last executing test programs: 2m23.482439456s ago: executing program 0 (id=989): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000380)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x80, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x54, 0x4, 0x0, 0x1, [{0x50, 0x1, 0x0, 0x1, @target={{0xb}, @val={0x40, 0x2, 0x0, 0x1, [@NFTA_TARGET_INFO={0x2c, 0x3, "7339f2f10455afb9fdd672bad09dfb78c7699c74e891a0c700"/40}, @NFTA_TARGET_REV={0x8}, @NFTA_TARGET_NAME={0x8, 0x1, 'LED\x00'}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xa8}, 0x1, 0x0, 0x0, 0x4000850}, 0x20040040) 2m23.411815001s ago: executing program 0 (id=990): r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) wait4(r0, 0x0, 0x40000000, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x1f, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0) r2 = eventfd(0x0) r3 = socket(0x40000000015, 0x5, 0x0) getsockopt(r3, 0x200000000114, 0x2715, 0x0, &(0x7f0000000240)) ioctl$VIDIOC_S_INPUT(0xffffffffffffffff, 0xc0045627, 0x0) ioctl$VIDIOC_G_SLICED_VBI_CAP(0xffffffffffffffff, 0xc0745645, &(0x7f0000000100)={0x6, [0xff, 0x8, 0x8, 0x7fff, 0x5, 0x800, 0x7, 0xfffa, 0xfc01, 0x1, 0x2, 0x10, 0x400, 0xa, 0x8, 0x2, 0x7, 0x8, 0x7f, 0x0, 0x4, 0x3, 0x97, 0x457f, 0x2, 0x5, 0x81, 0x1, 0x4, 0x8544, 0xb, 0x5, 0x6, 0x7684, 0x98bd, 0x0, 0x8000, 0x8, 0x2, 0x2, 0x0, 0x5, 0xe9da, 0xf, 0x8, 0x6, 0x0, 0xa], 0x6}) ioctl$VHOST_SET_LOG_FD(r1, 0x4004af07, &(0x7f0000000240)=r2) ioctl$VHOST_SET_VRING_KICK(r1, 0x4008af20, &(0x7f0000000040)={0x1, r2}) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000180)=""/53, 0x0}) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000180), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r4, &(0x7f0000006840)={0x2020, 0x0, 0x0, 0x0}, 0x2020) syz_fuse_handle_req(r4, &(0x7f00000042c0)="9ab1446569aa24b774753c9e994c09c24df9d42fa5a228e469b44cecf6f9f5ce5f77c93b1895aaac9cf34b37415f11fe22d6fa0162aa743b242e8fe0a8659e32fb543d7969d6513136a9f332a8074f8ee1e445277ddd5859eb5ac3321eb710be880a441031da9b31f791d54fb3c97cd8ee92b00cbf962be8eb5fd0b7cab207645f59cf87a8c41e2739dd8386b6bb84b627cbf5e09bac876ad4b215f0e510a853c5e8b9f7822b26771d72972290a1f9a6f0a46942be0d0eb7aa5145ff368863b14e9845926088f9f92d554e572926290dc6e6b574aea8c500fbe5697f881c0cec48282c6d07619248da0c3b9aa6f7c778525d1760051e4ba8ef31d3c8d3e1d4214ffa5261ce1fdbc12eba889968137f5c06fea233000296cf18df494b4e7b1bee7dc2f3751c37415d46f6d7ffb3d0f788f2100ee41266e6fba75b61af22e1d7b286507ff100cc34ed28d5a2c8be3231446874bbbde6f3c367ca802d64192ffcce1ea41b2cbc57f7500fc4f8f12fe02690c1c9785bbc35542b59d05600783cf4f4633b374101d8ed395303392b238d198f9f68c8ae928cbf3b558deec6d38ebaa526e749ac4e47dd5b838ec34f2820a1134252ae60159d4e030cf5e5d6f8de799a31e12ae57cfe5a1a3ded525c6e71271271d35a0056265362387a361f21ea0f4b6d46f6a83a8512687e43b31e11b1396d6e9e49cf42b693732e226b55d21a1203022f6be9f8ecccb68de3bf4ce99689514bd752f4e60bd2f8e376d7fae5b5fc8db0f53db8c52746671e361b9319419c1b3f3168b4797ebd2d118ee42dda4bc59dd0251236195c8cdafc0546354eeb28f4c7e71e8245a6ccaddfb858f61039c0ccf5acd924680aab38dd061fc7b123f24ac7f3d3c0cee43b61045bb1efea25af86088a0591f166e2f11ea4089860893b17ca5e3d99ec75131268e2e4e290c2bf15e4dde23284e4bdf6e549c096ce221d9c8a6c0fc78aa6a1c8b547c0e10738de2a1e8663e03ab0ce4594e244989f75b6672de1eee97ba7e6467a0da51c0e75d5866c405b03c4744d8d3fbb01eddba5a0361662269154c2f0e61a9433982eb904ff562896cbfa692eb1e6c644fcf6cbc103a76b712af706a47608d3e2f5d54d47d8e9906ab37ddf04004d32ce00200fc3c274666aeb618b27424d87b6a4b0262de4436b9e6f150bc798394c298b25a2c318fbe786185464057c0bcfcd1917230d78ee1a49eca12068fa676852c1099096c6cb98dfda27fedac41826516e42cc116f0cbb68f0f810418258dc5a65c0e1ada296176e17f8d762894c80542a79383cc1674a4f3d6520633ce80baba214c20628899f9ac826484c887713aed9c5caf13b40a598cb1e81f7b18dae39efc22dc99ff497e11f158edc2716ebe3bcd593691aa26523efc168e1394ab439c9a9270575ef34eeee9084b0a31b2d81d47c964ac61e600f75d9321d7474dde45bb8d0cc46510488ab68486d3ba6cc9c3ddb6f66f2e5d251ee285121e1645a2f5167fc5fb8ac4491c0d9d0423c7a8452efea2f5a30096a0fa47173f3a68500a5c755ea939c838d3be126a87ff6baa5a1fba638a5c64767d17f04201b935fcb1cb6afa175594f410f2ff773194c703e623876051e46bb0850a5016e65f8fa34b96bafdfe851a0756fe26fb63d52113c0935b0867f7dc8a94d887484b15e8f92b6a316a22c04a985cc94e432cd43f44001bcdbd48efcd463c402d3d181298e96db60fdb714b82e146567af5ae3fc0c3f9d241471b4d129f928d286f780facb1e84434610ab3379dfff0f64d57b4a1c2e96c98b693de952d26773d24e7a95eddbc450f79932d5332d27991c7bfbd3bc35bfeb9496fbebccb5e4c35c368e021dea643cb292d794d3d3bbcc960f989bef09763dc73d83cbf907485635265e81f87b712d958a66719230fc6466615a0e3bb998d48159e9e9c51959354a545966bcffa298c7673b4d32b991c886a997236642c0f104f6795feab9f48d0ffc74667f3f3e82473ac892ad25f4b13029b0b27fb1d86991ddc42bbc3fe584ed364e769f3bc72ed8749e7a654ec1a2ec7a01bd2d5caccdc6241a1b1ef2726db54d2c34ab47020b4c729b5994b43deb00ad959950e0051d2c0f27217397055e78f1dd3bd867a45e06c2134ae8981021aae881cc7b2049fe7c82d2127ec81d6430c8116355c8d0ab8b9291c688ed9b8dbb1ed6f1a99bb58a1be8d5737acbf9461b142c8982f52481195d35ef82aed4fa52385ea4ed00a739d01cad7af9f7c27d357748e24f28d22065ccb37300e8f5d8dae5ca79af7a50edc3e05184d1a2a6d59784d5ceeb1f1550a44ea03bee4dc5c27eb78f0032593c7d082e59211f83a8b91aa78bfb7e959328ee63af26a37b79ce5e5139eeebd12e28b2a26ad2fcbdca652524d036b324782d54247a48b9f8200b2d6d2c091c41366d677e3be6e136cec6c3080d608849135c6e3c7d695d2e226ae1ce999d730d7f79116ab85762e55a3e5a66a690ce0a4bb4fd1560c796e2797414b544ef78e29d55e4853fdbf3362085a65c46105f32c360a0a9867b984a5d0297fe0b06a45684ac801a8e66294cef6e5f3c48648884fbb2422fa00488df33a9a0ff1039c81f1939f2cd2f5fe8aa805af2d2332ac37244ed4a7b50265af8062752b0c16511e5f25e8aa2b60645675bc826557bb75474ca4787f6b584b2f83bc25192579104aa0baae79f396df0d31121f90db9acea9695ee0fe0c22df4db503ec8b2437b05f5d35a65722fa82eebd2aff4bcd3316a5cffc4b31913fd02f82130c77f320bf04bf8fa873d0e3f62122d6a5f87d3e908bedafed4a3cb6d9f73ff546f5a2b74a2493b1753e89b682352bb3166563518dcb190c7b3d9fd667c57978a670b192641a674dc92c2401d067b6767aa632ce32a401175c98200a52ab5d80dffa719746d0bff8a84bac4a56e0ab8124fc332b64ea662d01e1b73231a6638f01cf4d699448da228c16951149c8d3dab9a7e3be9a16c7d1ffb061818f8f9cb2b42739fae4a0d70c0701c8dceee785d36ef6413162de1917df01c693ef3e1f517e7fc46245209fee52f5c6a2f50ab3f56d67d1cd987282b24071d8ebb1bc5cd635957b2a7ad92d0650abd5bbc24b75885b6119592a3d715392718e52f9124c4ac95be3582abba4ac3a4049ee49fa8ceb9b59d4e1e2a069c9d482879fd8d27d5ac22ef870542453be22c2ec4ebf1472c19fbfb56aa0a3671297b020e3fe49d201a82a04420e90bda43691dacf92347bcbcae3742cc4abad4c8010c0afa15278795d4d76c482461ae78f30569e1dcf87b9b150d07a2bd81676ec6022422d490759ae1e861a6c4cd1f733bd772d60975a59356c385a4a390429f3d2131e7f616015261df6db3cc3ec261a53be10c4f197e71878984fee00e6d1069f79825194b7af434fb6bb86db18e11977f82928be35054543060cea94ebb4015d061f20f8454e056e7b6e4f9a1621ef2377d77659c20bf358c817519f1801be15ae3b5b42adfab367777a6789635a0dcdd1f2b97edecea0210768af67601d1b95a8850dddb6b1f4b0c2f52c835b0833d81966ad19e49ceb9dc9c729cd8334bc3ee5bb8c74186f5cc3e765b9fdd91d79baaab3d2ab64c15d655d1af7de9cf8d5d7c1baef24577843ce142331743b45b06104b6d0d4392e61ca8c07507ff5f831bbf720854db4debf64182aaebf899ba57626a48748fc2dcf016013d575595d24d383eef2da0ff0c9f6fe9c64b186cd4617e3f37635d7dacb58ec297f3ddb48ce4a5e00cc127267e18a1fdf209e098f2cb2e9c0630d15ec9b867b2b95ecf82ad2c0ba39df9c4d36d492bc9a55c4b767da966e4fd7f4d2fef5e91d0575177c05d240b50757031c76333d43bcc828ab2f0376e29d12d1261ce104a8ea488091326bc451c120c8c04d3e64835c893f55b312e248ad8fc1c32429d68e6b67bf45ab8a1cc3db22f9f01a2266b8349046d3d3e081eaa7f7020c73c0762d11a33