnect, device number 52 [ 570.869248][T13670] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 570.895348][T13670] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 570.928539][T13670] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 571.034030][ T4889] tipc: Disabling bearer [ 571.042588][ T4889] tipc: Disabling bearer [ 571.059091][ T4889] tipc: Left network mode [ 571.060069][T13670] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 571.076614][T13670] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 571.103288][T13670] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 571.148199][ T5930] usb 7-1: USB disconnect, device number 19 [ 571.387926][T13670] hsr_slave_0: entered promiscuous mode [ 571.408921][T13670] hsr_slave_1: entered promiscuous mode [ 571.445358][T13670] debugfs: 'hsr0' already exists in 'hsr' [ 571.468370][T13670] Cannot create hsr debugfs directory [ 571.589886][ T44] usb 6-1: Service connection timeout for: 256 [ 571.617611][ T44] ath9k_htc 6-1:1.0: ath9k_htc: Unable to initialize HTC services [ 571.651693][ T44] ath9k_htc: Failed to initialize the device [ 571.701264][ T1603] usb 6-1: ath9k_htc: USB layer deinitialized [ 572.270590][ T4889] hsr_slave_0: left promiscuous mode [ 572.314821][ T4889] hsr_slave_1: left promiscuous mode [ 572.321943][ T4889] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 572.353555][ T4889] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 572.395200][ T4889] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 572.412882][ T4889] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 572.529535][ T4889] veth1_macvtap: left promiscuous mode [ 572.545600][ T4889] veth1_vlan: left promiscuous mode [ 572.560698][ T4889] veth0_vlan: left promiscuous mode [ 572.603645][ T5852] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 572.621321][ T5852] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 572.657373][ T5852] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 572.670053][ T5852] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 572.679921][ T5852] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 572.864338][ T5852] Bluetooth: hci5: command tx timeout [ 573.587322][ T4889] team0 (unregistering): Port device team_slave_1 removed [ 573.649837][ T4889] team0 (unregistering): Port device team_slave_0 removed [ 574.369953][ T30] kauditd_printk_skb: 198 callbacks suppressed [ 574.369972][ T30] audit: type=1326 audit(2000000301.830:2088): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13760 comm="syz.5.2240" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f4566d8e9a9 code=0x0 [ 574.424035][T13763] Mount JFS Failure: -22 [ 574.786085][ T5852] Bluetooth: hci3: command tx timeout [ 574.945142][ T5852] Bluetooth: hci5: command tx timeout [ 575.687895][ T4889] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 575.759315][T13756] chnl_net:caif_netlink_parms(): no params data found [ 575.872245][ T4889] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 576.082096][ T4889] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 576.254077][ T4889] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 576.279784][T13756] bridge0: port 1(bridge_slave_0) entered blocking state [ 576.287701][T13756] bridge0: port 1(bridge_slave_0) entered disabled state [ 576.295514][T13756] bridge_slave_0: entered allmulticast mode [ 576.303663][T13756] bridge_slave_0: entered promiscuous mode [ 576.316988][T13756] bridge0: port 2(bridge_slave_1) entered blocking state [ 576.331280][T13756] bridge0: port 2(bridge_slave_1) entered disabled state [ 576.339509][T13756] bridge_slave_1: entered allmulticast mode [ 576.348177][T13756] bridge_slave_1: entered promiscuous mode [ 576.423536][T13670] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 576.562772][T13670] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 576.596069][T13670] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 576.620595][T13756] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 576.686416][T13670] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 576.746329][T13756] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 576.864946][ T5852] Bluetooth: hci3: command tx timeout [ 576.896183][T13756] team0: Port device team_slave_0 added [ 577.151541][T13756] team0: Port device team_slave_1 added [ 577.357972][ T4889] bridge_slave_1: left allmulticast mode [ 577.395985][ T4889] bridge_slave_1: left promiscuous mode [ 577.403254][ T4889] bridge0: port 