last executing test programs: 4m41.156422498s ago: executing program 3 (id=112): socket$netlink(0x10, 0x3, 0x0) syz_usb_connect(0x3, 0x46, &(0x7f00000003c0)=ANY=[@ANYBLOB="12015002b9a97d20fd0b16009ac50102030109023400018008c0060904570003bcf24e0c09050700000205030d0725018307000009050203200081054b09050202080006a804"], &(0x7f0000000c40)={0x0, 0x0, 0x8, &(0x7f00000009c0)={0x5, 0xf, 0x8, 0x1, [@generic={0x3, 0x10, 0xb}]}}) 4m38.768763742s ago: executing program 3 (id=117): pipe2(&(0x7f0000000000)={0x0, 0x0}, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(0xffffffffffffffff, 0xc0305710, &(0x7f0000000440)={0x1, 0x7f, 0x1, 0x0, 0x10001000}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) r1 = socket(0x2a, 0x2, 0x0) sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffe0}, {0xffff, 0xffff}, {0x0, 0xe}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x40000) sendmsg$nl_route_sched(r1, &(0x7f0000000340)={0x0, 0x1b, &(0x7f0000000500)={&(0x7f0000000540)=@delqdisc={0x24, 0x25, 0x400, 0x70bd26, 0x25dfdbfe, {0x0, 0x0, 0x0, r2, {0xc, 0x4}, {0xfff7, 0x8}, {0x2, 0xf}}}, 0x24}, 0x1, 0x0, 0x0, 0x8000}, 0x2400c8c4) r3 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r3, &(0x7f00000002c0), 0x40000000000009f, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r4 = syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x311000) ioctl$VIDIOC_S_FMT(r4, 0xc0d05605, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000002000)=""/102400, 0x19000) select(0x40, &(0x7f0000000400)={0x9, 0x3, 0x80000000, 0x0, 0x7, 0x201}, 0x0, 0x0, &(0x7f0000000100)={0x0, 0xea60}) close(r0) sendmsg$can_bcm(0xffffffffffffffff, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[], 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x840) kcmp$KCMP_EPOLL_TFD(0x0, 0x0, 0x7, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) mkdir(&(0x7f0000000340)='./file0/file0\x00', 0x1c0) semget$private(0x0, 0x3, 0x18) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000040)={'bond0\x00'}) 4m37.540447054s ago: executing program 3 (id=121): socketpair$unix(0x1, 0x2, 0x0, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) (async) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) (async) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) (async) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) (async) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) (async) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x3, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}}, &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x1, '\x00', 0x0, @fallback=0x28, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r3}, 0x18) (async) r4 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) r5 = fsmount(r4, 0x0, 0x8) r6 = openat$cgroup_subtree(r5, 0x0, 0x2, 0x0) write$cgroup_subtree(r6, 0x0, 0x5) (async) syz_open_dev$media(&(0x7f0000000100), 0x4, 0x20003) syz_open_dev$swradio(&(0x7f0000000240), 0x0, 0x2) (async) r7 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r7, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR(r7, 0x6, 0x13, &(0x7f00000000c0)=0x1, 0x4) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TYPE(r8, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000002c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="4c0000000d0601020000000000000000050000070500010007000000050005000500000011000300686173683a69702c706f7274000000001300030068610002000000000000666163650000"], 0x4c}, 0x1, 0x0, 0x0, 0x4004}, 0x4800) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) (async) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x8000000000000000, 0x0) (async) connect$inet(r7, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) (async) setsockopt$inet_tcp_TCP_REPAIR(r7, 0x6, 0x13, 0x0, 0x0) 4m36.844460104s ago: executing program 3 (id=123): r0 = syz_open_dev$dri(&(0x7f0000000140), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_ADDFB2(r0, 0xc06864b8, &(0x7f0000000580)={0x0, 0xc1, 0x80, 0x20203843, 0x3, [0x2], [0x80ffff, 0x0, 0x101], [], [0x9]}) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) socket$inet6_sctp(0xa, 0x1, 0x84) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) move_mount(r2, 0x0, r1, &(0x7f0000000240)='./file0\x00', 0x46) 4m36.525608657s ago: executing program 3 (id=126): sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@allocspi={0xf4, 0x16, 0x1, 0x0, 0x0, {{{@in6=@mcast1, @in6=@ipv4={'\x00', '\xff\xff', @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0xa0}, {@in6=@mcast2, 0x0, 0x33}, @in6=@empty, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffff1, 0x3}, {0x0, 0x0, 0x0, 0xfffffffffffffffe}, {0x0, 0x0, 0x796}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}, 0x0, 0x1a0b1}}, 0xf4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="20010000120013070000000000000000e0000001000000000000000000000000fc00"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fc02000000000000000000000000000000000000000000000000000000000000000000000000000080ffffff0000000000000000000000072c42572f64a264410b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fbc18c8582fc7800000000000000000000000050019000000000028001a"], 0x120}}, 0x0) 4m34.792470202s ago: executing program 3 (id=129): r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=ANY=[@ANYBLOB="240000002d00090027bd70000000000004000000040019000c00090000000080"], 0x24}, 0x1, 0x0, 0x0, 0x42804}, 0x84) 4m33.081919728s ago: executing program 32 (id=129): r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=ANY=[@ANYBLOB="240000002d00090027bd70000000000004000000040019000c00090000000080"], 0x24}, 0x1, 0x0, 0x0, 0x42804}, 0x84) 3m57.445850516s ago: executing program 1 (id=220): r0 = socket$kcm(0x10, 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) close(0xffffffffffffffff) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYRES32, @ANYRES32=0x0], 0x50) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0xfffffffffffffffe) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$AUTOFS_IOC_PROTOVER(r0, 0x80049363, &(0x7f0000000080)) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r3 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000008500000022000000180100002020702500000000002020207b0af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000073"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000006c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f0000000400)='io_uring_create\x00', r4}, 0x18) syz_io_uring_setup(0x1113, &(0x7f0000000280)={0x0, 0xb44a, 0x0, 0x0, 0x21e}, &(0x7f0000000000), &(0x7f0000000040)) ioctl$VIDIOC_DQEVENT(r3, 0x80885659, 0x0) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) read$eventfd(r6, &(0x7f0000000240), 0x8) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000400)='locks_get_lock_context\x00', r5}, 0x18) syz_init_net_socket$netrom(0x6, 0x5, 0x0) sendmsg$kcm(r0, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x800) 3m55.912301704s ago: executing program 1 (id=225): openat$sysfs(0xffffff9c, &(0x7f00000037c0)='/sys/kernel/notes', 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') r1 = syz_open_dev$usbmon(&(0x7f00000002c0), 0x13dd, 0xc01) mount$9p_fd(0x0, &(0x7f00000001c0)='.\x00', &(0x7f0000000240), 0x8080, &(0x7f0000000300)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) capset(&(0x7f0000000340)={0x20071026}, &(0x7f0000000040)) r2 = shmget$private(0x0, 0x1000, 0xa48, &(0x7f0000ffd000/0x1000)=nil) shmctl$SHM_UNLOCK(r2, 0xc) syz_usb_connect(0x0, 0x24, &(0x7f0000000b40)={{0x12, 0x1, 0x250, 0xc1, 0x48, 0x8e, 0x10, 0x451, 0x5416, 0x100, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x2, 0x9, 0x0, 0x0, [{{0x9, 0x4, 0x16, 0xfc, 0x0, 0xf6, 0x7e, 0x50, 0x3}}]}}]}}, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0}) 3m51.686030357s ago: executing program 1 (id=229): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) ioctl(r0, 0x8be0, &(0x7f0000000040)) 3m51.056041328s ago: executing program 1 (id=232): syz_open_dev$dri(&(0x7f0000000080), 0x5, 0x10000) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000480)='./file0\x00', &(0x7f0000000380)='devtmpfs\x00', 0x4000, 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000100)='tmpfs\x00', 0x280008, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='setgroups\x00') eventfd2(0x2, 0x80001) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r2 = fanotify_init(0x200, 0x0) r3 = dup(r1) fanotify_mark(r2, 0x1, 0x48001059, r3, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) r4 = open_tree(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x0) move_mount(r4, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, 0x0, 0x262) r5 = syz_open_dev$radio(&(0x7f0000002100), 0x2, 0x2) ioctl$VIDIOC_S_FREQUENCY(r5, 0x402c5639, &(0x7f0000002280)={0x0, 0x1, 0x40}) r6 = syz_clone(0x20042400, 0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r7 = socket$inet6(0xa, 0x3, 0x4) bind$inet6(r7, &(0x7f0000000140)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @loopback}, 0x4}, 0x1c) ptrace(0x4206, r6) mremap(&(0x7f0000028000/0x2000)=nil, 0x2000, 0x1000, 0x3, &(0x7f0000ffc000/0x1000)=nil) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(0xffffffffffffffff, 0xc0a85320, &(0x7f00000003c0)={{0x80}, 'port0\x00', 0x511e36599023629, 0x100000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r5, &(0x7f00000000c0)={0x20000000}) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0) write$binfmt_script(r8, &(0x7f0000000240), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x280000b, 0x28011, r8, 0x0) syz_io_uring_setup(0x3480, &(0x7f00000002c0)={0x0, 0x0, 0x10100}, &(0x7f0000000240), &(0x7f00000023c0)) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r9, &(0x7f00000001c0)=ANY=[@ANYBLOB='2'], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r9, 0x0) 3m49.72436267s ago: executing program 1 (id=236): r0 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet_int(r0, 0x0, 0xf, &(0x7f0000000340)=0xfffffffffffffff9, 0x4) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f00000009c0)=[@in6={0xa, 0x4e24, 0x62559365, @mcast2, 0x3}], 0x1c) r1 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) fcntl$notify(r1, 0x402, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETA(r2, 0x560a, &(0x7f0000001040)={0x0, 0x3, 0x4, 0x20, 0x0, "0000e5ff0100"}) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) sched_setscheduler(r3, 0x2, &(0x7f00000000c0)=0xf8000000) read$msr(r1, &(0x7f0000000000)=""/176, 0xb0) 3m49.084035014s ago: executing program 1 (id=239): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000040)={'syz1\x00', {0x3, 0x7, 0x4}, 0x3e, [0xf02, 0x29b6, 0x3, 0xfffffff7, 0x2, 0x7fff, 0x3ff, 0x30c, 0xf1b2, 0xffffffff, 0x3e, 0x9, 0x1, 0x4, 0x1, 0x2, 0x6, 0x5, 0x1, 0x7, 0x8000, 0xe8a, 0x15260512, 0x3d7f, 0x8, 0x1, 0x100, 0x8fec, 0x0, 0x0, 0xfff, 0x8001, 0x10000, 0x7fff, 0x8, 0x7, 0x2, 0x2c, 0x2, 0x1, 0x1, 0x100, 0x2, 0x5dcc, 0x8311, 0x1, 0x9, 0x5, 0x10, 0x8, 0x4, 0x6, 0x2, 0x5, 0xa118, 0x7, 0x0, 0xa, 0x9, 0x4, 0x5, 0x8, 0x28, 0x80], [0x7fff, 0x5, 0x2, 0x2, 0x69, 0x5, 0x7fffffff, 0x4, 0x6, 0x8000, 0x9, 0x3, 0x3, 0x6, 0x7, 0x6, 0x7, 0xfffffffe, 0x4, 0x5, 0x1, 0x94e8, 0x7, 0x4, 0x1, 0x9, 0x4, 0x6, 0x4, 0x7, 0x7, 0x4, 0x9, 0x7f, 0x30, 0x7fff, 0x1ff, 0xc, 0x10, 0x4, 0x6, 0x2, 0x2, 0xa5a, 0x0, 0x3, 0x9, 0xa0, 0x1000, 0x8, 0xa, 0x858f, 0x0, 0xcd6, 0xcdb, 0x3, 0x68, 0x8000, 0x8, 0x3, 0x1, 0x7fffffff, 0xfff, 0x8], [0x7, 0x9, 0x0, 0x3ff, 0xffffffff, 0x5, 0x4, 0x7fffffff, 0x66, 0x6, 0x24446fcc, 0x300000, 0xf, 0x6, 0xb, 0x80000000, 0x1, 0xfffffffa, 0xf5, 0x4, 0x6, 0xa3c, 0xfffffff2, 0xb, 0x5, 0x3, 0x5, 0x1c2, 0x6, 0x2, 0x2, 0x401, 0x0, 0x2, 0x6, 0x6ac, 0xeb9, 0x1191, 0xca1a, 0x9, 0x8, 0x40, 0x8173, 0x1, 0x40, 0x10, 0x1ff, 0x9, 0x1, 0x8, 0x982b, 0x5, 0x6, 0x80000001, 0x5, 0x6, 0xe, 0x3, 0xfffffffb, 0x4, 0xffff, 0x1, 0x9, 0x240], [0x7, 0x6, 0x462, 0x7fff, 0x8000, 0xf5c9, 0x9, 0x10, 0x4, 0x54, 0x2d, 0x10000, 0x6, 0x8, 0x7, 0x8, 0x99, 0x0, 0x1, 0x10, 0x6, 0x5b85, 0x2, 0x8, 0x0, 0x3, 0x7ff, 0xc, 0x4f21ced4, 0x7, 0x80000000, 0x8001, 0x4, 0x5, 0x5, 0x1, 0x0, 0x7, 0x10000, 0x80000000, 0x7, 0x9, 0x9, 0x9, 0x9, 0x6, 0xff, 0xe4f, 0xc174, 0x6, 0xfffffffd, 0x7fff, 0x6, 0x5, 0x2, 0x8, 0x5, 0x5, 0xe, 0x0, 0xa0000000, 0x0, 0x6, 0xf]}, 0x45c) ioctl$UI_SET_LEDBIT(r0, 0x40045569, 0xa) mmap$fb(&(0x7f0000feb000/0x14000)=nil, 0x14000, 0x1000000, 0x30, 0xffffffffffffffff, 0x8e000) read(r0, &(0x7f00000004c0)=""/78, 0x4e) ioctl$HIDIOCGFLAG(0xffffffffffffffff, 0x8004480e, &(0x7f0000000540)) mprotect(&(0x7f0000fee000/0x12000)=nil, 0x12000, 0x6) r1 = openat(0xffffffffffffffff, &(0x7f0000000580)='./file0\x00', 0x1, 0x40) ioctl$UI_SET_PROPBIT(r1, 0x4004556e, 0x5) write$input_event(r0, &(0x7f00000005c0)={{}, 0x3, 0x1, 0x1}, 0x18) ioctl$UI_DEV_DESTROY(r1, 0x5502) umount2(&(0x7f0000000600)='./file0\x00', 0x1) sync_file_range(r0, 0x9, 0x4, 0x1) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000640)=0x8000) timer_create(0x5, &(0x7f0000000680)={0x0, 0x2c, 0x1}, &(0x7f00000006c0)=0x0) timer_settime(r2, 0x0, &(0x7f0000000700)={{0x0, 0x3938700}, {0x77359400}}, &(0x7f0000000740)) ioctl$FICLONE(r1, 0x40049409, 0xffffffffffffffff) utimensat(r1, &(0x7f0000000780)='./file0\x00', &(0x7f00000007c0), 0x0) r3 = openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000800), 0x2, 0x0) ioctl$AUTOFS_IOC_PROTOVER(r3, 0x80049363, &(0x7f0000000840)) timer_settime(r2, 0x0, &(0x7f0000000880)={{}, {0x77359400}}, &(0x7f00000008c0)) ioctl$BTRFS_IOC_DEFRAG_RANGE(r0, 0x40309410, &(0x7f0000000900)={0xfd, 0x8, 0x1, 0x247, 0x0, [0x5, 0x4, 0xd6, 0x9]}) io_setup(0x7, &(0x7f0000000940)=0x0) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000980), 0x208400, 0x0) r6 = eventfd(0x800) r7 = syz_open_dev$dri(&(0x7f0000001c40), 0x6, 0x315c02) r8 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000001e00), 0x2, 0x0) io_submit(r4, 0x8, &(0x7f00000020c0)=[&(0x7f0000000ac0)={0x0, 0x0, 0x0, 0x8, 0x5cc7, r5, &(0x7f00000009c0)="46c6c25182d85938e479cc3d879d659fa2b51862dff8e690fc91bc3c81d1054649fe2a70f0528a51160674d054c7a902aaf5926eacc094565a4d5b11ca233ec3e2ef7c1eb2cb0767a199abcd9101adc251c1c497c0071922a907a375e93741628007ec020b0ed8943750198570d38921d2d32c5a102a2ed11dde28149183f3c5b618190ae4b666c2f27984fe8c2a4ae157e85c22146c7e0d275af8c8e44dd7670e5f54e1fb606cb44333bdced8a6bdec72f791bfdc16cb69542f80f09052068060079feaa74cd55266eea718fc08dd2e05b12df5a3ada8a1", 0xd8, 0x7c0}, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, 0x3, r3, &(0x7f0000000b00)="b5e9ce3ad424d3b3db80a3e492a31f48c4fcb28a1348a78e5ee4d093d85b42b041751d85f9eb1f80ad12bd88f92c1cda186bdabfeca67f2520c8cd5167ab259c1c54ff113e2e0593432440ad066cad97178c3425803670c7b9d49acb8f8017a712fe48d6ed7ebb8c35100b525dea0642ec458159d792173431d9b30f6d46ea240da55fdc6d8dffe8d9233fdcbcf05c75d79bdc586676ba000d78dca2d2c23fb086d9a5674146eac8abdccd4603ae60216cf8cbaa2a83ba94a83671fdac3d260f0d7f2d74c235ae4fa763afc613925dc65ed7a9662db51559d2b228eb4e42ab6ecadd30eae629b65060141e520593b2717a924449a5e72d0ef4f49f1a22c23f9824323075cf6468a04c5342727cc6df3bdc47c7ee0641fc45774ea038cc59ef7513b91a351204e3c2b300371c897d638d6dd13a55bf383be7ead31e9c8dd74699bd28cabea888acafe402e17e679a688f7249a4a696a527757f4b90914b3ae23d2fc312a5ca4a2b28a0009b5c1c115971dff6771414751b202bd7c623b53ce2ecd2e8d73e9658641c7a7bd8de7f5d98747624acd3acc254a9eb8419d24a68b0f0cc31e9376a3099f9c4f06859c0848d461727735035d348978afc9e92ddc4b67a4416ff6e1f13bbfbf6283d5effb84bfea444d046fa320837717a37dc2124bd8b987cb6d17abf38081e89cb41f533f91131bd56b5e872530032b8fd7a7419ff307ea2ec3c12893505750353f4fb1d23ac4c6865ed44a80a268cbf4ad43258dcaba5317648df969402c5d855402274a5c5c77aa8c24e0f0dc0f0b8b264112d2b0c2e8bb1ad3960d9b8aba96da80c131adec458b06623f640745a115a231b0d971d78418478ca695802f5232f22346a82a639e14d26ee72d8890c719373b75fc29be6fd7b700033f5c933e860bf50d117fa57ada8c4e5167d85e547cd3f89a5fab5c87535ea02b25598cd2b311f3ef800c87d00576a6edaf752ce5fbcf7dad82c9f4560fd60cff05f7da8964ffb7ce306a3c0c66fd7013747edd5aa38aba4eadc59a404213ed3fa1ae25bb156f3cc7d9a942774d41c4735c04680fb2c9e0334e37febd62497fbd23bffdd00fe0029d53a6c294a4d17c0cc1edd3be6000031212d302b79dd2823f2f7b2893c865e678f1f3b824e97a4fdf4ef67b5edc3a483cde36fa2f7648feb04606dd50f0bb7f7c39ea69e72d55694676fcead4ac38f6b4bab3f10f4cd80ca8b968cc79c83d7e9fb497465402f8abac7aed050965bfb7b24e095605416602bd2348c8a448d1df11bed2f6c21533ba93c1be09c5284ee96976bd423216c514c92c56287c7c534daf2346dfe6d1bcb902a27d5e35ebd7d5921352f8b8fa622b49903975269bbd908334a0c96bc7412d6ea118b556eb904375fd0d98c970406306554c268ad88b8083c5e527d50d7cd0028a305667484a15c7d6e66c610ac3e4ce02f8436e855ed22907bfba65e275a6b436ac6fc7b92dcc4df507f8229b86d2b7cc81406794400b87d20d175fcbfd75b2b2a692cc118a782241bb7b73820126436fc0ef1812fb8d87cdf142cf9ad4c023f049225d28980d0f7f41d488bafe7e0ca6de4d1003fbead8ef7f7a776e21228d5b1234c1271b630c6a6efa5dc880e214fc974a9a6d77e7021eaa70f0816646f389325453ca89f4a1d281bbb1dce8c9b82f4c68909fa9101b1752f2dd4888f488c061f73e1ebe142720facae82e5e634e92d1df81281f2e8dcc76f10d9b695948c231009e6dc7338cbce3009122d7545cbb44574b62d0ad54f5a2787355cea1caeea390935ed125d03f126c7b23bda8056c070319893c29a5c45eb671e7a1a194333fde4f3e02fc54f30c05ba3bff64bcac1125c4b760ec0cb831145f101b9a473699ebe3e25e9ea94d6c5d5963a93d1750d851a83b5e5251cb9422b8c546848247c7d0a1d1f32edbbfbcaeb5191a81f3d3ee29224d3b3560b631e6795a270b4fea7a8cbd10171e0dabe2371849e05041f873b5fd270d8464f02293d3d80860311b67f626c4b5b4c53918d9f74980268cfa5683450f3a062e9c3c68e917362f40a50a1114c9965dcadf08523fb54521bde19cdbcf6b9d5dc8be675ecde0da0ade3ba7eb4540efc17c87127c42739e167c818ad549603ce8f25fb3a515c4dd7b161ac5097f9a4c4a141247d49f386a87ce2107101cf69c8049170f094e37dcc04a82ba4cfef16ede3d08bd17b0e402fb41ddb86669fcce9630f5bc77dd0b595e15c561781164fae6e90a40fa94af8311ff835d24b47f62d2648e75316ad643bbc747b74f99e25116293837f53d8cba14977a9b3665f0a42c368b7a22912acfcec89043a5d24009793a68ae6472002ceec7d12ae2210d1b9ee00ab341f305cf9312f89b4fd787af3fc6107ba625e4fe4bcff20a801912523d82b68be864cc09a416d62ca3abed0c39857070b523e78542c61ef21a2500b46f4d4a497fb060d7c28cd0266e02dade99b837a8b5175ed2eef775763248bd27f1e01708130db8ca919faed5deafd354eebb841b65820e9e859a627355a918aa67516705152d183ce3583018453ecb1ac3a143d1f737ac9b2b532c624b650e1ffc9ab3f9cab31a3d5bbd82de46c431304b4324065d9ab46fb6195a2cbcdaf2125fec8b82b44053414e009323f0738595331186faf065187e4917de5ad0c8c61bf6ea87eeb9ecef3e4e57c758da6468fd091f4291246e908f7c7ae9c6186d433c16216b7d0d849d9a741561bd1ec47f9bc4ec5c581ca5ac42d6f3eb4a337b25d9f10b5a43346b7c69808387c2ac520c412ded4f6530f17f5e0d88050f4ef0d7127cffc756fa1f5ae2c52d40abaf3a3c1eb21b2f7161c9a0b129cb00961385006f3399dacb8c8d1fbf040a6f6bad06fe71fd2af8f0ff6c8ddf579bf6222aedd9e9838ae7ed047cc82def3a9483982f4f76753659c944ca6249ead4e50be7b0dc18d3720892afd801a769570b07a78c54df8c83bd204c4e4130a9ed486827b7012a32aaf6d92c22682f75c0de539c47273c2662246021ecbaeb1f6f17b330f71015ee5a1090392831e8c8dbd21b59c237a458ffa7af9f9defda802c103dc2d722ff3e0ecbba7e3fc7fe9541dc51d78d583a1510726601ad07bf89f77286618e37520043619dc2e2e9581a2ebb3ae425dc4c0329435f80b11580f10b2ece38ad062877b96762066bc14e269dcbaae19efa504cd5ae2bd8fa4c39aa965822dcac55db0eccce7174778933c41256406d9b344025440570f1718b6b8ef604ef74bf592bf4b3b6d155bb6621f63db8a9de07fa136f03fbad10ec020af40e2cbea898d3beb3bf8fd979a5a234d6cb0b431ec28f65c11b2acdaa0eaaf0aeeedd3d4064b446bfa38bc02df508d2d058c32707fb1bffd5b6c66c5b2ab0fdc9e844340cb4f19e9d9d77398d3a19ae334f875cf1fc01d3b7322c07c7d5c36d4be53e1d8057e2243f0cf96252b9cb4b9802fa5701f4177e4252052945329f7e17ff6e893cc99fb816a0a326a664fe55b02d2b6309f7237a63874e51f2db61327fe8898c03aa31c3268b17fd3c6fef63d8c853f92291aa0f47ba4a9bc0a6fb3db90063e40834db0081b852aba07694c05f1c4366f75c481ac75b24eb1710ba6027bf6c99cb9375254b8f9749ec6ddb1bff06c8a141810077193428f7d2d51963aa0b3d079ab52a6703266ae5cc6bcec72844b9cbe8e4b795c9e330e1931a66cc0fd7511ed81f21b30fabe6b75ac9cdbefb0e4a7a444ed6a171b8947b2cabd4506ec68aee04d1e4af7acda3cae91358a0286e6bdc535c3b66c4e756bc03ff840483285b7f0dce14e555cfc4dbdfd98d3cb446fcd599e5276ea7ec2d35a093ea7528d06b221e132e4a29393b314bad62154ef6530ad06405b62a3b00c51361400dc4c7e05c6a2a0d11c48417878a24c43a0e4203d35e3b4e9ac2ce3aa78b2c4a6f8fe90616d05590e80e1374c8cb88a5907f85623b61606ee020f41e6448a8262ec7c192b4f52eae485e38e8e7ddf078d48ee2ea40cf97df785e8edf17faf1fedc171dd5015e47a9782070962f539413300175a61e969505774cb15233e018a5796d706796783ecfb6629854a5592c5e2aee6627ceba0c5f5707152cd828e6254ca4fffdcf399d7acb552889fa3692ddca9e277058f60ef543a3667ab4a6eb1e5cbe551d1475270aef2654c0d061a6345acf8e7b6a318d33e5f0708d7eda8aca2c1b81843d3a4e2be71233bc4b3ab976bacdec07631d2a02f400efa5866c0cab2bfd932a5fbfc1f2935391749e0f3d0f734d4c24d2586c0dc443f08bdf6d5d82002f3c5f943b406f8d97bc308d615667e2728a40081ae7d3d34a133cba0b5b06bd8fee1eaf04f1288590d42ac4c9470dd65be334acac28a911dfac8adbc34f32e8bd187eedfb016af603667c1b87ea65c7a47b06f7930856e1327b1c56d65ed1cc406559be4361a5972f9f5cf2aa74d90485b0e75ee2c049871187737bc6138c85ea4afff3522f31aad69e5f0935f3f224437da13f403a0493ff7e206cdf400677c5cb2f0b0e1066087a0e5c372065b24691682105f93cccc4d2573663fac872342220ad438963403381d737d848a839c52a660bc88c00efad9fa6aed8f70f19e58148ca0c4501d97dc1a4aa8ea9b4acc39a697f8dabeb38c78aaa5d789d834182aba8cb22906d41539418dc6bb8ea9a46471c11f97952af1769b4f1e1214bcb80c2ddac6e1b3931fd0c754478676d7045b3d2e8ff030aa752c0a1a93e261944c2ae3c4f9ec6b93a6d95e72415008779313ac0ebcd29499c2db43e1e0737c259f5b0aa81e75d33e06504a743d7ef7bef4151a2a0bb2eb251d68b4e03a5aad09390c62865ec8d9118a7bffa7f417c3ee81b68c49bcf8b21978039b5a65a0b24d00932287f0f86f9b2351485ad7400e28017fd7be9c5901387b2b9dc423c5fd5df1fc708fe9944b8e32f5d370c9f8048f3509a59ef575fe8ba4758aeaf50be7de4eec52825356606cc44d629a0e57bc4c9a81cf1a1b01b3a457ce43c695179b8115b28b77df4a4a6da5f1c4b8acf2ec1de01111702fcbfc44341d41197a6f68316a5d7db594c47a539c14b16002c9aa806896cca40c9981e3d32ecb1fbb07502996de8de3298b1059e0ae4454fa87b258c920ec30e980ac48d8e5e21c691629297a87d9a65270d88c723e9e4cb7f5d9fa4cc7000b2accf21072a7831614f32e6397f2f7041a5ac5747f2aab602cceca8b6ef840ac5120526a2e8544ad64280af27a523d7b286c0f627aaf6a5c12e3460fc847449101207edeae4a020ec73c2d2bec07d473a2d3735aab75206cefca128da54d0ae57d1699e4004a6d0a2c2a31cdeddab9a4d3186818390e5a7b7e554b092386c7667756f6a9acbb2f6867035824c9f733c0cafd08142cf8b307399c72c0ea2c349bd6721617bbcb652bf758790f60031be5a9c500007d5290bf9d05f2048411bd3a3e55d3752d977e9ff072bb49d97d236d695cb619c0ee79730957521d623c7685bee83f9cd18a541bddd2bbcb8283ac9f5aef55c2811972a8d7f8c0ce8eeb48f93de79bc9020e8ebc5eccb292077aa1c7ecde5f12e139fcca9c8aca33bed42186f44a053aa189443f428d6316b552bc3a99bdb4f9448df886fe6da09e062761fa4ebc05d23ebd914bd08f09e56bd2f06207d45e842ef9be3f8cbffb22410632e0268ef990c35f555bc79cd44c9a07d368ae5727246000f26221f019b2837a23759d8632e11bd569c01b31a34b9c450eb75ee6f21afbf51607a9752b59a4a1b5cf19cc36833fc9bcd6cc36", 0x1000, 0x7, 0x0, 0x0, r1}, &(0x7f0000001c00)={0x0, 0x0, 0x0, 0x6, 0x8, r3, &(0x7f0000001b40)="e341f1d69311909ec297c28f318cf7adbf55caa9973f6e1d010ee703b50e8aa5d867cfeeb355d00956e58e9643000dcaf09cdc94f4dc6b57348ae0c332ed1740292a2b0ba1ddbdb83b38ddb46f9186084d1b29d31fae606ec23340ac59b7d2edb460114cb84a1205a3e6e9e5dd3ec6f5e62c37a283a5bb46068ddf26aa619d27961a25dfcd", 0x85, 0x9, 0x0, 0x6, r6}, &(0x7f0000001cc0)={0x0, 0x0, 0x0, 0x6, 0x8, r7, &(0x7f0000001c80)="e1f86036aca1dfc49fb1c6413934c90601937a98685a55c9d488d2aa7529c4c08bb3d082bbdb", 0x26, 0xfffffffffffffffa, 0x0, 0x2, r1}, &(0x7f0000001dc0)={0x0, 0x0, 0x0, 0x5, 0xe, r1, &(0x7f0000001d00)="8ac7e72011b1f3c13b5986da519ff8799da26b58b1dc7182d0f20a44ad3be945df33902d68cf5c535f04415127984c40880a17888221b91f630f240b179d87d2763351a175713d01bb1181c069b0e442dd95100887a651ce82595df624066ed80a9b07f04b879f996815f33c91d04f33cbfa8e0bc60a287cac5efdeee16736be00974126a402ffad0210", 0x8a, 0xb5, 0x0, 0x3, r1}, &(0x7f0000001f40)={0x0, 0x0, 0x0, 0x5, 0xd, r8, &(0x7f0000001e40)="e21e93593be69b1dea414ebbfe49762b5ea7852fef905cee670286ddba5973084d4fab4747fc5ba6dc601c909eed7e612b4bd56f9bf15aa1436469f9a10ebba8762a01cd832e72f971f7c372d725a461221e4f21baacc9302d9fed22e5374035f3574009d545f410ceb919f74d55d64b3583cffbd57ef628f0f700e94a0dc3971bd0308caea60b256f86d6c7aa08e78bdb0551dda37f89372f0bb43e0f85021e9dfda5c1ad35c99ae84bd93fe6c283882130a84c96c3d73fce00f6302071630e6564f0fd9439bcc14c7263e04e9a125d002d1f81d0053a270f89df3e73f7f7b9e08018a6d093e9cad82c8e03c8d45a47efc8881b276b51608f", 0xf9, 0x6ba20da1, 0x0, 0x0, r1}, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x7, r1, &(0x7f0000001f80)="01d0e59071ba6f395caab8f052b3970cb0dc68e53c070e0e45f629f3e4073762929834002fe9f50c22e54778b6fb064168483e78b0d309ef3e596f105554f2d22d7014b7e94313e95f885684b3cbc4a838567d3a0015bdc6", 0x58, 0xfffffffffffffffe, 0x0, 0x2, r1}, &(0x7f0000002080)={0x0, 0x0, 0x0, 0x0, 0x4, r3, &(0x7f0000002040)="91c572a76fab1fdf8fdb", 0xa, 0x8000, 0x0, 0x1}]) sendto$inet_nvme_pdu(r1, &(0x7f0000002100)=@r2t={{0x9, 0x2, 0x18, 0x83, 0x5}, 0x0, 0x8, 0x46, 0x5}, 0x80, 0x0, 0x0, 0x0) syz_open_dev$vcsu(&(0x7f0000002180), 0xb, 0x40000) 3m47.847483435s ago: executing program 33 (id=239): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000040)={'syz1\x00', {0x3, 0x7, 0x4}, 0x3e, [0xf02, 0x29b6, 0x3, 0xfffffff7, 0x2, 0x7fff, 0x3ff, 0x30c, 0xf1b2, 0xffffffff, 0x3e, 0x9, 0x1, 0x4, 0x1, 0x2, 0x6, 0x5, 0x1, 0x7, 0x8000, 0xe8a, 0x15260512, 0x3d7f, 0x8, 0x1, 0x100, 0x8fec, 0x0, 0x0, 0xfff, 0x8001, 0x10000, 0x7fff, 0x8, 0x7, 0x2, 0x2c, 0x2, 0x1, 0x1, 0x100, 0x2, 0x5dcc, 0x8311, 0x1, 0x9, 0x5, 0x10, 0x8, 0x4, 0x6, 0x2, 0x5, 0xa118, 0x7, 0x0, 0xa, 0x9, 0x4, 0x5, 0x8, 0x28, 0x80], [0x7fff, 0x5, 0x2, 0x2, 0x69, 0x5, 0x7fffffff, 0x4, 0x6, 0x8000, 0x9, 0x3, 0x3, 0x6, 0x7, 0x6, 0x7, 0xfffffffe, 0x4, 0x5, 0x1, 0x94e8, 0x7, 0x4, 0x1, 0x9, 0x4, 0x6, 0x4, 0x7, 0x7, 0x4, 0x9, 0x7f, 0x30, 0x7fff, 0x1ff, 0xc, 0x10, 0x4, 0x6, 0x2, 0x2, 0xa5a, 0x0, 0x3, 0x9, 0xa0, 0x1000, 0x8, 0xa, 0x858f, 0x0, 0xcd6, 0xcdb, 0x3, 0x68, 0x8000, 0x8, 0x3, 0x1, 0x7fffffff, 0xfff, 0x8], [0x7, 0x9, 0x0, 0x3ff, 0xffffffff, 0x5, 0x4, 0x7fffffff, 0x66, 0x6, 0x24446fcc, 0x300000, 0xf, 0x6, 0xb, 0x80000000, 0x1, 0xfffffffa, 0xf5, 0x4, 0x6, 0xa3c, 0xfffffff2, 0xb, 0x5, 0x3, 0x5, 0x1c2, 0x6, 0x2, 0x2, 0x401, 0x0, 0x2, 0x6, 0x6ac, 0xeb9, 0x1191, 0xca1a, 0x9, 0x8, 0x40, 0x8173, 0x1, 0x40, 0x10, 0x1ff, 0x9, 0x1, 0x8, 0x982b, 0x5, 0x6, 0x80000001, 0x5, 0x6, 0xe, 0x3, 0xfffffffb, 0x4, 0xffff, 0x1, 0x9, 0x240], [0x7, 0x6, 0x462, 0x7fff, 0x8000, 0xf5c9, 0x9, 0x10, 0x4, 0x54, 0x2d, 0x10000, 0x6, 0x8, 0x7, 0x8, 0x99, 0x0, 0x1, 0x10, 0x6, 0x5b85, 0x2, 0x8, 0x0, 0x3, 0x7ff, 0xc, 0x4f21ced4, 0x7, 0x80000000, 0x8001, 0x4, 0x5, 0x5, 0x1, 0x0, 0x7, 0x10000, 0x80000000, 0x7, 0x9, 0x9, 0x9, 0x9, 0x6, 0xff, 0xe4f, 0xc174, 0x6, 0xfffffffd, 0x7fff, 0x6, 0x5, 0x2, 0x8, 0x5, 0x5, 0xe, 0x0, 0xa0000000, 0x0, 0x6, 0xf]}, 0x45c) ioctl$UI_SET_LEDBIT(r0, 0x40045569, 0xa) mmap$fb(&(0x7f0000feb000/0x14000)=nil, 0x14000, 0x1000000, 0x30, 0xffffffffffffffff, 0x8e000) read(r0, &(0x7f00000004c0)=""/78, 0x4e) ioctl$HIDIOCGFLAG(0xffffffffffffffff, 0x8004480e, &(0x7f0000000540)) mprotect(&(0x7f0000fee000/0x12000)=nil, 0x12000, 0x6) r1 = openat(0xffffffffffffffff, &(0x7f0000000580)='./file0\x00', 0x1, 0x40) ioctl$UI_SET_PROPBIT(r1, 0x4004556e, 0x5) write$input_event(r0, &(0x7f00000005c0)={{}, 0x3, 0x1, 0x1}, 0x18) ioctl$UI_DEV_DESTROY(r1, 0x5502) umount2(&(0x7f0000000600)='./file0\x00', 0x1) sync_file_range(r0, 0x9, 0x4, 0x1) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000640)=0x8000) timer_create(0x5, &(0x7f0000000680)={0x0, 0x2c, 0x1}, &(0x7f00000006c0)=0x0) timer_settime(r2, 0x0, &(0x7f0000000700)={{0x0, 0x3938700}, {0x77359400}}, &(0x7f0000000740)) ioctl$FICLONE(r1, 0x40049409, 0xffffffffffffffff) utimensat(r1, &(0x7f0000000780)='./file0\x00', &(0x7f00000007c0), 0x0) r3 = openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000800), 0x2, 0x0) ioctl$AUTOFS_IOC_PROTOVER(r3, 0x80049363, &(0x7f0000000840)) timer_settime(r2, 0x0, &(0x7f0000000880)={{}, {0x77359400}}, &(0x7f00000008c0)) ioctl$BTRFS_IOC_DEFRAG_RANGE(r0, 0x40309410, &(0x7f0000000900)={0xfd, 0x8, 0x1, 0x247, 0x0, [0x5, 0x4, 0xd6, 0x9]}) io_setup(0x7, &(0x7f0000000940)=0x0) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000980), 0x208400, 0x0) r6 = eventfd(0x800) r7 = syz_open_dev$dri(&(0x7f0000001c40), 0x6, 0x315c02) r8 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000001e00), 0x2, 0x0) io_submit(r4, 0x8, &(0x7f00000020c0)=[&(0x7f0000000ac0)={0x0, 0x0, 0x0, 0x8, 0x5cc7, r5, &(0x7f00000009c0)="46c6c25182d85938e479cc3d879d659fa2b51862dff8e690fc91bc3c81d1054649fe2a70f0528a51160674d054c7a902aaf5926eacc094565a4d5b11ca233ec3e2ef7c1eb2cb0767a199abcd9101adc251c1c497c0071922a907a375e93741628007ec020b0ed8943750198570d38921d2d32c5a102a2ed11dde28149183f3c5b618190ae4b666c2f27984fe8c2a4ae157e85c22146c7e0d275af8c8e44dd7670e5f54e1fb606cb44333bdced8a6bdec72f791bfdc16cb69542f80f09052068060079feaa74cd55266eea718fc08dd2e05b12df5a3ada8a1", 0xd8, 0x7c0}, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, 