b517b8f081da3c61ef63e1d40cd87d69c7ac7491fb61bb57c1fe2d218aff6d39b3e1fc847f0ed894e2f0b4d6a4ad03ba42e28bb1dfab645081f548e64ceb8ce15d2214bd66a14fe594aa447c3537eb493299fef0f9326236ea5dae44e23b34801fe06ee16c79545feaf2528421d6e7f9a256a7914d86bd053dc33c8c2043ba73714f5ff5f0507097a56c40b2190e77877d43be849ee2ac129e582930ced06d359eebb49eda4edb13819f91cecc449c9613d9659906179f8fefa34fecb7d21cdaf09a1ce8d094421da80796c97c02fc56171aaba53fd8a7f55de059044717df164f3571028f16995d51fc8829534cdf58dd134def1e43a34e4f5f372fa8e19d3b85881e99ecd45faa4fccfdb47e094ab06955f3960fac71294dd965f24a97cff36b9966cf1a4c3e96c3e14a3951dcc8a3e9371f7e1ae9df77ddb1a99172174adbee8ea57a0c9872a6d677c2875da88a6a7234bebf68a3cc0532a9809a4de4b4d419bff67b0ba825a7ae6e999087155378357ae67e2dd98697f1d10ffa4497dde6582571670456db995228b97d0ecb2fb30c2ba6c16038c40059815c56b35666cc1c5090f6c38e0f4c12abf79919951b85a2734d32dd12b239912d541f9163387a4aa0be0b7a12d9c6b56dbcf1e9aadcfd72e2664a84d6c5147c72bffe7c3560ccd8c447b748dcd26cc9ca2a85cded742a8dccdfd8e78c96e78d405a19faab9e57183b37583f94b3d416b2920c6b746427ed75c08dc3be02720c1edc4743229153c48f1239b222b9fe2e21c0ae28122bc44f9dc78a59f3485ac8057eb21f0857bcfea2d9ebbbcc197e7880d81515bb1cb7192d97c4258c09926d137e245977db40812b253f99a504bb68137d8d73ca4e7c808d50f1dcc600e6a6db90238ff44e075932fe668c066e6988a6a8b4a8485120c8e4d6511268a75d8f9b0f06689aac8cd621e90c62af1e59aa9efe928e9ea098661b408a2825c4f9aac1efd9d54d163a651054b9ab32719d2be3b176f6795ddad0f1310b9237181689f2f9dd34a41d4d4cd2d7569bf56e6a80bc24d90df3bdde0f9649e699f4ef70c4f3faf9553a231215416bba26c29f17861e0f265e9641b2307ed43d6fde23a378669f4ade874e54c20a5e902205dcaa79a3e8584a3f78a86e703451115a1717df882507c607297afac0a056a0f3509a57502fd2ffff6035d04b91f72f5e1a69ddafaf80f7b2f7a13f38c683988436585e6bc7fc2da328449675c234ec0acf5294ce06c72442beba15e65d6a3e1b5dc3c8f115e1005798383f79b0194f6b7d4b1b32371acbf22340af6e5ee3ea840f7ed451226daef3041fc194e051af2fb450022b394c774273b9575c974c324ecd7268435176ee28c54bb54c8e829232ca636f3bdef60ed460b5ff425936626dd16a3f436f08a863582a79f393378f60f6c8ecdd13d83073bfda2e9f8d0c74a841021cbb8c148e70bfc585627449cdd9fb3045db3ea08a96108b52ee8a4f5048a5d910355789f4bb85c1362955e267e719581c38a2648eaa0b516db6277d2ee3c6e1e1090df3f53a31b747d99887e337dadddab16a297d9e56797007a3d18ce333311c70bb1bf45bdae517ffc589419af643773bb30a1fbff7ecd4a8ae7456a608fe73547c2eda4f070d57dc70b65d867526c946a435ea581497da18646ce569eaf6ccf3474cd6e7aa3d6d4732836ff4167c9153757ce58a34864be6d479f7b4ea1d6480b9ac16c5bff346a74e74133234744df867e16b3d2f1f7db4b21b89019b520917ef863e60f52999d6946b9e09cb60054f49d8a255f02e4b62fff6e6adb9a167ea70a177d00b26f56e29b63138a2ebc30b956161a4ab25d5da1c207c3f762714f651341ae771e17d84fa1c86685f2fcb0a128c2e1208d1930e7ff0d8d55299154112af574b881be8b69cc1721d548ad4dc02632e184c47f9b394bf4a834e60fbead8c8bfbf5087f8454513b0b086ac97bbbb9aa342af9def758fe88f1e4570e65f93fd4a9868665d08fac0cf6ebde786995c433504ca01cdf83311aaae20cc76f819a4344a8ee4e26c1094cb00d2c8a67c733fffcd89e97534cacb08a64d75e8594fa31f0dcfcafb0d1bc184c7067fec6a48ddefd580d4d9a4128d8f70f6fc6562da683904766e982ecd0286064db6844131bb7962a0a497f7b97fefad88a0b128bdf8cca774b1c32cb4af259bfebccda036e7e4ea8962838dbb5c04ffab0a2f1481848a27f06171645daf5246a2e563f3ed60097a9d7023d6ba5c8a58d39f733b12baf0863d82c427460f51cf9e3f77281a42221725b7bb75c2116ab31f704661f090d3eeddd2aa6efc619946b4933c398b635fd04ba3758294965c568997e1ef44b0562804e6c64558f6cfa87662a988c321a856ead51c848528a4954f9ff1948d517d67bc11db66801648848bfb7ee12296428bc3ffec863e9c77ff31ee386197679adab2a0e93bbe0c66ffe9c4b09b636f6216faa373aa8271678cc57ad46898222df7e2d8b14a5b70130596c0430997c4c04d9b5187fd9bb26b71fd19aacc8e08a3239f0eebca7b2873062a19f327a4a282012ebf9898a5ab6310b8623c864d4dada3ded00ad201ce8f3973f90396f5edc1ba466e16247fe6b0ee98acfd53792cc0fea33647b841596655b8d9efbc14b50fe0b588e4c41e2cbd0a700529e7ca91122d3d1b26e52bf44a0c9fe37cdbc352357f13b2adc68e78a00f6dc88a8e6ea54bd0b2c8276f9e1bfebc8655a1f47b72c25ffa97f4463630cc21428ca3bb381a6d3171d28bb946f746f820247bf3f7bb69caaeb5c47026ca9997e586e657a9e1569312bb443299ef4cfeacc9aaf4fc3aaa4a77a21579234d2aab6fd0234398ae07ca7c57ac6d6a51e025744b1430abce27f7f9b0d0e45c051e34d20db95cadcc0e4e327dbd979166b33e39a3951d0b8dd62c0d1542b69583cfc07b127243cac4b052cb29ccb3592972698fa4cd84633d222d78b8741d5f903f8636d95cddfe2ef13829df9ce32705edfda51ded2f0ef38f60a33a2e00373107eef56a01acb5e05d849279b5987343c8bbc73ea660ceaf7c9b90c0a8e1412ff3f517cef8fe604d7a26e085170a76e1bf43f5d1bb77ee771fe841d59fe2cc2874d25bf991b4af6bf9ffe1bfbf3a5587006b60bab5bdfd5a3192e82d474ecab0ab656967856c84cba9469c5823c1d1bf104d2a21c071bb08b2a137883dd9c8f545d6958db8efa45263ae303de76e70f2f6a10e1858e6654004f2a099dc31950ee730c465e0a1822935e309d41650fba489aa3050eedbf3f058d24d1f04fc340966e42d72052d84a66789ccf75000c3fc83b8842badd6b22ddaaaf53ed34e25c1b638e3630d66a7903405052902cf8e7395d54679e2f4a2bf7c8c89b0dc38969376ea164fe97b37b1172e6e8f05a929aa373108e891a64e38e18b432a115a44d754811e03c4f4ae7c525a6b9b92aab0d16967ee1a64eeeb2207c094f6aa96f126d058eff22435a4ae76c31f888ee13b327d2cab4ab5a56abf4cae88c583dd67129271708aa17f4f10886ead0e12734314bd4a49e64349beba4abdf94a1fb23a72cf7e16b5af2f1706d9646a5ff7dbf5c7b1cb2c3781346167b15d4625841d9f3d14392db1d39101d37175c42c522229db0708544058d75cebf3e399cd443d1b943c6f3017a898bd49836a8d92519deb810712aed76602682ef0df2be270734eeda7f289a76f4684baf75702a1ac3da005e62b83f794b934cf882db5d50e5ed4aca868e300d690c0b10daf0a47486e9f49d1b08eac6cf5090ddd2443b1459b2df86ab3447b2b5c6afe8aadb410de6a84b640e326eb882832d1a9cb12e0b8f13aef579f404af8631cdd5a30a031dad19cdf247575dd223229330f19fe4d88c51242217397acf66b86c743de283d5df7212fce59af17eb702eccab192f56f054a33709d41841e4a39638e02b4210559593f9b5c44fd22d9da637ef1a3a0a41c40469990dc4beec30a05b67931c0560d9a59fa875f3e26fd1eb32655aa30c7a1cd3d541716fdaacdda206328f3cbc8f16fc2be26690f18963a16febbaf2cb6c199330579ca067c60b54cbdd211c1350e066448fb50ae28ed58788ac98f0ded3414c8735ab90639916e26ab29102cc2609035e56d9b9d2dbc98118835bcf0e437c77052efe2293d9f19b7197aa1b94b10997b0b1efdef251de8945a97fec885f032c3bee2447335230b866d7aef515b04664d0c59e18233f9a229969e3e17d69716413ca3bc55f5959e340627ea803f7b26f4a74295b295344a3685287093998a1ce75b1ed5d730c9aec812617b4c200a0250c9ef8ef7d2fcfc59ef97422eca746bc6451a5b77307d14c1cfa0ea2c8eb7cf7819644577a6456efec0af058a0e3c8ec371019009462bfe174a11368b57fbe3090208a57b2236b97edc32cda5c6fc988cbaaf91c4020a06a7ad45519eaa761e045fc84d3219b287206282347a031ef1e7b7dbc67de738fa8f9fe71c44201fd1d548f8aebe93bf502d64d4b5f470a419e3fcd87f0616b9813048311ed20ac2efd7f18dcd6889542208b50c28c8c0700f73fa33a964e38d699819cab2098c6ff081266721cdced87ff41948c84037485f30d38a99eeeb3ff4c3049742a29eb09bb35c358e732546267c165a62fee9e25abdafdb8a48785bd432d160797e7a41d580f59d7d8e59b3e6b954d39f86db33b8f7cabde43e8e04cac1fcf9aa6fdbe4326e0d9c782d9a630055b36f85c2b8efebf18f42ef14ee5eb1d33ca322db69704f8bb90bf30eb05908b8d8ed169580923f53a6539cc3b55baa47718053d2ff103c23d90f9cb49ddc7d759950f605bafabcb7953c042c0523b84da994529a87ad68fc6f0709fd7af5fc20e53a17d3f5fd4d25fc5ff6598c6ddfc34668a08ee5e066d81a65e7979c50c08febf76dc5a3a405f551bb8449d94ea0dfdad6dd6dd6d6e4486f4ae1d2523c05f46198d8af4da12873ebdf7d6b5f2d0f1b2d29759ab0d78e34ae6f17b7ab83518cf8b18836ea5630ee934e5ecc123f0d3fe6b803ae1f735d65dcadcaaf6660e02ecad0290f6ead0594733a10b2b1654a44244424fa8b3180b551ac401828203e61603b017106e2256f01b9f26db33897167d9defb54ddfe49334150574493895370bad46cc658667aa9a8ed333c86f112b2a542936af92e2f933254b6fb0b1a599eec3bf2e476ae6714e2486dd31b29e4d26838d84bd7a62c62beab3ba71642278ecaf2e50d70670d9fdff105019791