2(bridge_slave_1) entered disabled state [ 577.461592][ T4889] bridge_slave_0: left allmulticast mode [ 577.471905][ T4889] bridge_slave_0: left promiscuous mode [ 577.482663][ T4889] bridge0: port 1(bridge_slave_0) entered disabled state [ 577.694239][ T44] usb 6-1: new high-speed USB device number 53 using dummy_hcd [ 577.854222][ T44] usb 6-1: Using ep0 maxpacket: 16 [ 577.861654][ T44] usb 6-1: unable to get BOS descriptor or descriptor too short [ 577.871491][ T44] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 577.883028][ T44] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 2039, setting to 1024 [ 577.898293][ T44] usb 6-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 32 [ 577.915205][ T44] usb 6-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 16 [ 577.928385][ T44] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 577.939185][ T44] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 577.948680][ T44] usb 6-1: Product: syz [ 577.952887][ T44] usb 6-1: Manufacturer: syz [ 577.958042][ T44] usb 6-1: SerialNumber: syz [ 577.975923][T13804] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 578.190827][ T4889] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 578.205593][T13804] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 578.213095][T13804] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 578.233678][ T4889] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 578.251338][ T4889] bond0 (unregistering): Released all slaves [ 578.372501][T13756] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 578.402069][T13756] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 578.452797][T13756] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 578.470800][T13756] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 578.478557][T13756] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 578.509914][T13756] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 578.866026][T13804] vxfs: WRONG superblock magic 00000000 at 1 [ 578.872427][T13804] vxfs: WRONG superblock magic 00000000 at 8 [ 578.895109][T13756] hsr_slave_0: entered promiscuous mode [ 578.914186][T13804] vxfs: can't find superblock. [ 578.915394][T13756] hsr_slave_1: entered promiscuous mode [ 578.944812][ T5852] Bluetooth: hci3: command tx timeout [ 578.951243][T13756] debugfs: 'hsr0' already exists in 'hsr' [ 578.957844][ T44] cdc_ncm 6-1:1.0: SET_CRC_MODE failed [ 578.970769][T13756] Cannot create hsr debugfs directory [ 578.976624][ T44] cdc_ncm 6-1:1.0: SET_NTB_FORMAT failed [ 579.004481][ T44] cdc_ncm 6-1:1.0: bind() failure [ 579.046631][ T44] cdc_ncm 6-1:1.1: CDC Union missing and no IAD found [ 579.053506][ T44] cdc_ncm 6-1:1.1: bind() failure [ 579.105726][ T44] usb 6-1: USB disconnect, device number 53 [ 579.493332][ T4889] hsr_slave_0: left promiscuous mode [ 579.510343][ T4889] hsr_slave_1: left promiscuous mode [ 579.535040][ T4889] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 579.542489][ T4889] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 579.571041][ T4889] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 579.600682][ T4889] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 579.685335][ T4889] veth1_macvtap: left promiscuous mode [ 579.694618][ T4889] veth0_macvtap: left promiscuous mode [ 579.700354][ T4889] veth1_vlan: left promiscuous mode [ 579.726378][ T4889] veth0_vlan: left promiscuous mode [ 579.736120][T13821] tls_set_device_offload_rx: netdev not found [ 580.963299][ T4889] team0 (unregistering): Port device team_slave_1 removed [ 581.021459][ T4889] team0 (unregistering): Port device team_slave_0 removed [ 581.028985][ T5852] Bluetooth: hci3: command tx timeout [ 581.842379][T13670] 8021q: adding VLAN 0 to HW filter on device bond0 [ 581.854368][ T9] usb 6-1: new high-speed USB device number 54 using dummy_hcd [ 582.008316][ T9] usb 6-1: Using ep0 maxpacket: 32 [ 582.013827][T13670] 8021q: adding VLAN 0 to HW filter on device team0 [ 582.035010][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 582.054487][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 582.072431][ T9] usb 6-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 582.082568][ T9] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 582.103960][ T9] usb 6-1: config 0 descriptor?? [ 582.133122][ T9] hub 6-1:0.0: USB hub found [ 582.153210][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 582.160595][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 