0x3, r3, &(0x7f0000000b00)="b5e9ce3ad424d3b3db80a3e492a31f48c4fcb28a1348a78e5ee4d093d85b42b041751d85f9eb1f80ad12bd88f92c1cda186bdabfeca67f2520c8cd5167ab259c1c54ff113e2e0593432440ad066cad97178c3425803670c7b9d49acb8f8017a712fe48d6ed7ebb8c35100b525dea0642ec458159d792173431d9b30f6d46ea240da55fdc6d8dffe8d9233fdcbcf05c75d79bdc586676ba000d78dca2d2c23fb086d9a5674146eac8abdccd4603ae60216cf8cbaa2a83ba94a83671fdac3d260f0d7f2d74c235ae4fa763afc613925dc65ed7a9662db51559d2b228eb4e42ab6ecadd30eae629b65060141e520593b2717a924449a5e72d0ef4f49f1a22c23f9824323075cf6468a04c5342727cc6df3bdc47c7ee0641fc45774ea038cc59ef7513b91a351204e3c2b300371c897d638d6dd13a55bf383be7ead31e9c8dd74699bd28cabea888acafe402e17e679a688f7249a4a696a527757f4b90914b3ae23d2fc312a5ca4a2b28a0009b5c1c115971dff6771414751b202bd7c623b53ce2ecd2e8d73e9658641c7a7bd8de7f5d98747624acd3acc254a9eb8419d24a68b0f0cc31e9376a3099f9c4f06859c0848d461727735035d348978afc9e92ddc4b67a4416ff6e1f13bbfbf6283d5effb84bfea444d046fa320837717a37dc2124bd8b987cb6d17abf38081e89cb41f533f91131bd56b5e872530032b8fd7a7419ff307ea2ec3c12893505750353f4fb1d23ac4c6865ed44a80a268cbf4ad43258dcaba5317648df969402c5d855402274a5c5c77aa8c24e0f0dc0f0b8b264112d2b0c2e8bb1ad3960d9b8aba96da80c131adec458b06623f640745a115a231b0d971d78418478ca695802f5232f22346a82a639e14d26ee72d8890c719373b75fc29be6fd7b700033f5c933e860bf50d117fa57ada8c4e5167d85e547cd3f89a5fab5c87535ea02b25598cd2b311f3ef800c87d00576a6edaf752ce5fbcf7dad82c9f4560fd60cff05f7da8964ffb7ce306a3c0c66fd7013747edd5aa38aba4eadc59a404213ed3fa1ae25bb156f3cc7d9a942774d41c4735c04680fb2c9e0334e37febd62497fbd23bffdd00fe0029d53a6c294a4d17c0cc1edd3be6000031212d302b79dd2823f2f7b2893c865e678f1f3b824e97a4fdf4ef67b5edc3a483cde36fa2f7648feb04606dd50f0bb7f7c39ea69e72d55694676fcead4ac38f6b4bab3f10f4cd80ca8b968cc79c83d7e9fb497465402f8abac7aed050965bfb7b24e095605416602bd2348c8a448d1df11bed2f6c21533ba93c1be09c5284ee96976bd423216c514c92c56287c7c534daf2346dfe6d1bcb902a27d5e35ebd7d5921352f8b8fa622b49903975269bbd908334a0c96bc7412d6ea118b556eb904375fd0d98c970406306554c268ad88b8083c5e527d50d7cd0028a305667484a15c7d6e66c610ac3e4ce02f8436e855ed22907bfba65e275a6b436ac6fc7b92dcc4df507f8229b86d2b7cc81406794400b87d20d175fcbfd75b2b2a692cc118a782241bb7b73820126436fc0ef1812fb8d87cdf142cf9ad4c023f049225d28980d0f7f41d488bafe7e0ca6de4d1003fbead8ef7f7a776e21228d5b1234c1271b630c6a6efa5dc880e214fc974a9a6d77e7021eaa70f0816646f389325453ca89f4a1d281bbb1dce8c9b82f4c68909fa9101b1752f2dd4888f488c061f73e1ebe142720facae82e5e634e92d1df81281f2e8dcc76f10d9b695948c231009e6dc7338cbce3009122d7545cbb44574b62d0ad54f5a2787355cea1caeea390935ed125d03f126c7b23bda8056c070319893c29a5c45eb671e7a1a194333fde4f3e02fc54f30c05ba3bff64bcac1125c4b760ec0cb831145f101b9a473699ebe3e25e9ea94d6c5d5963a93d1750d851a83b5e5251cb9422b8c546848247c7d0a1d1f32edbbfbcaeb5191a81f3d3ee29224d3b3560b631e6795a270b4fea7a8cbd10171e0dabe2371849e05041f873b5fd270d8464f02293d3d80860311b67f626c4b5b4c53918d9f74980268cfa5683450f3a062e9c3c68e917362f40a50a1114c9965dcadf08523fb54521bde19cdbcf6b9d5dc8be675ecde0da0ade3ba7eb4540efc17c87127c42739e167c818ad549603ce8f25fb3a515c4dd7b161ac5097f9a4c4a141247d49f386a87ce2107101cf69c8049170f094e37dcc04a82ba4cfef16ede3d08bd17b0e402fb41ddb86669fcce9630f5bc77dd0b595e15c561781164fae6e90a40fa94af8311ff835d24b47f62d2648e75316ad643bbc747b74f99e25116293837f53d8cba14977a9b3665f0a42c368b7a22912acfcec89043a5d24009793a68ae6472002ceec7d12ae2210d1b9ee00ab341f305cf9312f89b4fd787af3fc6107ba625e4fe4bcff20a801912523d82b68be864cc09a416d62ca3abed0c39857070b523e78542c61ef21a2500b46f4d4a497fb060d7c28cd0266e02dade99b837a8b5175ed2eef775763248bd27f1e01708130db8ca919faed5deafd354eebb841b65820e9e859a627355a918aa67516705152d183ce3583018453ecb1ac3a143d1f737ac9b2b532c624b650e1ffc9ab3f9cab31a3d5bbd82de46c431304b4324065d9ab46fb6195a2cbcdaf2125fec8b82b44053414e009323f0738595331186faf065187e4917de5ad0c8c61bf6ea87eeb9ecef3e4e57c758da6468fd091f4291246e908f7c7ae9c6186d433c16216b7d0d849d9a741561bd1ec47f9bc4ec5c581ca5ac42d6f3eb4a337b25d9f10b5a43346b7c69808387c2ac520c412ded4f6530f17f5e0d88050f4ef0d7127cffc756fa1f5ae2c52d40abaf3a3c1eb21b2f7161c9a0b129cb00961385006f3399dacb8c8d1fbf040a6f6bad06fe71fd2af8f0ff6c8ddf579bf6222aedd9e9838ae7ed047cc82def3a9483982f4f76753659c944ca6249ead4e50be7b0dc18d3720892afd801a769570b07a78c54df8c83bd204c4e4130a9ed486827b7012a32aaf6d92c22682f75c0de539c47273c2662246021ecbaeb1f6f17b330f71015ee5a1090392831e8c8dbd21b59c237a458ffa7af9f9defda802c103dc2d722ff3e0ecbba7e3fc7fe9541dc51d78d583a1510726601ad07bf89f77286618e37520043619dc2e2e9581a2ebb3ae425dc4c0329435f80b11580f10b2ece38ad062877b96762066bc14e269dcbaae19efa504cd5ae2bd8fa4c39aa965822dcac55db0eccce7174778933c41256406d9b344025440570f1718b6b8ef604ef74bf592bf4b3b6d155bb6621f63db8a9de07fa136f03fbad10ec020af40e2cbea898d3beb3bf8fd979a5a234d6cb0b431ec28f65c11b2acdaa0eaaf0aeeedd3d4064b446bfa38bc02df508d2d058c32707fb1bffd5b6c66c5b2ab0fdc9e844340cb4f19e9d9d77398d3a19ae334f875cf1fc01d3b7322c07c7d5c36d4be53e1d8057e2243f0cf96252b9cb4b9802fa5701f4177e4252052945329f7e17ff6e893cc99fb816a0a326a664fe55b02d2b6309f7237a63874e51f2db61327fe8898c03aa31c3268b17fd3c6fef63d8c853f92291aa0f47ba4a9bc0a6fb3db90063e40834db0081b852aba07694c05f1c4366f75c481ac75b24eb1710ba6027bf6c99cb9375254b8f9749ec6ddb1bff06c8a141810077193428f7d2d51963aa0b3d079ab52a6703266ae5cc6bcec72844b9cbe8e4b795c9e330e1931a66cc0fd7511ed81f21b30fabe6b75ac9cdbefb0e4a7a444ed6a171b8947b2cabd4506ec68aee04d1e4af7acda3cae91358a0286e6bdc535c3b66c4e756bc03ff840483285b7f0dce14e555cfc4dbdfd98d3cb446fcd599e5276ea7ec2d35a093ea7528d06b221e132e4a29393b314bad62154ef6530ad06405b62a3b00c51361400dc4c7e05c6a2a0d11c48417878a24c43a0e4203d35e3b4e9ac2ce3aa78b2c4a6f8fe90616d05590e80e1374c8cb88a5907f85623b61606ee020f41e6448a8262ec7c192b4f52eae485e38e8e7ddf078d48ee2ea40cf97df785e8edf17faf1fedc171dd5015e47a9782070962f539413300175a61e969505774cb15233e018a5796d706796783ecfb6629854a5592c5e2aee6627ceba0c5f5707152cd828e6254ca4fffdcf399d7acb552889fa3692ddca9e277058f60ef543a3667ab4a6eb1e5cbe551d1475270aef2654c0d061a6345acf8e7b6a318d33e5f0708d7eda8aca2c1b81843d3a4e2be71233bc4b3ab976bacdec07631d2a02f400efa5866c0cab2bfd932a5fbfc1f2935391749e0f3d0f734d4c24d2586c0dc443f08bdf6d5d82002f3c5f943b406f8d97bc308d615667e2728a40081ae7d3d34a133cba0b5b06bd8fee1eaf04f1288590d42ac4c9470dd65be334acac28a911dfac8adbc34f32e8bd187eedfb016af603667c1b87ea65c7a47b06f7930856e1327b1c56d65ed1cc406559be4361a5972f9f5cf2aa74d90485b0e75ee2c049871187737bc6138c85ea4afff3522f31aad69e5f0935f3f224437da13f403a0493ff7e206cdf400677c5cb2f0b0e1066087a0e5c372065b24691682105f93cccc4d2573663fac872342220ad438963403381d737d848a839c52a660bc88c00efad9fa6aed8f70f19e58148ca0c4501d97dc1a4aa8ea9b4acc39a697f8dabeb38c78aaa5d789d834182aba8cb22906d41539418dc6bb8ea9a46471c11f97952af1769b4f1e1214bcb80c2ddac6e1b3931fd0c754478676d7045b3d2e8ff030aa752c0a1a93e261944c2ae3c4f9ec6b93a6d95e72415008779313ac0ebcd29499c2db43e1e0737c259f5b0aa81e75d33e06504a743d7ef7bef4151a2a0bb2eb251d68b4e03a5aad09390c62865ec8d9118a7bffa7f417c3ee81b68c49bcf8b21978039b5a65a0b24d00932287f0f86f9b2351485ad7400e28017fd7be9c5901387b2b9dc423c5fd5df1fc708fe9944b8e32f5d370c9f8048f3509a59ef575fe8ba4758aeaf50be7de4eec52825356606cc44d629a0e57bc4c9a81cf1a1b01b3a457ce43c695179b8115b28b77df4a4a6da5f1c4b8acf2ec1de01111702fcbfc44341d41197a6f68316a5d7db594c47a539c14b16002c9aa806896cca40c9981e3d32ecb1fbb07502996de8de3298b1059e0ae4454fa87b258c920ec30e980ac48d8e5e21c691629297a87d9a65270d88c723e9e4cb7f5d9fa4cc7000b2accf21072a7831614f32e6397f2f7041a5ac5747f2aab602cceca8b6ef840ac5120526a2e8544ad64280af27a523d7b286c0f627aaf6a5c12e3460fc847449101207edeae4a020ec73c2d2bec07d473a2d3735aab75206cefca128da54d0ae57d1699e4004a6d0a2c2a31cdeddab9a4d3186818390e5a7b7e554b092386c7667756f6a9acbb2f6867035824c9f733c0cafd08142cf8b307399c72c0ea2c349bd6721617bbcb652bf758790f60031be5a9c500007d5290bf9d05f2048411bd3a3e55d3752d977e9ff072bb49d97d236d695cb619c0ee79730957521d623c7685bee83f9cd18a541bddd2bbcb8283ac9f5aef55c2811972a8d7f8c0ce8eeb48f93de79bc9020e8ebc5eccb292077aa1c7ecde5f12e139fcca9c8aca33bed42186f44a053aa189443f428d6316b552bc3a99bdb4f9448df886fe6da09e062761fa4ebc05d23ebd914bd08f09e56bd2f06207d45e842ef9be3f8cbffb22410632e0268ef990c35f555bc79cd44c9a07d368ae5727246000f26221f019b2837a23759d8632e11bd569c01b31a34b9c450eb75ee6f21afbf51607a9752b59a4a1b5cf19cc36833fc9bcd6cc36", 0x1000, 0x7, 0x0, 0x0, r1}, &(0x7f0000001c00)={0x0, 0x0, 0x0, 0x6, 0x8, r3, &(0x7f0000001b40)="e341f1d69311909ec297c28f318cf7adbf55caa9973f6e1d010ee703b50e8aa5d867cfeeb355d00956e58e9643000dcaf09cdc94f4dc6b57348ae0c332ed1740292a2b0ba1ddbdb83b38ddb46f9186084d1b29d31fae606ec23340ac59b7d2edb460114cb84a1205a3e6e9e5dd3ec6f5e62c37a283a5bb46068ddf26aa619d27961a25dfcd", 0x85, 0x9, 0x0, 0x6, r6}, &(0x7f0000001cc0)={0x0, 0x0, 0x0, 0x6, 0x8, r7, &(0x7f0000001c80)="e1f86036aca1dfc49fb1c6413934c90601937a98685a55c9d488d2aa7529c4c08bb3d082bbdb", 0x26, 0xfffffffffffffffa, 0x0, 0x2, r1}, &(0x7f0000001dc0)={0x0, 0x0, 0x0, 0x5, 0xe, r1, &(0x7f0000001d00)="8ac7e72011b1f3c13b5986da519ff8799da26b58b1dc7182d0f20a44ad3be945df33902d68cf5c535f04415127984c40880a17888221b91f630f240b179d87d2763351a175713d01bb1181c069b0e442dd95100887a651ce82595df624066ed80a9b07f04b879f996815f33c91d04f33cbfa8e0bc60a287cac5efdeee16736be00974126a402ffad0210", 0x8a, 0xb5, 0x0, 0x3, r1}, &(0x7f0000001f40)={0x0, 0x0, 0x0, 0x5, 0xd, r8, &(0x7f0000001e40)="e21e93593be69b1dea414ebbfe49762b5ea7852fef905cee670286ddba5973084d4fab4747fc5ba6dc601c909eed7e612b4bd56f9bf15aa1436469f9a10ebba8762a01cd832e72f971f7c372d725a461221e4f21baacc9302d9fed22e5374035f3574009d545f410ceb919f74d55d64b3583cffbd57ef628f0f700e94a0dc3971bd0308caea60b256f86d6c7aa08e78bdb0551dda37f89372f0bb43e0f85021e9dfda5c1ad35c99ae84bd93fe6c283882130a84c96c3d73fce00f6302071630e6564f0fd9439bcc14c7263e04e9a125d002d1f81d0053a270f89df3e73f7f7b9e08018a6d093e9cad82c8e03c8d45a47efc8881b276b51608f", 0xf9, 0x6ba20da1, 0x0, 0x0, r1}, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x7, r1, &(0x7f0000001f80)="01d0e59071ba6f395caab8f052b3970cb0dc68e53c070e0e45f629f3e4073762929834002fe9f50c22e54778b6fb064168483e78b0d309ef3e596f105554f2d22d7014b7e94313e95f885684b3cbc4a838567d3a0015bdc6", 0x58, 0xfffffffffffffffe, 0x0, 0x2, r1}, &(0x7f0000002080)={0x0, 0x0, 0x0, 0x0, 0x4, r3, &(0x7f0000002040)="91c572a76fab1fdf8fdb", 0xa, 0x8000, 0x0, 0x1}]) sendto$inet_nvme_pdu(r1, &(0x7f0000002100)=@r2t={{0x9, 0x2, 0x18, 0x83, 0x5}, 0x0, 0x8, 0x46, 0x5}, 0x80, 0x0, 0x0, 0x0) syz_open_dev$vcsu(&(0x7f0000002180), 0xb, 0x40000) 1m30.651705919s ago: executing program 5 (id=561): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x3, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000000000000000000000008500000061000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffbfffb702000008000000b703000000000000850000007b00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x7, 0x4, 0x100, 0x4, 0x28}, 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="07000000040000008000000001"], 0x50) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r5, 0x84, 0xb, &(0x7f0000000180)={0x8, 0xff, 0x4, 0x68, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c, 0xff, 0x1, 0x0, 0x6}, 0xe) sendto$inet6(r5, &(0x7f0000000300)="8b", 0x34000, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @private1}, 0x1c) shutdown(r5, 0x1) 1m29.357638005s ago: executing program 5 (id=564): r0 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r0, &(0x7f0000002680)=[{{&(0x7f0000000000)={0xa, 0x0, 0x0, @private1}, 0x1c, &(0x7f0000000300)=[{&(0x7f0000000040)="18", 0x1}], 0x1}}, {{&(0x7f0000000140)={0xa, 0x4e20, 0x0, @private0, 0x80000001}, 0x1c, &(0x7f0000000800)=[{&(0x7f0000000180)="ed", 0x1}], 0x1}}], 0x2, 0x0) shutdown(r0, 0x1) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f00000000c0)={0x8, 0x4, 0x1000, 0x7}, &(0x7f0000000100)=0x10) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) 1m28.698808626s ago: executing program 5 (id=566): r0 = socket$netlink(0x10, 0x3, 0x15) bind$netlink(r0, &(0x7f0000000040)={0x10, 0x0, 0x25dfdbfe}, 0xc) bind$netlink(r0, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbfe}, 0xc) sendmsg$NFNL_MSG_CTHELPER_NEW(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="34000000000901020000000000000000010000020c00048008e101400001000108000540000000090900010073797a3100000000"], 0x34}, 0x1, 0x0, 0x0, 0x4000010}, 0x88c0) syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYRESHEX=r0], 0x0) 1m25.560600944s ago: executing program 5 (id=575): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000140), r0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000780)=ANY=[@ANYBLOB="9feb010018000000000000001201000012010000030000000e0000000500000f010000000200000081000000ff0f0000050000009a0000000500000004000000000c00000008000002000000ad4000000104000005000000faffffff08000000f4000000000500000d000000000300000000000000060000000500000010000000000000000b0000000500000003000000000000000e00000000000008010000000e000000000000110500000004000000050000000400000f010000000100000009000000080000000400000000000000ffffff7f04000000060000000900000003000000ddfdffff08000000650700000000000010100000000800000000000012030000000000000000000003000000000500000003000000010000000e0000000000000b000000000000002e004de9bba4dcb0cfd57f9c8af7e02b661d90ede10015982c627c4478b4f55376070d8adbce7f574af454178bb6b41bd4c35efcbbb1712308170547d77d23734aaf26c0132b5e62347a27fd72d06ef954a8691cfc19d7b2eb3df56ec619215d08d0c86ce6c415e686fd48c383a6b9aad420534b71a6ea492a531466a72f68424f81d39ccf8fa6e6bb2c384ce7721d2845569834ae34c81dd06836229bc4c70d"], &(0x7f0000000240)=""/20, 0x12f, 0x14, 0x0, 0xffff}, 0x28) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2000007, 0x31, 0xffffffffffffffff, 0x0) unshare(0x24060400) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=@newtaction={0x48, 0x5a, 0x1, 0xfffffffc, 0x25dfdbfa, {0x2}, [{0x34, 0x3, [@m_ctinfo={0x30, 0x8, 0x0, 0x0, {{0xb}, {0x4}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2, 0x1}}}}]}]}, 0x48}}, 0x8080) ftruncate(0xffffffffffffffff, 0x7000000) bind$inet6(r1, &(0x7f0000002100)={0xa, 0x4e27, 0x7, @private2={0xfc, 0x2, '\x00', 0x1}, 0x84}, 0x1c) r2 = socket$vsock_stream(0x28, 0x1, 0x0) io_setup(0x402, &(0x7f0000000200)=0x0) close(0x3) openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) io_submit(r3, 0x1, &(0x7f0000000240)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x5, 0x80, r2, 0x0}]) getpid() prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0xb, &(0x7f0000000380)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2}, 0x94) r8 = syz_open_dev$sndpcmc(&(0x7f0000000180), 0x0, 0x82000) ioctl$SNDRV_PCM_IOCTL_RESUME(r8, 0x4147, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000300)='rcu_utilization\x00', r7}, 0x10) ioctl$DRM_IOCTL_SET_CLIENT_CAP(0xffffffffffffffff, 0x4010640d, 0x0) 1m23.610989176s ago: executing program 5 (id=580): mkdir(&(0x7f0000001300)='./file1\x00', 0x4) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) (async) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) (async) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) (async) r2 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) fsmount(r2, 0x0, 0x0) (async) r3 = fsmount(r2, 0x0, 0x0) fchdir(r3) symlink(&(0x7f0000000040)='./file0\x00', &(0x7f0000000180)='./file0\x00') (async) symlink(&(0x7f0000000040)='./file0\x00', &(0x7f0000000180)='./file0\x00') r4 = creat(&(0x7f0000000080)='./file0\x00', 0xecf86c37d53049cc) r5 = dup3(r1, r0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) (async) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) ioctl$sock_FIOGETOWN(r5, 0x8903, &(0x7f0000000180)=0x0) sched_setscheduler(r7, 0x5, &(0x7f0000000240)=0x8000) socket(0x28, 0x5, 0x0) (async) r8 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r8, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10) (async) bind$vsock_stream(r8, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10) listen(r8, 0x0) r9 = socket(0x28, 0x5, 0x0) recvmsg$can_bcm(r9, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000280)=""/4096, 0x1000}], 0x1}, 0x20000000) shutdown(r9, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000001540)={0x3, 0x8, &(0x7f0000002340)=ANY=[@ANYRES64=r5], &(0x7f0000001280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x94) (async) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000001540)={0x3, 0x8, &(0x7f0000002340)=ANY=[@ANYRES64=r5], &(0x7f0000001280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x94) bpf$BPF_PROG_DETACH(0x1c, &(0x7f0000001600)=ANY=[@ANYRES32=r10, @ANYRES32=r10, @ANYBLOB="2f0000000000000004000000", @ANYRES32=r10, @ANYBLOB="400679a4aaccbc42a422cf017f14866a723e9f38b5390c7cdf9105a36a1b6ba6068782785153d9648db5d51bf25cb214490e20b08c5955bf78e8f94633c0de0f46e1b6b3ee79c6376c3b43cc492c60e75eb61af26cb3039f2bbbf276e9fe742277113c81df8b535b48143e14b2ca374537cf1892d04a", @ANYRES64=0x0], 0x20) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r6, 0x10000000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r6, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) (async) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r6, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000001380)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x12, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001480)={@fd={0x66642a85, 0x0, r4}, @fd={0x66642a85, 0x0, r1}, @ptr={0x70742a85, 0x1, &(0x7f0000001400)=""/91, 0x5b, 0x2, 0x21}}, &(0x7f0000001340)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x101f}], 0x0, 0x0, 0x0}) syz_emit_ethernet(0xe, &(0x7f0000000000)=ANY=[@ANYBLOB="00000000000079469be78e725330"], 0x0) setresgid(0x0, 0xee00, 0x0) setfsgid(0x0) 1m22.236273728s ago: executing program 5 (id=585): r0 = socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x219}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) listen(0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0xa) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000680), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102400, 0x19000) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/partitions\x00', 0x0, 0x0) r3 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) sendfile(r3, r2, &(0x7f00000000c0)=0x58, 0xa) socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_open_dev$loop(&(0x7f0000000080), 0x7, 0x2480) ioctl$HDIO_GETGEO(r4, 0x301, &(0x7f0000000180)) landlock_restrict_self(r2, 0x4) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$VIDIOC_G_EXT_CTRLS(0xffffffffffffffff, 0xc0205648, &(0x7f0000000000)={0xf010000, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}) shutdown(r0, 0x0) recvmmsg(r5, &(0x7f0000002540), 0x0, 0x406, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) ioctl$sock_SIOCADDDLCI(0xffffffffffffffff, 0x8980, 0x0) 1m7.029180502s ago: executing program 34 (id=585): r0 = socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x219}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) listen(0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0xa) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000680), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102400, 0x19000) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/partitions\x00', 0x0, 0x0) r3 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) sendfile(r3, r2, &(0x7f00000000c0)=0x58, 0xa) socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_open_dev$loop(&(0x7f0000000080), 0x7, 0x2480) ioctl$HDIO_GETGEO(r4, 0x301, &(0x7f0000000180)) landlock_restrict_self(r2, 0x4) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$VIDIOC_G_EXT_CTRLS(0xffffffffffffffff, 0xc0205648, &(0x7f0000000000)={0xf010000, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}) shutdown(r0, 0x0) recvmmsg(r5, &(0x7f0000002540), 0x0, 0x406, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) ioctl$sock_SIOCADDDLCI(0xffffffffffffffff, 0x8980, 0x0) 7.728352667s ago: executing program 2 (id=773): sendmsg$802154_raw(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x24, @none={0x0, 0x3}}, 0x14, &(0x7f00000000c0)={&(0x7f0000000040)="a0f60f50f4119a109e76c09d955b87de70beebc5dbc57d61242355ab748605979cefc7c88227959346183e51e18ef4db47da2384eecc6a0557265504d2bac765f4adf72569c8178667e5578bd3625e869818a8fee85fc4b0a3294d228a29c36a3c031275c919254400a1e2626a129d", 0x6f}, 0x1, 0x0, 0x0, 0x40000}, 0x24000010) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mkdir(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{0x0}], 0x1}, 0x0) r0 = add_key$keyring(0x0, &(0x7f0000000380)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$chown(0x4, r0, 0xee01, 0x0) keyctl$setperm(0x5, r0, 0x30925) keyctl$setperm(0x5, r0, 0x4) r1 = syz_open_dev$MSR(&(0x7f0000000540), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = syz_open_dev$admmidi(&(0x7f0000000140), 0x20, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r2, 0xc0305710, &(0x7f0000000040)={0x1, 0xff, 0x1f}) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x80383, 0x0) read$midi(r2, 0x0, 0x0) ioctl$SNDCTL_SEQ_PANIC(r3, 0x5111) ustat(0x801, &(0x7f0000000300)) 7.559795693s ago: executing program 0 (id=774): r0 = creat(&(0x7f0000000040)='./file0\x00', 0x8c) read$smackfs_cipsonum(r0, &(0x7f00000000c0), 0x14) mount_setattr(0xffffffffffffffff, 0x0, 0x0, &(0x7f00000000c0)={0x96, 0x10007e}, 0x20) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket(0x1e, 0x4, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) connect$l2tp(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0x5, &(0x7f0000000000)={0xffffffff, 0x1000086}, 0x0) sched_setaffinity(0x0, 0x43, &(0x7f0000000040)=0x2) r2 = syz_open_dev$MSR(0x0, 0x2, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) syz_open_dev$video4linux(0x0, 0x401, 0x0) syz_kvm_add_vcpu$x86(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x0, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000032680)=""/102400, 0x19000) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, r4) sendmsg$ETHTOOL_MSG_TSINFO_GET(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x20}, 0x1, 0x0, 0x0, 0x24000044}, 0x4008800) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000040)=@req={0x3fc}, 0x10) socket(0x1e, 0x4, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_NODE_ADDR(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)={0x24, r6, 0x201, 0x400000, 0x0, {{}, {}, {0x8, 0x11, 0x4}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000890}, 0x0) 6.832688592s ago: executing program 7 (id=776): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="1800"/15], &(0x7f00000003c0)='GPL\x00'}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000140)='contention_end\x00', r0}, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$TIPC_NL_UDP_GET_REMOTEIP(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)={0x14, r2, 0x325}, 0x14}}, 0x0) 6.343781097s ago: executing program 2 (id=778): r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000040)=0x1c, 0x80800) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x3, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x1}, 0x1c) r1 = bpf$TOKEN_CREATE(0x24, &(0x7f0000000200)={0x0, r0}, 0x8) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000001c0)={&(0x7f00000000c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x40, 0x40, 0x4, [@struct={0xb, 0x1, 0x0, 0x4, 0x0, 0x0, [{0x4, 0x2, 0x9}]}, @volatile={0xb, 0x0, 0x0, 0x9, 0x3}, @enum={0x6, 0x2, 0x0, 0x6, 0x4, [{0x4, 0x1ff}, {0x8, 0x3}]}]}, {0x0, [0x30, 0x5f]}}, &(0x7f0000000140)=""/81, 0x5c, 0x51, 0x1, 0xfff, 0x10000, @value=r1}, 0x28) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_j1939(0x1d, 0x2, 0x7) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$batadv(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_HARDIF(r4, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r5, 0x20, 0x70bd2a, 0x25dfdbff, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0xffffff66}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000001}, 0x10) r6 = semget$private(0x0, 0x3, 0x8) semctl$GETPID(r6, 0x0, 0xb, &(0x7f00000003c0)=""/77) r7 = signalfd(r1, &(0x7f0000000440)={[0xa]}, 0x8) r8 = signalfd(r1, &(0x7f0000000480)={[0x595d]}, 0x8) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f00000005c0)={{0x1, 0x1, 0x18, r3, {r2}}, './file0\x00'}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000008c0)={r3, 0xe0, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000600)=[0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x4, 0x5, &(0x7f0000000640)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000680)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xdb, &(0x7f00000006c0)=[{}, {}, {}, {}, {}], 0x28, 0x10, &(0x7f0000000700), &(0x7f0000000740), 0x8, 0xd0, 0x8, 0x8, &(0x7f0000000780)}}, 0x10) r13 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000940)=@o_path={&(0x7f0000000900)='./file0\x00', 0x0, 0x4008}, 0x18) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x1f, 0x13, &(0x7f00000004c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, [@exit, @ldst={0x2, 0x1, 0x3, 0x1, 0x1, 0x8, 0xfffffffffffffff0}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x10001}, @jmp={0x5, 0x0, 0x8, 0x4, 0x6, 0x0, 0xfffffffffffffff0}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x1}, @tail_call={{0x18, 0x2, 0x1, 0x0, r7}}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r8}}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffc}]}, &(0x7f0000000580)='syzkaller\x00', 0x7f, 0x0, 0x0, 0x41100, 0x40, '\x00', 0x0, @fallback=0x2a, r10, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, r12, r13, 0x8, 0x0, &(0x7f0000000980)=[{0x1, 0x2, 0x7, 0xa}, {0x3, 0x5, 0xa, 0x6}, {0x1, 0x2, 0x0, 0x8}, {0x2, 0x3, 0x3, 0xa}, {0x1, 0x2, 0x2, 0x9}, {0x5, 0x3, 0x4, 0xa}, {0x3, 0x4, 0x0, 0x8}, {0x0, 0x1, 0xf, 0xc}], 0x10, 0x4}, 0x94) r14 = bpf$PROG_LOAD(0x5, &(0x7f0000000d80)={0x4, 0x15, &(0x7f0000000b00)=@framed={{0x18, 0x0, 0x0, 0x0, 0xbf6, 0x0, 0x0, 0x0, 0x3ff}, [@alu={0x4, 0x0, 0x1, 0xa, 0x1, 0xfffffffffffffffc, 0x1}, @map_idx={0x18, 0xa, 0x5, 0x0, 0xb}, @map_fd={0x18, 0x8, 0x1, 0x0, r8}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7fffffff}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r8}}]}, &(0x7f0000000bc0)='GPL\x00', 0xfffffffe, 0x0, 0x0, 0x41100, 0x4, '\x00', r11, @fallback=0x18, 0xffffffffffffffff, 0x8, &(0x7f0000000c00)={0xa, 0x5}, 0x8, 0x10, &(0x7f0000000c40)={0x5, 0xc, 0x9, 0x37ab}, 0x10, r12, 0xffffffffffffffff, 0xa, &(0x7f0000000c80)=[r8, r10], &(0x7f0000000cc0)=[{0x1, 0x3, 0xa, 0x14}, {0x5, 0x4, 0xf, 0xa}, {0x4, 0x5, 0xd, 0x7}, {0x1, 0x3, 0xe, 0xb}, {0x1, 0x4, 0x7, 0x8}, {0x3, 0x1, 0x7, 0xe}, {0x2, 0x3, 0xd, 0xb}, {0x2, 0x4, 0xe, 0x9}, {0x5, 0x4, 0x2, 0xedd4e00b7667f1b3}, {0x4, 0x4, 0x6, 0xa}], 0x10, 0x6}, 0x94) bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000e40)=@generic={&(0x7f0000000ac0)='./file0\x00', r14}, 0x18) r15 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ec0), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r7, &(0x7f0000000f80)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000f40)={&(0x7f0000000f00)={0x34, r15, 0x200, 0x70bd2d, 0x25dfdbfe, {}, [@L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x5}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x4008041}, 0x0) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r9, 0xc2604111, &(0x7f0000000fc0)={0x4, [[0x9, 0x6, 0xffffff7a, 0x10001, 0x3, 0x8, 0x3, 0x62a], [0x4, 0x5b98, 0x4, 0xe, 0x4, 0x6, 0xe, 0x4], [0x0, 0x0, 0x3f34, 0x81, 0xff, 0x3, 0x3, 0x1ff]], '\x00', [{0x2, 0x2, 0x1, 0x1, 0x1, 0x1}, {0xa9, 0x1, 0x0, 0x1}, {0xffffffff, 0x1, 0x0, 0x1, 0x1}, {0x1, 0x9, 0x1, 0x0, 0x0, 0x1}, {0xe, 0x64224624, 0x1, 0x0, 0x1, 0x1}, {0xe, 0x1, 0x1, 0x1, 0x1, 0x1}, {0x5, 0x21374, 0x1, 0x0, 0x1, 0x1}, {0x1a, 0xfffffffd, 0x1, 0x0, 0x0, 0x1}, {0xffffff01, 0x8, 0x1}, {0xd3, 0x0, 0x1, 0x1, 0x0, 0x1}, {0x4, 0x9, 0x0, 0x1, 0x0, 0x1}, {0x0, 0x997, 0x0, 0x0, 0x0, 0x1}], '\x00', 0x401}) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(r7, 0xc018937d, &(0x7f0000001240)={{0x1, 0x1, 0x18, r4, {0x3}}, './file0\x00'}) openat$dir(0xffffffffffffff9c, &(0x7f0000001280)='./file0\x00', 0x80, 0x96) semctl$IPC_INFO(r6, 0x0, 0x3, &(0x7f00000012c0)=""/98) bpf$PROG_LOAD(0x5, &(0x7f0000001580)={0x17, 0xc, &(0x7f0000001340)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x100}, [@exit, @exit, @map_fd={0x18, 0x0, 0x1, 0x0, r16}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r4}}, @jmp={0x5, 0x0, 0x5, 0x5, 0xa, 0xfffffffffffffffe, 0x1}]}, &(0x7f00000013c0)='syzkaller\x00', 0x4, 0x7f, &(0x7f0000001400)=""/127, 0x41000, 0x20, '\x00', 0x0, @fallback=0x1a, r8, 0x8, &(0x7f0000001480)={0x8, 0x1}, 0x8, 0x10, &(0x7f00000014c0)={0xffffff80, 0xc, 0x4}, 0x10, 0x0, 0xffffffffffffffff, 0x6, 0x0, &(0x7f0000001500)=[{0x2, 0x1, 0xc, 0x8}, {0x0, 0x4, 0x4, 0x6}, {0x4, 0x4, 0xc, 0x1}, {0x5, 0x2, 0xc, 0x6}, {0x0, 0x3, 0xf, 0x6}, {0x4, 0x1, 0x8, 0x6}], 0x10, 0xcf}, 0x94) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r16, 0x8933, &(0x7f0000001640)={'batadv_slave_0\x00'}) ioctl$F2FS_IOC_SET_COMPRESS_OPTION(r13, 0x4002f516, &(0x7f0000001680)={0xff, 0x1}) ioctl$DRM_IOCTL_GET_CLIENT(r9, 0xc0286405, &(0x7f00000016c0)={0x9, 0xfffffe00, {0xffffffffffffffff}, {0xee00}, 0x4, 0x8}) syz_open_procfs(r17, &(0x7f0000001700)='net/unix\x00') 6.254179246s ago: executing program 0 (id=779): bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB="fcffffff00"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000000000000000085016b7b9afa0d78000000000000000000"], 0x50) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000180)={'batadv_slave_0\x00', 0x0}) setsockopt$packet_drop_memb(r0, 0x107, 0x2, &(0x7f0000000000)={r1, 0x1, 0x6, @multicast}, 0x10) write$dsp(0xffffffffffffffff, &(0x7f00000001c0)="5cba91a4", 0xffffffd9) creat(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, 0x0, 0x4000) read$msr(r2, &(0x7f0000002000)=""/102400, 0x19000) eventfd(0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = userfaultfd(0x1) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x3, &(0x7f0000000240)=ANY=[@ANYBLOB="180000000000000000090000000000009500000000000000"], &(0x7f00000001c0)='syzkaller\x00'}, 0x80) r6 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000080)={'veth0_to_team\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000000c0)={r5, r7, 0x25, 0x0, @val=@iter={0x0}}, 0x40) sendmsg$nl_route_sched(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000004c00)=@newtfilter={0x24, 0x11, 0xd27, 0x1000000, 0x0, {0x0, 0x0, 0x74, r1, {}, {}, {0x9, 0x1}}}, 0x24}, 0x1, 0xf0ffffffffffff}, 0x40804) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x114}) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r3, 0xc028aa05, &(0x7f0000000180)={&(0x7f00002b9000/0x400000)=nil, &(0x7f00003ab000/0x2000)=nil, 0x400000, 0x2, 0x2}) r8 = syz_open_dev$swradio(&(0x7f0000000180), 0x0, 0x2) ioctl$VIDIOC_S_TUNER(r8, 0x4054561e, &(0x7f00000001c0)={0x0, "be3ff4f2d3b71ad35cbc5ad31906b40f70ea0177f7f3f12a503b7e8e589e845a"}) ioctl$SNDCTL_DSP_SETFRAGMENT(0xffffffffffffffff, 0xc004500a, &(0x7f0000000180)=0x9) 6.194185603s ago: executing program 7 (id=780): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0xa, 0x4, 0x29, 0x9, 0x0, 0x1, 0xff}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$inet_udplite(0x2, 0x2, 0x88) socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$tipc(0x1e, 0x5, 0x0) socket$tipc(0x1e, 0x5, 0x0) socket(0x23, 0x80805, 0x0) socket$packet(0x11, 0x3, 0x300) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r3, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={0x0, 0x18}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0xffffffffffffff6e, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="5000000010008105e9c51c000000000000000000", @ANYRES32=r4, @ANYBLOB="01000000000000002800128009000100766c616e000000001800028006000100000000000c0002000c0000000d00000008000500", @ANYRES64=r2], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x0) r5 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r5, 0x0, 0x0, 0x44010, &(0x7f0000000040)={0x11, 0x4, r4, 0x1, 0x7}, 0x14) r6 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000080)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x1}, 0x50) bpf$PROG_BIND_MAP(0x23, &(0x7f0000000000)={r1, r6}, 0xc) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000007c0)={&(0x7f0000000040)='sys_exit\x00', r1, 0x0, 0x4000000000000004}, 0x18) 6.051578524s ago: executing program 2 (id=781): mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file0/file0\x00', 0x90) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xe, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="850000002e0000001600ffff8000fdff95000000000000006884d1d9fe4c9ce4c8b7a8e93bb957f5ac915f7683352dbbdb85d8965f40a9372a85319dc353a5b7b7bf0365836f54ae60375c46827cb4d9f8a15bddba79096be7d495c19b3afaa67d2aea409ea69c67cc026d1f0d509b0055e7a371960c7eef346408d031b1249592ccc129485120730762afd7006f54bd541f8be0902162f15e7539ad6623"], 0x0, 0x5, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @sk_skb}, 0x94) write$P9_RVERSION(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff0180000008003950323030302e4c"], 0x15) syz_io_uring_setup(0x3a7e, &(0x7f0000000340)={0x0, 0xd339, 0x8, 0xffff7ffd, 0x198}, &(0x7f0000000280), 0x0) r2 = dup(r1) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x8031, 0xffffffffffffffff, 