d36321bc57fdfd8f65f2ea1cb188035ecabf6140e777b7e6d2177ac29e9a1a2f87dd54d96184bb1a855bd9efdadfc606f13621f40e07cd8be9c2435c8c90b4ccba5eb7ddcf8cf1f76617c9a9e011abf4a63ffe31df63ecacb8b1d2d653e613cb399ce079392f9ca2e226c60b6e8103447c24c1f80d42e1ee747997602ae3ccff8f9f98ce9b56f6f3e3c0ba507df8b2169539cfc946c42da72644feb9b3b582ce332f8b2eda02192958194903d17b3e9b4bd60d08cd9a7989d946ece6d8dc01d6b66a7851bb11e4b075d38081d3ce7bf1875fec9daf47a589abdb72763c9747b83a28389238b0279c8e41db6521130420851acac463664a97be2190aff921923475f2c1f8a87d1169229e5f10dd0a92221e61358b156020f2c9ca2cb6580743a8d5e3c59e6fd97a7a246211450c7c62f1891cedb434102f8794d81c1caf2c1b4ae18b7c4b9c88de5c51da33e3343cef76da0d00341c2e60c4562c162e41a7efa8290cc9061f3d6a592d5f104c5018f31bcaf912bdd37370fbf8fedf0aa9026c1142299197d67ab026756927b5864ea42c45a82c23c275697d31a1b7900670c9a3c967d12974543c11f20c367a336bea9b9ebe480f9c806528138dff35c5f56b1199b75748e9c5cf50e6a32397dc3eeb04c3636c0848a5e13df8a9758bacea231f34cba13b466360b0dec69f74f8bf9a2dcf3dd94fa3a7d27e8caae00240559d75875ef9c619416593ca0072e7f38caae5a530c62dbe00e38c12cb8b924d63fca4d5c3a4c8f50e8f4f86fc1fe2b163219c46c21eb783e587e18e07ab7e1927a646c4f154c5000cb65ce9528457c3c66f43d9ab7d61580df0ecfb31cb38e4cbcdc3dafcca57311abec6b74048c8b74505ba678a4db07ed7243c70a821aee66a487bf91fd273418f8ef657d1eeb9ea6f095d47641e9f9fa30599e8b9c6b4453a1a5e8afd86fcafb46dd095fa4a98a2b26470e2c799b08c6000f5c3c4e28961463724377f37813f3922484fda986eb7c93ae8365baf648acbb344ca7e044d7ba93e7ba35c31085f3f99c5fdb2f9f2845f00b8590395e8ff730b86f5dd7f52297b8ecd5d5a6bb452bcd12b98d6adb27e7ef0e84b9567c66093ca3edab7e64ac4f56360501d81823ea2b1595f934c5f61c8558304c16154109a983a2af8725c7af91b5bc57e555768aa8115236a6ccc921d472b608eb6b82c4ba3747d79027d7856fae5369aa325df6a76138a5b41a94377eeeb251087e0b8510d8890e3f7a0cffaeddb9d2c29bc89f952489f82ee2e2b485cd297e6d30683701623cf73ee9ee606baeae9c3afba287eff57731b9cfaf034b1f56c8b31a32a1078c4fcab298c3f925a8e7cacceb9edf7ba2e54d31033a25462021e4a3c0bf5af341b462ee4417024da7c12c7f385de3af129aef1338a9c1fd68323d07ff47ec8bcca66b44300624d02c9202a2d093c3c85fd922b57b3bd14162c8ca5690734b7e4e4b8980b73a8e9908a9fa3dd508b30e3b1e1fd4ec388affa27c4bc26ca2820e0a902d51ff94984e8894fa5fca7b8704b7600ca6d6b1b1527ea999fcdf8fe3b290ec0036cad222f92cf8a5a54d0fa91de6e74ef61f60a233c9f15fdc86226c3f688de15ed8f0c3f1bc3afcad87cee47a19384afc6a804f197339ebce4aca211dbe0504a000755d18f20c4ecacd4123acdff7653cbb26456499495662508c8186afb883f5481c6bdf88cf137e263bde9d62f054573e0d1454cc119c95d4d9011332bd77682f79debcf5c21f0be7e9a83a58cec34e7cfb17a8122e030669228e4d3d9e274a678c5b77e6180aacc2fa8eb9952c5b04de6b2c7bee591badab96a3c3248c275b5b8faf5394eacc427a840570033be5006c33ce2d2c6e54f08681c3f74ad2fe54bca6dc62a9d84f6c58509c1e5dd5cfcc7a358493d428de48dfc1bc3f74154801c97e6aae38445045320b4cf66c1e56eb6ea2c1218de65f120b463c5cfb9255b3a25eb6e848cbd977f0605d71c561c2a754f5761c31f84101ee8178782cc8cf70b41a2204c5cb2f3134d572327fe4bbc1792249dfcf0ae7ba5d81fb5ae4a7978d044085f3b7f2e398c05733e2bf456cae898f8b5a81e9c79179bb5ca716713fce643dabe21eaee4386e646e25ad3adc5a4ad40f9bd6743f5f742efb1a674ffdbd2ced56c646ae590eb8f10283b47f57e6f96ad76adebecb24df74020b096fdee3c8d780d563a915f73c8b0246b861cd3a8580d5cf75798e8cf1c5875724661a39277e7165fe48ed8d5e6a20d68239f626fe8ea434a4e6e03ea434ec68c4b92a0fc2af15a135d6cbaeeca39a0c1896dab33daac", 0x2000, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) write$FUSE_INIT(r4, &(0x7f00000013c0)={0x50, 0x0, r5, {0x7, 0x2b, 0x1, 0x0, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40}}, 0x50) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006780)={0x90, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0xf, 0x0, 0x0, 0x0, 0x0, r6, 0x0, 0x0, 0x4}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_fuse_handle_req(r4, 0x0, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006780)={0x90, 0x0, 0x0, {0x5, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000, 0x0, 0x0, 0x0, 0x10b}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) r7 = open(&(0x7f00000001c0)='./file0/file0\x00', 0x2, 0x0) read$FUSE(r7, 0x0, 0x0) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, &(0x7f00000000c0)=""/87, &(0x7f0000000800)=""/90}) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000000680)) ioctl$VHOST_SET_VRING_ERR(r1, 0x4008af22, &(0x7f00000002c0)={0x1, r2}) ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000340)=0x1) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r8, 0x0) 2m23.30456402s ago: executing program 0 (id=993): r0 = ioctl$KVM_GET_STATS_FD_cpu(0xffffffffffffffff, 0xaece) ioctl$COMEDI_BUFCONFIG(r0, 0x8020640d, &(0x7f0000000000)={0x1, 0x1, 0x2, 0x2}) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan4\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wpan3\x00', 0x0}) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r1, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x64, r2, 0x100, 0x70bd2a, 0x25dfdbfe, {}, [@IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x7}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r3}, @IEEE802154_ATTR_LLSEC_SECLEVELS={0x5, 0x35, 0x4f}, @IEEE802154_ATTR_LLSEC_SECLEVELS={0x5, 0x35, 0xc8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r4}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r5}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000000}, 0x800) r6 = msgget$private(0x0, 0x10) msgctl$IPC_RMID(r6, 0x0) r7 = msgget$private(0x0, 0x66) msgctl$IPC_RMID(r7, 0x0) ioctl$PPPIOCATTCHAN(r0, 0x40047438, &(0x7f0000000280)=0x3) r8 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000300), r1) sendmsg$NL802154_CMD_SET_MAX_FRAME_RETRIES(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x5c, r8, 0x200, 0x70bd25, 0x25dfdbfc, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_MAX_FRAME_RETRIES={0x5, 0xf, 0x2}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_MAX_FRAME_RETRIES={0x5, 0xf, 0xf}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_MAX_FRAME_RETRIES={0x5, 0xf, 0x5e}, @NL802154_ATTR_MAX_FRAME_RETRIES={0x5, 0xf, 0x8}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4040005}, 0x20000004) ioctl$KVM_CREATE_IRQCHIP(r0, 0xae60) msgsnd(r6, &(0x7f0000000440)={0x1, "a2b6d710ab6f328dad1bae9d371f32b26e794af9881c4e67e9c17c11b3bdebf9fe6e9c0d75c65a47d323fef341c9fac228ec248da5da1c5c9cf176b44156e76be9289e0816c47741d6312130f1b6ca1e98ca6b30419ea0dc6e4e92e035bcd31d53a393bcc0831e50b3b7341bc5612744fa54063976c860f13015c5304ab02e17b622b5c1734c0f4e1f0b5d72d47e"}, 0x92, 0x0) ioctl$PPPIOCDISCONN(r0, 0x7439) msgsnd(r6, &(0x7f0000000500)={0x0, "d528dd8b2bad20d6b022585ced71a1f066fdb4d9e5a14142bbcfb974f6dc16f2cea3615b62fad7fe6a12bfd1d968c311db8ca0f23864e78ae2d5b24646cbe449caf186a3f2406d160516926f62887db27532"}, 0x56, 0x800) syz_genetlink_get_family_id$net_dm(&(0x7f0000000580), r1) bind$inet(r0, &(0x7f00000005c0)={0x2, 0x4e21, @multicast2}, 0x10) msgctl$MSG_STAT(r7, 0xb, &(0x7f0000000600)=""/40) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000640)={{{@in6=@ipv4={""/10, ""/2, @remote}, @in=@multicast2}}, {{@in6=@empty}, 0x0, @in6=@private2}}, &(0x7f0000000740)=0xe4) socket$nl_netfilter(0x10, 0x3, 0xc) r9 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x2b) ioctl$KVM_GET_NR_MMU_PAGES(r9, 0xae45, 0x1) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000780)={'wpan0\x00'}) openat$uinput(0xffffff9c, &(0x7f00000007c0), 0x2, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r0, 0xc0502100, &(0x7f0000000800)={0x0, 0x0}) ptrace$cont(0x18, r10, 0x3, 0x80000000) 2m23.266759161s ago: executing program 