582.231216][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 582.238468][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 582.332881][ T9] hub 6-1:0.0: 1 port detected [ 582.553192][ T9] hub 6-1:0.0: activate --> -90 [ 582.593186][T13756] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 582.631347][T13756] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 582.648625][ T1603] usb 6-1: USB disconnect, device number 54 [ 582.649409][ T5943] hub 6-1:0.0: hub_ext_port_status failed (err = -71) [ 582.723982][T13756] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 582.781156][T13756] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 583.002903][T13861] RDS: rds_bind could not find a transport for ::ffff:172.30.1.6, load rds_tcp or rds_rdma? [ 583.211880][T13756] 8021q: adding VLAN 0 to HW filter on device bond0 [ 583.283440][T13756] 8021q: adding VLAN 0 to HW filter on device team0 [ 583.350058][T13670] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 583.406531][T12511] bridge0: port 1(bridge_slave_0) entered blocking state [ 583.419765][T12511] bridge0: port 1(bridge_slave_0) entered forwarding state [ 583.471303][T12511] bridge0: port 2(bridge_slave_1) entered blocking state [ 583.478604][T12511] bridge0: port 2(bridge_slave_1) entered forwarding state [ 583.869478][T13670] veth0_vlan: entered promiscuous mode [ 583.971188][T13670] veth1_vlan: entered promiscuous mode [ 584.101428][T13670] veth0_macvtap: entered promiscuous mode [ 584.140405][T13670] veth1_macvtap: entered promiscuous mode [ 584.217746][T13670] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 584.262376][T13670] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 584.367404][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 584.423069][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 584.454437][ T36] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 584.475938][ T1169] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 584.575831][T13756] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 584.749069][T13903] omfs: Invalid superblock (0) [ 584.778032][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 584.812314][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 584.937445][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 584.984911][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 585.126003][T13910] netlink: 16186 bytes leftover after parsing attributes in process `syz.5.2252'. [ 585.230202][T13917] hpfs: Bad magic ... probably not HPFS [ 585.575988][T13756] veth0_vlan: entered promiscuous mode [ 585.624528][T13756] veth1_vlan: entered promiscuous mode [ 585.703724][T13756] veth0_macvtap: entered promiscuous mode [ 585.731370][T13756] veth1_macvtap: entered promiscuous mode [ 585.813467][T13756] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 585.828896][T13931] omfs: Invalid superblock (0) [ 585.879082][T13756] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 585.916000][ T36] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 585.943817][ T36] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 585.996171][ T36] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 586.025433][ T36] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 586.190585][T13938] 9pnet_fd: Insufficient options for proto=fd [ 586.247314][T13938] nfs4: Bad value for 'source' [ 586.330115][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 586.354664][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 586.441385][T13943] MTD: Attempt to mount non-MTD device "/dev/rnullb0" [ 586.483834][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 586.485566][T13943] VFS: Can't find a romfs filesystem on dev rnullb0. [ 586.485566][T13943] [ 586.528321][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 586.599008][T13948] netlink: 64 bytes leftover after parsing attributes in process `syz.5.2257'. [ 587.690715][T13982] UDF-fs: warning (device rnullb0): udf_load_vrs: No VRS found [ 587.734296][T13982] UDF-fs: Scanning with blocksize 4096 failed [ 587.857658][T13988] qnx4: no qnx4 filesystem (no root dir). [ 587.954385][T13993] netlink: 'syz.7.2265': attribute type 1 has an invalid length. [ 588.028609][T13993] /dev/rnullb0: Can't open blockdev [ 588.354435][ T1603] usb 6-1: new high-speed USB device number 55 using dummy_hcd [ 588.524290][ T1603] usb 6-1: Using ep0 maxpacket: 16 [ 588.552245][ T1603] usb 6-1: unable to get BOS descriptor or descriptor too short [ 588.577353][ T1603] usb 6-1: config 15 has an invalid