0x209f0000) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r4, &(0x7f0000002540)=@abs, 0x6e) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00'}) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2041, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) sched_setscheduler(r3, 0x5, &(0x7f0000000440)=0x9) r7 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r8 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r7, 0xae04) r9 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x2) mmap$KVM_VCPU(&(0x7f0000000000/0x3000)=nil, r8, 0x3000003, 0x4000812, r9, 0x100000) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2, 0x42031, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) r10 = socket(0x15, 0x5, 0x0) getsockopt(r10, 0x200000000114, 0x271f, 0x0, &(0x7f0000000000)) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_DIRENTPLUS(r2, &(0x7f0000000280)=ANY=[@ANYBLOB="38010000fe0000"], 0x138) mount$9p_fd(0x0, &(0x7f0000000400)='./file0/file0\x00', &(0x7f00000003c0), 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1, @ANYBLOB="2c009e7bb2bc071c4d0df2e751e0ec3ce61c4813fc9b6199a0a4a3b1bb9aeacd4146daeb58a4182b4f7471"]) 5.627974171s ago: executing program 4 (id=782): mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x20000, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r0, 0x3ba0, &(0x7f0000000440)={0x48, 0x1, r1, 0x0, 0x97, 0x8000000}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x6, r1, 0x0, &(0x7f0000ff6000/0xa000)=nil, 0xa000}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000500)={0x28, 0x4, r1, 0x0, &(0x7f0000931000/0x3000)=nil, 0x3000, 0x6}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, &(0x7f0000000180)={0x48, 0x2, r1}) ioctl$IOMMU_IOAS_COPY(r0, 0x3b83, &(0x7f0000000040)={0x28, 0x2, r1, r1, 0x2, 0xf114, 0xfffffffffffffffc}) syz_usb_connect(0x2, 0x2d, &(0x7f0000000240)=ANY=[@ANYBLOB="9f01000083667d1040206402d14e0102030109021b000100000000090400000190f19c000905f3ed"], 0x0) syz_emit_ethernet(0x7a, &(0x7f00000008c0)={@empty, @local, @void, {@ipv6={0x86dd, @gre_packet={0x0, 0x6, "92c01f", 0x44, 0x2f, 0x0, @remote, @loopback, {[], {{0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x1, 0x806}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x57}}}}}}}, 0x0) 5.18967243s ago: executing program 7 (id=783): r0 = syz_open_dev$mouse(&(0x7f0000000040), 0x3, 0x0) getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0) r1 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r1, &(0x7f00000022c0)=[{{&(0x7f0000000000)={0xa, 0x4e23, 0x6, @dev={0xfe, 0x80, '\x00', 0x22}, 0x5}, 0x1c, &(0x7f0000000040)=[{&(0x7f0000000140)='A', 0x1}], 0x1}}], 0x1, 0xc010) shutdown(r1, 0x1) getsockopt$bt_hci(r1, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x10, 0x1e, &(0x7f00000001c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xc, 0x0, 0x0, 0x0, 0xf4}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@map_idx={0x18, 0x4, 0x5, 0x0, 0xa}, @exit, @map_val={0x18, 0x4, 0x2, 0x0, r0, 0x0, 0x0, 0x0, 0x6}, @generic={0x6, 0x5, 0x9, 0x101, 0x9}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, &(0x7f00000000c0), 0x8, 0x10, &(0x7f0000000000)={0x10000}, 0x10}, 0x94) 5.149071569s ago: executing program 6 (id=784): r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x3}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000380)=@newtfilter={0x84, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r4, {0x0, 0x2}, {}, {0x8}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0xfffffffd, 0x400, 0x20000008, 0x6, 0x7}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x10}, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) close_range(r0, 0xffffffffffffffff, 0x1000000000000000) 5.066132525s ago: executing program 0 (id=785): syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_pressure(r0, &(0x7f0000000040)='io.pressure\x00', 0x2, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0xd, 0x0, 0x0) write$cgroup_pressure(r1, &(0x7f0000000340)={'some', 0x20, 0x7, 0x20, 0xff}, 0x2f) r3 = openat$cgroup_pressure(r0, &(0x7f00000000c0)='io.pressure\x00', 0x2, 0x0) ppoll(&(0x7f0000000180)=[{r1}], 0x1, 0x0, 0x0, 0x0) write$cgroup_pressure(r3, &(0x7f0000000340)={'some', 0x20, 0x4, 0x20, 0xffffa}, 0x2f) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r4, 0x0, 0x32, &(0x7f0000000f00)=0x1000000, 0x4) sendmmsg$inet(r4, &(0x7f0000002240)=[{{&(0x7f0000000000)={0x2, 0x4e20, @broadcast}, 0x10, 0x0, 0x0, &(0x7f0000000b40)=ANY=[@ANYBLOB="3000000000000000000000000700000000830b4be0000001e0000001008911e44833856ee8b25633f47d13d5e4aa00001c000000000000000000000008000000", @ANYRES32], 0x50}}], 0x1, 0x400c6) close(r1) r5 = openat$dsp(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) ioctl$SNDCTL_DSP_SETTRIGGER(r5, 0x40045010, &(0x7f0000000000)) ioctl$SNDCTL_DSP_SETFRAGMENT(r5, 0xc004500a, &(0x7f0000001400)) writev(r5, &(0x7f0000000180)=[{&(0x7f00000006c0)="2e31b69c9bd4beb2ce56518bf0aea548722f054677edd0cb67e2afb987c3e16e3b65bfe50c4d55086a56832bebeb32802ecd8e61032995b891d24c782afea345ed2f0a87bc1bfc6101fa7d1d2c2e57f889dbb28fe7b7e2fc562acebfd86566be11c267f5c5c5e1707a44f2795400fb26cd4170d76c6807d8270435f365d737751f", 0x81}, {&(0x7f0000000080)="b51d2c15efe458943f424bb18101c6fe728f6d301c8df16d65f4c6de76b6a3c3a3f244c009139a5a48f5628107672191d78096cb6a18a629dc7a57529a8bbb", 0x3f}], 0x2) ioctl$SNDCTL_DSP_SYNC(r5, 0x5001, 0x0) close(r3) bpf$PROG_LOAD(0x5, 0x0, 0x0) 4.83551801s ago: executing program 6 (id=786): sched_setscheduler(0x0, 0x1, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x19, 0x4, 0x8, 0x8}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xb, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r0, 0xffffffffffffffff}, &(0x7f0000000280), &(0x7f00000002c0)=r1}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0x1b, &(0x7f00000004c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@kfunc={0x85, 0x0, 0x2, 0x0, 0x5}, @map_fd={0x18, 0xa, 0x1, 0x0, r2}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000040)='syzkaller\x00', 0x9b8f, 0x0, 0x0, 0x41100, 0x11, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000080)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x9, &(0x7f0000000340)=[r2, r0, r0], &(0x7f0000000600)=[{0x5, 0x4, 0x10, 0x1}, {0x0, 0x3, 0xf, 0xa}, {0x4, 0x4, 0xb, 0x1}, {0x1, 0x3, 0x9, 0x3}, {0x3, 0x2, 0x9, 0xa}, {0x0, 0x1, 0x7, 0x5}, {0x5, 0x1, 0x10, 0x3}, {0x1, 0x3, 0xb, 0xc}, {0x4, 0x4, 0xb, 0x9}], 0x10, 0x58f}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r3, 0x2000000, 0x57, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf8200667576", 0x0, 0x3800, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[], 0x48) getpid() r4 = msgget$private(0x0, 0x400) msgrcv(r4, &(0x7f00000003c0)={0x0, ""/74}, 0x52, 0x0, 0x1000) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x1, 0x4, &(0x7f0000000040)=@framed={{0xffffffb7, 0x5, 0x0, 0x0, 0x0, 0x79, 0x10, 0x9e}, [@ldst={0x5, 0x3, 0x0, 0xa}]}, &(0x7f00000002c0)='GPL\x00', 0x5, 0xfd90, &(0x7f0000000300)=""/188, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x1f3, 0x10, &(0x7f0000000080), 0xfffffffffffffc79}, 0x2a) open(0x0, 0x108843, 0x98) fcntl$setlease(0xffffffffffffffff, 0x400, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) r6 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000380), 0x200, 0x0) ioctl$sock_qrtr_TIOCINQ(r6, 0x541b, 0x0) sendmsg$NFNL_MSG_CTHELPER_NEW(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000007c0)={0x28, 0x0, 0x9, 0x5, 0x0, 0x0, {0xa}, [@NFCTH_NAME={0x9, 0x1, 'syz0\x00'}, @NFCTH_QUEUE_NUM={0x8, 0x3, 0x1, 0x0, 0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000010}, 0x8880) sched_setscheduler(0x0, 0x1, 0x0) (async) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x19, 0x4, 0x8, 0x8}, 0x48) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xb, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) (async) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r0}, &(0x7f0000000280), &(0x7f00000002c0)=r1}, 0x20) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0x1b, &(0x7f00000004c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@kfunc={0x85, 0x0, 0x2, 0x0, 0x5}, @map_fd={0x18, 0xa, 0x1, 0x0, r2}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000040)='syzkaller\x00', 0x9b8f, 0x0, 0x0, 0x41100, 0x11, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000080)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x9, &(0x7f0000000340)=[r2, r0, r0], &(0x7f0000000600)=[{0x5, 0x4, 0x10, 0x1}, {0x0, 0x3, 0xf, 0xa}, {0x4, 0x4, 0xb, 0x1}, {0x1, 0x3, 0x9, 0x3}, {0x3, 0x2, 0x9, 0xa}, {0x0, 0x1, 0x7, 0x5}, {0x5, 0x1, 0x10, 0x3}, {0x1, 0x3, 0xb, 0xc}, {0x4, 0x4, 0xb, 0x9}], 0x10, 0x58f}, 0x94) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r3, 0x2000000, 0x57, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf8200667576", 0x0, 0x3800, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[], 0x48) (async) getpid() (async) msgget$private(0x0, 0x400) (async) msgrcv(r4, &(0x7f00000003c0)={0x0, ""/74}, 0x52, 0x0, 0x1000) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x1, 0x4, &(0x7f0000000040)=@framed={{0xffffffb7, 0x5, 0x0, 0x0, 0x0, 0x79, 0x10, 0x9e}, [@ldst={0x5, 0x3, 0x0, 0xa}]}, &(0x7f00000002c0)='GPL\x00', 0x5, 0xfd90, &(0x7f0000000300)=""/188, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x1f3, 0x10, &(0x7f0000000080), 0xfffffffffffffc79}, 0x2a) (async) open(0x0, 0x108843, 0x98) (async) fcntl$setlease(0xffffffffffffffff, 0x400, 0x0) (async) connect$unix(0xffffffffffffffff, 0x0, 0x0) (async) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000380), 0x200, 0x0) (async) ioctl$sock_qrtr_TIOCINQ(r6, 0x541b, 0x0) (async) sendmsg$NFNL_MSG_CTHELPER_NEW(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000007c0)={0x28, 0x0, 0x9, 0x5, 0x0, 0x0, {0xa}, [@NFCTH_NAME={0x9, 0x1, 'syz0\x00'}, @NFCTH_QUEUE_NUM={0x8, 0x3, 0x1, 0x0, 0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000010}, 0x8880) (async) 4.660391115s ago: executing program 6 (id=787): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r0 = getpid() r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000240), 0x10b040, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000280)={0xc, 0x0, 0x0}) ioctl$IOMMU_VFIO_IOAS$SET(r1, 0x3b88, &(0x7f00000002c0)={0xc, r2}) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) landlock_create_ruleset(0x0, 0x0, 0x0) symlinkat(&(0x7f0000000b00)='./file2\x00', 0xffffffffffffff9c, &(0x7f0000000b40)='./file7\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCGSID(r5, 0x5429, &(0x7f0000000300)=0x0) sched_getparam(r6, &(0x7f0000000340)) ioctl$sock_SIOCGIFCONF(r4, 0x8912, &(0x7f00000001c0)=@buf={0xc4, &(0x7f0000000040)="ee5cb462b90cc70b58abea74018fa8305ceae553701a80088d490923c32f4477e1be7341aa782f834cae4841b62feeff420c56b3f502f9f0a3ea3746b2ebeb1bb230a07b0dd0dda3208ea59286e55fd369e62d63b743ff6dc7a38bb2c5828bfb47859fd8c86e178f48cad7b23b4f8c950e0dfd61069c541e8dca045cc2e3da0b1302e26a17160966b5ebd5d53a340cd34d24f71897e86ce004a0a21ac87a3e420ad43839f757eab96460acf9882529715e5054c8f63e707c7a75f177803a256b4789d332"}) newfstatat(0xffffffffffffff9c, &(0x7f0000000400)='./file0\x00', &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) chown(&(0x7f00000003c0)='./file0\x00', r7, 0xee01) stat(&(0x7f00000005c0)='./file7\x00', &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmmsg$unix(r3, &(0x7f00000006c0)=[{{&(0x7f0000000380)=@file={0x4fc06819ba3daaf3, './file2\x00'}, 0x6e, &(0x7f0000000580)=[{&(0x7f0000000400)="ce5333c93febaaf93c5e00a0bc79f3c12fbeca1503900a", 0x17}, {&(0x7f0000000440)="3852c00110fee29c8d5f515fffba34ca9af934d7d132f147f5278d28ee0ee61b196b948f61c86831c91fd9e327ac8536408d5df84d068ce8319f2277ab6fa49fc562c4d46720119c21da9517c99cbf82e6d4c8cf2a58bec4bdce36223fc1124d6ef69b8104122e1479cae01eb5b0836fa2ca010029b7e7be6cd6002919162abea80480b839884adfa1109b2deada6f08dce66b199f949ccb0decc3a8d56d484382329f55bd111aeadd5850de038066c4cfb562ccfe02b8d8a9492f2b91af27c68791e2", 0xc3}, {&(0x7f0000000540)}], 0x3, &(0x7f0000000680)=[@cred={{0x1c, 0x1, 0x2, {r0, r7, r8}}}, @rights={{0x10}}], 0x30}}], 0x1, 0x20000014) ioctl$PIO_UNIMAP(r5, 0x4b67, &(0x7f0000001ec0)={0x1, &(0x7f0000001e80)=[{0x0, 0x1000}]}) 4.320114311s ago: executing program 2 (id=788): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x1ff) ioctl$VIDIOC_DQEVENT(r1, 0x80885659, &(0x7f0000000500)={0x0, @data}) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) mount$fuseblk(&(0x7f0000000240), &(0x7f00000002c0)='./file0\x00', &(0x7f0000000380), 0x200, &(0x7f00000000c0)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x1000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x800}}, {@max_read={'max_read', 0x3d, 0x7}}]}}) r3 = syz_open_procfs(0x0, &(0x7f00000042c0)='mounts\x00') pread64(r3, &(0x7f0000000400)=""/207, 0xcf, 0x4eb) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="1e0000006302000002000000ff03000000200000", @ANYRES32=0x1, @ANYBLOB='\v\b\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0300000001000000040000000b00"/28], 0x50) r6 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x140, 0x0) ioctl$KDGKBDIACR(r0, 0x4b4a, &(0x7f0000000640)=""/4096) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000180)={0x2, 0x4, 0x8, 0x1, 0x80, r5, 0x0, '\x00', 0x0, r6, 0x2, 0x4, 0x5}, 0x50) r7 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x1) r8 = syz_io_uring_setup(0x4bfc, &(0x7f0000000280)={0x0, 0x10000000, 0x10100, 0x0, 0x200000}, &(0x7f0000000200), &(0x7f0000000340)) io_uring_enter(r8, 0x2d3e, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000015000/0x4000)=nil, 0x4000, 0x4, 0x10, r8, 0x39733000) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000007900)=[{{0x0, 0x0, &(0x7f0000007640)=[{&(0x7f0000007380)="cd00d5fb4131deb0cd30bee8a03428202a60cf55d5", 0x15}], 0x1, 0x0, 0x68, 0x4000000}}], 0x1, 0xc014) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100), 0x80, &(0x7f00000002c0)={[{@noswap}]}) mount$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x4002a, &(0x7f0000000000)=ANY=[@ANYBLOB='noswap,inodm32,\x00']) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000600)=[@textreal={0x8, &(0x7f0000000100)="de2e000066b9800000c00f326635000100000f30bad00466b80080000066ef0f01c30f20e06635000002000f22e00fc718f466b9a60b00000f3266b9e00100000f3264660f78c70500", 0x49}], 0x1, 0x74, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) 3.560258074s ago: executing program 0 (id=789): bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xd, 0x4, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x3}, [@call={0x85, 0x0, 0x0, 0x19}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x41, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) memfd_create(0x0, 0x1f) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff56}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r0}, 0x10) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x401) r2 = socket(0x8000000010, 0x2, 0x0) write(r2, &(0x7f00000002c0)="fc0000001c000704ab5b2509b868030002ab087a0100000001481893210001c0f0030584050060100000000000039815fa2c53c28648000000b9d95662537a00bc000c00f0ff7f0000b400600033d44000040560916a0033f436313012dafd5a32e273fc83ab82d710f74cec184406f90d435ef8b29d3ef3d92c94170e5bba2e177312e081bea05d3a021ea2a062914a46ccfc510bb73c9455cdc8363ae4f5df77bc4cfd6239ec2a0f0d1bcae5fa0f5f9dcdd51af51af8502943283f4bb102b2b8f5566791cf190201ded815b2ccd243f395ed94e0ad91bd6433802e0784f2013cd1890058a10000c880ac801fe4af000049f0d4796f0000090548de", 0xfc) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f00000000c0)={'\x00', 0x7ff, 0x81, 0xd, 0x4003, 0x2}) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x8) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0xc0086202, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)=0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000940)={0xffffffffffffffff, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_BIND_IP(r6, &(0x7f0000000500)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e21, 0x8, @mcast2, 0x2}}}, 0x30) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r7, 0x0, r9, 0x0, 0xf3a, 0x0) write$binfmt_misc(r9, &(0x7f0000000980), 0xfdef) splice(r5, 0x0, r9, 0x0, 0x80, 0x4) timer_settime(r4, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) read$FUSE(r8, &(0x7f0000000980)={0x2020}, 0x2020) ioctl$BLKTRACESTART(r1, 0x1274, 0x0) capset(&(0x7f0000019340)={0x20071026}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x81, 0xffffffff, 0xe}) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000c00)=ANY=[@ANYBLOB="b7000000ff020000bfa3000000000000070300c034ffffff620af0fff8ffffff71a4f0ff000000002d040200000000001d400200000000004604000001ed000062030000c0ff00001d440000000000007a0a00fe00ffffffc3030000a1000000b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710e4d58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00c37dfca3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebba2c598b4fc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0465f2f994114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840b08000000f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c3bfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed93517a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e96753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c25000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e82623951743283070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c7bc46dd12305a1ae9dd19e8d525206c0a728cfd42193abe8130b51d6c9b94c5513df2d85e8c01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ad1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef670000000000000000ba470bfe62fe2933082149d42e8a00a5b4f7e9ad0500000000000000"], &(0x7f00000001c0)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xffffffbf}, 0x48) 3.555644877s ago: executing program 6 (id=790): r0 = creat(&(0x7f0000000040)='./file0\x00', 0x8c) read$smackfs_cipsonum(r0, &(0x7f00000000c0), 0x14) mount_setattr(0xffffffffffffffff, 0x0, 0x0, &(0x7f00000000c0)={0x96, 0x10007e}, 0x20) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket(0x1e, 0x4, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) connect$l2tp(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0x5, &(0x7f0000000000)={0xffffffff, 0x1000086}, 0x0) sched_setaffinity(0x0, 0x43, &(0x7f0000000040)=0x2) r2 = syz_open_dev$MSR(0x0, 0x2, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) syz_open_dev$video4linux(0x0, 0x401, 0x0) syz_kvm_add_vcpu$x86(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x0, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000032680)=""/102400, 0x19000) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, r4) sendmsg$ETHTOOL_MSG_TSINFO_GET(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x20}, 0x1, 0x0, 0x0, 0x24000044}, 0x4008800) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000040)=@req={0x3fc}, 0x10) socket(0x1e, 0x4, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_NODE_ADDR(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)={0x24, r6, 0x201, 0x400000, 0x0, {{}, {}, {0x8, 0x11, 0x4}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000890}, 0x0) 3.555133279s ago: executing program 4 (id=791): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="1800"/15], &(0x7f00000003c0)='GPL\x00'}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000140)='contention_end\x00', r0}, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$TIPC_NL_UDP_GET_REMOTEIP(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)={0x14, r2, 0x325}, 0x14}}, 0x0) 3.49631954s ago: executing program 7 (id=792): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000c40)={&(0x7f0000000040)=@setlink={0x3c, 0x13, 0x5, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x1000, 0x44400}, [@IFLA_IFNAME={0x14, 0x3, 'vlan0\x00'}, @IFLA_TARGET_NETNSID={0x8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4044814}, 0x24008804) 3.403309135s ago: executing program 7 (id=793): socket(0x11, 0x3, 0x0) socket(0x200000000000011, 0x2, 0x1) socket$nl_generic(0x10, 0x3, 0x10) socket$pppl2tp(0x18, 0x1, 0x1) bpf$MAP_CREATE(0x0, 0x0, 0x48) r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={0x0, r0}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) clock_nanosleep(0x0, 0x1, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x5c399000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) socket$nl_netfilter(0x10, 0x3, 0xc) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8b36, &(0x7f0000000000)={'wlan0\x00'}) 3.37791154s ago: executing program 4 (id=794): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/power/wakeup_count', 0x0, 0xa0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @multicast2}, 0x2, 0x0, 0x4}}, 0x2e) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000140)) recvmmsg(0xffffffffffffffff, &(0x7f0000000040), 0x400000000000284, 0x2, 0x0) sendmsg$L2TP_CMD_SESSION_DELETE(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="01072cbd7010fcfff3eb04"], 0x34}}, 0x20) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f00000002c0)=@file={0x0, './file0\x00'}, 0x6e) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x1c}, 0x1, 0x0, 0x0, 0x810}, 0x4004080) sendmmsg$unix(r1, &(0x7f0000000d80)=[{{0x0, 0x0, &(0x7f0000000640), 0x0, &(0x7f00000001c0)=[@cred={{0x1c, 0x1, 0x2, {r2}}}], 0x20, 0x20000095}}, {{0x0, 0x0, &(0x7f00000001c0), 0x0, &(0x7f00000009c0)=[@rights={{0x38, 0x1, 0x1, [r8, r1, r9, r9, r0, r9, r7, r8, r8, 0xffffffffffffffff]}}, @rights={{0x1c, 0x1, 0x1, [r7, r7, 0xffffffffffffffff]}}, @cred={{0x1c, 0x1, 0x2, {r2, 0x0, 0xee00}}}], 0x78, 0x24000030}}, {{0x0, 0x0, &(0x7f0000000c40)=[{&(0x7f0000000a40)="84f6b7a1c57e8b1aa12df69c841c67eb44a62fa8f76dd1f21520f95b025bbed9aa8a7575b94dd4ba0ebea662f36a673d7d06be325b52360d497b7fe6aa4b731a1c6b1b91284c38c9097c68d64f1993e136b559ad504ea4be6fc02ffb9bc268ff10eceb3788c75714ae7358326fe3262f6b4ea75cc2715495267036cc1c02b29b0673b6f249e3e569a678e698c50c59a712af27775cf2460116f4295178a53ae46cd28bd446673ed06c8823d9fa8a4c14eed96be151ba1f87f1d42f4dda82fc78cb310b9d61f7c50ad972ae", 0xcb}, {&(0x7f0000000b40)="3bda84670d7ed3d260b5311bd2ff633ef5a524b4d4d6b7432431ca151e9379809cd1169675baf1a753a65ecc53339869ecb49e0280654596cba86b91b7e5bc9125c1fac24797e7cc799d64fa7315d191bb16708444c0f4ba24dbd0e65dd86f77c7a38438ea7488e5dc42cf8846143259c2950118c5a6b60ac70469ab5243fd0ca12eee806d00d7aa6fc7b8f614466d304bd4d87f34a715243d8e370623e01c8a3eb76c8715e099ca9a8e543aa996aac517451a961d15c1edbc016a569439da6d09bb273bab6a39efce7d9c6a3e19e75fa79017bedcfa15067278aee6fd11a6c677d318559aa491c91446236df1a90a5593d960f131", 0xf5}], 0x2, &(0x7f0000000cc0)=[@rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, r7, 0xffffffffffffffff, 0xffffffffffffffff, r8]}}, @cred={{0x1c, 0x1, 0x2, {r2}}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r0, r4]}}, @cred={{0x1c, 0x1, 0x2, {r2}}}], 0x88, 0x4000001}}], 0x3, 0x0) recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SET_NAME(0xf, 0x0) r10 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00') read$FUSE(r10, &(0x7f0000001300)={0x2020}, 0x2020) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r11 = syz_io_uring_setup(0xbdc, &(0x7f0000000440)={0x0, 0x79a8, 0x8, 0x1, 0x1de}, &(0x7f00000006c0)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r12, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r12, r13, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{&(0x7f0000001800)=""/216, 0xd8}], 0x1}) io_uring_enter(r11, 0x847ba, 0x0, 0xe, 0x0, 0x0) ioctl$IMSETDEVNAME(r1, 0x80184947, &(0x7f0000000000)={0x9, 'syz0\x00'}) 2.724206322s ago: executing program 2 (id=795): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="1805000000000000000000004b64ffec8500000075000000040000000700000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) (async) gettid() ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, 0x0) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) (async) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() (async) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) (async) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$getownex(r3, 0x10, &(0x7f0000000180)) (async) sendto$inet6(r4, 0x0, 0x0, 0x20000841, 0x0, 0x0) (async) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000840)=ANY=[@ANYBLOB="fc00000019000100000000000000000000000000000000000000000000000000fe8000000000000000000000000000bb00000000000000000200000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000007000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000001000000000000004400050020010000000000000000000000000000000000022b"], 0xfc}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) r7 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r7, &(0x7f0000000100)={0x2, 0x0, @broadcast}, 0x10) (async) connect$inet(r7, &(0x7f0000000280)={0x2, 0x0, @private=0xa010101}, 0x10) (async) r8 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/resume', 0x149a82, 0x0) (async) bpf$PROG_LOAD(0x5, 0x0, 0x0) (async) add_key$fscrypt_v1(&(0x7f0000000040), &(0x7f0000000080)={'fscrypt:', @desc2}, 0x0, 0x0, 0xffffffffffffffff) add_key$fscrypt_v1(0x0, &(0x7f0000000440)={'fscrypt:', @desc3}, 0x0, 0x0, 0xfffffffffffffffe) (async) sendmsg$NFULNL_MSG_CONFIG(r5, &(0x7f0000000340)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="2800000001888c0401010000000000000000010000050a0002000008000500000000050001000100"], 0x28}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) (async) write$cgroup_int(r8, &(0x7f0000000040)=0x1c9, 0x12) 1.235994555s ago: executing program 7 (id=796): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0xc) semctl$IPC_INFO(0x0, 0x2, 0x3, 0xfffffffffffffffd) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setscheduler(0x0, 0x3, &(0x7f0000000100)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$IOCTL_VMCI_INIT_CONTEXT(0xffffffffffffffff, 0x7a0, &(0x7f0000000000)={@my=0x0}) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000001440)={'vcan0\x00', 0x0}) bind$can_j1939(0xffffffffffffffff, &(0x7f0000000100)={0x1d, r2, 0xfffffffffffffffc, {0x1, 0xff, 0x4}, 0x1}, 0x18) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000580)={'\x00', 0x9, 0x4, 0x9, 0x2, 0xfffffffffffff7ab}) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="81b641f1", 0x4}], 0x1}, 0x48005) connect$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) r3 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_DROP_MASTER(r3, 0x641f) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(0xffffffffffffffff, 0x40045532, &(0x7f0000000040)) r4 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x419, 0x600, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x7}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x0, 0x0, 0x3}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r4, 0x0, 0x0) syz_usb_control_io(r4, &(0x7f0000000000)={0x2c, &(0x7f0000000080)=ANY=[@ANYBLOB="00010700000007300000170000"], 0x0, 0x0, 0x0, 0x0}, 0x0) sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x19, 0xc, &(0x7f0000000340)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$TOKEN_CREATE(0x24, &(0x7f0000000280)={0x0, r5}, 0x8) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xd, 0x4f, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffd26, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={0x0, r6, 0x0, 0x2}, 0x18) r7 = socket$kcm(0xa, 0x922000000003, 0x11) setsockopt$sock_attach_bpf(r7, 0x29, 0x24, &(0x7f00000000c0), 0x4) sendmsg$kcm(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000780)="f4000900062b2c25fe80000000000000dc8b71d5", 0x14}], 0x1}, 0x0) 1.201283105s ago: executing program 6 (id=797): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) syz_emit_ethernet(0x66, &(0x7f00000002c0)=ANY=[@ANYBLOB="0180c2000002aaaaaaaaaa"], 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @remote}, 0x6}, 0x1c) (async) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c) (async, rerun: 64) syz_emit_ethernet(0x42, &(0x7f0000000280)={@local, @empty, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x2, 0x3, 0x34, 0x64, 0x0, 0x7, 0x6, 0x0, @remote, @remote}, {{0x4e22, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x8, 0x10, 0x6071, 0x0, 0xe7, {[@generic={0x8, 0xa, "09df168a00000000"}]}}}}}}}, 0x0) (rerun: 64) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000f40)=ANY=[@ANYBLOB="12010000dc3f6e4013080100083a000000010902120001000000000904"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) (async) syz_usb_control_io(r1, 0x0, &(0x7f00000008c0)={0x84, &(0x7f0000000500)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async, rerun: 32) syz_usb_control_io$uac1(r1, 0x0, &(0x7f0000000240)={0x44, &(0x7f0000000040)=ANY=[@ANYBLOB="00000102000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async, rerun: 32) socketpair$unix(0x1, 0x2, 0x0, 0x0) (async) capset(&(0x7f0000000040)={0x20071026}, &(0x7f0000000740)={0x0, 0x0, 0x1, 0x81, 0xfffffff9}) (async) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x103100) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0xffffffffffffffff, 0x6, 0xfc, @buffer={0x0, 0x82, &(0x7f0000000540)=""/130}, &(0x7f0000000280)="5dc5264913cd", 0x0, 0x3, 0x10000, 0x22, 0x0}) syz_usb_control_io$cdc_ncm(r1, &(0x7f0000000140)={0x14, &(0x7f0000000080)={0x20, 0x7, 0xb9, {0xb9, 0x11, "cc0824064caa18828919474d690576464d93a23d1727bc7225cebcd63b904b8319b75484aa9aa0ad9abf2278b3a352546250374ae14e73db38bd69bb8d08b37755e97c57e4d137e16c9888e371398c3a9a3f7760cba45a49ef03fb8640a524571bf8123831a84771b341d8c07cdac737cb61fc673f111d6be8bb829d3404066cf6417497df31050d7eea1de6aa12bb178023372c9539c99d4406820e606eeabc407663d72512577c3dee470e4feff467185eea0e8a6ff5"}}, &(0x7f0000000000)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f00000004c0)={0x44, &(0x7f00000002c0)=ANY=[@ANYBLOB="4031e9000000a551025217f9e97bb7e7eca8acbd70c785a396f80ace812c47975de5910c297b944e25fe17c25d4c553470d25a9b61468413a99c1809474a00badac4980d8e61127a33eb53b9b51c2a2e385d30e177fd9b405c7c779d779b871f0a3842c9f024e87bb806bdf52176ad444072b986b2abe8a5b8be64a493ebeccf3883503cfc4804e1bf0db6f713267a5d0ad8aefeb50984e5366813feeb587dbfc3cddffbfca5f7e2df28c8e06c780e5b913173e9432747b44b0d9a662b83aaea9ca26b2a155a7ea70d832e5a8f7fd7436e64d2b0a513c052287947b121b58ebfe4bb0e90677391313bfaf2152bcb34"], &(0x7f0000000180)={0x0, 0xa, 0x1, 0xcc}, &(0x7f00000001c0)={0x0, 0x8, 0x1, 0x9}, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0xc47, 0x9, 0x1, 0x6, 0x3, 0xa4d2, 0x231, 0x4800000, 0xfff, 0x5, 0x3, 0x3}}, &(0x7f00000003c0)={0x20, 0x85, 0x4, 0x4c}, &(0x7f0000000400)={0x20, 0x83, 0x2, 0x1}, &(0x7f0000000440)={0x20, 0x87, 0x2, 0x9}, &(0x7f0000000480)={0x20, 0x89, 0x2}}) syz_usb_control_io$cdc_ncm(r1, 0x0, &(0x7f0000000600)={0x44, &(0x7f0000000680)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) 1.142260719s ago: executing program 0 (id=798): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) r1 = fcntl$dupfd(r0, 0x0, r0) write$sndseq(r1, &(0x7f0000000180)=[{0xff, 0x0, 0x0, 0x0, @tick=0x4, {}, {}, @result={0x1, 0x2}}, {0x0, 0x0, 0xff, 0x3, @tick=0xf27, {0x1}, {0xfb}, @control={0x3f, 0x1, 0xb56}}], 