0 (id=997): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000000)) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x7000000) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setreuid(0x0, r5) pipe2(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) fcntl$setpipe(r6, 0x407, 0x100000) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) r8 = signalfd(r2, &(0x7f0000000240)={[0x5000, 0xb006]}, 0x8) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f00000002c0)={0x0, @dev, @multicast1}, &(0x7f0000000300)=0xc) sendmsg$nl_route_sched_retired(r8, &(0x7f0000000400)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000380)={&(0x7f0000000a00)=@newtfilter={0xdb4, 0x2c, 0x100, 0x70bd29, 0x25dfdbff, {0x0, 0x0, 0x0, r9, {0x2, 0xe}, {0x9, 0x2715ad22253886f9}, {0xfff2, 0xb}}, [@f_rsvp6={{0xa}, {0xd40, 0x2, [@TCA_RSVP_POLICE={0x8b4, 0x5, [@TCA_POLICE_RATE64={0xc, 0x8, 0x4}, @TCA_POLICE_TBF={0x3c, 0x1, {0x8, 0x8, 0x0, 0xfffffff6, 0x7, {0x6, 0x2, 0xffff, 0xffb8, 0x2622, 0x8}, {0x2, 0x2, 0x7, 0xd72a, 0x4, 0x7}, 0x8000, 0x10, 0xae}}, @TCA_POLICE_RATE64={0xc, 0x8, 0x6}, @TCA_POLICE_RATE={0x404, 0x2, [0x13, 0x7, 0x0, 0x204, 0xdc, 0x6, 0x6, 0x2, 0x40, 0x0, 0x81, 0x6, 0x3c, 0x9, 0x6, 0xffff, 0x1, 0x7, 0x53d5, 0x53b, 0x8, 0x8, 0xffffffff, 0x673, 0x6, 0xfaf, 0x7, 0xd, 0x2, 0x5, 0x401, 0xaa, 0x1, 0x7, 0x3, 0x5, 0xb874, 0xffffffff, 0xf5a2, 0x7, 0x7, 0x3, 0x1, 0x5, 0x3, 0x7, 0x2, 0xfff, 0xfffffffa, 0x8, 0x400, 0x3, 0xfffffc2f, 0x3, 0x32f, 0x4, 0x1, 0x1, 0x0, 0x3ff, 0x4, 0x8, 0x191, 0x4, 0x7ff, 0x10001, 0x2, 0x850, 0x42, 0x80000001, 0x3, 0x10, 0x3, 0x1, 0x7, 0x8, 0x5, 0x3, 0x1ff, 0xfff, 0xa69, 0x2, 0x8, 0x3ff, 0x7, 0xffff0000, 0x7fff, 0x6, 0x9, 0x0, 0x4, 0x2, 0xff, 0x7, 0xfffffc01, 0xfffffffc, 0x3, 0xc, 0x1, 0x3, 0x7, 0xffff7fff, 0x7fffffff, 0x8872, 0x80000001, 0x6, 0x8, 0x7, 0x349, 0x7, 0x9, 0x8, 0x81, 0x4, 0x4, 0x4, 0xffffffa6, 0x410, 0x2, 0x1, 0x9e, 0x517, 0x400, 0xffff, 0x1, 0x6, 0xffffff80, 0xfffffc01, 0x80, 0x10001, 0x4, 0xfff, 0xb034, 0xe, 0x2, 0x2, 0x5, 0xfffffff7, 0x98cd, 0x9, 0x8, 0x1, 0x5d6, 0x9, 0xf1, 0x4, 0x2, 0x8, 0xfffffffc, 0x6, 0x0, 0x6, 0x100, 0x9, 0x3, 0x8, 0x5, 0x1, 0x0, 0x3, 0xffff, 0x8, 0x0, 0x8f, 0x6, 0x4, 0x1, 0xfff, 0x3, 0x6e1, 0x1000, 0xe, 0x6, 0x1, 0xffff, 0x4, 0x5c, 0x1, 0x8, 0x7, 0x599000, 0x8, 0x1, 0x3, 0x9, 0x408c0af, 0x5, 0x5a, 0x1, 0x7fff, 0x1, 0x5347, 0x4, 0xbc4b, 0x1, 0x8, 0x91, 0x3, 0x6, 0x8074, 0xfffffff1, 0x0, 0x4, 0x36f, 0x1, 0x8001, 0x80000001, 0x1, 0x1, 0x5, 0x39d7, 0x5, 0x0, 0x100, 0x3, 0x8, 0x7, 0x1, 0x6, 0x6, 0x2, 0x5, 0x0, 0x4, 0x81, 0x8, 0x3, 0x7e, 0x800, 0x600000, 0x4, 0x7, 0x9, 0x8, 0x317, 0x0, 0x2, 0x3, 0x7ff, 0x8000, 0x0, 0x4, 0x100000, 0x0, 0xfffffffd, 0x6, 0x4, 0x4e, 0x8, 0x0, 0xf, 0x1e, 0x419f3379, 0x18a, 0x9, 0x7f]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x3102c9a9, 0x2, 0x5, 0x5, 0x2, {0xa, 0x1, 0x0, 0x421, 0xf1e1, 0x5e4}, {0x9, 0x1, 0x2, 0xffc0, 0xd, 0xd}, 0x0, 0x0, 0xd}}, @TCA_POLICE_RATE64={0xc, 0x8, 0x9}, @TCA_POLICE_RATE64={0xc, 0x8, 0x3}, @TCA_POLICE_RATE={0x404, 0x2, [0x1, 0x6, 0x8, 0x7, 0xcf1, 0x7fffffff, 0x8, 0x2, 0xa589, 0x200, 0x401, 0x2, 0x6, 0x80000000, 0xffffffff, 0x3, 0x25a2, 0xfffffff7, 0x7f, 0x4, 0x6, 0x65e, 0x2, 0x3, 0x4, 0xff, 0x3, 0x0, 0x80, 0x8, 0x4d, 0x4, 0xffff2d63, 0x6, 0x33, 0x1, 0x0, 0x4, 0x1, 0x400, 0xfffffffd, 0x3, 0xfffff800, 0x9, 0xfff, 0x7ff, 0x5, 0x8, 0x6, 0x608f, 0xd, 0x6, 0x0, 0x3, 0x8, 0x8001, 0x5d, 0x81, 0xfffffffe, 0x40, 0x7, 0x0, 0x1c, 0x80000000, 0xd, 0xe, 0x8, 0x37bd, 0x7, 0xfffffff9, 0x2, 0x7, 0xd, 0x4, 0x3b34, 0xfffffffd, 0x68000, 0x0, 0x5, 0x7, 0x9, 0x1000, 0x0, 0x1, 0x3ff, 0xb, 0xe, 0x6, 0xa, 0x8000, 0x8, 0x3, 0x4, 0x7, 0x8, 0x34000000, 0x5, 0x1ff, 0x5, 0x6, 0x6b, 0x3, 0x2, 0x8, 0x5f, 0x7, 0x0, 0x6, 0x8, 0x7, 0x1, 0x6, 0x8, 0x0, 0x9, 0x7, 0x195, 0xffffff36, 0xb, 0x8, 0x10001, 0x236c, 0xffff, 0x8, 0x38c9, 0xb8ed, 0x6, 0x3, 0xfb8, 0x6, 0x6, 0x3, 0x7fff, 0x2, 0x401, 0x8, 0x1, 0x7, 0x1, 0x8, 0x5e, 0x1000, 0x100, 0x8, 0x3, 0x0, 0x91, 0xe84, 0x3, 0x0, 0x3ff, 0x80000001, 0x6, 0x9, 0x26d0b0a1, 0xb, 0x2, 0x9, 0x1000, 0x2, 0x8, 0x7, 0x7e0d, 0x4, 0x5, 0x8, 0x90be, 0x41, 0x3, 0x3b, 0xd, 0x1, 0x8b0b, 0x8, 0xb, 0x5, 0x1, 0x10001, 0x2, 0x0, 0x98ea, 0xfffffff7, 0x9, 0xd, 0x80, 0x1, 0x80000001, 0x4, 0x0, 0xfffffffd, 0x5, 0x40, 0xccc0, 0x9, 0x2, 0x2, 0x9, 0x8, 0x1, 0x3bed, 0x1ff, 0xd, 0x4, 0x8, 0x4, 0x7, 0x3ff, 0x3, 0xa, 0x1ff, 0xfffffff6, 0xffff2ead, 0x7, 0x2, 0x2, 0x8, 0x3, 0x6, 0xfffffe01, 0xffff, 0x9, 0xfffff7ee, 0x1, 0x9, 0x4, 0x5, 0x6, 0x3, 0x2, 0x3, 0x9, 0xbe1, 0xf47d, 0x7, 0x1, 0x2, 0x200, 0xffffffff, 0x7f, 0x1, 0x401, 0xee4c1498, 0x4, 0x9, 0x10000, 0x0, 0x3, 0x5, 0xffffff00, 0xb, 0x0, 0x80000000, 0x9, 0x8001, 0x3, 0x8]}]}, @TCA_RSVP_CLASSID={0x8, 0x1, {0x2, 0xc}}, @TCA_RSVP_POLICE={0x470, 0x5, [@TCA_POLICE_TBF={0x3c, 0x1, {0x5, 0x1, 0xace8, 0x3, 0x3, {0x7, 0x0, 0x2, 0x9, 0x5971, 0xcf2a}, {0x1, 0x0, 0x8, 0xfffe}, 0x7, 0x9, 0x9}}, @TCA_POLICE_PEAKRATE64={0xc}, @TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x4}, @TCA_POLICE_PEAKRATE64={0xc}, @TCA_POLICE_RESULT={0x8, 0x5, 0x80}, @TCA_POLICE_RATE={0x404, 0x2, [0xb, 0x8001, 0x6, 0x7c7, 0x0, 0x68, 0x9, 0x1, 0x5, 0xff800, 0x10000, 0x6, 0x0, 0x0, 0xfca, 0x8, 0x7, 0x2, 0x10000000, 0x1a9f9c5, 0x6, 0xf92, 0x9, 0x7, 0x5, 0x7, 0x40, 0x7ff, 0x3, 0x3, 0x1, 0x0, 0x6, 0x4, 0x7fffffff, 0x8, 0x9, 0x10000, 0x4, 0x9, 0x7, 0x19a, 0x6, 0xc, 0x6, 0x565add24, 0x9, 0xdec9592, 0x3553d1d1, 0xdf, 0x5, 0x0, 0x6, 0x8, 0x7b, 0x7, 0x4, 0x9, 0x8, 0x6, 0x6, 0x800, 0x5, 0x0, 0xef3c, 0x9, 0x4, 0x5, 0x7ff, 0x2, 0x7, 0x569a, 0x7, 0x3, 0x3, 0x1, 0x5, 0x9f6, 0x5, 0x1ff, 0x0, 0xff, 0xfffffff8, 0xd2, 0xfffffffc, 0xffff, 0x2, 0xb, 0x9, 0x10, 0x7, 0x3, 0x800, 0x1ff, 0x3, 0xa, 0x4, 0x9, 0x3, 0x3, 0xffffff7e, 0xa, 0x7, 0x9, 0x6, 0x5, 0x4, 0x2, 0xd, 0xffff4daf, 0x3, 0x9, 0x1ff, 0xffffffff, 0x6, 0x3, 0x9e7e, 0x0, 0xc07, 0x7d02, 0x8, 0x8, 0xf74, 0x1, 0x7, 0x4, 0x3, 0x8, 0x7, 0x0, 0x8, 0x56, 0xf47, 0x4, 0x9, 0x617, 0xbd5e, 0x0, 0x5, 0x3, 0x7, 0x1000, 0x200, 0x5, 0x8, 0xfffffff1, 0x3, 0x33, 0x80000001, 0xfffffc00, 0x2, 0x40, 0x6b3e, 0xae000000, 0x7, 0xbaf, 0x1, 0x7, 0x8, 0x40, 0x1, 0x5, 0x7, 0x6, 0x8, 0x7fffffff, 0x5, 0x9, 0x80000000, 0xe8, 0x5da, 0x87, 0x14000000, 0x401, 0x2, 0x10b5, 0x1, 0xf9, 0xf, 0x4, 0x2, 0x5, 0x1, 0x6, 0x8, 0x5, 0x2e, 0x5, 0x6, 0x5, 0x4, 0x2, 0x4, 0x6, 0xfff, 0x6, 0x5, 0x3, 0x2, 0xf6, 0x80, 0x1, 0x2, 0xde, 0xe9b5, 0x70000000, 0x7, 0x1, 0x9, 0x8, 0x81, 0x2, 0x2de, 0x4, 0x2, 0x2, 0x889300, 0xe, 0x9, 0x4, 0x3, 0x9c3, 0xfffffff2, 0x5, 0x4, 0xb, 0x2, 0x8, 0x4, 0x9, 0x1, 0x4, 0x800, 0x800, 0x3de, 0xff, 0x27a8, 0x7fff, 0x20, 0x40, 0x1, 0x0, 0x3, 0x3e, 0x7f53, 0xffffffff, 0x33, 0x7, 0xffff, 0x1, 0x7ff, 0xffffffff, 0x3, 0x902, 0x10, 0xe0]}]}, @TCA_RSVP_POLICE={0x10, 0x5, [@TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x10}]}]}}, @f_rsvp6={{0xa}, {0x38, 0x2, [@TCA_RSVP_SRC={0x14, 0x3, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @TCA_RSVP_PINFO={0x20, 0x4, {{0x5, 0x4, 0x3d7d}, {0x3, 0x8, 0x5}, 0x2, 0x7, 0x4}}]}}]}, 0xdb4}, 0x1, 0x0, 0x0, 0x80}, 0x200000c1) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)={0x34, r1, 0x1, 0x20080, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r7}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x66}], @NL80211_ATTR_CH_SWITCH_COUNT={0x8, 0xb7, 0x87}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CRIT_PROTOCOL_STOP(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x28, r1, 0x8, 0x70bd25, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r10}, @val={0xc, 0x99, {0x2, 0xd}}}}, ["", "", "", "", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x20044800}, 