interface number: 53 but max is 0 [ 588.597030][ T1603] usb 6-1: config 15 has no interface number 0 [ 588.603307][ T1603] usb 6-1: config 15 interface 53 altsetting 99 has an endpoint descriptor with address 0x2C, changing to 0xC [ 588.651324][ T1603] usb 6-1: config 15 interface 53 altsetting 99 endpoint 0xC has an invalid bInterval 144, changing to 11 [ 588.683726][ T1603] usb 6-1: config 15 interface 53 altsetting 99 endpoint 0x9 has invalid maxpacket 1023, setting to 64 [ 588.708375][ T1603] usb 6-1: config 15 interface 53 has no altsetting 0 [ 588.726808][ T1603] usb 6-1: New USB device found, idVendor=2c7c, idProduct=0512, bcdDevice=91.ce [ 588.744165][ T1603] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 588.764539][ T1603] usb 6-1: Product: syz [ 588.768766][ T1603] usb 6-1: Manufacturer: syz [ 588.804969][ T1603] usb 6-1: SerialNumber: syz [ 589.030885][ T1603] option 6-1:15.53: GSM modem (1-port) converter detected [ 589.079284][ T1603] usb 6-1: USB disconnect, device number 55 [ 589.108946][ T1603] option 6-1:15.53: device disconnected [ 589.659938][T14033] hpfs: Bad magic ... probably not HPFS [ 589.967086][T14048] /dev/rnullb0: Can't open blockdev [ 590.936798][T14069] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 591.052494][T14077] /dev/rnullb0: Can't open blockdev [ 591.984880][ T5836] usb 6-1: new high-speed USB device number 56 using dummy_hcd [ 592.156911][ T5836] usb 6-1: Using ep0 maxpacket: 32 [ 592.164014][ T5836] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 592.188886][ T5836] usb 6-1: config 0 has no interface number 0 [ 592.202033][ T5836] usb 6-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=b6.d8 [ 592.217990][ T5836] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 592.472397][ T5836] usb 6-1: Product: syz [ 592.477008][ T5836] usb 6-1: Manufacturer: syz [ 592.481774][ T5836] usb 6-1: SerialNumber: syz [ 592.510298][ T5836] usb 6-1: config 0 descriptor?? [ 592.546778][ T5836] usb 6-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 592.574651][ T5836] usb 6-1: selecting invalid altsetting 1 [ 592.580449][ T5836] usb 6-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 592.603088][ T5836] usb 6-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 592.654635][ T5836] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 592.672629][ T5836] usb 6-1: media controller created [ 592.756756][ T5836] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 592.842695][ T5836] usb 6-1: dvb_usb_ce6230: usb_control_msg() failed=-71 [ 592.873498][ T5836] zl10353_read_register: readreg error (reg=127, ret==-71) [ 592.894730][ T5836] usb 6-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 593.024842][ T5836] usb 6-1: USB disconnect, device number 56 [ 594.534268][T14169] syz.5.2304(14169): Attempt to set a LOCK_MAND lock via flock(2). This support has been removed and the request ignored. [ 594.570908][T14169] omfs: Invalid superblock (0) [ 595.231125][T14189] netlink: 'syz.5.2307': attribute type 3 has an invalid length. [ 595.292819][T14189] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2307'. [ 595.295231][T14190] Mount JFS Failure: -22 [ 595.621146][T14194] omfs: Invalid superblock (0) [ 595.659726][T14194] syz.5.2308 (14194) used greatest stack depth: 19576 bytes left [ 595.826340][ T31] INFO: task syz.3.1674:11724 blocked for more than 143 seconds. [ 595.845323][ T31] Not tainted 6.16.0-rc6-next-20250718-syzkaller #0 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 595.877559][ T31] Blocked by coredump. [ 595.885596][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 595.899887][ T31] task:syz.3.1674 state:D stack:26920 pid:11724 tgid:11724 ppid:5845 task_flags:0x40044c flags:0x00004004 [ 595.920159][ T31] Call Trace: [ 595.923704][ T31] [ 595.967573][ T31] __schedule+0x1737/0x4d30 [ 595.972188][ T31] ? __lock_acquire+0xab9/0xd20 [ 596.015965][ T31] ? schedule+0x165/0x360 [ 596.020397][ T31] ? __lock_acquire+0xab9/0xd20 [ 596.030334][ T31] ? __pfx___schedule+0x10/0x10 [ 596.035686][ T31] ? schedule+0x91/0x360 [ 596.039994][ T31] schedule+0x165/0x360 [ 596.045711][ T31] schedule_preempt_disabled+0x13/0x30 [ 596.051263][ T31] rwsem_down_read_slowpath+0x5fd/0x8f0 [ 596.063250][ T31] ? rwsem_down_read_slowpath+0x4b8/0x8f0 [ 596.069921][ T31] ? __pfx_rwsem_down_read_slowpath+0x10/0x10 [ 596.077774][ T31] ? exit_mm+0xcc/0x2c0 [ 596.088956][ T31] ? __pfx_mm_release+0x10/0x10 [ 596.093917][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 