0x38) readv(r1, &(0x7f0000000000)=[{&(0x7f0000001140)=""/136, 0x88}], 0x1) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$uinput_user_dev(r2, &(0x7f0000000980)={'syz0\x00', {}, 0x42, [0x0, 0x0, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff9, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x55f8, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x200000]}, 0x45c) ioctl$UI_DEV_SETUP(r2, 0x5501, 0x0) ioctl$UI_GET_SYSNAME(r2, 0x8040552c, &(0x7f0000006480)) 973.909461ms ago: executing program 4 (id=799): prctl$PR_SCHED_CORE(0x3e, 0x800003, 0xffffffffffffffff, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080), 0x569d00, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000000), 0xffffffff, 0x151102) writev(r0, &(0x7f0000001ac0)=[{&(0x7f0000000140)="714871614c6fe1a4919bc1f5dadde37d55137eceb4d394938be6cb9b47df24807da072d76ea1739c20b45ce734dbd63260c36c25ad2229837a57c14e", 0x3c}, {&(0x7f0000000180)}, {&(0x7f0000000240)="b518606d24545b56ce3dcc33ea1b4a163d59c73f97d72472647e5202c4256d4e81b373b20e6f4c6d11c026c1c9bd4fba485c9a630955ab9425d16e9a2536251291ed17c3856a9e9a828e81a26376da90afe6d55f9a38bc4b8220879cd0f9fa4abfd9de67d9b12bff1d9510b626946e680f12d467fab6a1192a76fb7165658577f2e200f81cd18f6bee35a8dc019c5f6ed05da0410d39bf31c258503536a4175151d11c8434ef6454aa70aa780451afe24020b846a0af3d5873", 0xb9}, {&(0x7f00000001c0)}, {&(0x7f00000003c0)="f4249f905be877b0a40e75d33a84a7b6398e305c2a33c0b06692b2a95b7e9f1724d6dd5ac549fc93cd494a0af9a068b093debcad9590dff685daa70f8d580362c36eedc465757d042f167c69503ead4752ac89bdb927054da3116697c42e3f1e93513573d3d73c6d2e55d4b82e1f3d1724032eef6acd33f27eb5e186ac5b24f591d77d9932fcb685b1549862ea963eca4160ea2a040ffa7b17d5677e776232e9e3ebd638363000a74139eb256aa6fae179f7d14493cd50e23f860aa0bbd8267b74ca29d5c660d4f2b2cbde1ca4b51c8fc1ccd090cbcfdebd96702e11371eaeb6dd61726d7e71", 0xe6}, {&(0x7f00000009c0)="97d228f3f487a2c789bb0a55cdd9b347bf99d041cf267828e1fd74c980781e6360cad228dcc07fe23e39e5f1ae7fc11f02a80db349e1e658c64839fb4a85fb871608284eaa974cddcd9197031f56a2171914b0642cd96b617296102a8885069c8aa03ad694466ae23235771c9fbb831aebaf1fe08cb0f6b8b4f9f99f5db8a00e98ec437a4183539d6106080866632338c99cb4dcaf9dde8afc72cf6207eee84e65eabd5cdebbe861b6849fc2b6760d46004b7abfaa51f87f5ac1584e586a514a55a19b6892ac49", 0xc7}, {&(0x7f0000000ac0)="16d00d54730bc08bedea901349632c6a83520319bef3ffaccb6a7828e1c4d0658cdf1c0c6917843a7941dbdb2f20aee49315356e783f24f2d174aef93e66c336d108b72deedfe71f6ef8ecefd262a06822e306f9d8d1dcd04ff7d63d8e883bb5656e7f219248d95b3c378d613772c53e3202c23deab055ab850e50a950b7b6678946350ab6bee0663d5ff3c2e89daee915cbf384aa4d87c48db4b5dbbcac822adcb1d9c5de7a90b61132f17a3a8f81c39060944f609290bfe9a38842ea85e911232d5f0d1e33c14247c21a59a8297bbccb5204fa306c83d49554456030bc47a9075f41fd74c3f574771560407e564e7be9153fbaa623c3699bb96df2a4a409177a7f54a60e63b1ec65c9a8b1409b5caf85ed0c7a82c8e078ba0d27a8384d911bd45186f59774d58558278e6dbab84169978995a1bebdafe6240f80a51d8f0bd9e8a210b1864da7a26933a798dc293cfb6d02095f6f28cb0d8914f3ce68ca33e5fcf034e9385edb7d8b281d52b159b2117cc64272d45e27f6fff2541c220342550a02e080d45bde66e2a3bd0686b12923e5faea93d14d90085932e696897258b93fe3a5a6cb6ae658055cda2e039da9f6f35d2af8293e4462deeef2705d78c967b43fdf556f623a9d7332846f9ab1cd230d6db25b95343be991f259663675ba12c0eba8a7114a813338c22eb1c1a25258d48fe54899fe63304b0b5ccb22b18bc69889d0c3d592d3e24a286a63ab589d03b7d838f5b4a74ff467a74cfc4fa2a165b8ec502fb34c6594556aaa053234bf617edc3f6e44fd5e92e237e276ce713ce12b4d00a3e8be092aa5cf61782577506428410d61fbdbef420bfce0f0bf19dc52cb7b577c6b2fb4b9f81a283d319534b637ff09f3dc380ba7e70450ff1682be3ff099d2ac895898a038dbce833dd1e7d66b407059c0f84db0db919cfc6c49e8fb2c9d28d973b96dff014622b9f82ada7b9d46dc7d78a73a364fdc9a69b63f530e64737ebc400399819a6c4f2ae323b7fc69767cc905c40dbfacc3dcd5265118576a42786919759a784984b44203e55fd0deb36f53f4990f0ee8ee9dea5d43cc2f09ae55c4c22ab475623c86965aa4741c262cd930556552bc86d36b54e8946ac03016e6572876e997b78101f425cb5e6db8bce6819c3720fbe89bcadac179dec6c1c0d9b4313a72d6a7427861cd1dec26f76b07a7c7ac28a5e313c1051c2e8fcbe47ce71bc4acc8540bb4ae208b1bc8623fd8f6d9454ba86fc61fc2618ac3b10908bdf5a168b1bd64ce75710ab758ec55c8863b906a393fbdb0b880eb1349aad0787bf1f6a6679bb7e3822a7826a84555fd36fc98013ec6f713f4148a832b0fd76bd22f14dc5424c65e6d2e4bc36850d0d5a7e5531a68f99973ef88722e2578c2fe4af65024e42bf0636ac962865074fe5254d549b7aa7df4ab301b3eb45c9f9eb3835a3abedbf1146bc31da0880739c08c33a67f02078d936355ade40f240c285b058149939002c5ef0b420606b6b7772ee3727b8b63607a8910e8386ae0dd1e586164f8cb1e6b59bd164d8b7d14d1b256a70872b2956abde1030d9a1259e384b0c72fdc399a8e73cd4e776c5eba3246a31c719cc214a12ffc58b0fec32c81804e9008aa26aadffed97025f49549242fe5482b399ec744a09bb1ec407bf43a18a3c92a234f7363e58c1130a56364add21185dcecd196a9a6b4c472e99102fa11d154b267c8b5f7be113c324620b8e246d775c50c4ce8fb0ccaae6c44ce81a7416aa7536facb30931744272c64415fbe3026ea3b74972940682ff6636ac6e4ca19c7a2d480324a97e3acde914688fd83ce59001d2e2f81141f1052cd3dfdc169d330bf0e7829b8927ffb37f9007c720769fd8cf860ea150af88cbe069571e0d22b9a64d8cf026dca9ff3e52ec1dc9b1bcd2c8b45991da2d53485a00abce4a43db60ab6bcb9d670accfa689a683f867509b089f885428c56144638a36001c87a625d89739912acab58b1fd4dd5c9219a393d3511a5e146a5c899a34be76e7310e6efbefc5d74109dece21312ba5d681b3184aa70f1cf771847f84d174dd4f22f914ff8a1a19899eab45a62e4fe055a643aeac72ef8b27025beded49dbd09d1c1ea04cc172dbe0a4cca823bb9249cbad770c8a537bda8ec70bae9f52d850feee5745ef3654a1ee4297888ac788cdef2c449d798132f87c91bbd734f586c3f7867440e15a4de2707be6fae1f51f03c30aceb45195e0b4f7b35fd168826adb6808a1fc09629f36b3991b419512e66bacc1d5f768ff004366e1b88d91a7c0748bd68653f2c03723483ef981665fb88b2080acf0f062a6dd32afa6e22a84caa8c4bafd10f32d38c164551461f893ea916b93fa946d004fffd722635689936b7b6a640f39aa22dddc34d9f62dee72ec9fb4025668df831aef2dece7ff0efae241340eccbf9b387aa8b5eebe59670ba75080639d3aec09464b63ac9e70d0a60a72b86dbb3caf37154a2926ffe2f04c833072e01a7323006b5f502aae87b6e7c3519d7d37a39f2c886310cd1fccb1a9b90e9bdc1f6fa3be037e0c78bde3cfb950a8ed903959e8a00dbe57f882df9a695782422be3eb9d422f1c62213891e1b631f71e471179399880bbe59aca93f894e6ac3b2638c8d634d7266004014b37f88dad5066db9daa4d8f328dfed5555c22fe59720f94ef540ffe56b46c4e09d4338db64c9a63edbffedac095c52fa21a1395472adc14fa9deb9e12d66f4d911fff395c824dbf950935cf526d91b2674bb855381686213bb4ffbbeb8f0a1e7bddf92fd133e1b8512f8c4ce15fdabc9e78a58eeab894a9d55f238ca36e273321d39d0bb3d8369975c225aa61061927ae55ae029c9c5bf19e8dc99539b485a09a17aeb37a61714f0662e8d7ac692ef8dfc8d28d99d34085725a9e398fe4954ca4ae3686f83194f10ef9bdd79d0cb7ce54121f99b65f314ee5dcc82b24c0a3d670197639f49e60dc20bd002e0fc13ed95c5d73f00da495439bcca5730f72e13969e6d0f5e59a927c280f3ad6b569078c9c02c0c66cc9a4f4552eed360bd449d61a4ad2f6e5dfe640863991e26ec2ab673ffee33750b11b5eb573a0a3d283e596982474fefd4fccc81e5d2d2241bbf1a0e2b4066ad61e5835189409793634161f441f0c3ce11eacda240bec23042a789b84cb86745051e0e2b8c3c6697f9106bcd713435e53a5b5b59d0287e4e0f872893bc5ce2e6757d2cb067612157183797fb141b1297d00ab85abb15b95ca03bab38f0d044e778cc7da2e998dd80599512df7dabb23c1a8a00010aad546ef7ea2eea3a05587076bdecfdd1830093b39ab289f0a1c9242141a6dfe1cf212445bb086c6bcaca6acd4b8d3ff21186f7e3a7fc6804410c58d7adc48e2b8551883dc92bdfb13afdf91c1aa021fe602a8e33e26eb5c456379b40d030eecf52c9b8df467196073a2654911c3c1edd858be54900b3d48e630da5597c284884df45c996d5e899f2d1b212a238885ae5334538245bd3ce8eb31a3cb3ce9f5ef66234c0725196b7b770d65aef0b38c2e33fa42d76068826fb8594cc0eab5ce92a7ae96ff34b0a8d6eaa89a793fbaa0438890aacb504603a93aff1aa0a50777c43c3574731345d0bb7996f93ff331d74a9b6d4714d4223681882cd572694528f9aad66f37d045efa6ad59a5ec6642856f443778a506b1c4c230ac196f3df54491f2c2a10f5461497e4d1cb92eae15a8ebb7a22bc6d9fc4a9e757017182e23bf46e808c4d8ad234f9f62d1aaa8de004ea380e1d50d1919376c219a981126b2b8fbcdcd9fa59afc7afd6bef19c8e55bf8dba510416c31dad722e6bd9703a9edf47efdf6688f8369578accd64e8efaeb6e412db103df8a96b8706012f0bbbc9fb084d939f9cc99d2493fb9a1ae7d60314f14ccac2f20410b23b65e7df345854139b5c026690582d7988142ffa9fdec496b42435b711ae4db48cd5bd9a5da35f7d90d70bae256bd0128c7af95c53908ea200bddb56ba8893299ffc7a68807dccd55d326be61619d6fa702180c8d37634bfdfcc01446003e9d1cf2e9fbad4b921bef87f7292861279fed9a805f136142090bcaa418443488c4228b3f6699c9ca23b16a475d7c3f818d8b57a2b3e7a3dff84258c4c01e5e29cb2b2a4a96935348ee20f978c7d153a007ccd7b1b8a1f3fff68fd13bd708c950c39b8519fe312dd3534a05cdc764ad2cb8a193cf8d5a7bbc8ded25975d74a2ff49f9abab9253b95b33ce16a64634e0623881dc104fa4c265bebf9697721d27e3752e9e932355bb707f1e3431682a13876a6b9768b3b70509572f121e7e7b0900c0107eb22d5541c070c1b9469fe4ee797e7a75e87d03d952cba63c31c44d2803f9fa03f953610222fed9862f19cc90c1f4ae10fd2d5578bb58fb99dd7995d1ca2fdf5f5b54dd77ed31eea59b67138ab0e77407ab7474dd06326f781891f488b73b391889ab0fc868b9cd37f0188b577a697f9c2228a69cfba17e5cd78e725051b80f0384783640e908f1fd2f33f7fea40961c873f0730995ce4d6530f17ce80574d9fd83cb17dff9348882a3dcd65d3a9a41d8a1c32cdf438c4f01b7f99e3e9977571703e6a588af7bc4c52e6c2611c64ed95c7d463b31c9a9d75f087b535e099994b366b850db752eba8d642727a8146e728a7dbcec4b07794ac35482c46bee6e8d5254ffb750e30dd61d08770e0e72685aed54f0ac402d3ec1ff7a5a7f7f8521eeda98d938c07903508f662b80d70a4d29a3b5a7c0c133621396224e3a1dabe5bafc8ee072eab9f51ebbb0367f28a962a1125f0542b9b1587421f11c81f86609b4dfe1515eaad4ef3fd022fae8a189dff2e8be5ed408a288b59afd6bc1148a04593742ba20736a5174951b38e01fcff8ba170001af998cd6f5c2117534368bc10c5bb4213c05158546348e69629487e31f5a5c972c69d8f4ff3c9ae8016f115d25713f4b9cf70304e6865f34391fbc24cef9daeb8a7570f1c499854cca4fece16923f31099841feaa35026e9df0355c671566c18bc50c2050fe6546cf0887bbfe38c88bedacfae417f188ab92fe1149ff25cdfbf7b73eec0236d7a8d29fd586c03f68fb8ba0783fb556835bf3ad1a8170e0f1a4dab9e7f28a9e8018343645c28ebccc71b5341305196550e5c61c178078d13b035e57c31e9073d2a3b4f8fe8c9d1634fa457133a7311bac1e5fafb66d07f9d4ce52ab1768b1b71a47022ecab73e3ec3c1f60f7078c1ee4b4ca0c9309382546649822ebdc55eb420eb11aba3f9f58156bdd799cdb7b7c9129250ff51e0fc8b7d0290e424774fd6ec682e219cfb10b99055c5f8513a63cff55163f7bc890e95799d5d888987151be14d1949ad7cb284372012c638e72eef3cd8d3b6e595eb9ed14661a3f525d4fe44193d1d4782fb3f51183f8a5855a87a3b32aba2b22bd88955fa59e2e5bfd43371228f7c9587ba6f63375381aefa39551c9a0aef04c31c8814cbaea73b16b5a5de3890d347b4cca64b77b1910bd39a60e0f393b67c2cea36989b3665aba8b14fae7c2b850200569d2136796d87a08061fb42839b1f833b73663fbf48441fc628c053155702d55ab087675a593b4c70a819d25472d39c527a993fce094692b223122fee7a878c424a436d772ecd0fb01ab888dd9c41cd0b1b72abe972af54fad7dadab1d660ed2dfba092ed3e32187552069af246bf9b2a9b9f7e965021dd9413a6b163ac98011c83c01ca5932ea0d167cf6f4e1548391d2384521aab94a84350078f1b3c72f65aa6e1e507b2fb4a891d", 0x1000}, {&(0x7f0000002080)="859c7878a109c3dedd1aa8487128bc499db78482eb7d0ec9c91234273a27b4b48b3ee277581d1cdfab90cb43d2a9e83e08be1b565bb91e64efa6e64bb7147b29c62faec93268d63cbeb15cd1ffa6affb1a717b64b3c18548314ac39a3afa417b3dce0126239818eeb75a8ad65709cde25922dfc2a36ef1df3888f9754a83b40130d872b64c546121424bc6ebf0c04e099a3561591fec4e74e20f5ff70209d94b05fb005d7d4da2c43b4d5e8283bd6d81db28dfe34016b81d1c1ae070a6f63a89684367e602caf23d05a6e4cf8f9909c9bcfefddaed5c958d07c8e2cbe060477b943f1a5683cd434a63588d55f252e11bf10f3eba74e15cebe7634b7155e2578f6d1c6f81d8a971c92b2a4b20768512fbdf81ac3209f7cebc2f177e783dc38cb40526c61afc89da975251284f088740fd6107f166ae7830e31892bfbb80aa7c9f249da9b927a21ac159157ae490d0519970492bee1a4aa761951359d60d325251ad454a05b9ad1a682df01ff70c5d8abd11c589708a5bec999cb293dff3f114bce71c3f68d66e1c991b4e3d9f5483148748e4a51901c306f22d15e626cce3540586c62098f2bb22b4208ac1aea67f345e4e06519e7eb4c70f4cdbcdc07dc64108a05f6352497fd500613ce00831fa0b918b3e9e186e6a254c7952168ce962ee7b9c595078732d2b9fd3997a05de0f4ec20220826599f04472187208a80d7b307d5dbf1b5a2d1fcbcf9a3c5d234b30942def5a4a6b216a97affb449f9d27117859bb7bab48d2878e1edd0dac921fef27384c074349db182e6dc5f3228f1f78d656469a2415eb0093db77c0d60fc210c5b8121bf84f9a0da9cdbda39f98c96b13d736e9c2ccf7de29847c3e5ccbfec97bef0932c83682c777e47a6117591ec01115fcf33ce18ea63b972a68f66589dc301c7a02729b21f4d20c3f019af5b3cfacdab6f7aed781d800c4a489e7e5cd7cde6e77022ad35a770353fee325fba9e7fa722d4f2c753796a27e69d7b224c94aa89a2b802106c13b5f0d885bb12b8be5fb3c6afdf4eb6dcf8b6797403d074d376b88b1feb36f64c2a20dae33917c0eb75b54be037d00b33bb57fbf76f58b657afc0ca53ca35b70e53de7e97aac041985b9fc7157414c3514a89c56df132e3730da3557b85698a5671595e6bfd88cf2666abb78675dc6161f6392c6534915e20194c766855599f648ec7b3ec3312bf11a9f33d5829cd0f90cd6d5f809c3151ddb67f358e21ccbc4c59a599cfbb6998e8a7d8016cf4cc4bf5d5eca35a2b120e15ebe721ced5aeb59be895329ea237610057b55b923bc9a3d3cb62c22bae62ac505691d24e2e5c922283a95d8fd5ff4171fce8bb4c107e48074df31441dda315934a40c37b6c0b7d123303f31fdb7a616de0790b66be8f875ddd57b5cc6fb06af9f6c44211016f6af74c2b87d7e6709eaa13cf24ed197a52b8676c2976fe237fb4316aa5b10a1fbb57a4b025b8c377351a7839d6b098fecdb46e59e23ca83defe2517453b1070b0b65a6022ee6c6cfd9025ac778fa731cac6d006e92f61c5b69c40286ddbfbccf7b75b917b04cefb5790137ef18681df82b9c11787b79ce67d5c86488f8e1fedbe3b90bcd21997a7ea269634226f032bee5352e47866488dd589b6c3ca885a1828ddeeca24bd5832d199b7b5050d410246ebed9a011300f9e587d6be8d70b27357a7e70974cfc152af95d9dc9f07e6afdca74bacb7d334c95ebd930fd7bd7cf789abf7595a935c76f9f26a49a1ff73974e5d0cba5ba72863408247fa819329060aed48e9147cf6bbaed55b7a233bcfe798cfaf39674264633486c90fb3f479a4f11d2fda74a5bd6b8c1ff6b543f98885d89258f9b4d90eb101befa41af1d8d1050283b546efad5f50ec3fa6182432ffbde8041c2f8622c73b934fcae5d764317958c68ddb51dc1ddd46ef895e77059fb7f336cdb50f2fa5960d18d1f242e2add5068f6a9000264a000021582b9e6d06b23d2e32c12b22dc6de1b01cb8cdac59cd05668e8cb383fd57f3cf3713b31e5212f4740809177066d15d22d7e1b8a62dbf98ed868d9c5452cebff2709930f0c826c647ebc027d92d7708bfccd348223b273a242a549b28ace58e93b1426a60a40b7e60ac18ffd457c5857b1dd668e5a5ef10de760e445cb9e7346fd9cb4a44fc34446a3740cce632081b43f799f0520980ac009451164a2597b545454c375fb5d2566fd601e9280efc4c0c402edf9ba3f57fbc3972ab290b4c7dfc58af81a0686862efdb6b034f5dba4ae303e83925a25aa5243fa4076ca365e5a71effd2e0de9431c032a7524fff9d91884a2f0f71155b0fa7e6e36dc296dab08552a8b2ebd17b9964e95cdca85429e261a5bbdca5780217d33061a7f1e2a5704c7795b340b8f62a05d51172cfef672c065604c37feddd88ad8bc855f725dfd28511f059d6ae594bba55f2075abc2887147b698b3fccbbdfc2051d699247dfe06c01e3c38ad1205c687bb0b913f60570eac059c80bf321da5b12e7fe72f17160f0cb6eaa891a04adea7e973e43fb02649058a0c6617a76b2b501743cd2113b65b91de8086b5fd40566dc019462e00170e632b12406c85091dbf58f47a0979e12e0a65026190099d63b61e3f5215d1360fd9461d21211073ce181233a6f0a4b10029537a537af2f45a8baa3da5dafebc276a25e376d3fe0672f678d0328f8c18cfcdc89c787de9e708f33347458e2a2ca5490548193e0e3ff4eabc8fa3c0940599879c9eedc5350163402b6947f2d85f54b324ef9e4ba11cca7e126ed80ad2646a554cd1a5327e10446529af80b9d32f8a48754d2f7abb4d8a65a6628415acc59ef4019d681e1f9ea128330304600298ffd24cf901d47d686eae52f34a67be9c4a7fe83782a1ee7a5e2642a6865444e9448e28414d838a2f234781aeb9102bb04d53999a19e8840be9e85295d6a5919eb228c660a43828a082fbb672a31486ea52228ad21d80236c13de4e553af761d1930c71f45cc0821685c39a640af1891733ab8deb6de46657174324e196c77158f079c9599beb84b2fe9f9d0fdffe5552107c2e9adfd3f86504d3150a5022544cdcd1bbc157b7d4e5aaa01de5d8f95609f130421f4e9fc43c3daa9bf1857f654335d80b2ff8137088445e81a2337d5133d143b053fd878fbd1ff4f3366ed1e3eae90d4543e2fae3788fb39c05d9ed64db85b5d3a30b4634519c203271e7c7b4d2dff9b2ccf4e9409dd1a743b2222fb70760792d800591361ec5bfc57ff140d97f01abcc1f355f7a79531aaba219e4526d3a6493c5ac331745d48368f65a7b989df803eb4c96e5a5802c3abfecb954a3985ed165fe0eb63eef273d0748b2046b949658bf0a914f9ec91d425e3585510e70de49f71985fd0b61be6e377fa3bb17d31cbeb8f403144f91a72f87f202aa7ecdeacff94f0e982cdb20bfb8e33de01664b63b8e6e0664dd15245dc79013ca03835741d41c526054389bc9df70fba93065e3384e63415f1393544fdd42e22931656d89525ea9ea08ca13ee9b267c3239789df6262626fc8e01b497c526c6faeab3b8b1aabec1cce2ec6bc2fbe19404190a258afdece21986283c58afd6327ccc4d5a7c97a09229eaa4defd118aa5fb8f0bba8569cccca6ad019dd72e9e89c4a544d44d7c7252b470bede7cc92b5bec14ddb5b0b1c3406781a2aa7be5ed0b06403692faa0546ab68347a85f3ec34cbceda36aabcb67d38c1fac9d793151af70a0b6137f8f41ac80cafcef60e9e48aca3a53fe068b449d0f2c2ea93f1df08fcf6b6426b558d1dc8720397afac45d97944831f6b0309d883739afd6d6325cf8c3ca6886400dacef2ad1f0f472b20188759b968fc83530ddd577d9fc352dea6285c164107124bb48a7b62ad67931740a548222df36e3ed4a2e9d066ab1fd7a25d18549f4cc9006fa1f6193d4caa115481b47c6847473017595b18d8d89a8d3dbea0e0b3a67aa4b8ba656c3d2d84a355697bf022665ac8fb302b12e025f9f4508f62e604e6ad866535b64ccf6900e9d706caf8e511a915f6d362c00717b82a319c0c899928953bc0a74b91dc2ddeccdb4c0d9203044c6953eab5454eeec1261f303c34d1c982bd0f80aaae56c63f8239288f0a162e09fc5a127f91d169b0202c9dd3775b792cc3778b45501b11136776c286c64681201efb782084c743ae67eb23b2ca7025bae3e54c62660edde1ee461645861c0454b9ffc8df4ee3352a8375396e579e086e1bb2de836364833b4d1a57958de22c86528d098395e5a5e6b331e88216cf1d986f2867609bdc623953a5a3c353b85833a976bd73586f09c5ab5e04c9e9e085890c662cace4c576cf9a47d0b4ff14388cbecaa9f3aab13b01a2c5e87fd2c8c79c3557abccdc51d9d861b77416fcc567591ff63e25c1864bbb7d5985b206740fcd8532b4f2297c26c5d16a733caee248f7535d6909cf57672b41e49810e339dc7e558bf284f32510077b75c820e7ed28564f777a60b47bc9b0282e837ccc5efdf52f17911e5d899e0c75eefddbaed2568560c9ff957ff7c97fe427ead5ffe5f09676ca53ac9b0acb2fd333a9fde9752cdc282ca7373c4da1e2fcd55011b6ce05087f81fc689e34f1c3733018deae4806bcb7eca5a16df76652444a011de7f947b9a42aff1d1b4581fbc03c867b9171d21770e2abf25e093f8808dfe25a4bc7c932f29c23cc829f9a29ee32a7be32d663e896e9bdaa4ca8184575b293e705f636843139361ca112444242480e1aadc636f670e8417c237771a18acedfc8b6398e77b8b1fc47531e206d100f0df21a5dcb4fe4ee9dcddaf216b403900b53e0455cfdb01dc2c546fcdc0a70ab6088434994957985b71575192f1457fae8ae25de8abecb852db7202d8cb3872ef97c61edf813ebf28a51157531b83e11eb7774d767925608158171add6964b30257ce8f43269ea517fa8fb89dbe13f036feedfb307d9eba8c7558df27d342c25645a37d4c8015281f18e3a07f521f00103803a1774ca343331f5cc8f1acdd916c0c764792966b51c5b73d45ee3f9d6e3ef50ebc72cc60cbd5502012beb2dce1f156866502c8332bb6b62bfc7ca1daf17910f5c3b448f9b756d210edfe3656fcd5821d9328c89014abcdbf246f907842ada24e9bb5e962ed848ed4895a0c5573e8233811e7d37fe762544b66cd3dbbb14c8f7e2afe6d7a6018b728341c1b10bd454fa7828c20bb86a016d76720e8ed0692b33510ad5d9ed254283675ef180dbcc01d5639d279ab4f9baff3d7bd90a1d0ce0fff061ab8d46a0e4a3dd4c4b1312b15e8a59bddecaffbf11e4e8d8d9188ad34108b6b57287e5dce672ce0b914766f73457cc0819575156097bc157a29552afa220a935d9e728f3905f17c8147b00eddcb26290acd58423d8b1fd95fefee5c3ecc0bd550fa02118c8f68eaf8eb72d70e1c8d618a344e2a3f4814fa31ee7f31e20dc266b68ac152f2409a7a18b3d4db7f64f5752f7fc6c4126db18752227af60db401b10ec30b40057d8117442b9340aa67b96bbd2cf78cada96f6881da9953988de0b4a517fc41232b7e44086c20e62d2fbce56987db163abc81aab973763afcb5af0aebd0334fe76a28fbac440c6ee73c909980146b23e9175fae8f08c4fab94c81ef204e05ca1410e0d6dd8f9092b0efb4dbbb1806bd46ecfa5e4004ea31e054edfb6bb8ed8c27468d1b4e349c3fb6b84425b4aec1dace26b8bed2fe9324fa55a3656b6d4ec8f0d39995e1b39c45c1c140e9149b5e9a344b5d45980529cfc555189ca2302ed9", 0x1000}, {&(0x7f00000007c0)="fc42c3a2f0b40c5b4ffbee9f1a0b1b4806a90cdca8d5fc17bddf28efda9f98283ccd73b1d576858a0ee7ccb2e16bd5e119cd37b4e51482066cc2d3c3fae36e35a23330b4e70384fb94477915d1f843c36f56e19ad136b8242b371df8ccddcdbc2e1a5dbb8ba91ef3e37dd843b3f74e27fae5e25d9af722f3712d623f31e84ba980e10f704cbc1948d8d37be5df1ca68f978c2487ba1035d84682e202efb2bea0babae57bac", 0xa5}], 0x9) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x80800) ioctl$DRM_IOCTL_MODE_SETPROPERTY(r1, 0xc01064ab, &(0x7f0000000380)={0x1}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = creat(&(0x7f0000000580)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) r4 = fanotify_init(0xf00, 0x40000) readv(r4, 0x0, 0x0) sendmsg$can_bcm(r3, 0x0, 0x8000) fanotify_mark(r4, 0x105, 0x4000997d, r3, 0x0) sendmsg$nl_route(r2, 0x0, 0x0) dup(0xffffffffffffffff) r5 = syz_io_uring_setup(0x23126, &(0x7f0000000740)={0x0, 0xe32a, 0x10100, 0x4, 0x9c}, 0x0, &(0x7f0000000180)) r6 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/power/pm_test', 0x8a000, 0x105) sendfile(r6, r6, 0x0, 0x8) io_uring_enter(r5, 0x154c, 0xef91, 0x48, 0x0, 0x0) mremap(&(0x7f0000041000/0x2000)=nil, 0x2000, 0x1000, 0x2, &(0x7f00004c4000/0x1000)=nil) r7 = socket$kcm(0x29, 0x2, 0x0) ioctl$DRM_IOCTL_MODE_GETFB(0xffffffffffffffff, 0xc01c64ad, &(0x7f0000000700)) write$cgroup_pressure(r3, &(0x7f0000000100)={'full', 0x20, 0x21e, 0x20, 0x444}, 0x2a) sendmsg$kcm(r7, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x20000818) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(r6, 0xc018937d, &(0x7f0000000340)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x1}}, '\x00'}) setxattr$security_evm(&(0x7f0000000040)='./cgroup/../file0\x00', &(0x7f0000000080), 0x0, 0x33, 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x20) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) 792.216706ms ago: executing program 2 (id=800): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000001380)={0x1, 0x5, &(0x7f0000000400)=ANY=[@ANYBLOB="bf16000000000000b7070000000100004870000000800000500000000000000095000000000000002ba728041598fbd30cb599e83d24a3aa81d36bb3019c13bd23212fb56fa54f2641d8b02c3815e79c1414eb07eae6f0711e6bd917487960717142fa9ea4318123f602000000000080de89e661168c1886d0d4dd4f204e345c65c26e278ef5b915395b19284a1a4bc72fbc1626e3a2a2ad358061d0ae0209e62f51ee988e6ea604ce974a22a550d6f97080980400003e05df3ceb9f1feae5737ecaa80a666963c474c2a100c788b277beee1cbf9b0a4d3881dcc7b1b85f3c3d44aeaccd3641110bec4e90a6341965c39e4b3431abe802f5ab3e89cf6c662ed4048d3b3e22278d00ce00000000d3a02762c2951257b85802189d74005d2a1bcf9436e192e23fd275985bf31b714f000bca"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x34}, 0x94) syz_usb_connect(0x2, 0x3d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100004e826d4094225a4241d10102030109022b00010020000009040000020764c2000905a17f00000000000705", @ANYRES32=r0], 0x0) 755.834851ms ago: executing program 0 (id=801): r0 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) fchdir(r1) r2 = inotify_init() inotify_add_watch(r2, &(0x7f0000000000)='.\x00', 0x400017e) openat(0xffffffffffffff9c, &(0x7f0000001740)='.\x00', 0x515001, 0x488) syz_usb_connect$uac1(0x0, 0xed, &(0x7f0000000040)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x10, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xdb, 0x3, 0x1, 0x2f, 0x28, 0xfe, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x559, 0x7}, [@input_terminal={0xc, 0x24, 0x2, 0x1, 0x206, 0x6, 0x6, 0x7, 0x5, 0xa}, @extension_unit={0xa, 0x24, 0x8, 0x3, 0x8, 0x3, "ebb445"}, @input_terminal={0xc, 0x24, 0x2, 0x2, 0x206, 0x1, 0x7, 0x7, 0x81, 0x6}, @mixer_unit={0x5, 0x24, 0x4, 0x6, 0x3}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_discrete={0x8, 0x24, 0x2, 0x1, 0x7, 0x3, 0x1, 0x1}, @format_type_ii_discrete={0x9, 0x24, 0x2, 0x2, 0x9, 0x8, 0x5}, @format_type_i_continuous={0xa, 0x24, 0x2, 0x1, 0x3, 0x1, 0xa, 0x5, "", "97df"}, @format_type_ii_discrete={0xd, 0x24, 0x2, 0x2, 0xd497, 0x1, 0xff, "7400e7dd"}, @format_type_i_discrete={0x9, 0x24, 0x2, 0x1, 0x0, 0x3, 0x8, 0x2, '-'}]}, {{0x9, 0x5, 0x1, 0x9, 0x8, 0x8, 0x7, 0x5, {0x7, 0x25, 0x1, 0x0, 0x10, 0x3}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_ii_discrete={0x10, 0x24, 0x2, 0x2, 0x2, 0xffff, 0xd6, "19f5f9ca64f659"}, @as_header={0x7, 0x24, 0x1, 0x7, 0x2, 0x1001}, @format_type_i_continuous={0xd, 0x24, 0x2, 0x1, 0x8, 0x1, 0x4, 0x4, "b060a2", "ac84"}]}, {{0x9, 0x5, 0x82, 0x9, 0x40, 0xcb, 0x8, 0x9, {0x7, 0x25, 0x1, 0x82, 0x6, 0xa}}}}}}}]}}, &(0x7f0000000380)={0xa, &(0x7f0000000140)={0xa, 0x6, 0x340, 0x5, 0x6, 0x81, 0x20}, 0x3e, &(0x7f0000000180)={0x5, 0xf, 0x3e, 0x5, [@wireless={0xb, 0x10, 0x1, 0x8, 0x2, 0x1, 0x9, 0x8, 0x3}, @ssp_cap={0x10, 0x10, 0xa, 0x3, 0x1, 0x2, 0xf000, 0x8000, [0xf]}, @ptm_cap={0x3}, @ext_cap={0x7, 0x10, 0x2, 0x18, 0xd, 0x0, 0xe71}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "afa25ee4f3cfe29e4b905a282e92acbb"}]}, 0x4, [{0x4, &(0x7f0000000200)=@lang_id={0x4, 0x3, 0x41c}}, {0x94, &(0x7f0000000240)=@string={0x94, 0x3, "54b73b58d287dff49d5142b66c20124344f8dc50d3b2eb81f4d9b1d8062f91fbc60c10c1e8dd98e5e76ad0f413dec15a438739a42f3c2b2876c4fb1f945dc75beb1ec37cdab935e82a6d6a808f18a8e3a2ae6c5b81dde578818f00969725adae0c77d470acb8aa2cc7a104aa57c906d9f342c1767685ba2cd7628d57406fe85f4f967c9517cc0d6181adecf1574d6637e220"}}, {0x4, &(0x7f0000000300)=@lang_id={0x4, 0x3, 0x804}}, {0x23, &(0x7f0000000340)=@string={0x23, 0x3, "227f8a64421511ea229bcfa0ec9274cff0689b45749451fddba1bd2b8f3c226e7e"}}]}) 709.157019ms ago: executing program 4 (id=802): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f00000003c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000000)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000a00)={0x4c, r3, 0x1, 0xfffffffd, 0x0, {}, [@NL802154_ATTR_SEC_DEVKEY={0x30, 0x2f, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0002}}, @NL802154_DEVKEY_ATTR_ID={0x18, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x8001}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x3}]}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0x1ff}]}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}]}, 0x4c}}, 0x44040) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x16, 0x21, &(0x7f0000000340)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x6}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f00000007c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 108.238381ms ago: executing program 6 (id=803): mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x103) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) ioctl$F2FS_IOC_COMMIT_ATOMIC_WRITE(r0, 0xf502, 0x0) r1 = userfaultfd(0x801) r2 = socket$inet_smc(0x2b, 0x1, 0x0) getsockopt$IPT_SO_GET_REVISION_MATCH(r2, 0x0, 0x42, &(0x7f0000000000)={'HL\x00'}, &(0x7f0000000040)=0x1e) io_setup(0x8, &(0x7f0000004200)=0x0) keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='new default use'], 0x2a, 0xfffffffffffffffc) r4 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000003b40), 0x80040, 0x0) ioctl$LOOP_CTL_REMOVE(r4, 0x4c81, 0x2) r5 = add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) add_key$user(&(0x7f0000000040), &(0x7f0000000000), &(0x7f00000002c0), 0x0, 0xfffffffffffffffe) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) r7 = socket(0x10, 0x803, 0x0) sendto(r7, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r7, &(0x7f0000003480)=[{{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000100)=""/248, 0xf8}], 0x1}, 0xa}], 0x1, 0x40002100, 0x0) sendmsg$nl_xfrm(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="58010000100013"], 0x158}, 0x1, 0x0, 0x0, 0x4048010}, 0x24040014) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003e80)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000009c0)="18acf8b1ed479de320cdbff21bc648a4423880b9fb95564f48c38e3fdaea755288c2a91a1ef344702de01af77d599320e22a0ea41b13aa09f1b359b0e2d2e8b6074bb4119ea219d2055df8bab18280f3c3ea8e45510d60a28f7af2a9c471dbe0a88f57ae4580b0b420f5f90b70efb6805d81812d5d64c87c99f9c75e9f656dfd", 0x80}], 0x1}}], 0x1, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000000)={0x0}) keyctl$read(0xb, r5, &(0x7f0000000240)=""/112, 0x349b7f55) io_submit(r3, 0x1, &(0x7f0000004540)=[&(0x7f0000004280)={0x0, 0x0, 0x0, 0x5, 0xfffd, r1, 0x0}]) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=0000000000000000010000', @ANYRESDEC=0x0, @ANYBLOB=',group_i']) syz_emit_ethernet(0x4e, &(0x7f0000000240)={@local, @remote, @void, {@ipv4={0x800, @tcp={{0xb, 0x4, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x6, 0x0, @dev, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@ssrr={0x89, 0x7, 0xc9, [@private=0xa010100]}, @timestamp={0x44, 0xc, 0x5, 0x0, 0x0, [0x5, 0x0]}, @timestamp={0x44, 0x4}]}}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x800}}}}}}, 0x0) read$FUSE(r0, &(0x7f00000021c0)={0x2020}, 0x2020) ioctl$AUTOFS_IOC_SETTIMEOUT(r0, 0x80049367, &(0x7f0000000100)=0x6) syz_fuse_handle_req(r0, &(0x7f000000e3c0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b600", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) acct(&(0x7f00000001c0)='./file0\x00') umount2(0x0, 0x0) acct(&(0x7f00000000c0)='./file0\x00') 0s ago: executing program 4 (id=804): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="1800"/15], &(0x7f00000003c0)='GPL\x00'}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000140)='contention_end\x00', r0}, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$TIPC_NL_UDP_GET_REMOTEIP(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)={0x14, r2, 0x325}, 0x14}}, 0x0) kernel console output (not intermixed with test programs): 132.256288][ T5906] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 132.256649][ T5936] tipc: Node number set to 2130706433 [ 132.373720][ T6310] dummy0: entered allmulticast mode [ 132.802706][ T5906] usbhid 2-1:7.0: can't add hid device: -71 [ 132.856192][ T5906] usbhid 2-1:7.0: probe with driver usbhid failed with error -71 [ 132.903503][ T5906] usb 2-1: USB disconnect, device number 6 [ 133.346254][ T5906] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 133.541594][ T5906] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 133.612237][ T5906] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 133.694121][ T5906] usb 2-1: New USB device found, idVendor=2040, idProduct=4900, bcdDevice=4d.4d [ 133.724354][ T5906] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 133.769613][ T5906] usb 2-1: config 0 descriptor?? [ 134.121209][ T5906] usb 2-1: string descriptor 0 read error: -71 [ 134.130536][ T5906] hdpvr 2-1:0.0: Could not find bulk-in endpoint [ 134.137509][ T5906] hdpvr 2-1:0.0: probe with driver hdpvr failed with error -12 [ 134.149125][ T5906] usb 2-1: USB disconnect, device number 7 [ 134.981279][ T5845] Bluetooth: hci4: command 0x0c1a tx timeout [ 134.987610][ T43] Bluetooth: hci4: Opcode 0x0c1a failed: -110 [ 134.993757][ T43] Bluetooth: hci4: Error when powering off device on rfkill (-110) [ 135.460510][ T6352] process 'syz.3.84' launched '/dev/fd/3' with NULL argv: empty string added [ 137.506557][ T6026] usb 2-1: new full-speed USB device number 8 using dummy_hcd [ 137.816338][ T6026] usb 2-1: device descriptor read/64, error -71 [ 138.157909][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 138.164605][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 138.309150][ T6026] usb 2-1: new full-speed USB device number 9 using dummy_hcd [ 139.568015][ T6372] netlink: 12 bytes leftover after parsing attributes in process `syz.2.87'. [ 139.681905][ T6026] usb 2-1: device descriptor read/64, error -71 [ 139.866421][ T6026] usb usb2-port1: attempt power cycle [ 141.324344][ T6377] delete_channel: no stack [ 144.082894][ T6444] syz.2.100: attempt to access beyond end of device [ 144.082894][ T6444] nbd2: rw=4096, sector=2, nr_sectors = 2 limit=0 [ 144.096678][ T6444] EXT4-fs (nbd2): unable to read superblock [ 144.200357][ T6445] No control pipe specified [ 144.298903][ T5906] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 145.008217][ T5906] usb 5-1: Using ep0 maxpacket: 16 [ 145.059995][ T5906] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 145.104065][ T5906] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 