0x20000080) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000006c0)=ANY=[@ANYBLOB="1803000010000900fffffffffddbdf250200000004001f00f4020180ee021f803af27530bc64d8dc38a7b4d10078d58347e1c55acf0401017c113797d59a91cc1395c0d47d45e8c3a3d73309d66e8c5a2fa05b81a08529fa2770195ee8276e4d08481de4e9f8f334eac8a9bcfb24ee106d77cf5de14e0564834bc07a1591f132af972045bfb4e4def6eaa9602e9869c905267d02d5efdb984e5a0e2af4f1679d1237f03c84734fe77b0f9c2340d130625f77d92efe18789632cb40b0f6d7acb899b7e43d68701649372171d17ff8123fbf12382f74e0afde40812d475e628fa484c41cb051c1eefd12e6cfd2aa5b538397d51695509ed266d837390c48d5e763db975c8ef70cee86ce1262f62b774a5c0c00558008003300ac1e00010cb5231101ee9fd0fb3471c808be7bffd2fbff0b4ce291605680bf53f0c6b832f591987d3cc806f75da62e168ce8943f26625d2aad33452174b901b4e02bfd72a408e99866de11944847847b9c5bab4e35f09d4b77b7f51df39d38267be5a6cbb5da8451a2ba47c14b15aa8d67ef3e07350465762dcc72ac297957984e6a13e9b6e9ba0b03fa22d51701e7bee7b2ba33a96c22cbc183f0a6d94a7edf1e7e3a0d8d086467c6496c040001801b109cc582e56d1f18d634daaf439b2e26a90b6e6932209ac8b91689d0face969c512c8f2b2790fb1cf238b703786c2a4e114858cf618767681e6b04c4896f01016526c60de8a6b2ecbf8d58f86e7403b763e3281b381527813828740e99f750609c7e3e4508000000000000005b9dce26a96ec2600582ada72fabeaea64f46b0100953faca1bec6af985d148cb2348e11aeac074200000000000000c2634f0cf3f6522b88ef7222bf603209b1043cfa00000000c9db3e637cd3017d1f71afef42dc4fc422406bf02cfc68018cbe87c2796dd5d26f89c008b252606a2cdd6c59a7572b32307f94fa501076c4914cfffe2b49dea4a7765d8dc8ff635d9d1d059ff240b25f0d48e4d92ebefbee685ab01d9fffb8918f3584d99f94d74849dcd187e1db9809029abd241b97f34dca090804c8207e6f50efa11a365408002200", @ANYRES32=r0, @ANYBLOB='\b\x00=\x00', @ANYRES32, @ANYBLOB="00000900eb00585e492300000000"], 0x318}, 0x1, 0x0, 0x0, 0x8000}, 0x800) 2m23.186623662s ago: executing program 0 (id=999): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newlink={0x50, 0x10, 0x401, 0x800000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x32b}, [@IFLA_ALT_IFNAME={0x14, 0x35, 'bond0\x00'}, @IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_AD_SELECT={0x5}]}}}]}, 0x50}, 0x1, 0x0, 0x0, 0x20000000}, 0x74c920689c38ea7e) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) chroot(&(0x7f00000001c0)='./file0\x00') mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_RESET_LINK_STATS(r1, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000700)={0x30, r2, 0x1, 0x70bd2d, 0x25dfdbfb, {{}, {0xeaffffff, 0x410c, 0xea}, {0x14, 0x14, 'broadcast-link\x00'}}}, 0x30}, 0x1, 0x0, 0x0, 0x51}, 0x40000) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x220) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000480)='./file0\x00', 0x89901) move_mount(r3, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x10) mount$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240), 0x1, 0x0) mount$afs(&(0x7f0000000000)=@cell={0x23, 'syz0:', 'syz1', '.readonly'}, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x20107c, &(0x7f0000000280)=ANY=[@ANYBLOB="666c6f636b3d6f70656e61667b2c666c6f636b3d6c6f63616c2c666c6f636b3d77726974652c666c6f636b3d77726974652c666c6f636b3d6c6f63616c2c646f6e745f6170707261697365746166665f752c736d61636b66736861743d2c736d61636b6673726f6f743d6175746f6673002c7365636c6162656c2c6673757569643d36346562c23231342d366334642d373531002d656461612d383065f0666561382c61707072616973655f747970653d696d617369672c00"/199]) 2m23.133082247s ago: executing program 0 (id=1002): gettid() (async) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) (async) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (async) socket$vsock_stream(0x28, 0x1, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x100008b}, 0x0) (async) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0xfffffffa) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000140), 0xc0843, 0x0) (async) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) (async) ioctl$VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, 0x0) (async) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x5, &(0x7f0000000300)=[{0x6, 0x7a, 0x0, 0x7fff0000}, {0x80, 0x3, 0x4, 0xfff}, {0x9, 0x7, 0x6, 0x10}, {0x2249, 0x5, 0xea, 0xd6}, {0x3, 0x8, 0x7b, 0x6}]}) (async) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x1}) (async) request_key(&(0x7f0000000040)='keyring\x00', &(0x7f0000000100)={'syz', 0x1}, 0x0, 0xfffffffffffffffe) (async) r2 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r2, &(0x7f0000000340), 0x10) (async) listen(r2, 0x0) (async) r3 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r3, &(0x7f0000000100)={0x28, 0x0, 0x0, @local}, 0x10) (async) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) pselect6(0x40, &(0x7f0000000000)={0x5, 0x0, 0x11ffffffffff, 0x2, 0x500, 0x0, 0x1800000000000000, 0x49}, 0x0, &(0x7f0000000180)={0x3fe, 0x53bf, 0x0, 0x200000004, 0x4000000000000086, 0x804, 0x3, 0x1}, 0x0, 0x0) (async) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000500)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="01002abd5000fddbdf250e00000008003a000400000005002a000000000005000200000020008a93571213fd246368926bbab3c866b7c96e7fe19ad69975b3e700c4fe2e66c19575f79c14a07fc06a528a637197c3dc3bb00050f519f776dcd8937f3721fb22fd05e595db39e6387bd874640882d3de1d1057798a049ffbcb0af1213dbb9e0aa77c956ceb4e46954e69fd611431dd0586f3539e30eac67f6afb293b397172666d29c8bed7ee68ddc00b8b13076717a244ce0932d7dae5ec2a220a8b930a37887a1e72c2a121729c924ed672e3b42e649aed53924feda03379cd9d9491472deed923249843bc949db31da2c7c678edd2c36f82b72ae5816cc2bebbeeaa532c817cf91cfba0e7a0bcc18abf5a2f8c261192a124054a3f"], 0x2c}}, 0x0) r4 = mq_open(&(0x7f00000000c0)='${$\x00', 0x840, 0x0, 0x0) (async) r5 = syz_io_uring_setup(0x554e, &(0x7f0000000440)={0x0, 0xaa66, 0x8000, 0x3, 0x3dc}, &(0x7f0000000280)=0x0, &(0x7f00000001c0)=0x0) pidfd_send_signal(0xffffffffffffffff, 0x9, &(0x7f00000003c0)={0x0, 0x200, 0x10000}, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r6, r7, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r4, 0x6, &(0x7f0000000380), 0x0, 0x4}) (async) io_uring_enter(r5, 0x847ba, 0x0, 0xe, 0x0, 0x0) (async) close_range(r0, 0xffffffffffffffff, 0x0) timer_create(0x6, &(0x7f0000533fa0)={0x0, 0x29, 0x800000000004}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) 2m7.060465219s ago: executing program 32 (id=1002): gettid() (async) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) (async) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (async) socket$vsock_stream(0x28, 0x1, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x100008b}, 0x0) (async) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0xfffffffa) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000140), 0xc0843, 0x0) (async) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) (async) ioctl$VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, 0x0) (async) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x5, &(0x7f0000000300)=[{0x6, 0x7a, 0x0, 0x7fff0000}, {0x80, 0x3, 0x4, 0xfff}, {0x9, 0x7, 0x6, 0x10}, {0x2249, 0x5, 0xea, 0xd6}, {0x3, 0x8, 0x7b, 0x6}]}) (async) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x1}) (async) request_key(&(0x7f0000000040)='keyring\x00', &(0x7f0000000100)={'syz', 0x1}, 0x0, 0xfffffffffffffffe) (async) r2 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r2, &(0x7f0000000340), 0x10) (async) listen(r2, 0x0) (async) r3 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r3, &(0x7f0000000100)={0x28, 0x0, 0x0, @local}, 