596.099718][ T31] down_read+0x98/0x2e0 [ 596.103939][ T31] exit_mm+0xcc/0x2c0 [ 596.112614][ T31] ? __pfx_exit_mm+0x10/0x10 [ 596.164279][ T31] ? rcu_is_watching+0x15/0xb0 [ 596.172539][ T31] do_exit+0x648/0x2300 [ 596.192563][ T31] ? do_raw_spin_lock+0x121/0x290 [ 596.272812][ T31] ? __pfx_do_exit+0x10/0x10 [ 596.304340][ T31] ? cgroup_freezing+0x20/0x350 [ 596.309405][ T31] do_group_exit+0x21c/0x2d0 [ 596.314034][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 596.380276][ T31] get_signal+0x1286/0x1340 [ 596.401939][ T31] arch_do_signal_or_restart+0x9a/0x750 [ 596.421315][ T31] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 596.438246][ T31] ? exit_to_user_mode_loop+0x40/0x110 [ 596.443940][ T31] exit_to_user_mode_loop+0x75/0x110 [ 596.507466][ T31] do_syscall_64+0x2bd/0x3b0 [ 596.512158][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 596.534377][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 596.540524][ T31] ? clear_bhb_loop+0x60/0xb0 [ 596.567829][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 596.573850][ T31] RIP: 0033:0x7f472c78e9e3 [ 596.579536][ T31] RSP: 002b:00007ffe3ce8aab8 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 596.593644][ T31] RAX: fffffffffffffffc RBX: 00007f472adf76c0 RCX: 00007f472c78e9e3 [ 596.610333][ T31] RDX: 0000000000000000 RSI: 0000000000021000 RDI: 0000000000000000 [ 596.647301][ T31] RBP: 0000000000000000 R08: 00000000ffffffff R09: 0000000000000000 [ 596.668148][ T31] R10: 0000000000020022 R11: 0000000000000246 R12: 00007ffe3ce8ac10 [ 596.684333][ T31] R13: ffffffffffffffc0 R14: 0000000000001000 R15: 0000000000000000 [ 596.692407][ T31] [ 596.714667][ T31] INFO: task syz.3.1674:11725 blocked for more than 144 seconds. [ 596.744167][ T31] Not tainted 6.16.0-rc6-next-20250718-syzkaller #0 [ 596.751425][ T31] Blocked by coredump. [ 596.792858][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 596.804394][ T31] task:syz.3.1674 state:D stack:24968 pid:11725 tgid:11724 ppid:5845 task_flags:0x40044c flags:0x00004004 [ 596.854241][ T31] Call Trace: [ 596.857593][ T31] [ 596.860564][ T31] __schedule+0x1737/0x4d30 [ 596.884194][ T31] ? __lock_acquire+0xab9/0xd20 [ 596.889226][ T31] ? schedule+0x165/0x360 [ 596.893600][ T31] ? __lock_acquire+0xab9/0xd20 [ 596.914213][ T31] ? __pfx___schedule+0x10/0x10 [ 596.919175][ T31] ? schedule+0x91/0x360 [ 596.923502][ T31] schedule+0x165/0x360 [ 596.944247][ T31] schedule_preempt_disabled+0x13/0x30 [ 596.954448][ T31] rwsem_down_read_slowpath+0x5fd/0x8f0 [ 596.960151][ T31] ? rwsem_down_read_slowpath+0x4b8/0x8f0 [ 596.989005][ T31] ? __pfx_rwsem_down_read_slowpath+0x10/0x10 [ 597.004338][ T31] ? exit_mm+0xcc/0x2c0 [ 597.008603][ T31] ? __pfx_mm_release+0x10/0x10 [ 597.013501][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 597.044229][ T31] down_read+0x98/0x2e0 [ 597.048465][ T31] exit_mm+0xcc/0x2c0 [ 597.052507][ T31] ? __pfx_exit_mm+0x10/0x10 [ 597.074238][ T31] ? rcu_is_watching+0x15/0xb0 [ 597.079106][ T31] do_exit+0x648/0x2300 [ 597.083318][ T31] ? do_raw_spin_lock+0x121/0x290 [ 597.107379][ T31] ? __pfx_do_exit+0x10/0x10 [ 597.112088][ T31] ? cgroup_freezing+0x20/0x350 [ 597.124360][ T31] do_group_exit+0x21c/0x2d0 [ 597.129044][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 597.150582][ T31] get_signal+0x1286/0x1340 [ 597.157332][ T31] arch_do_signal_or_restart+0x9a/0x750 [ 597.163002][ T31] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 597.197849][ T31] ? exit_to_user_mode_loop+0x40/0x110 [ 597.203417][ T31] exit_to_user_mode_loop+0x75/0x110 [ 597.225076][ T31] do_syscall_64+0x2bd/0x3b0 [ 597.229756][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 597.254321][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 597.260480][ T31] ? clear_bhb_loop+0x60/0xb0 [ 597.266121][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 597.272072][ T31] RIP: 0033:0x7f472c78e9a9 [ 597.277017][ T31] RSP: 002b:00007f472d5f80e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 597.287767][ T31] RAX: fffffffffffffe00 RBX: 00007f472c9b5fa8 RCX: 00007f472c78e9a9 [ 597.298301][ T31] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f472c9b5fa8 [ 597.306851][ T31] RBP: 00007f472c9b5fa0 R08: 0000000000000000 R09: 0000000000000000 [ 597.318864][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f472c9b5fac [ 597.327399][ T31] R13: 0000000000000000 R14: 00007ffe3ce8aa30 R15: 00007ffe3ce8ab18 [ 597.346165][ T31] [ 597.414952][ T31] INFO: task syz.3.1674:11727 blocked for more