145.146972][ T5906] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 145.162420][ T5906] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 145.193873][ T5906] usb 5-1: Product: syz [ 145.203382][ T5906] usb 5-1: Manufacturer: syz [ 145.246767][ T5906] usb 5-1: SerialNumber: syz [ 145.695587][ T5906] usb 5-1: 0:2 : does not exist [ 146.256670][ T5906] usb 5-1: 5:0: failed to get current value for ch 0 (-22) [ 146.298292][ T30] audit: type=1326 audit(1755897535.996:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6457 comm="syz.2.104" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7feb8418ebe9 code=0x7ffc0000 [ 146.304529][ T5906] usb 5-1: USB disconnect, device number 3 [ 146.466565][ T30] audit: type=1326 audit(1755897535.996:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6457 comm="syz.2.104" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7feb8418ebe9 code=0x7ffc0000 [ 146.631022][ T30] audit: type=1326 audit(1755897535.996:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6457 comm="syz.2.104" exe="/root/syz-executor" sig=0 arch=c000003e syscall=437 compat=0 ip=0x7feb8418ebe9 code=0x7ffc0000 [ 146.764933][ T30] audit: type=1326 audit(1755897535.996:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6457 comm="syz.2.104" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7feb8418ebe9 code=0x7ffc0000 [ 146.812134][ T30] audit: type=1326 audit(1755897535.996:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6457 comm="syz.2.104" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7feb8418ebe9 code=0x7ffc0000 [ 146.814416][ T6478] binder: 6477:6478 ioctl c018620c 200000000380 returned -22 [ 146.833506][ C1] vkms_vblank_simulate: vblank timer overrun [ 146.999980][ T30] audit: type=1326 audit(1755897536.046:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6457 comm="syz.2.104" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7feb8418ebe9 code=0x7ffc0000 [ 147.022866][ T30] audit: type=1326 audit(1755897536.046:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6457 comm="syz.2.104" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7feb8418ebe9 code=0x7ffc0000 [ 147.044662][ T30] audit: type=1326 audit(1755897536.046:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6457 comm="syz.2.104" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7feb8418ebe9 code=0x7ffc0000 [ 147.650188][ T5906] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 147.658077][ T10] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 147.820352][ T10] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 147.838915][ T10] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 147.856165][ T5906] usb 4-1: Using ep0 maxpacket: 32 [ 147.888606][ T5906] usb 4-1: config 128 has an invalid interface number: 87 but max is 0 [ 147.914009][ T10] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 147.941124][ T5906] usb 4-1: config 128 has no interface number 0 [ 147.959182][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 148.020879][ T5906] usb 4-1: config 128 interface 87 altsetting 0 endpoint 0x7 has invalid maxpacket 512, setting to 64 [ 148.034741][ T10] usb 2-1: SerialNumber: syz [ 148.056564][ T5906] usb 4-1: config 128 interface 87 altsetting 0 endpoint 0x2 has an invalid bInterval 129, changing to 11 [ 148.459829][ T5906] usb 4-1: config 128 interface 87 altsetting 0 has a duplicate endpoint with address 0x2, skipping [ 148.685059][ T10] usb 2-1: 0:2 : does not exist [ 148.724060][ T5956] usb 5-1: new full-speed USB device number 4 using dummy_hcd [ 148.740119][ T10] usb 2-1: unit 255 not found! [ 148.748071][ T5906] usb 4-1: New USB device found, idVendor=0bfd, idProduct=0016, bcdDevice=c5.9a [ 148.777352][ T5906] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 148.793172][ T5906] usb 4-1: Product: syz [ 148.802574][ T5906] usb 4-1: Manufacturer: syz [ 148.819501][ T5906] usb 4-1: SerialNumber: syz [ 148.837569][ T10] usb 2-1: USB disconnect, device number 11 [ 148.859601][ T6486] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 148.912890][ T5890] udevd[5890]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 148.941519][ T5956] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 148.953075][ T5956] usb 5-1: New USB device found, idVendor=18b1, idProduct=0037, bcdDevice= 0.00 [ 148.975518][ T5956] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 148.991136][ T5956] usb 5-1: config 0 descriptor?? [ 149.122713][ T5906] kvaser_usb 4-1:128.87: error -ENODEV: Cannot get usb endpoint(s) [ 149.161392][ T5906] usb 4-1: USB disconnect, device number 7 [ 149.467460][ T5956] petalynx 0003:18B1:0037.0002: item fetching failed at offset 0/2 [ 149.497001][ T5956] petalynx 0003:18B1:0037.0002: parse failed [ 149.503135][ T5956] petalynx 0003:18B1:0037.0002: probe with driver petalynx failed with error -22 [ 149.586071][ T6026] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 149.756111][ T6026] usb 1-1: Using ep0 maxpacket: 16 [ 149.764896][ T6026] usb 1-1: config 0 has an invalid interface number: 251 but max is 0 [ 149.776259][ T6026] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 149.810629][ T6026] usb 1-1: config 0 has no interface number 0 [ 149.838899][ T6026] usb 1-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 149.861656][ T6026] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 149.883393][ T6026] usb 1-1: Product: syz [ 149.898389][ T6026] usb 1-1: Manufacturer: syz [ 150.017071][ T6026] usb 1-1: SerialNumber: syz [ 150.265801][ T6026] usb 1-1: config 0 descriptor?? [ 150.301319][ T6026] asix 1-1:0.251: probe with driver asix failed with error -22 [ 150.686547][ T6508] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 150.758012][ T43] usb 5-1: USB disconnect, device number 4 [ 150.761431][ T6508] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 150.908859][ T24] usb 1-1: USB disconnect, device number 3 [ 150.994175][ T6530] netlink: 12 bytes leftover after parsing attributes in process `syz.4.120'. [ 151.276190][ T6533] Can't find ip_set type ha [ 151.346158][ T5898] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 151.728886][ T5898] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 151.758502][ T5898] usb 2-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 151.971028][ T5898] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 152.075604][ T6553] syz.4.124: attempt to access beyond end of device [ 152.075604][ T6553] nbd4: rw=0, sector=64, nr_sectors = 8 limit=0 [ 152.099309][ T6553] syz.4.124: attempt to access beyond end of device [ 152.099309][ T6553] nbd4: rw=0, sector=120, nr_sectors = 8 limit=0 [ 152.113655][ T6553] Mount JFS Failure: -5 [ 152.622615][ T5898] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 152.799406][ T6527] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 152.815903][ T6555] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 152.891665][ T5898] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 153.312034][ T6563] netlink: 'syz.4.127': attribute type 14 has an invalid length. [ 153.676418][ T6026] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 153.936159][ T6026] usb 5-1: Using ep0 maxpacket: 16 [ 154.046140][ T6026] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 154.146096][ T6026] usb 5-1: config 0 has no interfaces? [ 154.151726][ T6026] usb 5-1: New USB device found, idVendor=0c70, idProduct=f014, bcdDevice= 0.00 [ 154.370321][ T6026] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 154.420070][ T5906] usb 2-1: USB disconnect, device number 12 [ 154.567245][ T6026] usb 5-1: config 0 descriptor?? [ 154.980605][ T6085] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 155.224456][ T6085] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 155.391559][ T6085] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 155.526055][ T5898] usb 5-1: USB disconnect, device number 5 [ 155.786209][ T6589] snd_dummy snd_dummy.0: control 0:0:0:syz0:0 is already present [ 156.622222][ T6085] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 157.363158][ T6085] bridge_slave_1: left allmulticast mode [ 157.416186][ T6085] bridge_slave_1: left promiscuous mode [ 157.423699][ T6085] bridge0: port 2(bridge_slave_1) entered disabled state [ 157.642666][ T6085] bridge_slave_0: left allmulticast mode [ 157.866305][ T6085] bridge_slave_0: left promiscuous mode [ 157.875130][ T6085] bridge0: port 1(bridge_slave_0) entered disabled state [ 158.697973][ T6624] overlayfs: conflicting options: userxattr,redirect_dir=on [ 158.715628][ T5840] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 158.726369][ T5840] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 158.735308][ T5840] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 158.744601][ T5840] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 158.752996][ T5840] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 158.781727][ T5845] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 158.790403][ T5845] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 158.799743][ T5845] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 158.808067][ T5845] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 158.816043][ T5845] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 159.615408][ T6655] netlink: 16 bytes leftover after parsing attributes in process `syz.4.146'. [ 160.919106][ T5840] Bluetooth: hci3: command tx timeout [ 161.226488][ T6085] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 161.242083][ T6085] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 161.260941][ T6672] netlink: 'syz.4.150': attribute type 2 has an invalid length. [ 161.272768][ T6085] bond0 (unregistering): Released all slaves [ 161.840562][ T6682] vlan2: entered promiscuous mode [ 161.845845][ T6682] syz_tun: entered promiscuous mode [ 162.417293][ T6679] 9pnet_fd: Insufficient options for proto=fd [ 162.505110][ T6085] tipc: Disabling bearer [ 162.656807][ T6085] tipc: Left network mode [ 162.658663][ T6678] delete_channel: no stack [ 163.025009][ T5840] Bluetooth: hci3: command tx timeout [ 163.249483][ T6697] netlink: 16 bytes leftover after parsing attributes in process `syz.1.157'. [ 164.379192][ T6700] xt_connbytes: Forcing CT accounting to be enabled [ 164.386589][ T6700] Cannot find set identified by id 0 to match [ 164.484344][ T6703] FAULT_INJECTION: forcing a failure. [ 164.484344][ T6703] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 164.506577][ T6703] CPU: 1 UID: 0 PID: 6703 Comm: syz.4.158 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) [ 164.506607][ T6703] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 164.506627][ T6703] Call Trace: [ 164.506638][ T6703] [ 164.506648][ T6703] dump_stack_lvl+0x189/0x250 [ 164.506678][ T6703] ? __pfx____ratelimit+0x10/0x10 [ 164.506699][ T6703] ? __pfx_dump_stack_lvl+0x10/0x10 [ 164.506722][ T6703] ? __pfx__printk+0x10/0x10 [ 164.506763][ T6703] should_fail_ex+0x414/0x560 [ 164.506791][ T6703] _copy_to_user+0x31/0xb0 [ 164.506825][ T6703] simple_read_from_buffer+0xe1/0x170 [ 164.506853][ T6703] proc_fail_nth_read+0x1df/0x250 [ 164.506882][ T6703] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 164.506912][ T6703] ? rw_verify_area+0x258/0x650 [ 164.506944][ T6703] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 164.506972][ T6703] vfs_read+0x200/0x980 [ 164.507039][ T6703] ? __pfx___mutex_lock+0x10/0x10 [ 164.507065][ T6703] ? __pfx_vfs_read+0x10/0x10 [ 164.507100][ T6703] ? __fget_files+0x2a/0x420 [ 164.507130][ T6703] ? __fget_files+0x3a0/0x420 [ 164.507152][ T6703] ? __fget_files+0x2a/0x420 [ 164.507186][ T6703] ksys_read+0x145/0x250 [ 164.507209][ T6703] ? __pfx_ksys_read+0x10/0x10 [ 164.507225][ T6703] ? rcu_is_watching+0x15/0xb0 [ 164.507254][ T6703] ? do_syscall_64+0xbe/0x3b0 [ 164.507284][ T6703] do_syscall_64+0xfa/0x3b0 [ 164.507306][ T6703] ? lockdep_hardirqs_on+0x9c/0x150 [ 164.507327][ T6703] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 164.507347][ T6703] ? clear_bhb_loop+0x60/0xb0 [ 164.507373][ T6703] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 164.507394][ T6703] RIP: 0033:0x7ff0f318d5fc [ 164.507421][ T6703] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 164.507444][ T6703] RSP: 002b:00007ff0f3f2f030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 164.507466][ T6703] RAX: ffffffffffffffda RBX: 00007ff0f33b5fa0 RCX: 00007ff0f318d5fc [ 164.507482][ T6703] RDX: 000000000000000f RSI: 00007ff0f3f2f0a0 RDI: 0000000000000003 [ 164.507495][ T6703] RBP: 00007ff0f3f2f090 R08: 0000000000000000 R09: 0000000000000000 [ 164.507508][ T6703] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 164.507520][ T6703] R13: 00007ff0f33b6038 R14: 00007ff0f33b5fa0 R15: 00007ffcc047af18 [ 164.507554][ T6703] [ 164.842156][ T6710] netlink: 28 bytes leftover after parsing attributes in process `syz.4.161'. [ 164.851556][ T6710] netlink: 'syz.4.161': attribute type 7 has an invalid length. [ 164.859257][ T6710] netlink: 'syz.4.161': attribute type 8 has an invalid length. [ 164.867763][ T6710] netlink: 4 bytes leftover after parsing attributes in process `syz.4.161'. [ 164.915830][ T6707] overlayfs: option "volatile" is meaningless in a non-upper mount, ignoring it. [ 164.956698][ T6707] overlayfs: NFS export requires "redirect_dir=nofollow" on non-upper mount, falling back to nfs_export=off. [ 164.978586][ T6707] overlayfs: conflicting options: userxattr,redirect_dir=on [ 165.000572][ T6710] gretap0: entered promiscuous mode [ 165.007614][ T6710] batadv_slave_1: entered promiscuous mode [ 165.077589][ T5840] Bluetooth: hci3: command tx timeout [ 165.146442][ T5898] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 165.326451][ T6085] hsr_slave_0: left promiscuous mode [ 165.332449][ T5898] usb 3-1: Using ep0 maxpacket: 8 [ 165.367642][ T6085] hsr_slave_1: left promiscuous mode [ 165.410128][ T6085] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 165.420336][ T5898] usb 3-1: New USB device found, idVendor=0c45, idProduct=613e, bcdDevice= 0.6d [ 165.439794][ T5898] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 165.455813][ T6085] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 165.474089][ T5898] usb 3-1: Product: syz [ 165.490654][ T6730] netlink: 'syz.0.165': attribute type 1 has an invalid length. [ 165.501046][ T6085] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 165.510354][ T5898] usb 3-1: Manufacturer: syz [ 165.518001][ T5898] usb 3-1: SerialNumber: syz [ 165.525137][ T6085] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 165.532869][ T6730] netlink: 'syz.0.165': attribute type 11 has an invalid length. [ 165.566053][ T6730] netlink: 224 bytes leftover after parsing attributes in process `syz.0.165'. [ 165.754743][ T5898] usb 3-1: config 0 descriptor?? [ 165.764593][ T5898] gspca_main: sonixj-2.14.0 probing 0c45:613e [ 166.150811][ T5898] gspca_sonixj: reg_r err -32 [ 166.254228][ T5898] sonixj 3-1:0.0: probe with driver sonixj failed with error -32 [ 166.525660][ T6085] veth1_macvtap: left promiscuous mode [ 166.609728][ T6085] veth0_macvtap: left promiscuous mode [ 166.651087][ T6085] veth1_vlan: left promiscuous mode [ 166.673052][ T6085] veth0_vlan: left promiscuous mode [ 167.646001][ T6748] slcan: can't register candev [ 167.652050][ T6748] Falling back ldisc for ttyS3. [ 167.684847][ T5845] Bluetooth: hci3: command tx timeout [ 167.977710][ T5906] usb 3-1: USB disconnect, device number 6 [ 168.334904][ T6754] netlink: 16 bytes leftover after parsing attributes in process `syz.0.168'. [ 169.406190][ T43] usb 3-1: new full-speed USB device number 7 using dummy_hcd [ 169.736315][ T6763] netlink: 'syz.0.171': attribute type 1 has an invalid length. [ 169.800730][ T6761] fuse: Unknown parameter '' [ 169.807335][ T6761] fuse: Unknown parameter '' [ 169.921026][ T43] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 169.981673][ T43] usb 3-1: New USB device found, idVendor=18b1, idProduct=0037, bcdDevice= 0.00 [ 170.062289][ T43] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 170.244939][ T43] usb 3-1: config 0 descriptor?? [ 170.514643][ T6769] netlink: 16 bytes leftover after parsing attributes in process `syz.1.172'. [ 171.041306][ T43] petalynx 0003:18B1:0037.0003: item fetching failed at offset 0/2 [ 171.056006][ T43] petalynx 0003:18B1:0037.0003: parse failed [ 171.062945][ T43] petalynx 0003:18B1:0037.0003: probe with driver petalynx failed with error -22 [ 171.417162][ T6085] team0 (unregistering): Port device team_slave_1 removed [ 171.457692][ T6085] team0 (unregistering): Port device team_slave_0 removed [ 171.531822][ T6773] ======================================================= [ 171.531822][ T6773] WARNING: The mand mount option has been deprecated and [ 171.531822][ T6773] and is ignored by this kernel. Remove the mand [ 171.531822][ T6773] option from the mount to silence this warning. [ 171.531822][ T6773] ======================================================= [ 172.028431][ T10] usb 3-1: USB disconnect, device number 7 [ 172.656139][ T10] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 172.734932][ T6763] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 172.867632][ T10] usb 2-1: config index 0 descriptor too short (expected 23569, got 27) [ 172.901973][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 172.943694][ T10] usb 2-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 173.606419][ T10] usb 2-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 173.614608][ T10] usb 2-1: Manufacturer: syz [ 173.830182][ T10] usb 2-1: config 0 descriptor?? [ 173.862940][ T6623] chnl_net:caif_netlink_parms(): no params data found [ 174.817585][ T10] rc_core: IR keymap rc-hauppauge not found [ 174.817617][ T10] Registered IR keymap rc-empty [ 174.820358][ T10] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 174.822862][ T10] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input6 [ 174.922904][ C0] igorplugusb 2-1:0.0: Error: urb status = -32 [ 175.268264][ T6780] netlink: 4 bytes leftover after parsing attributes in process `syz.1.175'. [ 178.069465][ T6843] netlink: 44 bytes leftover after parsing attributes in process `syz.2.187'. [ 178.079978][ T6843] netlink: 43 bytes leftover after parsing attributes in process `syz.2.187'. [ 178.089629][ T6843] netlink: 'syz.2.187': attribute type 6 has an invalid length. [ 178.097912][ T6843] netlink: 'syz.2.187': attribute type 5 has an invalid length. [ 178.105734][ T6843] netlink: 43 bytes leftover after parsing attributes in process `syz.2.187'. [ 178.160971][ T6843] trusted_key: encrypted_key: insufficient parameters specified [ 178.377155][ T6623] bridge0: port 1(bridge_slave_0) entered blocking state [ 178.384908][ T6623] bridge0: port 1(bridge_slave_0) entered disabled state [ 178.406938][ T6623] bridge_slave_0: entered allmulticast mode [ 178.438379][ T6623] bridge_slave_0: entered promiscuous mode [ 178.496436][ T6623] bridge0: port 2(bridge_slave_1) entered blocking state [ 178.503859][ T6623] bridge0: port 2(bridge_slave_1) entered disabled state [ 178.518651][ T43] usb 2-1: USB disconnect, device number 13 [ 178.568527][ T6623] bridge_slave_1: entered allmulticast mode [ 178.616206][ T6623] bridge_slave_1: entered promiscuous mode [ 178.870311][ T6623] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 178.908546][ T6861] netlink: 24 bytes leftover after parsing attributes in process `syz.1.190'. [ 179.016292][ T6623] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 179.185673][ T6859] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 179.693981][ T6623] team0: Port device team_slave_0 added [ 180.278855][ T6623] team0: Port device team_slave_1 added [ 180.591965][ T6623] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 180.620263][ T6623] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 180.661672][ T6623] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 180.672477][ T6888] usb usb8: usbfs: process 6888 (syz.0.195) did not claim interface 0 before use [ 180.778060][ T6623] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 180.810253][ T6623] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 180.836573][ C1] vkms_vblank_simulate: vblank timer overrun [ 180.961995][ T6623] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 180.991212][ T6892] loop6: detected capacity change from 0 to 6656 [ 181.094397][ T6892] buffer_io_error: 31 callbacks suppressed [ 181.094417][ T6892] Buffer I/O error on dev loop6, logical block 0, async page read [ 181.156506][ T6892] Buffer I/O error on dev loop6, logical block 0, async page read [ 181.165531][ T6892] Buffer I/O error on dev loop6, logical block 0, async page read [ 181.174380][ T6892] Buffer I/O error on dev loop6, logical block 0, async page read [ 181.182618][ T6892] Buffer I/O error on dev loop6, logical block 0, async page read [ 181.673552][ T6892] Buffer I/O error on dev loop6, logical block 0, async page read [ 181.880304][ T6892] Buffer I/O error on dev loop6, logical block 0, async page read [ 182.086796][ T6892] Buffer I/O error on dev loop6, logical block 0, async page read [ 182.167478][ T6892] ldm_validate_partition_table(): Disk read failed. [ 182.220947][ T6892] Buffer I/O error on dev loop6, logical block 0, async page read [ 182.250519][ T6892] Buffer I/O error on dev loop6, logical block 0, async page read [ 182.260398][ T6892] Dev loop6: unable to read RDB block 0 [ 182.293559][ T6623] hsr_slave_0: entered promiscuous mode [ 182.324539][ T6892] loop6: unable to read partition table [ 182.327370][ T6623] hsr_slave_1: entered promiscuous mode [ 182.349045][ T6892] loop_reread_partitions: partition scan of loop6 (3 ) failed (rc=-5) [ 182.369859][ T6623] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 182.395774][ T6623] Cannot create hsr debugfs directory [ 182.496139][ T10] usb 1-1: new full-speed USB device number 4 using dummy_hcd [ 182.690862][ T10] usb 1-1: config 17 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 182.729891][ T10] usb 1-1: config 17 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 182.785225][ T10] usb 1-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 182.826090][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 183.077897][ T10] aiptek 1-1:17.0: Aiptek using 400 ms programming speed [ 183.146260][ T10] input: Aiptek as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:17.0/input/input7 [ 183.247942][ T10] input: failed to attach handler kbd to device input7, error: -5 [ 183.275825][ T6909] (unnamed net_device) (uninitialized): option arp_interval: mode dependency failed, not supported in mode balance-alb(6) [ 183.315849][ T10] usb 1-1: USB disconnect, device number 4 [ 183.602348][ T6623] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 183.660160][ T6623] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 183.735130][ T6623] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 184.880204][ T6623] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 186.247946][ T6623] 8021q: adding VLAN 0 to HW filter on device bond0 [ 186.378679][ T6953] blktrace: Concurrent blktraces are not allowed on nullb0 [ 187.033550][ T6922] Bluetooth: MGMT ver 1.23 [ 187.051756][ T6623] 8021q: adding VLAN 0 to HW filter on device team0 [ 187.150031][ T3522] bridge0: port 1(bridge_slave_0) entered blocking state [ 187.157272][ T3522] bridge0: port 1(bridge_slave_0) entered forwarding state [ 187.239484][ T3522] bridge0: port 2(bridge_slave_1) entered blocking state [ 187.246837][ T3522] bridge0: port 2(bridge_slave_1) entered forwarding state [ 187.450955][ T6961] ICMPv6: Received fragmented ndisc packet. Carefully consider disabling suppress_frag_ndisc. [ 188.369281][ T9] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 188.392479][ T6964] netlink: 4 bytes leftover after parsing attributes in process `syz.2.209'. [ 188.426635][ T6961] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 188.445149][ T30] audit: type=1326 audit(1755897579.128:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6967 comm="syz.4.212" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff0f318ebe9 code=0x7ffc0000 [ 188.511166][ T6961] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 188.650687][ T30] audit: type=1326 audit(1755897579.128:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6967 comm="syz.4.212" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff0f318ebe9 code=0x7ffc0000 [ 188.709088][ T30] audit: type=1326 audit(1755897579.128:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6967 comm="syz.4.212" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff0f318ebe9 code=0x7ffc0000 [ 188.746997][ T6964] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 188.768333][ T9] usb 1-1: config 0 has an invalid interface number: 114 but max is 0 [ 188.783258][ T9] usb 1-1: config 0 has no interface number 0 [ 188.791254][ T9] usb 1-1: too many endpoints for config 0 interface 114 altsetting 111: 97, using maximum allowed: 30 [ 188.811124][ T30] audit: type=1326 audit(1755897579.158:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6967 comm="syz.4.212" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7ff0f318d550 code=0x7ffc0000 [ 188.850439][ T9] usb 1-1: config 0 interface 114 altsetting 111 has 0 endpoint descriptors, different from the interface descriptor's value: 97 [ 188.867969][ T6973] netlink: 8 bytes leftover after parsing attributes in process `syz.4.213'. [ 188.896103][ T30] audit: type=1326 audit(1755897579.158:14): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6967 comm="syz.4.212" exe="/root/syz-executor" sig=0 arch=c000003e syscall=308 compat=0 ip=0x7ff0f3190417 code=0x7ffc0000 [ 188.928474][ T6964] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 188.936334][ T9] usb 1-1: config 0 interface 114 has no altsetting 0 [ 188.943707][ T9] usb 1-1: New USB device found, idVendor=1235, idProduct=0018, bcdDevice=f0.ee [ 188.969127][ T30] audit: type=1326 audit(1755897579.158:15): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6967 comm="syz.4.212" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7ff0f318ebe9 code=0x7ffc0000 [ 188.992205][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 189.053935][ T30] audit: type=1326 audit(1755897579.158:16): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6967 comm="syz.4.212" exe="/root/syz-executor" sig=0 arch=c000003e syscall=308 compat=0 ip=0x7ff0f3190417 code=0x7ffc0000 [ 189.075581][ C1] vkms_vblank_simulate: vblank timer overrun [ 189.084503][ T6975] tmpfs: Bad value for 'mpol' [ 189.094793][ T9] usb 1-1: config 0 descriptor?? [ 189.146051][ T30] audit: type=1326 audit(1755897579.158:17): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6967 comm="syz.4.212" exe="/root/syz-executor" sig=0 arch=c000003e syscall=3 compat=0 ip=0x7ff0f318d84a code=0x7ffc0000 [ 189.190812][ T30] audit: type=1326 audit(1755897579.158:18): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6967 comm="syz.4.212" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff0f318ebe9 code=0x7ffc0000 [ 189.213377][ C1] vkms_vblank_simulate: vblank timer overrun [ 189.223435][ T6623] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 189.276314][ T30] audit: type=1326 audit(1755897579.158:19): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6967 comm="syz.4.212" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff0f318ebe9 code=0x7ffc0000 [ 189.286034][ T6623] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 189.351225][ T6977] syz.4.215: attempt to access beyond end of device [ 189.351225][ T6977] nbd4: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 189.460722][ T6986] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 189.461276][ T6986] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 189.866979][ T6979] netlink: 40 bytes leftover after parsing attributes in process `syz.4.215'. [ 189.867722][ T6979] bridge0: port 2(bridge_slave_1) entered disabled state [ 190.069192][ T6979] bridge0: port 2(bridge_slave_1) entered disabled state [ 191.015787][ T9] usb 1-1: string descriptor 0 read error: -71 [ 191.018360][ T7010] blktrace: Concurrent blktraces are not allowed on nullb0 [ 191.121805][ T9] usb 1-1: USB disconnect, device number 5 [ 191.251753][ T5890] udevd[5890]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.114/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 192.046127][ T6623] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 192.741474][ T7033] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2829720175 (181102091200 ns) > initial count (136273899840 ns). Using initial count to start timer. [ 193.923133][ T7039] ptm ptm1: ldisc open failed (-12), clearing slot 1 [ 194.211088][ T7046] 9pnet_fd: Insufficient options for proto=fd [ 195.123932][ T5849] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 195.364054][ T5849] usb 2-1: Using ep0 maxpacket: 16 [ 195.376799][ T5849] usb 2-1: unable to get BOS descriptor or descriptor too short [ 195.442312][ T5849] usb 2-1: config 2 has an invalid interface number: 22 but max is 0 [ 195.931292][ T5849] usb 2-1: config 2 has no interface number 0 [ 195.974076][ T5849] usb 2-1: config 2 interface 22 has no altsetting 0 [ 196.063483][ T5849] usb 2-1: New USB device found, idVendor=0451, idProduct=5416, bcdDevice= 1.00 [ 196.103953][ T5849] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 196.213048][ T5849] usb 2-1: Product: syz [ 196.259764][ T5849] usb 2-1: Manufacturer: syz [ 196.299109][ T5849] usb 2-1: SerialNumber: syz [ 196.539585][ T7064] 9pnet: p9_errstr2errno: server reported unknown error @0x0000000000000006 [ 196.757033][ T5849] usb-storage 2-1:2.22: USB Mass Storage device detected [ 196.822667][ T5849] usb-storage 2-1:2.22: Quirks match for vid 0451 pid 5416: 2 [ 196.870524][ T6623] veth0_vlan: entered promiscuous mode [ 196.902306][ T6623] veth1_vlan: entered promiscuous mode [ 197.039923][ T5849] usb 2-1: USB disconnect, device number 14 [ 197.200365][ T6623] veth0_macvtap: entered promiscuous mode [ 197.390305][ T6623] veth1_macvtap: entered promiscuous mode [ 197.423077][ T6623] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 197.817712][ T6623] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 197.911797][ T7084] fanotify: failed to encode fid (type=0, len=0, err=-2) [ 197.921214][ T6623] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 197.931146][ T6623] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 198.000444][ T6623] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 198.044543][ T6623] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 198.237288][ T7089] blktrace: Concurrent blktraces are not allowed on nullb0 [ 199.264382][ T7105] hsr0: entered allmulticast mode [ 199.292270][ T7105] hsr_slave_0: entered allmulticast mode [ 199.322422][ T5835] syz-executor (5835) used greatest stack