0x10) (async) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) pselect6(0x40, &(0x7f0000000000)={0x5, 0x0, 0x11ffffffffff, 0x2, 0x500, 0x0, 0x1800000000000000, 0x49}, 0x0, &(0x7f0000000180)={0x3fe, 0x53bf, 0x0, 0x200000004, 0x4000000000000086, 0x804, 0x3, 0x1}, 0x0, 0x0) (async) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000500)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="01002abd5000fddbdf250e00000008003a000400000005002a000000000005000200000020008a93571213fd246368926bbab3c866b7c96e7fe19ad69975b3e700c4fe2e66c19575f79c14a07fc06a528a637197c3dc3bb00050f519f776dcd8937f3721fb22fd05e595db39e6387bd874640882d3de1d1057798a049ffbcb0af1213dbb9e0aa77c956ceb4e46954e69fd611431dd0586f3539e30eac67f6afb293b397172666d29c8bed7ee68ddc00b8b13076717a244ce0932d7dae5ec2a220a8b930a37887a1e72c2a121729c924ed672e3b42e649aed53924feda03379cd9d9491472deed923249843bc949db31da2c7c678edd2c36f82b72ae5816cc2bebbeeaa532c817cf91cfba0e7a0bcc18abf5a2f8c261192a124054a3f"], 0x2c}}, 0x0) r4 = mq_open(&(0x7f00000000c0)='${$\x00', 0x840, 0x0, 0x0) (async) r5 = syz_io_uring_setup(0x554e, &(0x7f0000000440)={0x0, 0xaa66, 0x8000, 0x3, 0x3dc}, &(0x7f0000000280)=0x0, &(0x7f00000001c0)=0x0) pidfd_send_signal(0xffffffffffffffff, 0x9, &(0x7f00000003c0)={0x0, 0x200, 0x10000}, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r6, r7, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r4, 0x6, &(0x7f0000000380), 0x0, 0x4}) (async) io_uring_enter(r5, 0x847ba, 0x0, 0xe, 0x0, 0x0) (async) close_range(r0, 0xffffffffffffffff, 0x0) timer_create(0x6, &(0x7f0000533fa0)={0x0, 0x29, 0x800000000004}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) 1m50.109884369s ago: executing program 1 (id=1192): r0 = syz_open_dev$dri(&(0x7f0000000100), 0x1, 0x1e080) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = dup(r2) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) ioctl$I2C_SMBUS(r3, 0x720, &(0x7f00000000c0)={0x1, 0x1, 0x8, &(0x7f0000000040)={0x10, "2b92fdc1eb2c9613ca196323e61ddc4931c81ec87f1ce7ba79403169fbbf01e127"}}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000140)={&(0x7f00000006c0)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f00000003c0)={r4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_SETPLANE(r0, 0xc03064b7, &(0x7f0000000200)={r4, r5, r6, 0x0, 0x7ffffffd, 0x5, 0x1f, 0x0, 0x3, 0x1000, 0x200400, 0x2}) 1m49.985632634s ago: executing program 1 (id=1193): r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6(0xa, 0x2, 0x0) socket$unix(0x1, 0x5, 0x0) openat(r0, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x1) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0xffffffffffffffff, 0x0, &(0x7f0000000000)=0xfff) syz_open_dev$sndmidi(&(0x7f00000000c0), 0x494, 0x1c7102) writev(r1, &(0x7f0000000840), 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0) write$binfmt_script(r3, &(0x7f0000000000), 0x208e24b) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000000540)) lseek(r3, 0xa, 0x4) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0x17) userfaultfd(0x801) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mbind(&(0x7f00001fa000/0x2000)=nil, 0x2000, 0x1, 0x0, 0x0, 0x1) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) sendmsg$NFT_BATCH(r2, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40186f40, &(0x7f0000000080)={0x6, 0x0, 0x81fe}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'bridge_slave_1\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="7c0000001000010400"/20, @ANYRES32=r5, @ANYBLOB="00000000000000005c001280110001006272696467655f736c61766500000000440005800500050000000000050020"], 0x7c}}, 0x0) 1m49.472489133s ago: executing program 1 (id=1197): sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={0x0}}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x4000010, 0xffffffffffffffff, 0x0) socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x3, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7}]}) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x2000000000000, 0xfffffdfffffffffe, 0xfa11, 0xffffffff}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$nl_route(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000000000)=ANY=[@ANYBLOB="50000000100001040100"/20, @ANYRES32=0x0, @ANYBLOB="000000000000000008000300", @ANYRES32=0x0, @ANYBLOB="2800128008000100677470001c00028008000100", @ANYRES32=r3], 0x50}}, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x4, &(0x7f00000001c0)={0xffffffffffffffff}, 0x13f, 0x1}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, &(0x7f0000000240)={0xe, 0x18, 0xfa00, @id_resuseaddr={0x0, r4}}, 0x20) r5 = openat$ppp(0xffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$PPPIOCSACTIVE(r5, 0x40087446, &(0x7f00000002c0)={0x6, &(0x7f0000000180)=[{0x3, 0x49, 0x6f, 0x400}, {0x9, 0xfe, 0x4, 0x66}, {0x6, 0x3, 0x3, 0x8000}, {0x200, 0x3, 0x7f, 0xc8}, {0x0, 0x6, 0x6, 0x8}, {0x9, 0xfe, 0x6, 0x1}]}) read(r3, 0x0, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, &(0x7f0000000140)={0x2, 0x1}, 0x2) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2000004, 0x200000005c831, r1, 0x0) r6 = socket(0x3, 0x2, 0xda2e) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r6, 0x84, 0x8, &(0x7f0000000100)=0x7ff, 0x4) 1m48.207264419s ago: executing program 1 (id=1203): r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000140)={&(0x7f00000006c0)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f00000003c0)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_SETPLANE(r0, 0xc03064b7, &(0x7f0000000200)={r1, r2, r3, 0x0, 0x7ffffffd, 0x5, 0x1f, 0x0, 0x3, 0x1000, 0x200400, 0x2}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000040)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000180)={&(0x7f00000000c0)=[r4, 0x0, 0x0], &(0x7f0000000100)=[0xe46, 0x9b8, 0xa5, 0xffffffff, 0xffff, 0x8, 0x400, 0x3], 0x3, 0x1}) 1m48.206812854s ago: executing program 1 (id=1204): socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r0, 0x0, 0x0, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x101041, 0x0) ioctl$TCSETS(r1, 0x404c4701, &(0x7f0000000040)={0x1, 0x0, 0x0, 0x400000, 0x14, "3eccd8000000000000000010000000040100"}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r3 = dup(r2) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) r4 = socket$inet_udp(0x2, 0x2, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="fc0000001900010000000000fcdbdf2500000000000000000000000000000000fe8000000000000000000000000000bb00000000000000000200000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000040000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000010000004400050000000000000000000000000000000000000000022b0000000a000000fe8000000000000000000000000000aa0000000004000000000000000000000000000000c6d6eac3624ce3cd3a1301d696468ff5bb8ab14d7f3ca4d28916cbf3f884ae1ea97f19ea656b3ff7b72d6c"], 0xfc}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_emit_vhci(&(0x7f0000000440)=ANY=[], 0x7) ioctl$KVM_CAP_ENFORCE_PV_FEATURE_CPUID(r3, 0x4068aea3, &(0x7f0000000140)={0xbe, 0x0, 0x1}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f0000000240)={'batadv_slave_0\x00'}) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r7 = dup(r6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r7, 0x2000) r8 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_ERR_FILTER(r8, 0x65, 0x2, &(0x7f0000000400)=0x2, 0x4) r9 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x18, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="180100002100000000000000000000008500000075000000a50000002300000095"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x100, 