than 144 seconds. [ 597.422758][ T31] Not tainted 6.16.0-rc6-next-20250718-syzkaller #0 [ 597.534508][ T31] Blocked by coredump. [ 597.539165][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 597.614267][ T31] task:syz.3.1674 state:D stack:28264 pid:11727 tgid:11724 ppid:5845 task_flags:0x40044c flags:0x00004004 [ 597.686658][ T31] Call Trace: [ 597.690011][ T31] [ 597.692971][ T31] __schedule+0x1737/0x4d30 [ 597.728255][ T31] ? __lock_acquire+0xab9/0xd20 [ 597.733196][ T31] ? schedule+0x165/0x360 [ 597.794306][ T31] ? __lock_acquire+0xab9/0xd20 [ 597.799260][ T31] ? __pfx___schedule+0x10/0x10 [ 597.824452][ T31] ? schedule+0x91/0x360 [ 597.828828][ T31] schedule+0x165/0x360 [ 597.833034][ T31] schedule_preempt_disabled+0x13/0x30 [ 597.884380][ T31] rwsem_down_read_slowpath+0x5fd/0x8f0 [ 597.890021][ T31] ? rwsem_down_read_slowpath+0x4b8/0x8f0 [ 597.936400][ T31] ? __pfx_rwsem_down_read_slowpath+0x10/0x10 [ 597.942553][ T31] ? exit_mm+0xcc/0x2c0 [ 597.974238][ T31] ? __pfx_mm_release+0x10/0x10 [ 597.979210][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 598.024273][ T31] down_read+0x98/0x2e0 [ 598.028566][ T31] exit_mm+0xcc/0x2c0 [ 598.032600][ T31] ? __pfx_exit_mm+0x10/0x10 [ 598.064464][ T31] ? rcu_is_watching+0x15/0xb0 [ 598.069320][ T31] do_exit+0x648/0x2300 [ 598.073534][ T31] ? do_raw_spin_lock+0x121/0x290 [ 598.124163][ T31] ? __pfx_do_exit+0x10/0x10 [ 598.128849][ T31] ? cgroup_freezing+0x20/0x350 [ 598.133749][ T31] do_group_exit+0x21c/0x2d0 [ 598.172663][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 598.178109][ T31] get_signal+0x1286/0x1340 [ 598.182702][ T31] arch_do_signal_or_restart+0x9a/0x750 [ 598.188529][ T31] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 598.199294][ T31] ? exit_to_user_mode_loop+0x40/0x110 [ 598.204991][ T31] exit_to_user_mode_loop+0x75/0x110 [ 598.211099][ T31] do_syscall_64+0x2bd/0x3b0 [ 598.236991][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 598.242391][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 598.264247][ T31] ? clear_bhb_loop+0x60/0xb0 [ 598.269110][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 598.284168][ T31] RIP: 0033:0x7f472c78e9a9 [ 598.292254][ T31] RSP: 002b:00007f472d5d6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000095 [ 598.314166][ T31] RAX: fffffffffffffffc RBX: 00007f472c9b6080 RCX: 00007f472c78e9a9 [ 598.334211][ T31] RDX: 0000000000000000 RSI: 0000000000800000 RDI: 0000200000000000 [ 598.342263][ T31] RBP: 00007f472c810d69 R08: 0000000000000000 R09: 0000000000000000 [ 598.369647][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 598.391581][ T31] R13: 0000000000000000 R14: 00007f472c9b6080 R15: 00007ffe3ce8ab18 [ 598.414233][ T31] [ 598.423152][ T31] [ 598.423152][ T31] Showing all locks held in the system: [ 598.444146][ T31] 1 lock held by khungtaskd/31: [ 598.450357][ T31] #0: ffffffff8e53d8a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 598.486817][ T31] 2 locks held by getty/5601: [ 598.491566][ T31] #0: ffff8880344590a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 598.504194][ T31] #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 [ 598.517822][ T31] 5 locks held by syz.4.1144/10098: [ 598.523081][ T31] #0: ffff8880500d4dc0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x212/0x510 [ 598.533422][ T31] #1: ffff8880500d40b8 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x66a/0x1330 [ 598.547445][ T31] #2: ffffffff8faa0e68 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xa1/0x230 [ 598.568659][ T31] #3: ffff88802802fb38 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x70/0x680 [ 598.590833][ T31] #4: ffffffff8e543338 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x3b9/0x730 [ 598.601939][ T31] 1 lock held by syz.3.1674/11724: [ 598.619391][ T31] #0: ffff888028c8cd20 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0xcc/0x2c0 [ 598.630143][ T31] 1 lock held by syz.3.1674/11725: [ 598.644671][ T31] #0: ffff888028c8cd20 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0xcc/0x2c0 [ 598.653744][ T31] 1 lock held by syz.3.1674/11727: [ 598.659206][ T31] #0: ffff888028c8cd20 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0xcc/0x2c0 [ 598.674172][ T31] 1 lock held by syz.3.1674/11728: [ 598.679356][ T31] 2 locks held by syz.5.1839/12523: [ 598.694314][ T31] #0: ffffffff8f938688 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 [ 598.703475][ T31] #1: ffffffff8e543338 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x3b9/0x730 [ 598.744223][ T31] 3 locks held by syz.7.2299/14150: [ 598.749488][ T31] #0: ffff888067260dc0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x212/0x510 [ 598.768427][ T31] #1: ffff8880672600b8 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x66a/0x1330 [ 598.796150][ T31] #2: ffffffff8faa0e68 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xa1/0x230 [ 598.824163][ T31] 3 locks held by syz.0.2311/14207: [ 598.829435][ T31] #0: ffff88804b4c8dc0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x212/0x510 [ 598.854238][ T31] #1: ffff88804b4c80b8 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x66a/0x1330 [ 598.864027][ T31] #2: ffffffff8faa0e68 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xa1/0x230 [ 598.894200][ T31] 1 lock held by cmp/14232: [ 598.898827][ T31] [ 598.922522][ T31] ============================================= [ 598.922522][ T31] [ 598.961721][ T31] NMI backtrace for cpu 0 [ 598.961746][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.16.0-rc6-next-20250718-syzkaller #0 PREEMPT(full) [ 598.961771][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 598.961784][ T31] Call Trace: [ 598.961793][ T31] [ 598.961802][ T31] dump_stack_lvl+0x189/0x250 [ 598.961839][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 598.961869][ T31] ? __pfx__printk+0x10/0x10 [ 598.961911][ T31] nmi_cpu_backtrace+0x39e/0x3d0 [ 598.961940][ T31] ? __pfx_nmi_cpu_backtrace+0x10/0x10 [ 598.961968][ T31] ? __pfx__printk+0x10/0x10 [ 598.962000][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 598.962026][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 598.962055][ T31] watchdog+0xf93/0xfe0 [ 598.962083][ T31] ? watchdog+0x1de/0xfe0 [ 598.962111][ T31] kthread+0x70e/0x8a0 [ 598.962144][ T31] ? __pfx_watchdog+0x10/0x10 [ 598.962164][ T31] ? __pfx_kthread+0x10/0x10 [ 598.962194][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 598.962220][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 598.962242][ T31] ? __pfx_kthread+0x10/0x10 [ 598.962266][ T31] ret_from_fork+0x3f9/0x770 [ 598.962290][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 598.962329][ T31] ? __switch_to_asm+0x39/0x70 [ 598.962342][ T31] ? __switch_to_asm+0x33/0x70 [ 598.962354][ T31] ? __pfx_kthread+0x10/0x10 [ 598.962378][ T31] ret_from_fork_asm+0x1a/0x30 [ 598.962404][ T31] [ 598.962410][ T31] Sending NMI from CPU 0 to CPUs 1: [ 599.118690][ C1] NMI backtrace for cpu 1 [ 599.118708][ C1] CPU: 1 UID: 0 PID: 14234 Comm: dhcpcd-run-hook Not tainted 6.16.0-rc6-next-20250718-syzkaller #0 PREEMPT(full) [ 599.118730][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 599.118741][ C1] RIP: 0010:check_preemption_disabled+0x3/0x120 [ 599.118765][ C1] Code: 04 8c 48 c7 c6 e0 d3 04 8c eb 1c 66 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 55 41 57 <41> 56 53 48 83 ec 10 65 48 8b 05 7e c1 67 07 48 89 44 24 08 65 8b [ 599.118779][ C1] RSP: 0018:ffffc90004466fa0 EFLAGS: 00000086 [ 599.118795][ C1] RAX: 0000000000000001 RBX: 0000000000000000 RCX: e8698fd7a1247600 [ 599.118808][ C1] RDX: 0000000000000000 RSI: ffffffff8de5b067 RDI: ffffffff8c04d400 [ 599.118820][ C1] RBP: ffffffff81730195 R08: 0000000000000000 R09: ffffffff81730195 [ 599.118831][ C1] R10: ffffc90004467178 R11: ffffffff81ac9660 R12: 0000000000000002 [ 599.118843][ C1] R13: ffffffff8e53d8a0 R14: 0000000000000000 R15: 0000000000000246 [ 599.118855][ C1] FS: 0000000000000000(0000) GS:ffff8881258ab000(0000) knlGS:0000000000000000 [ 599.118869][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 599.118881][ C1] CR2: 00007fc37b207286 CR3: 000000004f66c000 CR4: 00000000003526f0 [ 599.118896][ C1] Call Trace: [ 599.118903][ C1] [ 599.118910][ C1] ? unwind_next_frame+0xa5/0x2390 [ 599.118934][ C1] lock_acquire+0x130/0x360 [ 599.118955][ C1] ? unwind_next_frame+0xa5/0x2390 [ 599.118977][ C1] ? exec_mmap+0x6ac/0x7d0 [ 599.118996][ C1] ? unwind_next_frame+0xa5/0x2390 [ 599.119018][ C1] unwind_next_frame+0xc2/0x2390 [ 599.119039][ C1] ? unwind_next_frame+0xa5/0x2390 [ 599.119063][ C1] ? unwind_next_frame+0xa5/0x2390 [ 599.119108][ C1] ? __mmput+0x118/0x430 [ 599.119129][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 599.119155][ C1] arch_stack_walk+0x11c/0x150 [ 599.119181][ C1] ? exec_mmap+0x6ac/0x7d0 [ 599.119202][ C1] stack_trace_save+0x9c/0xe0 [ 599.119226][ C1] ? __pfx_stack_trace_save+0x10/0x10 [ 599.119252][ C1] ? __lock_acquire+0xab9/0xd20 [ 599.119271][ C1] kasan_save_track+0x3e/0x80 [ 599.119287][ C1] ? kasan_save_track+0x3e/0x80 [ 599.119303][ C1] ? kasan_save_free_info+0x46/0x50 [ 599.119325][ C1] ? __kasan_slab_free+0x62/0x70 [ 599.119341][ C1] ? kmem_cache_free+0x18f/0x400 [ 599.119358][ C1] ? unlink_anon_vmas+0x2cc/0x670 [ 599.119377][ C1] ? free_pgtables+0x587/0xaf0 [ 599.119397][ C1] ? exit_mmap+0x444/0xb50 [ 599.119415][ C1] ? __mmput+0x118/0x430 [ 599.119432][ C1] ? exec_mmap+0x6ac/0x7d0 [ 599.119471][ C1] ? unlink_anon_vmas+0x2cc/0x670 [ 599.119489][ C1] kasan_save_free_info+0x46/0x50 [ 599.119512][ C1] __kasan_slab_free+0x62/0x70 [ 599.119530][ C1] kmem_cache_free+0x18f/0x400 [ 599.119560][ C1] unlink_anon_vmas+0x2cc/0x670 [ 599.119582][ C1] free_pgtables+0x587/0xaf0 [ 599.119608][ C1] ? __pfx_free_pgtables+0x10/0x10 [ 599.119633][ C1] ? __pfx_down_write+0x10/0x10 [ 599.119650][ C1] ? __mas_set_range+0x12f/0x3c0 [ 599.119672][ C1] exit_mmap+0x444/0xb50 [ 599.119690][ C1] ? uprobe_clear_state+0x20f/0x290 [ 599.119718][ C1] ? __pfx_exit_mmap+0x10/0x10 [ 599.119735][ C1] ? __mutex_unlock_slowpath+0x1a1/0x760 [ 599.119765][ C1] ? __pfx_exit_aio+0x10/0x10 [ 599.119794][ C1] ? uprobe_clear_state+0x274/0x290 [ 599.119822][ C1] __mmput+0x118/0x430 [ 599.119841][ C1] exec_mmap+0x6ac/0x7d0 [ 599.119860][ C1] ? generic_permission+0x2e5/0x690 [ 599.119879][ C1] ? __pfx_exec_mmap+0x10/0x10 [ 599.119903][ C1] begin_new_exec+0x129c/0x2120 [ 599.119926][ C1] ? __pfx_load_elf_phdrs+0x10/0x10 [ 599.119957][ C1] load_elf_binary+0x998/0x2740 [ 599.119988][ C1] ? load_misc_binary+0x110/0xc40 [ 599.120013][ C1] ? __lock_acquire+0xab9/0xd20 [ 599.120034][ C1] ? __pfx_load_elf_binary+0x10/0x10 [ 599.120067][ C1] bprm_execve+0x99c/0x1450 [ 599.120095][ C1] ? __pfx_bprm_execve+0x10/0x10 [ 599.120119][ C1] do_execveat_common+0x510/0x6a0 [ 599.120146][ C1] __x64_sys_execve+0x94/0xb0 [ 599.120168][ C1] do_syscall_64+0xfa/0x3b0 [ 599.120192][ C1] ? lockdep_hardirqs_on+0x9c/0x150 [ 599.120216][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 599.120232][ C1] ? clear_bhb_loop+0x60/0xb0 [ 599.120251][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 599.120267][ C1] RIP: 0033:0x7fc37b14d107 [ 599.120286][ C1] Code: Unable to access opcode bytes at 0x7fc37b14d0dd. [ 599.120295][ C1] RSP: 002b:00007fff7734d0b8 EFLAGS: 00000246 ORIG_RAX: 000000000000003b [ 599.120312][ C1] RAX: ffffffffffffffda RBX: 00005633f3925fe0 RCX: 00007fc37b14d107 [ 599.120324][ C1] RDX: 00005633f3926000 RSI: 00005633f3925fe0 RDI: 00005633f3926088 [ 599.120336][ C1] RBP: 00005633f3926088 R08: 00007fff7734fe2c R09: 0000000000000000 [ 599.120347][ C1] R10: 0000000000000008 R11: 0000000000000246 R12: 00005633f3926000 [ 599.120358][ C1] R13: 00007fc37b312e8b R14: 00005633f3926000 R15: 0000000000000000 [ 599.120377][ C1] [ 599.122917][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 599.609817][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.16.0-rc6-next-20250718-syzkaller #0 PREEMPT(full) [ 599.621117][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 599.631204][ T31] Call Trace: [ 599.634494][ T31] [ 599.637441][ T31] dump_stack_lvl+0x99/0x250 [ 599.642050][ T31] ? __asan_memcpy+0x40/0x70 [ 599.646659][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 599.651876][ T31] ? __pfx__printk+0x10/0x10 [ 599.656491][ T31] vpanic+0x281/0x750 [ 599.660492][ T31] ? __pfx_vpanic+0x10/0x10 [ 599.665002][ T31] ? __x2apic_send_IPI_mask+0x1e4/0x260 [ 599.670570][ T31] ? preempt_schedule+0xae/0xc0 [ 599.675437][ T31] ? preempt_schedule_common+0x83/0xd0 [ 599.681009][ T31] panic+0xb9/0xc0 [ 599.684764][ T31] ? __pfx_panic+0x10/0x10 [ 599.689189][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 599.694590][ T31] ? nmi_trigger_cpumask_backtrace+0x2bb/0x300 [ 599.700758][ T31] watchdog+0xfd2/0xfe0 [ 599.704966][ T31] ? watchdog+0x1de/0xfe0 [ 599.709311][ T31] kthread+0x70e/0x8a0 [ 599.713405][ T31] ? __pfx_watchdog+0x10/0x10 [ 599.718090][ T31] ? __pfx_kthread+0x10/0x10 [ 599.722703][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 599.727915][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 599.733125][ T31] ? __pfx_kthread+0x10/0x10 [ 599.737737][ T31] ret_from_fork+0x3f9/0x770 [ 599.742343][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 599.747497][ T31] ? __switch_to_asm+0x39/0x70 [ 599.752273][ T31] ? __switch_to_asm+0x33/0x70 [ 599.757042][ T31] ? __pfx_kthread+0x10/0x10 [ 599.761673][ T31] ret_from_fork_asm+0x1a/0x30 [ 599.766457][ T31] [ 599.769783][ T31] Kernel Offset: disabled [ 599.774122][ T31] Rebooting in 86400 seconds..