depth: 20024 bytes left [ 199.342264][ T7105] hsr_slave_1: entered allmulticast mode [ 199.577287][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 199.583884][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 200.337106][ T7106] hsr_slave_0: left promiscuous mode [ 200.348924][ T7106] hsr_slave_1: left promiscuous mode [ 200.439408][ T7106] hsr0 (unregistering): left allmulticast mode [ 200.524462][ T2996] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 200.557143][ T2996] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 200.738739][ T2970] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 201.128937][ T5906] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 201.398292][ T5906] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 201.431418][ T5906] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 201.432510][ T2970] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 201.464471][ T5906] usb 3-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 201.500269][ T5906] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 201.544243][ T5906] usb 3-1: config 0 descriptor?? [ 201.558561][ T2996] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 201.609528][ T2996] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 201.865019][ T7132] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2829720175 (181102091200 ns) > initial count (136273899840 ns). Using initial count to start timer. [ 203.599356][ T5906] keytouch 0003:0926:3333.0004: fixing up Keytouch IEC report descriptor [ 203.886341][ T9] usb 5-1: new full-speed USB device number 6 using dummy_hcd [ 204.120613][ T5906] input: HID 0926:3333 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:0926:3333.0004/input/input10 [ 204.231106][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0xD has invalid wMaxPacketSize 0 [ 204.340485][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 204.481173][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0xD has invalid wMaxPacketSize 0 [ 204.582171][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 204.714374][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0xD has invalid wMaxPacketSize 0 [ 204.898787][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 204.911184][ T2970] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 205.025865][ T9] usb 5-1: New USB device found, idVendor=0451, idProduct=5152, bcdDevice=c0.b9 [ 205.084441][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 205.103702][ T5840] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 205.123117][ T5840] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 205.137273][ T5840] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 205.154643][ T5840] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 205.163367][ T5906] keytouch 0003:0926:3333.0004: input,hidraw0: USB HID v0.00 Keyboard [HID 0926:3333] on usb-dummy_hcd.2-1/input0 [ 205.163384][ T5840] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 205.187226][ T9] usb 5-1: Product: syz [ 205.208199][ T9] usb 5-1: Manufacturer: syz [ 205.232935][ T9] usb 5-1: SerialNumber: syz [ 205.304795][ T9] usb 5-1: config 0 descriptor?? [ 205.316711][ T5906] usb 3-1: USB disconnect, device number 8 [ 205.703593][ T2970] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 205.781391][ T9] ti_usb_3410_5052 5-1:0.0: TI USB 5052 2 port adapter converter detected [ 205.960228][ T7152] blktrace: Concurrent blktraces are not allowed on nullb0 [ 206.009290][ T9] ti_usb_3410_5052 5-1:0.0: missing endpoints [ 206.483092][ T9] usb 5-1: USB disconnect, device number 6 [ 206.609089][ T7149] fido_id[7149]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/3-1/report_descriptor': No such file or directory [ 207.003292][ T7162] fuse: Unknown parameter '' [ 207.019397][ T30] kauditd_printk_skb: 14 callbacks suppressed [ 207.019417][ T30] audit: type=1800 audit(1755897597.698:34): pid=7162 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz.5.132" name="file1" dev="tmpfs" ino=19 res=0 errno=0 [ 207.235849][ T2970] bridge_slave_1: left allmulticast mode [ 207.243116][ T5840] Bluetooth: hci1: command tx timeout [ 207.267739][ T2970] bridge_slave_1: left promiscuous mode [ 207.275114][ T2970] bridge0: port 2(bridge_slave_1) entered disabled state [ 207.290955][ T2970] bridge_slave_0: left allmulticast mode [ 207.298688][ T2970] bridge_slave_0: left promiscuous mode [ 207.304698][ T2970] bridge0: port 1(bridge_slave_0) entered disabled state [ 207.736046][ T43] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 207.899891][ T43] usb 5-1: config 0 has an invalid interface number: 91 but max is 0 [ 207.909460][ T43] usb 5-1: config 0 has no interface number 0 [ 207.928214][ T43] usb 5-1: New USB device found, idVendor=05ac, idProduct=a9d2, bcdDevice=95.16 [ 207.945999][ T43] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 207.964541][ T43] usb 5-1: Product: syz [ 207.970024][ T43] usb 5-1: Manufacturer: syz [ 207.985367][ T43] usb 5-1: SerialNumber: syz [ 208.070668][ T43] usb 5-1: config 0 descriptor?? [ 208.534609][ T2970] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 208.549477][ T2970] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 208.567045][ T2970] bond0 (unregistering): Released all slaves [ 208.618293][ T7169] netlink: 'syz.4.249': attribute type 29 has an invalid length. [ 208.654507][ T7191] netlink: 8 bytes leftover after parsing attributes in process `syz.2.252'. [ 208.678414][ T6026] usb 5-1: USB disconnect, device number 7 [ 208.745501][ T7191] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 208.755342][ T7191] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 208.764836][ T7191] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 208.773677][ T7191] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 209.386293][ T5840] Bluetooth: hci1: command tx timeout [ 210.724898][ T7210] blktrace: Concurrent blktraces are not allowed on nullb0 [ 211.397900][ T5840] Bluetooth: hci1: command tx timeout [ 212.319361][ T7143] chnl_net:caif_netlink_parms(): no params data found [ 213.476640][ T5840] Bluetooth: hci1: command tx timeout [ 213.904193][ T7229] netlink: 12 bytes leftover after parsing attributes in process `syz.4.260'. [ 214.514210][ T7225] vti0: entered promiscuous mode [ 214.641170][ T2970] hsr_slave_0: left promiscuous mode [ 214.696730][ T2970] hsr_slave_1: left promiscuous mode [ 214.762224][ T43] Process accounting resumed [ 214.854211][ T7237] Process accounting resumed [ 214.874429][ T2970] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 214.901181][ T2970] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 214.945420][ T2970] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 214.984027][ T2970] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 215.071573][ T2970] veth1_macvtap: left promiscuous mode [ 215.091735][ T2970] veth0_macvtap: left promiscuous mode [ 215.399175][ T7254] netlink: 12 bytes leftover after parsing attributes in process `syz.2.266'. [ 215.734818][ T2970] team0 (unregistering): Port device team_slave_1 removed [ 215.779880][ T2970] team0 (unregistering): Port device team_slave_0 removed [ 216.189171][ T7247] netlink: 8 bytes leftover after parsing attributes in process `syz.4.264'. [ 216.298182][ T7256] netlink: 4 bytes leftover after parsing attributes in process `syz.2.266'. [ 217.656833][ T7276] blktrace: Concurrent blktraces are not allowed on nullb0 [ 218.587199][ T7143] bridge0: port 1(bridge_slave_0) entered blocking state [ 218.666678][ T7143] bridge0: port 1(bridge_slave_0) entered disabled state [ 218.692406][ T7143] bridge_slave_0: entered allmulticast mode [ 219.027703][ T7143] bridge_slave_0: entered promiscuous mode [ 219.144320][ T7143] bridge0: port 2(bridge_slave_1) entered blocking state [ 219.193941][ T7143] bridge0: port 2(bridge_slave_1) entered disabled state [ 219.224926][ T7143] bridge_slave_1: entered allmulticast mode [ 219.272595][ T7143] bridge_slave_1: entered promiscuous mode [ 219.516876][ T43] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 219.700650][ T43] usb 1-1: Using ep0 maxpacket: 16 [ 219.744311][ T43] usb 1-1: config 232 has an invalid descriptor of length 0, skipping remainder of the config [ 219.790947][ T43] usb 1-1: config 232 has 0 interfaces, different from the descriptor's value: 1 [ 219.847106][ T43] usb 1-1: New USB device found, idVendor=044a, idProduct=07da, bcdDevice=9a.fc [ 219.884233][ T43] usb 1-1: New USB device strings: Mfr=178, Product=111, SerialNumber=108 [ 219.899847][ T7143] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 219.918050][ T43] usb 1-1: Product: syz [ 219.922318][ T43] usb 1-1: Manufacturer: syz [ 219.945479][ T43] usb 1-1: SerialNumber: syz [ 219.985873][ T7143] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 220.243100][ T7288] atomic_op ffff88807f06b198 conn xmit_atomic 0000000000000000 [ 220.291469][ T7143] team0: Port device team_slave_0 added [ 220.309885][ T43] usb 1-1: USB disconnect, device number 6 [ 220.335736][ T7143] team0: Port device team_slave_1 added [ 220.494934][ T7143] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 220.522182][ T7143] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 220.579474][ T7143] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 220.608201][ T7143] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 220.615225][ T7143] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 220.656349][ T6026] usb 5-1: new full-speed USB device number 8 using dummy_hcd [ 220.686934][ T7143] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 220.894252][ T6026] usb 5-1: config 0 has an invalid interface number: 52 but max is 0 [ 221.036516][ T6026] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 221.214480][ T7143] hsr_slave_0: entered promiscuous mode [ 221.264338][ T6026] usb 5-1: config 0 has no interface number 0 [ 221.377984][ T7143] hsr_slave_1: entered promiscuous mode [ 221.396353][ T6026] usb 5-1: config 0 interface 52 altsetting 1 has an endpoint descriptor with address 0x13, changing to 0x3 [ 221.416037][ T6026] usb 5-1: config 0 interface 52 altsetting 1 endpoint 0x3 has an invalid bInterval 0, changing to 10 [ 221.468671][ T6026] usb 5-1: config 0 interface 52 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 221.506894][ T6026] usb 5-1: config 0 interface 52 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 221.529973][ T6026] usb 5-1: config 0 interface 52 has no altsetting 0 [ 221.559049][ T6026] usb 5-1: New USB device found, idVendor=06cb, idProduct=0007, bcdDevice= 0.00 [ 221.571115][ T6026] usb 5-1: New USB device strings: Mfr=0, Product=149, SerialNumber=35 [ 221.579574][ T6026] usb 5-1: Product: syz [ 221.625265][ T6026] usb 5-1: SerialNumber: syz [ 221.650783][ T6026] usb 5-1: config 0 descriptor?? [ 222.138881][ T6026] usb 5-1: USB disconnect, device number 8 [ 222.990204][ T7341] blktrace: Concurrent blktraces are not allowed on nullb0 [ 223.646411][ T7143] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 223.690712][ T7143] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 223.731682][ T7143] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 223.773927][ T7143] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 223.896327][ T5849] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 223.947212][ T7375] netlink: 8 bytes leftover after parsing attributes in process `syz.4.288'. [ 224.096636][ T5849] usb 3-1: Using ep0 maxpacket: 8 [ 224.111541][ T7143] 8021q: adding VLAN 0 to HW filter on device bond0 [ 224.130032][ T5849] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 224.171856][ T5849] usb 3-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 224.194545][ T5849] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 224.227383][ T7143] 8021q: adding VLAN 0 to HW filter on device team0 [ 224.243113][ T6085] bridge0: port 1(bridge_slave_0) entered blocking state [ 224.250446][ T6085] bridge0: port 1(bridge_slave_0) entered forwarding state [ 224.304278][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 224.311580][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 224.437929][ T5849] usb 3-1: config 0 descriptor?? [ 224.456277][ T6026] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 225.321118][ T5849] iowarrior 3-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 225.850068][ T6026] usb 6-1: config 0 has no interfaces? [ 225.855849][ T6026] usb 6-1: New USB device found, idVendor=055f, idProduct=c420, bcdDevice=6a.33 [ 225.885989][ T6026] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 225.962839][ T7395] blktrace: Concurrent blktraces are not allowed on nullb0 [ 226.115294][ T6026] usb 6-1: config 0 descriptor?? [ 226.494407][ T7402] netlink: 'syz.0.293': attribute type 1 has an invalid length. [ 226.520016][ T7402] netlink: 208 bytes leftover after parsing attributes in process `syz.0.293'. [ 226.532966][ T7402] netlink: 'syz.0.293': attribute type 1 has an invalid length. [ 226.586519][ T7402] netlink: 'syz.0.293': attribute type 2 has an invalid length. [ 226.847220][ T7407] netlink: 452 bytes leftover after parsing attributes in process `syz.4.294'. [ 226.953560][ T7143] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 227.119534][ T9] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 227.297680][ T9] usb 5-1: Using ep0 maxpacket: 16 [ 227.322559][ T9] usb 5-1: config 1 interface 0 has no altsetting 0 [ 227.342701][ T9] usb 5-1: New USB device found, idVendor=05ac, idProduct=02e6, bcdDevice= 0.40 [ 227.358942][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 227.368602][ T6026] usb 6-1: USB disconnect, device number 2 [ 227.382594][ T9] usb 5-1: Product: syz [ 227.425308][ T10] usb 3-1: USB disconnect, device number 9 [ 227.456953][ T9] usb 5-1: Manufacturer: syz [ 227.484971][ T9] usb 5-1: SerialNumber: syz [ 227.592475][ T7430] random: crng reseeded on system resumption [ 227.799735][ T7143] veth0_vlan: entered promiscuous mode [ 227.833388][ T7143] veth1_vlan: entered promiscuous mode [ 227.877167][ T7407] nvme_fabrics: missing parameter 'transport=%s' [ 227.894831][ T7407] nvme_fabrics: missing parameter 'nqn=%s' [ 227.971125][ T9] usbhid 5-1:1.0: can't add hid device: -71 [ 227.986394][ T7143] veth0_macvtap: entered promiscuous mode [ 227.996213][ T9] usbhid 5-1:1.0: probe with driver usbhid failed with error -71 [ 228.002855][ T7143] veth1_macvtap: entered promiscuous mode [ 228.035264][ T9] usb 5-1: USB disconnect, device number 9 [ 228.144273][ T7143] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 228.367280][ T7143] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 228.397781][ T7452] netlink: 'syz.5.299': attribute type 1 has an invalid length. [ 229.107347][ T7452] netlink: 'syz.5.299': attribute type 6 has an invalid length. [ 229.115140][ T7452] netlink: 224 bytes leftover after parsing attributes in process `syz.5.299'. [ 229.277388][ T7143] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 229.294196][ T7143] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 229.492434][ T7143] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 229.896114][ T7143] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 230.334694][ T7464] blktrace: Concurrent blktraces are not allowed on nullb0 [ 231.579179][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 231.673891][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 232.307192][ T6085] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 232.449786][ T6085] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 235.714741][ T7517] netlink: 'syz.5.312': attribute type 8 has an invalid length. [ 235.864080][ T7522] blktrace: Concurrent blktraces are not allowed on nullb0 [ 238.424528][ T7534] Bluetooth: MGMT ver 1.23 [ 239.207617][ T7536] netlink: 'syz.0.316': attribute type 1 has an invalid length. [ 240.098044][ T7536] netlink: 'syz.0.316': attribute type 2 has an invalid length. [ 240.137516][ T7536] netlink: 4 bytes leftover after parsing attributes in process `syz.0.316'. [ 242.257236][ T7576] netlink: 'syz.6.324': attribute type 10 has an invalid length. [ 242.265416][ T7576] netlink: 156 bytes leftover after parsing attributes in process `syz.6.324'. [ 244.834276][ T7610] netlink: 36 bytes leftover after parsing attributes in process `syz.5.334'. [ 246.412180][ T7628] netlink: 24 bytes leftover after parsing attributes in process `syz.6.340'. [ 248.768781][ T5840] Bluetooth: hci1: SCO packet for unknown connection handle 100 [ 248.996729][ T7661] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 249.015843][ T7661] overlayfs: failed to set xattr on upper [ 249.095209][ T7661] overlayfs: ...falling back to redirect_dir=nofollow. [ 249.127753][ T7664] loop2: detected capacity change from 0 to 7 [ 249.659751][ T7670] netlink: 36 bytes leftover after parsing attributes in process `syz.6.349'. [ 249.807875][ T7664] Dev loop2: unable to read RDB block 7 [ 250.209431][ T7664] loop2: unable to read partition table [ 250.285061][ T7664] loop2: partition table beyond EOD, truncated [ 250.333329][ T7664] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 250.355720][ T7671] workqueue: Failed to create a rescuer kthread for wq "ceph-completion": -EINTR [ 250.433729][ T7672] ceph: No mds server is up or the cluster is laggy [ 250.434659][ T5849] libceph: connect (1)[c::]:6789 error -101 [ 250.612604][ T5849] libceph: mon0 (1)[c::]:6789 connect error [ 250.942809][ T5849] libceph: connect (1)[c::]:6789 error -101 [ 250.994916][ T5849] libceph: mon0 (1)[c::]:6789 connect error [ 253.483002][ T7699] tipc: Started in network mode [ 253.598372][ T7699] tipc: Node identity 0000000000005f2d87af00000000003a, cluster identity 4711 [ 253.686569][ T7699] tipc: Enabling of bearer rejected, failed to enable media [ 254.506275][ T5898] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 254.719210][ T5898] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 254.760730][ T5898] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 254.870071][ T5898] usb 5-1: New USB device found, idVendor=054c, idProduct=0df2, bcdDevice=d6.af [ 254.986970][ T5898] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 255.231967][ T5898] usb 5-1: config 0 descriptor?? [ 255.333927][ T7719] netlink: 36 bytes leftover after parsing attributes in process `syz.2.361'. [ 255.989995][ T7713] delete_channel: no stack [ 256.205316][ T5898] playstation 0003:054C:0DF2.0005: unknown main item tag 0x0 [ 256.218972][ T7729] netlink: 8 bytes leftover after parsing attributes in process `syz.5.363'. [ 256.280269][ T5898] playstation 0003:054C:0DF2.0005: unknown main item tag 0x0 [ 256.306520][ T5898] playstation 0003:054C:0DF2.0005: unknown main item tag 0x0 [ 256.341831][ T5898] playstation 0003:054C:0DF2.0005: unknown main item tag 0x0 [ 256.390866][ T5898] playstation 0003:054C:0DF2.0005: unknown main item tag 0x0 [ 256.462888][ T5898] playstation 0003:054C:0DF2.0005: hidraw0: USB HID v1.01 Device [HID 054c:0df2] on usb-dummy_hcd.4-1/input0 [ 256.496211][ T9] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 256.574395][ T5898] playstation 0003:054C:0DF2.0005: Invalid byte count transferred, expected 20 got 0 [ 256.647699][ T5898] playstation 0003:054C:0DF2.0005: Failed to retrieve DualSense pairing info: -22 [ 256.672627][ T5898] playstation 0003:054C:0DF2.0005: Failed to get MAC address from DualSense [ 256.686245][ T5898] playstation 0003:054C:0DF2.0005: Failed to create dualsense. [ 256.765276][ T5898] playstation 0003:054C:0DF2.0005: probe with driver playstation failed with error -22 [ 256.828563][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 47, changing to 9 [ 256.944290][ T5906] usb 5-1: USB disconnect, device number 10 [ 256.980715][ T9] usb 3-1: New USB device found, idVendor=24d2, idProduct=6007, bcdDevice= 0.00 [ 257.000593][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=22 [ 257.031759][ T9] usb 3-1: SerialNumber: syz [ 257.068469][ T9] usb 3-1: config 0 descriptor?? [ 258.340302][ T9] usbhid 3-1:0.0: can't add hid device: -71 [ 258.362419][ T9] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 258.393872][ T9] usb 3-1: USB disconnect, device number 10 [ 259.626174][ T9] usb 3-1: new full-speed USB device number 11 using dummy_hcd [ 259.825176][ T9] usb 3-1: config 0 has no interfaces? [ 259.845863][ T9] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 259.857199][ T7777] netlink: 'syz.5.372': attribute type 1 has an invalid length. [ 259.876667][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 259.902698][ T7771] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 259.951901][ T9] usb 3-1: config 0 descriptor?? [ 259.955339][ T7777] 8021q: adding VLAN 0 to HW filter on device bond1 [ 260.170130][ T7786] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 260.635131][ T6026] usb 3-1: USB disconnect, device number 11 [ 260.669806][ T7785] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 261.001611][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 261.008377][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 261.683269][ T7812] netlink: 'syz.4.379': attribute type 30 has an invalid length. [ 261.736357][ T7816] xt_TPROXY: Can be used only with -p tcp or -p udp [ 261.747239][ T6026] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 261.771166][ T7818] syz.0.376: attempt to access beyond end of device [ 261.771166][ T7818] nbd0: rw=0, sector=0, nr_sectors = 8 limit=0 [ 261.934629][ T6026] usb 7-1: device descriptor read/64, error -71 [ 262.526175][ T6026] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 263.166328][ T6026] usb 7-1: device descriptor read/64, error -71 [ 263.301734][ T7835] blktrace: Concurrent blktraces are not allowed on nullb0 [ 263.323438][ T6026] usb usb7-port1: attempt power cycle [ 263.755016][ T7837] blktrace: Concurrent blktraces are not allowed on nullb0 [ 263.808840][ T6026] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 264.041371][ T6026] usb 7-1: device descriptor read/8, error -71 [ 264.306206][ T6026] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 264.953206][ T6026] usb 7-1: device descriptor read/8, error -71 [ 265.096465][ T6026] usb usb7-port1: unable to enumerate USB device [ 265.368905][ T5956] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 265.910272][ T7877] netlink: 12 bytes leftover after parsing attributes in process `syz.2.391'. [ 266.690241][ T5956] usb 1-1: Using ep0 maxpacket: 8 [ 266.702955][ T5956] usb 1-1: config 0 has too many interfaces: 65, using maximum allowed: 32 [ 266.716156][ T5956] usb 1-1: config 0 has an invalid interface number: 150 but max is 64 [ 267.414745][ T5956] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 267.425337][ T5956] usb 1-1: config 0 has 2 interfaces, different from the descriptor's value: 65 [ 267.436061][ T5956] usb 1-1: config 0 has no interface number 0 [ 267.445566][ T5956] usb 1-1: config 0 interface 150 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 267.553170][ T5956] usb 1-1: config 0 interface 150 has no altsetting 0 [ 267.562093][ T5956] usb 1-1: New USB device found, idVendor=1395, idProduct=0300, bcdDevice=81.75 [ 267.574337][ T5956] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 267.586739][ T5956] usb 1-1: config 0 descriptor?? [ 268.097278][ T5956] usb 1-1: USB disconnect, device number 7 [ 268.236666][ T7896] blktrace: Concurrent blktraces are not allowed on nullb0 [ 269.031720][ T7901] netlink: 28 bytes leftover after parsing attributes in process `syz.4.396'. [ 271.113846][ T7922] tmpfs: Bad value for 'mpol' [ 271.177001][ T7924] tmpfs: Bad value for 'mpol' [ 271.298610][ T7927] bond0: option active_slave: mode dependency failed, not supported in mode balance-rr(0) [ 271.469262][ T7927] syz.0.403 (7927) used greatest stack depth: 15960 bytes left [ 272.109224][ T7942] netlink: 12 bytes leftover after parsing attributes in process `syz.4.407'. [ 272.983403][ T7957] blktrace: Concurrent blktraces are not allowed on nullb0 [ 273.696527][ T7965] netlink: 8 bytes leftover after parsing attributes in process `syz.4.413'. [ 273.852230][ T7960] capability: warning: `syz.6.410' uses 32-bit capabilities (legacy support in use) [ 274.188533][ T7967] netlink: 24 bytes leftover after parsing attributes in process `syz.5.412'. [ 275.464814][ T7979] netlink: 68 bytes leftover after parsing attributes in process `syz.4.418'. [ 276.814990][ T7995] netlink: 20 bytes leftover after parsing attributes in process `syz.0.420'. [ 277.337048][ T7998] netlink: 12 bytes leftover after parsing attributes in process `syz.6.421'. [ 278.377376][ T8015] netlink: 4 bytes leftover after parsing attributes in process `syz.5.427'. [ 278.697913][ T8019] blktrace: Concurrent blktraces are not allowed on nullb0 [ 280.666018][ T30] audit: type=1326 audit(1755897671.328:35): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8039 comm="syz.5.430" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fb2f5b8ebe9 code=0x0 [ 282.267751][ T8051] overlayfs: failed to resolve './file1': -2 [ 282.401704][ T5906] IPVS: starting estimator thread 0... [ 282.538040][ T8057] IPVS: using max 28 ests per chain, 67200 per kthread [ 282.638749][ T8059] trusted_key: encrypted_key: master key parameter '00N004093' is invalid [ 282.672525][ T8059] trusted_key: encrypted_key: master key parameter '00N004093' is invalid [ 283.557470][ T5845] Bluetooth: hci3: command 0x0406 tx timeout [ 283.577964][ T8064] netlink: 12 bytes leftover after parsing attributes in process `syz.0.434'. [ 284.646095][ T5898] usb 5-1: new full-speed USB device number 11 using dummy_hcd [ 285.071172][ T5898] usb 5-1: not running at top speed; connect to a high speed hub [ 285.165402][ T5898] usb 5-1: config 0 has no interfaces? [ 285.235861][ T5898] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 285.282283][ T5898] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 285.317702][ T5898] usb 5-1: Product: syz [ 285.333466][ T5898] usb 5-1: Manufacturer: syz [ 285.351255][ T5898] usb 5-1: SerialNumber: syz [ 285.392785][ T5898] usb 5-1: config 0 descriptor?? [ 285.507073][ T8096] xt_CT: No such helper "syz0" [ 285.637300][ T5898] usb 5-1: USB disconnect, device number 11 [ 286.575960][ T30] audit: type=1326 audit(1755897677.258:36): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8109 comm="syz.0.443" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fa08db8ebe9 code=0x0 [ 286.598203][ C1] vkms_vblank_simulate: vblank timer overrun [ 288.496911][ T8137] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2411458264 (38583332224 ns) > initial count (30882404864 ns). Using initial count to start timer. [ 290.817201][ T8146] netlink: 12 bytes leftover after parsing attributes in process `syz.5.450'. [ 291.746479][ T8157] netlink: 8 bytes leftover after parsing attributes in process `syz.6.451'. [ 291.767948][ T8157] : entered promiscuous mode [ 292.138725][ T8156] ip6t_srh: unknown srh match flags 4000 [ 292.148793][ T8153] syz.2.452: attempt to access beyond end of device [ 292.148793][ T8153] nbd2: rw=0, sector=0, nr_sectors = 1 limit=0 [ 292.176672][ T8153] (syz.2.452,8153,1):ocfs2_get_sector:1714 ERROR: status = -5 [ 292.270882][ T8153] (syz.2.452,8153,0):ocfs2_sb_probe:753 ERROR: status = -5 [ 292.454747][ T8153] (syz.2.452,8153,1):ocfs2_fill_super:989 ERROR: superblock probe failed! [ 292.477036][ T8153] (syz.2.452,8153,1):ocfs2_fill_super:1177 ERROR: status = -5 [ 293.516236][ T30] audit: type=1326 audit(1755897684.188:37): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8172 comm="syz.5.457" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fb2f5b8ebe9 code=0x0 [ 294.998060][ T8191] netlink: 4 bytes leftover after parsing attributes in process `syz.5.460'. [ 295.196140][ T10] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 295.386235][ T5898] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 295.396380][ T10] usb 3-1: Using ep0 maxpacket: 16 [ 295.423670][ T10] usb 3-1: New USB device found, idVendor=061d, idProduct=c020, bcdDevice=9c.15 [ 295.467541][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 295.501765][ T10] usb 3-1: Product: syz [ 295.511898][ T10] usb 3-1: Manufacturer: syz [ 295.514686][ T8197] mmap: syz.6.456 (8197) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 295.531026][ T10] usb 3-1: SerialNumber: syz [ 295.556512][ T5898] usb 6-1: Using ep0 maxpacket: 16 [ 295.569365][ T5898] usb 6-1: config 0 has an invalid interface number: 126 but max is 0 [ 295.580901][ T5898] usb 6-1: config 0 has an invalid descriptor of length 57, skipping remainder of the config [ 295.596077][ T5898] usb 6-1: config 0 has no interface number 0 [ 295.606015][ T5898] usb 6-1: config 0 interface 126 altsetting 0 has an endpoint descriptor with address 0xB7, changing to 0x87 [ 295.617075][ T10] usb 3-1: config 0 descriptor?? [ 295.625952][ T5898] usb 6-1: config 0 interface 126 altsetting 0 endpoint 0x87 has invalid maxpacket 34328, setting to 1024 [ 295.806022][ T5898] usb 6-1: config 0 interface 126 altsetting 0 endpoint 0xA has invalid maxpacket 512, setting to 64 [ 295.829541][ T10] ssu100 3-1:0.0: Quatech SSU-100 USB to Serial Driver converter detected [ 295.839639][ T5898] usb 6-1: config 0 interface 126 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 296.525982][ T5898] usb 6-1: config 0 interface 126 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 0 [ 296.561688][ T5898] usb 6-1: config 0 interface 126 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 296.596594][ T5956] usb 5-1: new full-speed USB device number 12 using dummy_hcd [ 296.656056][ T5898] usb 6-1: New USB device found, idVendor=0763, idProduct=1015, bcdDevice=56.88 [ 296.665844][ T5898] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 296.838988][ T8207] netlink: 12 bytes leftover after parsing attributes in process `syz.6.463'. [ 296.858955][ T5956] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 296.908827][ T5956] usb 5-1: New USB device found, idVendor=18b1, idProduct=0037, bcdDevice= 0.00 [ 296.919965][ T5898] usb 6-1: config 0 descriptor?? [ 296.937178][ T8193] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 296.980441][ T5898] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 297.006071][ T5956] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 297.028696][ T5956] usb 5-1: config 0 descriptor?? [ 297.208148][ T5898] snd-usb-audio 6-1:0.126: probe with driver snd-usb-audio failed with error -12 [ 297.260603][ T8189] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 297.277778][ T5898] usb 6-1: USB disconnect, device number 3 [ 297.286191][ T8189] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 299.420243][ T10] ssu100 3-1:0.0: probe with driver ssu100 failed with error -110 [ 301.037077][ T5956] petalynx 0003:18B1:0037.0006: item fetching failed at offset 0/2 [ 301.087812][ T5956] petalynx 0003:18B1:0037.0006: parse failed [ 301.094707][ T5956] petalynx 0003:18B1:0037.0006: probe with driver petalynx failed with error -22 [ 301.109233][ T5956] usb 5-1: USB disconnect, device number 12 [ 301.279502][ T5849] usb 3-1: USB disconnect, device number 12 [ 303.784847][ T8259] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3977454781 (31819638248 ns) > initial count (14852912752 ns). Using initial count to start timer. [ 306.226035][ T5898] usb 6-1: new full-speed USB device number 4 using dummy_hcd [ 306.461795][ T5898] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 306.474577][ T8291] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 306.484301][ T8291] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 306.493536][ T8291] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 306.502470][ T8291] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 306.581997][ T5898] usb 6-1: New USB device found, idVendor=18b1, idProduct=0037, bcdDevice= 0.00 [ 306.612405][ T8291] netdevsim netdevsim0 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 306.622224][ T8291] netdevsim netdevsim0 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 306.631272][ T8291] netdevsim netdevsim0 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 306.640673][ T8291] netdevsim netdevsim0 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 306.668639][ T5898] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 306.724781][ T5898] usb 6-1: config 0 descriptor?? [ 307.174618][ T5898] petalynx 0003:18B1:0037.0007: item fetching failed at offset 0/2 [ 307.249723][ T5898] petalynx 0003:18B1:0037.0007: parse failed [ 307.275654][ T5898] petalynx 0003:18B1:0037.0007: probe with driver petalynx failed with error -22 [ 308.502662][ T5898] usb 6-1: USB disconnect, device number 4 [ 309.348345][ T8320] usb usb8: usbfs: process 8320 (syz.5.484) did not claim interface 0 before use [ 310.433372][ T8345] kvm: user requested TSC rate below hardware speed [ 310.772603][ T5906] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 311.145973][ T5906] usb 3-1: Using ep0 maxpacket: 16 [ 311.173731][ T5906] usb 3-1: config 0 has an invalid interface number: 41 but max is 0 [ 311.196043][ T5906] usb 3-1: config 0 has no interface number 0 [ 311.232869][ T5906] usb 3-1: New USB device found, idVendor=06e1, idProduct=0709, bcdDevice= 2.04 [ 311.276615][ T5906] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 311.328600][ T5906] usb 3-1: Product: syz [ 311.338771][ T5906] usb 3-1: Manufacturer: syz [ 311.354814][ T5906] usb 3-1: SerialNumber: syz [ 311.384813][ T5906] usb 3-1: config 0 descriptor?? [ 311.751279][ T5906] go7007 3-1:0.41: probe with driver go7007 failed with error -12 [ 312.073759][ T5906] usb 3-1: USB disconnect, device number 13 [ 314.748348][ T8378] netlink: 16 bytes leftover after parsing attributes in process `syz.0.496'. [ 315.626253][ T5906] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 315.667469][ T8388] IPVS: stopping backup sync thread 8389 ... [ 315.674890][ T8389] IPVS: sync thread started: state = BACKUP, mcast_ifn = lo, syncid = 5, id = 0 [ 315.789094][ T5906] usb 3-1: Using ep0 maxpacket: 32 [ 315.859883][ T5906] usb 3-1: config 1 interface 0 altsetting 1 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 315.942876][ T5906] usb 3-1: config 1 interface 0 altsetting 1 endpoint 0x2 has invalid wMaxPacketSize 0 [ 315.989889][ T5906] usb 3-1: config 1 interface 0 has no altsetting 0 [ 316.036576][ T5906] usb 3-1: New USB device found, idVendor=0853, idProduct=0148, bcdDevice= 0.40 [ 316.049992][ T5906] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 316.089317][ T5906] usb 3-1: Product: syz [ 316.144583][ T5906] usb 3-1: Manufacturer: syz [ 316.178987][ T5906] usb 3-1: SerialNumber: syz [ 316.700299][ T5906] usbhid 3-1:1.0: can't add hid device: -71 [ 316.718431][ T5906] usbhid 3-1:1.0: probe with driver usbhid failed with error -71 [ 316.815122][ T5906] usb 3-1: USB disconnect, device number 14 [ 318.626322][ T5849] usb 3-1: new full-speed USB device number 15 using dummy_hcd [ 318.735957][ T8437] netlink: 16 bytes leftover after parsing attributes in process `syz.6.508'. [ 319.324254][ T5849] usb 3-1: unable to get BOS descriptor or descriptor too short [ 319.426811][ T8440] netlink: 12 bytes leftover after parsing attributes in process `syz.4.509'. [ 319.462545][ T5849] usb 3-1: not running at top speed; connect to a high speed hub [ 319.495732][ T5849] usb 3-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 319.505822][ T5849] usb 3-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 319.533065][ T5849] usb 3-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 319.554299][ T5849] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid maxpacket 8193, setting to 64 [ 319.605500][ T5849] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 319.631770][ T5849] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 319.652095][ T5849] usb 3-1: Product: syz [ 319.672757][ T5849] usb 3-1: Manufacturer: syz [ 319.716180][ T5849] usb 3-1: SerialNumber: syz [ 319.767563][ T43] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 319.939195][ T43] usb 7-1: Using ep0 maxpacket: 16 [ 320.007448][ T43] usb 7-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 320.029477][ T5849] usb 3-1: 0:2 : does not exist [ 320.195583][ T43] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 320.217206][ T43] usb 7-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 320.229155][ T43] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 320.255268][ T43] usb 7-1: Product: syz [ 320.263158][ T5849] usb 3-1: USB disconnect, device number 15 [ 320.272806][ T43] usb 7-1: Manufacturer: syz [ 320.285251][ T43] usb 7-1: SerialNumber: syz [ 320.318884][ T43] usb 7-1: config 0 descriptor?? [ 320.339856][ T43] em28xx 7-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 320.381718][ T43] em28xx 7-1:0.0: Audio interface 0 found (Vendor Class) [ 320.620637][ T8475] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1140193752 (36486200064 ns) > initial count (8035629696 ns). Using initial count to start timer. [ 320.641639][ T5898] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 320.876267][ T5898] usb 5-1: device descriptor read/64, error -71 [ 321.122701][ T43] em28xx 7-1:0.0: unknown em28xx chip ID (0) [ 321.180249][ T43] em28xx 7-1:0.0: Config register raw data: 0xfffffffb [ 321.196409][ T5898] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 321.455783][ T5898] usb 5-1: device descriptor read/64, error -71 [ 321.703663][ T5898] usb usb5-port1: attempt power cycle [ 321.966635][ T43] em28xx 7-1:0.0: AC97 command still being executed: not handled properly! [ 322.041511][ T43] em28xx 7-1:0.0: Unknown AC97 audio processor detected! [ 322.147827][ T43] em28xx 7-1:0.0: couldn't setup AC97 register 2 [ 322.165136][ T43] em28xx 7-1:0.0: couldn't setup AC97 register 4 [ 322.175290][ T43] em28xx 7-1:0.0: couldn't setup AC97 register 6 [ 322.186654][ T43] em28xx 7-1:0.0: couldn't setup AC97 register 54 [ 322.205193][ T43] em28xx 7-1:0.0: couldn't setup AC97 register 56 [ 322.220866][ T5898] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 322.254630][ T43] usb 7-1: USB disconnect, device number 6 [ 322.273333][ T5898] usb 5-1: device descriptor read/8, error -71 [ 322.636084][ T5928] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 322.823362][ T5898] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 323.433362][ T5898] usb 5-1: device descriptor read/8, error -71 [ 323.526382][ T5928] usb 6-1: Using ep0 maxpacket: 8 [ 323.546737][ T5898] usb usb5-port1: unable to enumerate USB device [ 323.814362][ T5928] usb 6-1: config index 0 descriptor too short (expected 30, got 18) [ 323.900037][ T5928] usb 6-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 323.988034][ T5928] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 324.066414][ T5928] usb 6-1: Product: syz [ 324.070979][ T5928] usb 6-1: Manufacturer: syz [ 324.075726][ T5928] usb 6-1: SerialNumber: syz [ 324.195173][ T8504] netlink: 12 bytes leftover after parsing attributes in process `syz.0.522'. [ 324.319359][ T5928] usb 6-1: config 0 descriptor?? [ 324.375305][ T5928] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 324.384388][ T5928] usb 6-1: setting power ON [ 324.389704][ T5928] dvb-usb: bulk message failed: -22 (2/0) [ 324.407411][ T5928] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 324.446260][ T5928] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 324.531635][ T8488] dvb-usb: bulk message failed: -22 (3/0) [ 324.564477][ T8488] cxusb: i2c rd: len=137 is too big! [ 324.564477][ T8488] [ 324.671652][ T5928] usb 6-1: media controller created [ 324.996456][ T5928] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 325.288382][ T5928] usb 6-1: selecting invalid altsetting 6 [ 325.416074][ T5928] usb 6-1: digital interface selection failed (-22) [ 325.435987][ T5928] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 325.452318][ T5928] usb 6-1: setting power OFF [ 325.471432][ T5928] dvb-usb: bulk message failed: -22 (2/0) [ 325.510782][ T5928] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 325.631377][ T5928] (NULL device *): no alternate interface [ 325.811803][ T5928] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 326.071347][ T5928] usb 6-1: USB disconnect, device number 5 [ 331.759344][ T8596] tipc: Started in network mode [ 331.764566][ T8596] tipc: Node identity f6dd3846fc87, cluster identity 4711 [ 331.778869][ T8596] tipc: Enabled bearer , priority 0 [ 331.841628][ T8597] syzkaller0: entered promiscuous mode [ 331.902759][ T8597] syzkaller0: entered allmulticast mode [ 331.946819][ T8600] netlink: 40 bytes leftover after parsing attributes in process `syz.4.541'. [ 331.957732][ T8600] netlink: 40 bytes leftover after parsing attributes in process `syz.4.541'. [ 332.061769][ T8597] tipc: Resetting bearer [ 332.180612][ T8597] tipc: Disabling bearer [ 332.338675][ T8613] loop6: detected capacity change from 0 to 7 [ 332.499675][ T8613] Dev loop6: unable to read RDB block 7 [ 332.548672][ T8615] netlink: 12 bytes leftover after parsing attributes in process `syz.6.544'. [ 332.781921][ T8613] loop6: AHDI p1 p2 [ 332.856530][ T8613] loop6: partition table partially beyond EOD, truncated [ 332.863771][ T8613] loop6: p1 start 926365495 is beyond EOD, truncated [ 333.469096][ T30] audit: type=1326 audit(1755897724.128:38): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8622 comm="syz.4.546" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff0f318ebe9 code=0x7ffc0000 [ 333.926300][ T30] audit: type=1326 audit(1755897724.128:39): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8622 comm="syz.4.546" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff0f318ebe9 code=0x7ffc0000 [ 334.009973][ T30] audit: type=1326 audit(1755897724.128:40): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8622 comm="syz.4.546" exe="/root/syz-executor" sig=0 arch=c000003e syscall=271 compat=0 ip=0x7ff0f318ebe9 code=0x7ffc0000 [ 334.041586][ T30] audit: type=1326 audit(1755897724.138:41): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8622 comm="syz.4.546" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff0f318ebe9 code=0x7ffc0000 [ 334.068574][ T30] audit: type=1326 audit(1755897724.148:42): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8622 comm="syz.4.546" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff0f318ebe9 code=0x7ffc0000 [ 334.101991][ T30] audit: type=1326 audit(1755897724.308:43): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8622 comm="syz.4.546" exe="/root/syz-executor" sig=0 arch=c000003e syscall=119 compat=0 ip=0x7ff0f318ebe9 code=0x7ffc0000 [ 334.185680][ T30] audit: type=1326 audit(1755897724.308:44): auid=4294967295 uid=0 gid=60929 ses=4294967295 subj=_ pid=8622 comm="syz.4.546" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff0f318ebe9 code=0x7ffc0000 [ 334.254187][ T30] audit: type=1326 audit(1755897724.318:45): auid=4294967295 uid=0 gid=60929 ses=4294967295 subj=_ pid=8622 comm="syz.4.546" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff0f318ebe9 code=0x7ffc0000 [ 334.290328][ T30] audit: type=1326 audit(1755897724.318:46): auid=4294967295 uid=0 gid=60929 ses=4294967295 subj=_ pid=8622 comm="syz.4.546" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7ff0f318ebe9 code=0x7ffc0000 [ 334.349899][ T30] audit: type=1326 audit(1755897724.318:47): auid=4294967295 uid=0 gid=60929 ses=4294967295 subj=_ pid=8622 comm="syz.4.546" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff0f318ebe9 code=0x7ffc0000 [ 334.386354][ T5898] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 334.536316][ T5898] usb 3-1: device descriptor read/64, error -71 [ 334.837565][ T5898] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 335.046738][ T5898] usb 3-1: device descriptor read/64, error -71 [ 335.243144][ T5898] usb usb3-port1: attempt power cycle [ 336.615993][ T5898] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 336.649455][ T5898] usb 3-1: device descriptor read/8, error -71 [ 336.788571][ T8663] syz.4.555 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 336.947493][ T5898] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 337.053277][ T5898] usb 3-1: device descriptor read/8, error -71 [ 337.187848][ T5898] usb usb3-port1: unable to enumerate USB device [ 337.219505][ T8674] netlink: 12 bytes leftover after parsing attributes in process `syz.4.558'. [ 337.629027][ T5898] usb 3-1: new full-speed USB device number 20 using dummy_hcd [ 337.812545][ T5898] usb 3-1: device descriptor read/64, error -71 [ 337.883822][ T8676] tipc: Started in network mode [ 337.899324][ T8676] tipc: Node identity fe496c026d93, cluster identity 4711 [ 337.929654][ T8676] tipc: Enabled bearer , priority 0 [ 337.969034][ T8680] syzkaller0: entered promiscuous mode [ 337.974613][ T8680] syzkaller0: entered allmulticast mode [ 338.162129][ T8682] comedi comedi3: 8255: I/O port conflict (0x5,4) [ 338.190646][ T8682] comedi comedi3: 8255: I/O port conflict (0x4,4) [ 338.211116][ T8682] comedi comedi3: 8255: I/O port conflict (0x1,4) [ 338.229703][ T8682] comedi comedi3: 8255: I/O port conflict (0x5c952399,4) [ 338.240909][ T5898] usb 3-1: new full-speed USB device number 21 using dummy_hcd [ 338.260443][ T8675] tipc: Resetting bearer [ 338.282179][ T8675] tipc: Disabling bearer [ 338.405961][ T5898] usb 3-1: device descriptor read/64, error -71 [ 338.516416][ T5898] usb usb3-port1: attempt power cycle [ 338.866040][ T5898] usb 3-1: new full-speed USB device number 22 using dummy_hcd [ 338.906830][ T5898] usb 3-1: device descriptor read/8, error -71 [ 338.953746][ T8691] netlink: 8 bytes leftover after parsing attributes in process `syz.6.563'. [ 338.968609][ T8691] openvswitch: netlink: nsh attribute has 65532 unknown bytes. [ 338.979424][ T8691] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 339.176107][ T5898] usb 3-1: new full-speed USB device number 23 using dummy_hcd [ 339.222195][ T5898] usb 3-1: device descriptor read/8, error -71 [ 339.388587][ T5898] usb usb3-port1: unable to enumerate USB device [ 340.105965][ T5927] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 342.126059][ T5927] usb 6-1: device descriptor read/64, error -71 [ 342.167895][ T8708] netlink: 16 bytes leftover after parsing attributes in process `syz.0.569'. [ 342.476056][ T5927] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 342.845985][ T5927] usb 6-1: device descriptor read/64, error -71 [ 342.956376][ T5927] usb usb6-port1: attempt power cycle [ 343.556938][ T8732] netlink: 'syz.5.575': attribute type 3 has an invalid length. [ 344.784428][ T8743] netlink: 12 bytes leftover after parsing attributes in process `syz.0.578'. [ 345.001694][ T5845] Bluetooth: hci1: command 0x0406 tx timeout [ 345.423524][ T8749] binder: BINDER_SET_CONTEXT_MGR already set [ 345.589294][ T8749] binder: 8744:8749 ioctl 4018620d 2000000000c0 returned -16 [ 345.659323][ T8746] binder: 8744:8746 ioctl 8903 200000000180 returned -22 [ 345.676317][ T8753] binder: BINDER_SET_CONTEXT_MGR already set [ 345.682733][ T8749] binder: BINDER_SET_CONTEXT_MGR already set [ 345.691561][ T8753] binder: 8744:8753 ioctl 4018620d 200000000040 returned -16 [ 345.706056][ T8749] binder: 8744:8749 ioctl 4018620d 200000000040 returned -16 [ 348.296270][ T5898] usb 7-1: new full-speed USB device number 7 using dummy_hcd [ 348.588557][ T5898] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 348.636088][ T5898] usb 7-1: New USB device found, idVendor=18b1, idProduct=0037, bcdDevice= 0.00 [ 348.845783][ T8781] vxcan1: entered allmulticast mode [ 348.866011][ T5898] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 348.883549][ T5898] usb 7-1: config 0 descriptor?? [ 349.086167][ T30] kauditd_printk_skb: 17 callbacks suppressed [ 349.086190][ T30] audit: type=1326 audit(1755897739.768:65): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8782 comm="syz.0.590" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fa08db8ebe9 code=0x0 [ 349.384024][ T5898] petalynx 0003:18B1:0037.0008: item fetching failed at offset 0/2 [ 349.400637][ T5898] petalynx 0003:18B1:0037.0008: parse failed [ 349.666529][ T5898] petalynx 0003:18B1:0037.0008: probe with driver petalynx failed with error -22 [ 350.678891][ T5898] usb 7-1: USB disconnect, device number 7 [ 350.746071][ T5906] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 351.623315][ T5906] usb 5-1: Using ep0 maxpacket: 8 [ 351.995042][ T5906] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 352.004569][ T5906] usb 5-1: config 0 has no interface number 0 [ 352.038556][ T5906] usb 5-1: config 0 interface 1 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 352.251222][ T5906] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x8F has an invalid bInterval 102, changing to 10 [ 352.263865][ T5906] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x8F has invalid maxpacket 24624, setting to 1024 [ 352.275312][ T5906] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 352.285641][ T5906] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 353.207358][ T5906] usb 5-1: config 0 descriptor?? [ 353.231127][ T5906] iowarrior 5-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 354.067993][ T5898] usb 5-1: USB disconnect, device number 17 [ 354.124571][ T8809] netlink: 12 bytes leftover after parsing attributes in process `syz.0.597'. [ 354.479843][ T8823] program syz.4.601 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 354.755640][ T8830] netlink: 44 bytes leftover after parsing attributes in process `syz.6.605'. [ 355.336071][ T5906] usb 5-1: new full-speed USB device number 18 using dummy_hcd [ 355.796261][ T5906] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 355.979581][ T5906] usb 5-1: New USB device found, idVendor=18b1, idProduct=0037, bcdDevice= 0.00 [ 355.989089][ T5906] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 356.036750][ T5898] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 356.245637][ T5906] usb 5-1: config 0 descriptor?? [ 356.306155][ T5898] usb 7-1: Using ep0 maxpacket: 32 [ 356.846250][ T5898] usb 7-1: config 0 has an invalid interface number: 51 but max is 0 [ 356.856009][ T5898] usb 7-1: config 0 has no interface number 0 [ 356.862832][ T5898] usb 7-1: config 0 interface 51 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 356.872866][ T5898] usb 7-1: config 0 interface 51 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 356.907265][ T5898] usb 7-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 356.927523][ T5898] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 356.935614][ T5898] usb 7-1: Product: syz [ 356.940093][ T5898] usb 7-1: Manufacturer: syz [ 356.944752][ T5898] usb 7-1: SerialNumber: syz [ 356.961146][ T5898] usb 7-1: config 0 descriptor?? [ 356.974180][ T5898] quatech2 7-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 356.983772][ T8842] netlink: 8 bytes leftover after parsing attributes in process `syz.0.606'. [ 357.048786][ T5906] petalynx 0003:18B1:0037.0009: item fetching failed at offset 0/2 [ 357.134278][ T5906] petalynx 0003:18B1:0037.0009: parse failed [ 357.156195][ T5906] petalynx 0003:18B1:0037.0009: probe with driver petalynx failed with error -22 [ 357.177197][ T5898] usb 7-1: qt2_setup_urbs - submit read urb failed -90 [ 357.217137][ T5898] quatech2 7-1:0.51: probe with driver quatech2 failed with error -90 [ 357.387529][ T5898] usb 7-1: USB disconnect, device number 8 [ 357.600772][ T8849] delete_channel: no stack [ 357.605415][ T8849] delete_channel: no stack [ 358.403098][ T5906] usb 5-1: USB disconnect, device number 18 [ 358.589345][ T8871] netlink: 12 bytes leftover after parsing attributes in process `syz.4.613'. [ 361.151240][ T8891] netlink: 8 bytes leftover after parsing attributes in process `syz.0.618'. [ 362.738296][ T8898] bridge1: entered promiscuous mode [ 362.770594][ T8898] bridge1: entered allmulticast mode [ 362.853307][ T5898] usb 7-1: new low-speed USB device number 9 using dummy_hcd [ 363.037518][ T8898] team0: Port device bridge1 added [ 363.086060][ T5898] usb 7-1: device descriptor read/64, error -71 [ 363.525443][ T5845] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 363.536214][ T5898] usb 7-1: new low-speed USB device number 10 using dummy_hcd [ 363.555531][ T5845] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 363.568196][ T5845] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 363.762188][ T5845] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 363.776097][ T5845] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 364.414221][ T5898] usb 7-1: device descriptor read/64, error -71 [ 364.688207][ T8918] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1140193752 (36486200064 ns) > initial count (8035629696 ns). Using initial count to start timer. [ 364.744444][ T5898] usb usb7-port1: attempt power cycle [ 365.365703][ T8775] syz.5.585 (8775): drop_caches: 1 [ 365.379772][ T5898] usb 7-1: new low-speed USB device number 11 using dummy_hcd [ 365.446770][ T5898] usb 7-1: device descriptor read/8, error -71 [ 365.735963][ T5898] usb 7-1: new low-speed USB device number 12 using dummy_hcd [ 366.046001][ T30] audit: type=1326 audit(1755897756.708:66): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8943 comm="syz.2.632" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7feb8418ebe9 code=0x0 [ 366.207236][ T5898] usb 7-1: device not accepting address 12, error -71 [ 366.822823][ T5845] Bluetooth: hci5: command tx timeout [ 366.993180][ T5898] usb usb7-port1: unable to enumerate USB device [ 367.334025][ T8920] chnl_net:caif_netlink_parms(): no params data found [ 368.042166][ T49] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 368.074104][ T8979] netlink: 12 bytes leftover after parsing attributes in process `syz.4.639'. [ 368.083703][ T8978] netlink: 12 bytes leftover after parsing attributes in process `syz.4.639'. [ 368.267642][ T49] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 368.469793][ T8982] bond1: (slave vcan1): The slave device specified does not support setting the MAC address [ 368.839975][ T5845] Bluetooth: hci5: command tx timeout [ 369.062461][ T8982] bond1: (slave vcan1): Error -95 calling set_mac_address [ 369.332298][ T49] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 369.504584][ T30] audit: type=1326 audit(1755897760.188:67): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9001 comm="syz.0.644" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fa08db8ebe9 code=0x0 [ 369.819937][ T9] usb 5-1: new full-speed USB device number 19 using dummy_hcd [ 370.037158][ T8920] bridge0: port 1(bridge_slave_0) entered blocking state [ 370.119008][ T8920] bridge0: port 1(bridge_slave_0) entered disabled state [ 370.130884][ T9] usb 5-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 370.144673][ T8920] bridge_slave_0: entered allmulticast mode [ 370.145211][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 370.183108][ T8920] bridge_slave_0: entered promiscuous mode [ 370.191690][ T9] usb 5-1: config 0 descriptor?? [ 370.260155][ T9] cp210x 5-1:0.0: cp210x converter detected [ 370.266831][ T49] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 370.306597][ T8920] bridge0: port 2(bridge_slave_1) entered blocking state [ 370.334246][ T8920] bridge0: port 2(bridge_slave_1) entered disabled state [ 370.376642][ T8920] bridge_slave_1: entered allmulticast mode [ 370.443517][ T8920] bridge_slave_1: entered promiscuous mode [ 370.926321][ T5845] Bluetooth: hci5: command tx timeout [ 370.951693][ T9] usb 5-1: cp210x converter now attached to ttyUSB0 [ 370.993804][ T8920] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 371.097604][ T8920] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 371.114638][ T5898] usb 5-1: USB disconnect, device number 19 [ 371.183991][ T5898] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 371.248417][ T5898] cp210x 5-1:0.0: device disconnected [ 371.392782][ T8920] team0: Port device team_slave_0 added [ 371.414007][ T8920] team0: Port device team_slave_1 added [ 371.466448][ T49] bridge_slave_1: left allmulticast mode [ 371.482400][ T49] bridge_slave_1: left promiscuous mode [ 371.493844][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 371.530831][ T49] bridge_slave_0: left allmulticast mode [ 371.536889][ T49] bridge_slave_0: left promiscuous mode [ 371.542769][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 372.993164][ T9032] netlink: zone id is out of range [ 372.999676][ T5845] Bluetooth: hci5: command tx timeout [ 373.206452][ T9032] netlink: zone id is out of range [ 373.211659][ T9032] netlink: zone id is out of range [ 373.274248][ T9032] netlink: zone id is out of range [ 373.302975][ T9032] netlink: zone id is out of range [ 373.363298][ T9040] syz.6.651: attempt to access beyond end of device [ 373.363298][ T9040] nbd6: rw=0, sector=2, nr_sectors = 1 limit=0 [ 373.396383][ T9032] netlink: zone id is out of range [ 373.416127][ T9032] netlink: zone id is out of range [ 373.445943][ T9032] netlink: zone id is out of range [ 373.463242][ T9041] netlink: 'syz.6.651': attribute type 4 has an invalid length. [ 373.476446][ T9032] netlink: zone id is out of range [ 373.488353][ T9041] netlink: 3657 bytes leftover after parsing attributes in process `syz.6.651'. [ 373.498101][ T9032] netlink: zone id is out of range [ 374.735626][ T30] audit: type=1326 audit(1755897765.418:68): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9051 comm="syz.2.655" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7feb8418ebe9 code=0x0 [ 375.416915][ T49] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 375.436948][ T49] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 375.448151][ T49] bond0 (unregistering): Released all slaves [ 375.737171][ T49] bond1 (unregistering): Released all slaves [ 376.067026][ T49] tipc: Left network mode [ 376.088287][ T8920] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 376.096204][ T8920] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 376.124186][ T8920] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 376.152272][ T8920] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 376.193354][ T8920] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 376.286903][ T8920] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 376.474943][ T9067] netlink: 56 bytes leftover after parsing attributes in process `syz.6.659'. [ 377.932694][ T8920] hsr_slave_0: entered promiscuous mode [ 377.970148][ T8920] hsr_slave_1: entered promiscuous mode [ 377.988051][ T8920] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 378.006231][ T8920] Cannot create hsr debugfs directory [ 378.419782][ T9087] netlink: 'syz.6.665': attribute type 12 has an invalid length. [ 378.494059][ T49] hsr_slave_0: left promiscuous mode [ 378.517696][ T49] hsr_slave_1: left promiscuous mode [ 378.524266][ T49] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 378.539393][ T49] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 378.550253][ T49] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 378.570725][ T49] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 378.620852][ T49] veth1_macvtap: left promiscuous mode [ 378.633019][ T49] veth0_macvtap: left promiscuous mode [ 378.639836][ T49] veth1_vlan: left promiscuous mode [ 378.645826][ T49] veth0_vlan: left promiscuous mode [ 380.428479][ T9103] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 381.553180][ T49] team0 (unregistering): Port device team_slave_1 removed [ 381.629314][ T43] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 381.711925][ T49] team0 (unregistering): Port device team_slave_0 removed [ 381.831692][ T43] usb 5-1: config 0 has no interfaces? [ 381.886571][ T43] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 381.896291][ T43] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 381.910532][ T43] usb 5-1: Product: syz [ 381.915061][ T43] usb 5-1: Manufacturer: syz [ 381.950811][ T43] usb 5-1: config 0 descriptor?? [ 382.733699][ T9117] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 382.764614][ T9117] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 383.830246][ T5906] usb 5-1: USB disconnect, device number 20 [ 384.283334][ T49] IPVS: stop unused estimator thread 0... [ 384.394931][ T8920] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 384.624508][ T8920] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 385.424296][ T8920] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 385.785714][ T8920] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 388.729898][ T8920] 8021q: adding VLAN 0 to HW filter on device bond0 [ 388.777424][ T8920] 8021q: adding VLAN 0 to HW filter on device team0 [ 388.801495][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 388.809282][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 388.885744][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 388.893679][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 388.954224][ T9173] netlink: 16 bytes leftover after parsing attributes in process `syz.0.684'. [ 389.300108][ T9183] netlink: 8 bytes leftover after parsing attributes in process `syz.0.686'. [ 389.518699][ T9187] blktrace: Concurrent blktraces are not allowed on nullb0 [ 390.183313][ T30] audit: type=1326 audit(1755897780.868:69): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9188 comm="syz.0.688" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fa08db8ebe9 code=0x0 [ 392.225806][ T8920] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 392.640350][ T9218] netlink: 'syz.6.695': attribute type 4 has an invalid length. [ 392.676650][ T9218] netlink: 152 bytes leftover after parsing attributes in process `syz.6.695'. [ 