0x2, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xad}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000440)={&(0x7f00000001c0)='inode_switch_wbs\x00', r9}, 0x18) r10 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(r10, &(0x7f0000000180)='4\x00', 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r8, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_raw(r8, &(0x7f0000000040)={0x1d, r11}, 0x10) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r4, 0x89f3, &(0x7f0000000280)={'syztnl1\x00', &(0x7f00000001c0)={'tunl0\x00', r11, 0x10, 0x1, 0x3, 0x0, {{0x10, 0x4, 0x1, 0x18, 0x40, 0x65, 0x0, 0x6, 0x0, 0x0, @private=0xa010101, @local, {[@end, @ssrr={0x89, 0x17, 0x6a, [@remote, @multicast1, @multicast2, @local, @rand_addr=0x64010100]}, @lsrr={0x83, 0x7, 0x80, [@empty]}, @noop, @ssrr={0x89, 0xb, 0x35, [@initdev={0xac, 0x1e, 0x1, 0x0}, @local]}]}}}}}) 1m47.773862709s ago: executing program 1 (id=1214): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$unix(0x1, 0x2, 0x0) r1 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(0xffffffffffffffff, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000580)=ANY=[@ANYBLOB="540000001200b7a325bd7000fddbdf25200f07074e204e22030000002f00000001ffffffc300000006000000000000000000000007000000", @ANYRES32=0x0, @ANYRESOCT=r0], 0x54}, 0x1, 0x0, 0x0, 0x4008000}, 0x0) mprotect(&(0x7f0000001000/0x400000)=nil, 0x400000, 0x4) sendmsg$TCPDIAG_GETSOCK(r1, &(0x7f0000001380)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x24048084}, 0x40000) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) r2 = socket(0x10, 0x1, 0xfffffffe) sendto$inet6(r2, &(0x7f0000000100)="7800000018002507b9409b14ffff0b000204be040207fe056406040c5c001f003f0006010d0085a168d0bf46d32345653610648d270005000a06024e49935ade4a460c89b6ec0cff3959547f509058ba86c902007a00004a3200040016000803180000000000e000e218d1ddf66ed538f252325000000000", 0x78, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r3 = dup(r2) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) syz_io_uring_setup(0x239, 0x0, 0x0, 0x0) r4 = ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0x6a) syz_io_uring_setup(0x497, &(0x7f0000000400)={0x0, 0x7079, 0x0, 0x14, 0x39c}, &(0x7f0000000140)=0x0, &(0x7f0000000280)) recvmmsg(r3, &(0x7f0000000840)=[{{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f00000009c0)=""/205, 0xcd}, {&(0x7f0000000340)=""/119, 0x77}, {&(0x7f0000000c40)=""/220, 0xdc}, {&(0x7f00000001c0)=""/64, 0x40}, {&(0x7f0000000480)=""/158, 0x9e}], 0x5, &(0x7f0000000600)=""/136, 0x88}, 0xbe}, {{&(0x7f0000000d40)=@caif=@dbg, 0x80, &(0x7f00000002c0)=[{&(0x7f0000000dc0)=""/137, 0x89}], 0x1, &(0x7f0000000e80)=""/106, 0x6a}, 0x5}, {{0x0, 0x0, &(0x7f0000001040)=[{&(0x7f0000000f00)=""/66, 0x42}, {&(0x7f00000003c0)}, {&(0x7f0000000f80)=""/176, 0xb0}], 0x3, &(0x7f0000001080)=""/172, 0xac}, 0x1}, {{&(0x7f0000001140)=@phonet, 0x80, &(0x7f0000001400)=[{&(0x7f00000011c0)=""/90, 0x5a}, {&(0x7f0000001240)=""/116, 0x74}, {&(0x7f00000012c0)}, {&(0x7f0000001300)=""/90, 0x5a}, {&(0x7f0000001380)=""/1, 0x1}, {&(0x7f00000013c0)=""/24, 0x18}], 0x6, &(0x7f0000001440)=""/247, 0xf7}, 0x7fff}, {{&(0x7f0000001540)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000001980)=[{&(0x7f00000015c0)=""/228, 0xe4}, {&(0x7f00000016c0)=""/244, 0xf4}, {&(0x7f00000017c0)=""/229, 0xe5}, {&(0x7f00000018c0)=""/11, 0xb}, {&(0x7f0000001900)=""/78, 0x4e}, {&(0x7f0000009980)=""/4096, 0x1000}], 0x6, &(0x7f00000019c0)=""/34, 0x22}, 0x4}, {{&(0x7f0000001a00)=@l2tp6={0xa, 0x0, 0x0, @private2}, 0x80, &(0x7f0000001b80)=[{&(0x7f0000001a80)=""/239, 0xef}], 0x1, &(0x7f0000001bc0)=""/69, 0x45}, 0x3}, {{0x0, 0x0, &(0x7f0000001f40)=[{&(0x7f000000a980)=""/4096, 0x1000}, {&(0x7f0000001c40)=""/153, 0x99}, {&(0x7f0000001d00)=""/231, 0xe7}, {&(0x7f0000001e00)=""/174, 0xae}, {&(0x7f0000001ec0)=""/72, 0x48}], 0x5, &(0x7f0000001f80)=""/17, 0x11}, 0xdc3}], 0x7, 0x101, &(0x7f00000020c0)={0x0, 0x989680}) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) ioctl$TIOCSISO7816(r4, 0xc0285443, &(0x7f0000000100)={0x5, 0x6a6bcd02, 0xc2, 0xff, 0x3}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, {}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0500000003000000003800003f00000000000000", @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000001025858a74e6d74ce0a00feb3047bce87b5d8515b459a85bb9f95df0fc7233364f941b858a91ea0124997db6e070a13043a58bcabc1e25b42c652f379c7647a8d7e35b9b0420d8ab68594d97142485ca0aa5428357fe15cb074fae415c4ea31881ff9c84cee11d2c40816202391970509b5129249f3596d6285a48c18d53f4b55bf8c470a2ccfd029b81cf45d75425cc8dbf0", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000010000000000000000"], 0x50) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r6, &(0x7f0000000040)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) syz_emit_ethernet(0x4e, &(0x7f0000000140)=ANY=[@ANYBLOB="0180c2000001bbbbbbbbbbbb86dd60b819230074c0c36e7094238b84660e5e3c180000fe8000000000000000000000000000aafe8000000000000000000000000000aa2f02008100000000fc0200"], 0x0) r7 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x0) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="180000001800ff0f00000000001b0000850000006d000000850000002300000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r8}, 0x10) r9 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r9, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000003c0)="5c00000013006bcd9e3fe3dceb48aa31086b8703110000001fa1ff0000000000040014000d000a000d0000009ee517d34460bc24eab556a705251e6182949a3651f60a84c9f5d1938037e786a6d0bdd7fcf50e4509c5bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f000801}, 0x0) preadv(r7, &(0x7f0000000540)=[{&(0x7f00000020c0)=""/4088, 0xff8}], 0x1, 0x800, 0x0) 1m31.490578736s ago: executing program 33 (id=1214): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$unix(0x1, 0x2, 0x0) r1 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(0xffffffffffffffff, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000580)=ANY=[@ANYBLOB="540000001200b7a325bd7000fddbdf25200f07074e204e22030000002f00000001ffffffc300000006000000000000000000000007000000", @ANYRES32=0x0, @ANYRESOCT=r0], 0x54}, 0x1, 0x0, 0x0, 0x4008000}, 0x0) mprotect(&(0x7f0000001000/0x400000)=nil, 0x400000, 0x4) sendmsg$TCPDIAG_GETSOCK(r1, &(0x7f0000001380)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x24048084}, 0x40000) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) r2 = socket(0x10, 0x1, 0xfffffffe) sendto$inet6(r2, &(0x7f0000000100)="7800000018002507b9409b14ffff0b000204be040207fe056406040c5c001f003f0006010d0085a168d0bf46d32345653610648d270005000a06024e49935ade4a460c89b6ec0cff3959547f509058ba86c902007a00004a3200040016000803180000000000e000e218d1ddf66ed538f252325000000000", 0x78, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r3 = dup(r2) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) syz_io_uring_setup(0x239, 0x0, 0x0, 0x0) r4 = ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0x6a) syz_io_uring_setup(0x497, &(0x7f0000000400)={0x0, 0x7079, 0x0, 0x14, 0x39c}, &(0x7f0000000140)=0x0, &(0x7f0000000280)) recvmmsg(r3, &(0x7f0000000840)=[{{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f00000009c0)=""/205, 0xcd}, {&(0x7f0000000340)=""/119, 0x77}, {&(0x7f0000000c40)=""/220, 0xdc}, {&(0x7f00000001c0)=""/64, 0x40}, {&(0x7f0000000480)=""/158, 0x9e}], 0x5, &(0x7f0000000600)=""/136, 0x88}, 0xbe}, {{&(0x7f0000000d40)=@caif=@dbg, 0x80, &(0x7f00000002c0)=[{&(0x7f0000000dc0)=""/137, 