392.744740][ T9218] : renamed from bond0 (while UP) [ 392.911364][ T9218] xt_TPROXY: Can be used only with -p tcp or -p udp [ 393.146783][ T9228] overlayfs: failed to resolve './bus': -2 [ 393.181099][ T9228] overlay: Unknown parameter 'fowner' [ 393.312424][ T8920] veth0_vlan: entered promiscuous mode [ 393.362620][ T8920] veth1_vlan: entered promiscuous mode [ 393.489867][ T8920] veth0_macvtap: entered promiscuous mode [ 393.501513][ T8920] veth1_macvtap: entered promiscuous mode [ 393.536790][ T8920] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 393.567534][ T8920] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 393.595017][ T30] audit: type=1326 audit(1755897784.278:70): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9236 comm="syz.0.700" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fa08db8ebe9 code=0x0 [ 393.618673][ T8920] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 393.631238][ T8920] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 393.642164][ T8920] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 393.652572][ T8920] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 394.586100][ T7305] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 394.631473][ T7305] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 394.652681][ T9246] netlink: 16 bytes leftover after parsing attributes in process `syz.6.702'. [ 394.922213][ T2970] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 394.950622][ T2970] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 396.259842][ T9264] netlink: 8 bytes leftover after parsing attributes in process `syz.6.706'. [ 397.616064][ T5927] usb 8-1: new full-speed USB device number 2 using dummy_hcd [ 398.396875][ T9281] fanotify: failed to encode fid (type=0, len=0, err=-2) [ 398.410393][ T9281] fanotify: failed to encode fid (type=0, len=0, err=-2) [ 398.476121][ T5906] usb 7-1: new full-speed USB device number 13 using dummy_hcd [ 398.648069][ T5906] usb 7-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 398.683536][ T5906] usb 7-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x94, changing to 0x84 [ 398.704339][ T5906] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid maxpacket 30768, setting to 64 [ 398.719989][ T5906] usb 7-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 398.745537][ T5906] usb 7-1: New USB device found, idVendor=084e, idProduct=1001, bcdDevice=ed.ae [ 398.755560][ T5906] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 398.773007][ T5906] usb 7-1: Product: syz [ 398.777932][ T5906] usb 7-1: Manufacturer: syz [ 398.782676][ T5906] usb 7-1: SerialNumber: syz [ 398.791098][ T5906] usb 7-1: config 0 descriptor?? [ 398.796307][ T9] usb 3-1: new low-speed USB device number 24 using dummy_hcd [ 398.812430][ T5906] input: KB Gear Tablet as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/input/input11 [ 398.892477][ T9289] binder: BINDER_SET_CONTEXT_MGR already set [ 398.898668][ T9289] binder: 9286:9289 ioctl 4018620d 2000000002c0 returned -16 [ 398.947834][ C0] kbtab 7-1:0.0: kbtab_irq - usb_submit_urb failed with result -1 [ 398.969047][ T9] usb 3-1: device descriptor read/64, error -71 [ 399.785950][ T9] usb 3-1: new low-speed USB device number 25 using dummy_hcd [ 399.836002][ T5898] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 399.836575][ T10] usb 7-1: USB disconnect, device number 13 [ 399.852006][ T9293] netlink: 16 bytes leftover after parsing attributes in process `syz.4.714'. [ 399.936123][ T9] usb 3-1: device descriptor read/64, error -71 [ 400.026181][ T5898] usb 1-1: Using ep0 maxpacket: 16 [ 400.056203][ T9] usb usb3-port1: attempt power cycle [ 400.090269][ T5898] usb 1-1: config 0 interface 0 altsetting 16 endpoint 0x81 has an invalid bInterval 70, changing to 10 [ 400.523854][ T9] usb 3-1: new low-speed USB device number 26 using dummy_hcd [ 400.608872][ T5898] usb 1-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid wMaxPacketSize 0 [ 400.634097][ T5898] usb 1-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 28 [ 400.647811][ T5898] usb 1-1: config 0 interface 0 has no altsetting 0 [ 400.655005][ T5898] usb 1-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 400.675720][ T5898] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 400.676789][ T9] usb 3-1: device descriptor read/8, error -71 [ 400.690052][ T5898] usb 1-1: config 0 descriptor?? [ 401.067925][ T5956] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 401.301710][ T9] usb 3-1: new low-speed USB device number 27 using dummy_hcd [ 401.671483][ T5956] usb 5-1: config index 0 descriptor too short (expected 9, got 0) [ 402.006075][ T5956] usb 5-1: can't read configurations, error -22 [ 402.042225][ T5898] usbhid 1-1:0.0: can't add hid device: -71 [ 402.054891][ T5898] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 402.076206][ T9] usb 3-1: device descriptor read/8, error -71 [ 402.106782][ T5898] usb 1-1: USB disconnect, device number 8 [ 402.206684][ T9] usb usb3-port1: unable to enumerate USB device [ 402.242938][ T9311] tmpfs: Unknown parameter 'hug߯ver' [ 402.276245][ T5956] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 402.834890][ T5956] usb 5-1: config index 0 descriptor too short (expected 9, got 0) [ 403.668805][ T5956] usb 5-1: can't read configurations, error -22 [ 403.700254][ T5956] usb usb5-port1: attempt power cycle [ 404.581373][ T5956] usb 5-1: new low-speed USB device number 23 using dummy_hcd [ 404.621279][ T5956] usb 5-1: Invalid ep0 maxpacket: 16 [ 405.557795][ T5956] usb 5-1: new low-speed USB device number 24 using dummy_hcd [ 405.651931][ T5956] usb 5-1: Invalid ep0 maxpacket: 16 [ 405.670708][ T5956] usb usb5-port1: unable to enumerate USB device [ 405.686054][ T9] usb 7-1: new low-speed USB device number 14 using dummy_hcd [ 406.038007][ T9] usb 7-1: config 0 has an invalid interface number: 1 but max is 0 [ 406.055374][ T9] usb 7-1: config 0 has no interface number 0 [ 406.069374][ T30] audit: type=1326 audit(1755897796.748:71): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9341 comm="syz.2.727" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7feb8418ebe9 code=0x0 [ 406.072885][ T9] usb 7-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 406.133623][ T9] usb 7-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 406.175070][ T9344] netlink: 'syz.0.726': attribute type 12 has an invalid length. [ 406.175277][ T9] usb 7-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 406.242393][ T9] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 406.258176][ T9] usb 7-1: config 0 descriptor?? [ 406.264373][ T9335] raw-gadget.1 gadget.6: fail, usb_ep_enable returned -22 [ 406.491606][ T9] iowarrior 7-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 407.373725][ T5898] usb 7-1: USB disconnect, device number 14 [ 407.937581][ T9359] netlink: 20 bytes leftover after parsing attributes in process `syz.6.724'. [ 408.535161][ T9359] netlink: 20 bytes leftover after parsing attributes in process `syz.6.724'. [ 409.264730][ T9375] blktrace: Concurrent blktraces are not allowed on nullb0 [ 409.744738][ T9384] tipc: Cannot configure node identity twice [ 410.185004][ T9391] FAULT_INJECTION: forcing a failure. [ 410.185004][ T9391] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 410.198847][ T9391] CPU: 0 UID: 0 PID: 9391 Comm: syz.0.737 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) [ 410.198877][ T9391] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 410.198899][ T9391] Call Trace: [ 410.198913][ T9391] [ 410.198923][ T9391] dump_stack_lvl+0x189/0x250 [ 410.198956][ T9391] ? __pfx____ratelimit+0x10/0x10 [ 410.198980][ T9391] ? __pfx_dump_stack_lvl+0x10/0x10 [ 410.199005][ T9391] ? __pfx__printk+0x10/0x10 [ 410.199050][ T9391] should_fail_ex+0x414/0x560 [ 410.199079][ T9391] _copy_to_user+0x31/0xb0 [ 410.199113][ T9391] wext_handle_ioctl+0x136/0x1c0 [ 410.199159][ T9391] ? __pfx_wext_handle_ioctl+0x10/0x10 [ 410.199187][ T9391] ? rcu_read_unlock_special+0x3fe/0x4c0 [ 410.199224][ T9391] ? __asan_memset+0x22/0x50 [ 410.199257][ T9391] ? smack_file_ioctl+0x24a/0x340 [ 410.199287][ T9391] sock_ioctl+0x15f/0x790 [ 410.199315][ T9391] ? __pfx_sock_ioctl+0x10/0x10 [ 410.199335][ T9391] ? __rcu_read_unlock+0x84/0xe0 [ 410.199367][ T9391] ? __fget_files+0x2a/0x420 [ 410.199391][ T9391] ? __fget_files+0x3a0/0x420 [ 410.199414][ T9391] ? __fget_files+0x2a/0x420 [ 410.199443][ T9391] ? bpf_lsm_file_ioctl+0x9/0x20 [ 410.199468][ T9391] ? __pfx_sock_ioctl+0x10/0x10 [ 410.199492][ T9391] __se_sys_ioctl+0xfc/0x170 [ 410.199528][ T9391] do_syscall_64+0xfa/0x3b0 [ 410.199555][ T9391] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 410.199576][ T9391] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 410.199598][ T9391] ? clear_bhb_loop+0x60/0xb0 [ 410.199625][ T9391] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 410.199658][ T9391] RIP: 0033:0x7fa08db8ebe9 [ 410.199684][ T9391] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 410.199704][ T9391] RSP: 002b:00007fa08e927038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 410.199728][ T9391] RAX: ffffffffffffffda RBX: 00007fa08ddb6180 RCX: 00007fa08db8ebe9 [ 410.199744][ T9391] RDX: 0000200000000000 RSI: 0000000000008b15 RDI: 000000000000000c [ 410.199759][ T9391] RBP: 00007fa08e927090 R08: 0000000000000000 R09: 0000000000000000 [ 410.199773][ T9391] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 410.199786][ T9391] R13: 00007fa08ddb6218 R14: 00007fa08ddb6180 R15: 00007ffe92b898f8 [ 410.199822][ T9391] [ 411.250015][ T30] audit: type=1326 audit(1755897801.938:72): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9394 comm="syz.7.740" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f519878ebe9 code=0x0 [ 411.446633][ T5898] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 411.651969][ T9402] bridge0: port 2(bridge_slave_1) entered disabled state [ 411.659531][ T9402] bridge0: port 1(bridge_slave_0) entered disabled state [ 411.668392][ T5898] usb 3-1: Using ep0 maxpacket: 16 [ 411.684060][ T9402] bridge0: entered allmulticast mode [ 412.092908][ T9407] bridge0: port 2(bridge_slave_1) entered blocking state [ 412.100344][ T9407] bridge0: port 2(bridge_slave_1) entered forwarding state [ 412.109265][ T9407] bridge0: port 1(bridge_slave_0) entered blocking state [ 412.116720][ T9407] bridge0: port 1(bridge_slave_0) entered forwarding state [ 412.138692][ T5898] usb 3-1: too many endpoints for config 1 interface 0 altsetting 0: 255, using maximum allowed: 30 [ 412.161936][ T5898] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 412.173377][ T5898] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 412.192543][ T5898] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 8 [ 412.204629][ T9407] bridge0: entered promiscuous mode [ 412.265238][ T5898] usb 3-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 255 [ 412.345774][ T5898] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 412.359004][ T5898] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 412.375975][ T5898] usb 3-1: SerialNumber: syz [ 412.468231][ T9388] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 412.506345][ T5898] cdc_acm 3-1:1.0: Control and data interfaces are not separated! [ 412.549765][ T5898] cdc_acm 3-1:1.0: probe with driver cdc_acm failed with error -12 [ 412.707984][ T9413] netlink: 8 bytes leftover after parsing attributes in process `syz.0.746'. [ 412.892398][ T9415] IPVS: sync thread started: state = BACKUP, mcast_ifn = ip_vti0, syncid = 3, id = 0 [ 414.328646][ T9425] blktrace: Concurrent blktraces are not allowed on nullb0 [ 415.006472][ T5898] usb 3-1: USB disconnect, device number 28 [ 415.074058][ T9431] FAULT_INJECTION: forcing a failure. [ 415.074058][ T9431] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 415.087397][ T9431] CPU: 1 UID: 0 PID: 9431 Comm: syz.4.751 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) [ 415.087426][ T9431] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 415.087440][ T9431] Call Trace: [ 415.087449][ T9431] [ 415.087460][ T9431] dump_stack_lvl+0x189/0x250 [ 415.087489][ T9431] ? __pfx____ratelimit+0x10/0x10 [ 415.087514][ T9431] ? __pfx_dump_stack_lvl+0x10/0x10 [ 415.087540][ T9431] ? __pfx__printk+0x10/0x10 [ 415.087583][ T9431] should_fail_ex+0x414/0x560 [ 415.087612][ T9431] _copy_to_user+0x31/0xb0 [ 415.087645][ T9431] simple_read_from_buffer+0xe1/0x170 [ 415.087675][ T9431] proc_fail_nth_read+0x1df/0x250 [ 415.087706][ T9431] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 415.087738][ T9431] ? rw_verify_area+0x258/0x650 [ 415.087772][ T9431] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 415.087801][ T9431] vfs_read+0x200/0x980 [ 415.087841][ T9431] ? __pfx___mutex_lock+0x10/0x10 [ 415.087868][ T9431] ? __pfx_vfs_read+0x10/0x10 [ 415.087903][ T9431] ? __fget_files+0x2a/0x420 [ 415.087934][ T9431] ? __fget_files+0x3a0/0x420 [ 415.087958][ T9431] ? __fget_files+0x2a/0x420 [ 415.087993][ T9431] ksys_read+0x145/0x250 [ 415.088012][ T9431] ? __fget_files+0x3a0/0x420 [ 415.088038][ T9431] ? __pfx_ksys_read+0x10/0x10 [ 415.088065][ T9431] ? do_syscall_64+0xbe/0x3b0 [ 415.088095][ T9431] do_syscall_64+0xfa/0x3b0 [ 415.088122][ T9431] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 415.088143][ T9431] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 415.088165][ T9431] ? clear_bhb_loop+0x60/0xb0 [ 415.088192][ T9431] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 415.088222][ T9431] RIP: 0033:0x7ff0f318d5fc [ 415.088242][ T9431] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 415.088262][ T9431] RSP: 002b:00007ff0f13f6030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 415.088285][ T9431] RAX: ffffffffffffffda RBX: 00007ff0f33b6180 RCX: 00007ff0f318d5fc [ 415.088302][ T9431] RDX: 000000000000000f RSI: 00007ff0f13f60a0 RDI: 000000000000000b [ 415.088316][ T9431] RBP: 00007ff0f13f6090 R08: 0000000000000000 R09: 0000000000000000 [ 415.088340][ T9431] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 415.088354][ T9431] R13: 00007ff0f33b6218 R14: 00007ff0f33b6180 R15: 00007ffcc047af18 [ 415.088390][ T9431] [ 415.335486][ C1] vkms_vblank_simulate: vblank timer overrun [ 416.741268][ T9454] netlink: 8 bytes leftover after parsing attributes in process `syz.4.759'. [ 416.850326][ T9459] net_ratelimit: 140 callbacks suppressed [ 416.850349][ T9459] openvswitch: netlink: Multiple metadata blocks provided [ 417.006290][ T5956] usb 7-1: new high-speed USB device number 15 using dummy_hcd [ 417.967527][ T5956] usb 7-1: Using ep0 maxpacket: 16 [ 418.030269][ T5956] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 418.067890][ T5956] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 418.079561][ T5956] usb 7-1: New USB device found, idVendor=04d8, idProduct=f002, bcdDevice= 0.00 [ 418.110202][ T5956] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 418.520422][ T5956] usb 7-1: config 0 descriptor?? [ 418.620963][ T9473] x_tables: ip6_tables: SET.1 target: invalid size 8 (kernel) != (user) 0 [ 418.787400][ T9480] FAULT_INJECTION: forcing a failure. [ 418.787400][ T9480] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 418.821148][ T9480] CPU: 0 UID: 0 PID: 9480 Comm: syz.0.765 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) [ 418.821181][ T9480] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 418.821195][ T9480] Call Trace: [ 418.821204][ T9480] [ 418.821214][ T9480] dump_stack_lvl+0x189/0x250 [ 418.821244][ T9480] ? __pfx____ratelimit+0x10/0x10 [ 418.821273][ T9480] ? __pfx_dump_stack_lvl+0x10/0x10 [ 418.821296][ T9480] ? __pfx__printk+0x10/0x10 [ 418.821324][ T9480] ? __might_fault+0xb0/0x130 [ 418.821359][ T9480] should_fail_ex+0x414/0x560 [ 418.821396][ T9480] _copy_from_user+0x2d/0xb0 [ 418.821427][ T9480] ___sys_sendmsg+0x158/0x2a0 [ 418.821465][ T9480] ? __pfx____sys_sendmsg+0x10/0x10 [ 418.821542][ T9480] ? __fget_files+0x2a/0x420 [ 418.821564][ T9480] ? __fget_files+0x3a0/0x420 [ 418.821601][ T9480] __x64_sys_sendmsg+0x19b/0x260 [ 418.821639][ T9480] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 418.821684][ T9480] ? __pfx_ksys_write+0x10/0x10 [ 418.821702][ T9480] ? rcu_is_watching+0x15/0xb0 [ 418.821732][ T9480] ? do_syscall_64+0xbe/0x3b0 [ 418.821762][ T9480] do_syscall_64+0xfa/0x3b0 [ 418.821785][ T9480] ? lockdep_hardirqs_on+0x9c/0x150 [ 418.821807][ T9480] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 418.821829][ T9480] ? clear_bhb_loop+0x60/0xb0 [ 418.821856][ T9480] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 418.821876][ T9480] RIP: 0033:0x7fa08db8ebe9 [ 418.821895][ T9480] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 418.821973][ T9480] RSP: 002b:00007fa08e969038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 418.821996][ T9480] RAX: ffffffffffffffda RBX: 00007fa08ddb5fa0 RCX: 00007fa08db8ebe9 [ 418.822012][ T9480] RDX: 000000000008c080 RSI: 0000200000000300 RDI: 0000000000000003 [ 418.822025][ T9480] RBP: 00007fa08e969090 R08: 0000000000000000 R09: 0000000000000000 [ 418.822039][ T9480] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 418.822052][ T9480] R13: 00007fa08ddb6038 R14: 00007fa08ddb5fa0 R15: 00007ffe92b898f8 [ 418.822085][ T9480] [ 419.317284][ T9457] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 419.347636][ T9457] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 419.996840][ T5956] hid-picolcd 0003:04D8:F002.000A: global environment stack underflow [ 420.005163][ T5956] hid-picolcd 0003:04D8:F002.000A: item 0 4 1 11 parsing failed [ 420.013757][ T5956] hid-picolcd 0003:04D8:F002.000A: device report parse failed [ 420.021905][ T5956] hid-picolcd 0003:04D8:F002.000A: probe with driver hid-picolcd failed with error -22 [ 420.047613][ T9457] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 420.157583][ T9457] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 420.201383][ T43] usb 7-1: USB disconnect, device number 15 [ 420.523135][ T9498] usb usb8: usbfs: process 9498 (syz.2.771) did not claim interface 0 before use [ 421.852693][ T9512] tipc: Cannot configure node identity twice [ 422.302758][ T9516] loop6: detected capacity change from 0 to 524287487 [ 422.337798][ T9516] buffer_io_error: 7 callbacks suppressed [ 422.337819][ T9516] Buffer I/O error on dev loop6, logical block 0, async page read [ 422.365451][ T9516] Buffer I/O error on dev loop6, logical block 0, async page read [ 422.448646][ T9528] loop6: detected capacity change from 524287487 to 0 [ 422.499356][ T9516] Buffer I/O error on dev loop6, logical block 0, async page read [ 422.506732][ T9536] netlink: 4 bytes leftover after parsing attributes in process `syz.0.779'. [ 422.521284][ T9536] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 422.661105][ T9516] ldm_validate_partition_table(): Disk read failed. [ 422.784714][ T9516] Dev loop6: unable to read RDB block 0 [ 422.840580][ T9516] loop6: unable to read partition table [ 422.906194][ T9516] loop6: partition table beyond EOD, truncated [ 422.962862][ T9516] loop_reread_partitions: partition scan of loop6 (^L A;b@֔:Bw<gnf. -ӑ.i >^.dDd) failed (rc=-5) [ 423.074096][ T9536] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 423.123724][ T9543] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 423.426585][ T10] usb 5-1: new full-speed USB device number 25 using dummy_hcd [ 423.588626][ T10] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 423.620818][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 4 [ 423.650081][ T10] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 423.666003][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 423.684532][ T10] usb 5-1: Product: syz [ 423.689484][ T10] usb 5-1: Manufacturer: syz [ 423.694580][ T10] usb 5-1: SerialNumber: syz [ 423.717255][ T10] usb 5-1: config 0 descriptor?? [ 423.759734][ T10] em28xx 5-1:0.0: New device syz syz @ 12 Mbps (2040:0264, interface 0, class 0) [ 423.789924][ T10] em28xx 5-1:0.0: Device initialization failed. [ 423.826295][ T10] em28xx 5-1:0.0: Device must be connected to a high-speed USB 2.0 port. [ 424.027779][ T5898] usb 5-1: USB disconnect, device number 25 [ 425.039343][ T9575] netlink: 'syz.0.789': attribute type 12 has an invalid length. [ 425.080172][ T9575] blktrace: Concurrent blktraces are not allowed on sg0 [ 425.183685][ T9577] tipc: Cannot configure node identity twice [ 427.062881][ T9588] block device autoloading is deprecated and will be removed. [ 427.422854][ T9600] blktrace: Concurrent blktraces are not allowed on nullb0 [ 427.509408][ T9601] input: syz0 as /devices/virtual/input/input12 [ 427.686068][ T5898] usb 7-1: new high-speed USB device number 16 using dummy_hcd [ 427.735951][ T5956] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 427.901069][ T5898] usb 7-1: New USB device found, idVendor=0813, idProduct=0001, bcdDevice=3a.08 [ 427.940903][ T5956] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 427.943848][ T5898] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 427.976394][ T5956] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 428.012819][ T5898] usb 7-1: config 0 descriptor?? [ 428.014022][ T5956] usb 8-1: New USB device found, idVendor=0419, idProduct=0600, bcdDevice= 0.00 [ 428.027950][ T10] usb 3-1: new full-speed USB device number 29 using dummy_hcd [ 428.060061][ T5956] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 428.062814][ T5898] gspca_main: cpia1-2.14.0 probing 0813:0001 [ 428.083516][ T5956] usb 8-1: config 0 descriptor?? [ 428.116091][ T43] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 428.209453][ T10] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 428.234544][ T10] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA1, changing to 0x81 [ 428.249017][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 428.261551][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 428.308418][ T43] usb 1-1: Using ep0 maxpacket: 16 [ 428.315997][ T5898] gspca_cpia1: usb_control_msg 05, error -71 [ 428.323036][ T5898] gspca_cpia1: usb_control_msg 01, error -71 [ 428.336553][ T5898] cpia1 7-1:0.0: only firmware version 1 is supported (got: 0) [ 428.344593][ T43] usb 1-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 428.348551][ T10] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 428.353891][ T43] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 428.388048][ T5898] usb 7-1: USB disconnect, device number 16 [ 428.399128][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 428.421948][ T43] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 428.459770][ T43] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 428.469356][ T43] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 428.472238][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 64 [ 428.484664][ T43] usb 1-1: Product: ࠄ [ 428.494011][ T43] usb 1-1: Manufacturer: 띔堻蟒冝뙂䌒僜닓臫⼆ﮑೆ섐櫧嫁蝃ꐹ㰯⠫쑶Ώ嶔寇ừ糃맚洪聪ᢏ꺢孬磥辁阀▗꺭県烔뢬Ⲫꇇꨄ쥗䋳盁蕶Ⲻ拗垍潀忨陏镼찗愍궁䵗㝦⃢ [ 428.547329][ T9617] [ 428.549928][ T9617] ====================================================== [ 428.557070][ T9617] WARNING: possible circular locking dependency detected [ 428.564114][ T9617] 6.16.0-syzkaller #0 Not tainted [ 428.569171][ T9617] ------------------------------------------------------ [ 428.576211][ T9617] syz.6.803/9617 is trying to acquire lock: [ 428.582445][ T9617] ffff8881427e0358 (&disk->open_mutex){+.+.}-{4:4}, at: __del_gendisk+0x129/0x9e0 [ 428.591913][ T9617] [ 428.591913][ T9617] but task is already holding lock: [ 428.599302][ T9617] ffff8881427d7368 (&set->update_nr_hwq_lock){++++}-{4:4}, at: del_gendisk+0xe0/0x160 [ 428.609004][ T9617] [ 428.609004][ T9617] which lock already depends on the new lock. [ 428.609004][ T9617] [ 428.619464][ T9617] [ 428.619464][ T9617] the existing dependency chain (in reverse order) is: [ 428.629289][ T9617] [ 428.629289][ T9617] -> #2 (&set->update_nr_hwq_lock){++++}-{4:4}: [ 428.638051][ T9617] lock_acquire+0x120/0x360 [ 428.643322][ T9617] down_write+0x96/0x1f0 [ 428.648175][ T9617] blk_mq_update_nr_hw_queues+0x3b/0x14c0 [ 428.654456][ T9617] nbd_start_device+0x16c/0xac0 [ 428.660015][ T9617] nbd_ioctl+0x636/0xeb0 [ 428.665001][ T9617] blkdev_ioctl+0x5a8/0x6d0 [ 428.670070][ T9617] __se_sys_ioctl+0xfc/0x170 [ 428.675296][ T9617] do_syscall_64+0xfa/0x3b0 [ 428.680339][ T9617] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 428.686861][ T9617] [ 428.686861][ T9617] -> #1 (&nbd->config_lock){+.+.}-{4:4}: [ 428.694895][ T9617] lock_acquire+0x120/0x360 [ 428.699963][ T9617] __mutex_lock+0x182/0xe80 [ 428.705005][ T9617] refcount_dec_and_mutex_lock+0x30/0xa0 [ 428.711185][ T9617] nbd_config_put+0x2c/0x790 [ 428.716412][ T9617] nbd_release+0xfe/0x140 [ 428.721382][ T9617] bdev_release+0x533/0x650 [ 428.726431][ T9617] blkdev_release+0x15/0x20 [ 428.731566][ T9617] __fput+0x449/0xa70 [ 428.736195][ T9617] fput_close_sync+0x119/0x200 [ 428.741511][ T9617] __x64_sys_close+0x7f/0x110 [ 428.746732][ T9617] do_syscall_64+0xfa/0x3b0 [ 428.751780][ T9617] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 428.758231][ T9617] [ 428.758231][ T9617] -> #0 (&disk->open_mutex){+.+.}-{4:4}: [ 428.766971][ T9617] validate_chain+0xb9b/0x2140 [ 428.772300][ T9617] __lock_acquire+0xab9/0xd20 [ 428.777516][ T9617] lock_acquire+0x120/0x360 [ 428.782606][ T9617] __mutex_lock+0x182/0xe80 [ 428.787653][ T9617] __del_gendisk+0x129/0x9e0 [ 428.792801][ T9617] del_gendisk+0xe8/0x160 [ 428.798004][ T9617] loop_remove+0x42/0xc0 [ 428.802903][ T9617] loop_control_ioctl+0x4ac/0x5a0 [ 428.808746][ T9617] __se_sys_ioctl+0xfc/0x170 [ 428.814322][ T9617] do_syscall_64+0xfa/0x3b0 [ 428.819388][ T9617] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 428.825844][ T9617] [ 428.825844][ T9617] other info that might help us debug this: [ 428.825844][ T9617] [ 428.836201][ T9617] Chain exists of: [ 428.836201][ T9617] &disk->open_mutex --> &nbd->config_lock --> &set->update_nr_hwq_lock [ 428.836201][ T9617] [ 428.850982][ T9617] Possible unsafe locking scenario: [ 428.850982][ T9617] [ 428.858809][ T9617] CPU0 CPU1 [ 428.865234][ T9617] ---- ---- [ 428.870785][ T9617] rlock(&set->update_nr_hwq_lock); [ 428.876362][ T9617] lock(&nbd->config_lock); [ 428.883511][ T9617] lock(&set->update_nr_hwq_lock); [ 428.891352][ T9617] lock(&disk->open_mutex); [ 428.896145][ T9617] [ 428.896145][ T9617] *** DEADLOCK *** [ 428.896145][ T9617] [ 428.904802][ T9617] 1 lock held by syz.6.803/9617: [ 428.909854][ T9617] #0: ffff8881427d7368 (&set->update_nr_hwq_lock){++++}-{4:4}, at: del_gendisk+0xe0/0x160 [ 428.919924][ T9617] [ 428.919924][ T9617] stack backtrace: [ 428.926010][ T9617] CPU: 1 UID: 0 PID: 9617 Comm: syz.6.803 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) [ 428.926034][ T9617] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 428.926045][ T9617] Call Trace: [ 428.926052][ T9617] [ 428.926062][ T9617] dump_stack_lvl+0x189/0x250 [ 428.926091][ T9617] ? __pfx_dump_stack_lvl+0x10/0x10 [ 428.926111][ T9617] ? __pfx__printk+0x10/0x10 [ 428.926141][ T9617] ? print_lock_name+0xde/0x100 [ 428.926163][ T9617] print_circular_bug+0x2ee/0x310 [ 428.926187][ T9617] check_noncircular+0x134/0x160 [ 428.926215][ T9617] validate_chain+0xb9b/0x2140 [ 428.926237][ T9617] ? stack_depot_save_flags+0x40/0x900 [ 428.926264][ T9617] __lock_acquire+0xab9/0xd20 [ 428.926282][ T9617] ? __del_gendisk+0x129/0x9e0 [ 428.926303][ T9617] lock_acquire+0x120/0x360 [ 428.926318][ T9617] ? __del_gendisk+0x129/0x9e0 [ 428.926344][ T9617] ? lockdep_unlock+0x89/0x120 [ 428.926374][ T9617] __mutex_lock+0x182/0xe80 [ 428.926393][ T9617] ? __del_gendisk+0x129/0x9e0 [ 428.926418][ T9617] ? __del_gendisk+0x129/0x9e0 [ 428.926441][ T9617] ? __pfx___mutex_lock+0x10/0x10 [ 428.926460][ T9617] ? __pfx___might_resched+0x10/0x10 [ 428.926485][ T9617] ? __lock_acquire+0xab9/0xd20 [ 428.926502][ T9617] ? disk_del_events+0xb5/0x210 [ 428.926525][ T9617] ? __del_gendisk+0xc1/0x9e0 [ 428.926548][ T9617] __del_gendisk+0x129/0x9e0 [ 428.926569][ T9617] ? del_gendisk+0xe0/0x160 [ 428.926593][ T9617] ? __pfx___del_gendisk+0x10/0x10 [ 428.926620][ T9617] ? down_read+0x1ad/0x2e0 [ 428.926649][ T9617] del_gendisk+0xe8/0x160 [ 428.926672][ T9617] loop_remove+0x42/0xc0 [ 428.926699][ T9617] loop_control_ioctl+0x4ac/0x5a0 [ 428.926718][ T9617] ? __pfx_loop_control_ioctl+0x10/0x10 [ 428.926733][ T9617] ? __fget_files+0x2a/0x420 [ 428.926758][ T9617] ? bpf_lsm_file_ioctl+0x9/0x20 [ 428.926789][ T9617] ? __pfx_loop_control_ioctl+0x10/0x10 [ 428.926807][ T9617] __se_sys_ioctl+0xfc/0x170 [ 428.926836][ T9617] do_syscall_64+0xfa/0x3b0 [ 428.926857][ T9617] ? lockdep_hardirqs_on+0x9c/0x150 [ 428.926877][ T9617] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 428.926900][ T9617] ? clear_bhb_loop+0x60/0xb0 [ 428.926926][ T9617] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 428.926945][ T9617] RIP: 0033:0x7f593b58ebe9 [ 428.926962][ T9617] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 428.926980][ T9617] RSP: 002b:00007f593c35a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 428.927000][ T9617] RAX: ffffffffffffffda RBX: 00007f593b7b6090 RCX: 00007f593b58ebe9 [ 428.927014][ T9617] RDX: 0000000000000002 RSI: 0000000000004c81 RDI: 0000000000000006 [ 428.927031][ T9617] RBP: 00007f593b611e19 R08: 0000000000000000 R09: 0000000000000000 [ 428.927045][ T9617] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 428.927055][ T9617] R13: 00007f593b7b6128 R14: 00007f593b7b6090 R15: 00007ffd8ee07eb8 [ 428.927076][ T9617] [ 429.239357][ T5956] samsung 0003:0419:0600.000B: unknown main item tag 0x0 [ 429.239930][ T43] usb 1-1: SerialNumber: 缢撊ᕂ鬢ꃏ鋬콴棰䖛鑴ﵑꇛ⮽㲏渢 [ 429.250880][ T5956] samsung 0003:0419:0600.000B: unknown main item tag 0x0 [ 429.277700][ T43] usb 1-1: rejected 1 configuration due to insufficient available bus power [ 429.281162][ T9621] trusted_key: encrypted_key: master key parameter 'use' is invalid [ 429.286797][ T43] usb 1-1: no configuration chosen from 1 choice [ 429.296695][ T10] usb 3-1: New USB device found, idVendor=2294, idProduct=425a, bcdDevice=d1.41 [ 429.319893][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 429.330392][ T5956] samsung 0003:0419:0600.000B: hidraw0: USB HID v0.00 Device [HID 0419:0600] on usb-dummy_hcd.7-1/input0 [ 429.351553][ T10] usb 3-1: Product: syz [ 429.371725][ T10] usb 3-1: Manufacturer: syz [ 429.385786][ T10] usb 3-1: SerialNumber: syz [ 429.402103][ T10] usb 3-1: config 0 descriptor?? [ 429.413856][ T9606] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 429.627716][ T10] usb 3-1: ucan: probing device on interface #0 [ 429.641215][ T10] usb 3-1: ucan: invalid endpoint configuration [ 429.648411][ T10] usb 3-1: ucan: probe failed; try to update the device firmware [ 429.665493][ T10] usb 3-1: USB disconnect, device number 29 [ 429.848855][ T5898] usb 8-1: USB disconnect, device number 3 [ 430.784945][ T10] usb 1-1: USB disconnect, device number 9