0x89}], 0x1, &(0x7f0000000e80)=""/106, 0x6a}, 0x5}, {{0x0, 0x0, &(0x7f0000001040)=[{&(0x7f0000000f00)=""/66, 0x42}, {&(0x7f00000003c0)}, {&(0x7f0000000f80)=""/176, 0xb0}], 0x3, &(0x7f0000001080)=""/172, 0xac}, 0x1}, {{&(0x7f0000001140)=@phonet, 0x80, &(0x7f0000001400)=[{&(0x7f00000011c0)=""/90, 0x5a}, {&(0x7f0000001240)=""/116, 0x74}, {&(0x7f00000012c0)}, {&(0x7f0000001300)=""/90, 0x5a}, {&(0x7f0000001380)=""/1, 0x1}, {&(0x7f00000013c0)=""/24, 0x18}], 0x6, &(0x7f0000001440)=""/247, 0xf7}, 0x7fff}, {{&(0x7f0000001540)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000001980)=[{&(0x7f00000015c0)=""/228, 0xe4}, {&(0x7f00000016c0)=""/244, 0xf4}, {&(0x7f00000017c0)=""/229, 0xe5}, {&(0x7f00000018c0)=""/11, 0xb}, {&(0x7f0000001900)=""/78, 0x4e}, {&(0x7f0000009980)=""/4096, 0x1000}], 0x6, &(0x7f00000019c0)=""/34, 0x22}, 0x4}, {{&(0x7f0000001a00)=@l2tp6={0xa, 0x0, 0x0, @private2}, 0x80, &(0x7f0000001b80)=[{&(0x7f0000001a80)=""/239, 0xef}], 0x1, &(0x7f0000001bc0)=""/69, 0x45}, 0x3}, {{0x0, 0x0, &(0x7f0000001f40)=[{&(0x7f000000a980)=""/4096, 0x1000}, {&(0x7f0000001c40)=""/153, 0x99}, {&(0x7f0000001d00)=""/231, 0xe7}, {&(0x7f0000001e00)=""/174, 0xae}, {&(0x7f0000001ec0)=""/72, 0x48}], 0x5, &(0x7f0000001f80)=""/17, 0x11}, 0xdc3}], 0x7, 0x101, &(0x7f00000020c0)={0x0, 0x989680}) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) ioctl$TIOCSISO7816(r4, 0xc0285443, &(0x7f0000000100)={0x5, 0x6a6bcd02, 0xc2, 0xff, 0x3}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, {}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0500000003000000003800003f00000000000000", @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000001025858a74e6d74ce0a00feb3047bce87b5d8515b459a85bb9f95df0fc7233364f941b858a91ea0124997db6e070a13043a58bcabc1e25b42c652f379c7647a8d7e35b9b0420d8ab68594d97142485ca0aa5428357fe15cb074fae415c4ea31881ff9c84cee11d2c40816202391970509b5129249f3596d6285a48c18d53f4b55bf8c470a2ccfd029b81cf45d75425cc8dbf0", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000010000000000000000"], 0x50) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r6, &(0x7f0000000040)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) syz_emit_ethernet(0x4e, &(0x7f0000000140)=ANY=[@ANYBLOB="0180c2000001bbbbbbbbbbbb86dd60b819230074c0c36e7094238b84660e5e3c180000fe8000000000000000000000000000aafe8000000000000000000000000000aa2f02008100000000fc0200"], 0x0) r7 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x0) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="180000001800ff0f00000000001b0000850000006d000000850000002300000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r8}, 0x10) r9 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r9, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000003c0)="5c00000013006bcd9e3fe3dceb48aa31086b8703110000001fa1ff0000000000040014000d000a000d0000009ee517d34460bc24eab556a705251e6182949a3651f60a84c9f5d1938037e786a6d0bdd7fcf50e4509c5bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f000801}, 0x0) preadv(r7, &(0x7f0000000540)=[{&(0x7f00000020c0)=""/4088, 0xff8}], 0x1, 0x800, 0x0) 1m23.382379501s ago: executing program 2 (id=1331): bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x79, 0x10, 0x48}, [@ldst={0x3, 0x3, 0x3, 0xa, 0x0, 0xff00}], {0x95, 0x0, 0x74}}, &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) sendmsg(r0, &(0x7f0000000240)={&(0x7f0000000080)=@vsock={0x28, 0x0, 0x0, @host}, 0x80, &(0x7f0000000200)=[{&(0x7f0000000000)="08a11618a1a2ef8a042f342c2dcde91b", 0x10}, {&(0x7f0000000100)="77fc56a1fca50b9b798c380f89a3ee6c340f1af92ed43735eabbb279ef087cfd5f50501fa030c6db54a675623c26b49f45978f13d17b558757a83499fc2d2278a98442d434f82145bf87784ce4568d1ba406df1ce5d3dc2125ad00dc7b78d5069fb19f10bc1f32d400f18f6d6a4f3b68d9b84824031c931669a412db1767673c0a788aded437951bc4127f10df899c78a631469ae7ee9dd3d791c65367ab134c1b4d414f181bf1a499c39a94a97f26df933944655acdb244cda35034adb5706d544f78d9d2ddcc69a141a057cd43fb6645518e211835de2475cc04294223391eb79953033390c9e9ef6e5d06908f9b55d2e97a9bd85f5dc3fdcaa404", 0xfc}], 0x2}, 0x4) 1m23.381581217s ago: executing program 2 (id=1333): r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_SETPLANE(r0, 0xc03064b7, &(0x7f0000000200)={0x0, r1, r2, 0x20000000, 0x5, 0x5, 0x80001f, 0x4, 0x3, 0x6, 0x200400, 0x4}) prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000006c0)=@newtaction={0x13c, 0x30, 0x1, 0x0, 0x25dfdbfe, {}, [{0x128, 0x1, [@m_ct={0xe0, 0x2, 0x0, 0x0, {{0x7}, {0x48, 0x2, 0x0, 0x1, [@TCA_CT_LABELS_MASK={0x14, 0x8, "db35e8f064e4376cbe22f440dbd179e3"}, @TCA_CT_ZONE={0x6, 0x4, 0xa15}, @TCA_CT_ZONE={0x6, 0x4, 0x21}, @TCA_CT_PARMS={0x18, 0x1, {0xb, 0x4, 0x7, 0x8, 0x2}}, @TCA_CT_ZONE={0x6, 0x4, 0x3}]}, {0x71, 0x6, "12f10a254b17dcc013049f6c8e19d3d6e977f4a6deb1906ab88876ec7aa53bc251a2740aa6c6a1cd9fc988019dd3634ab9e7892ad02eb1851642e784dac08ba62739c88ed241d5420e0a47ce0832ed21992e5c59b527894f62a5cbbc4f10eebc4900"/109}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x3}}}}, @m_ife={0x44, 0x12, 0x0, 0x0, {{0x8}, {0xc, 0x2, 0x0, 0x1, [@TCA_IFE_TYPE={0x6, 0x5, 0xd}]}, {0x13, 0x6, "02932837c573bcd9d961a456d5de5d"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x1}}}}]}]}, 0x13c}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xa, &(0x7f0000000140)={0x8, 0x8f}, 0x0) sched_setscheduler(0x0, 0x6, &(0x7f0000000080)=0x6) r3 = getpid() sched_setaffinity(0x0, 0x4f, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000380)={&(0x7f0000000040)=ANY=[@ANYRESHEX=r2], 0x50}, 0x1, 0x7}, 0x800) mount$9p_tcp(&(0x7f0000000180), &(0x7f0000000440)='./file0\x00', &(0x7f0000000280), 0x0, &(0x7f0000000640)=ANY=[@ANYRES32=r4, @ANYRESHEX=r3, @ANYRES8=r4, @ANYRES8=r0, @ANYRESHEX=0x0, @ANYRESDEC=r0, @ANYRES32=r6]) sendmmsg$unix(r5, &(0x7f0000000000), 0x0, 0x48091) sched_setaffinity(r3, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r5, &(0x7f00000000c0), 0x0, 0xd02294b8daa2d41b, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r4, 0xc01864c6, &(0x7f0000000340)={&(0x7f00000001c0)=[r2], 0x1, 0x80000}) socket$inet_mptcp(0x2, 0x1, 0x106) sendmmsg(r4, 0x0, 0x0, 0x881) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) add_key$keyring(&(0x7f0000000000), 0x0, 0x0, 0x0, 0xfffffffffffffffe) setresgid(0xffffffffffffffff, 0xee00, 0xffffffffffffffff) syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r7) r8 = socket(0x15, 0x5, 0x0) r9 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x161200, 0x0) mount$9p_fd(0x0, &(0x7f0000000100)='.\x00', &(0x7f0000000280), 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r9, @ANYBLOB=',wfdno=', @ANYRESHEX=r8]) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) write(r0, &(0x7f0000000400)="0800000014ca38b900000000000000", 0xf) 1m23.28696044s ago: executing program 2 (id=1334): r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000140)={&(0x7f00000006c0)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f00000003c0)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_SETPLANE(r0, 0xc03064b7, &(0x7f0000000200)={r1, r2, r3, 0x0, 0x7ffffffd, 0x5, 0x1f, 0x0, 0x3, 0xfff, 0x200400, 0x2}) 1m23.2857064s ago: executing program 2 (id=1335): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80202, 0x0) setrlimit(0x6, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000380)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x80, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x54, 0x4, 0x0, 0x1, [{0x50, 0x1, 0x0, 0x1, @target={{0xb}, @val={0x40, 0x2, 0x0, 0x1, [@NFTA_TARGET_INFO={0x2c, 0x3, "7339f2f10455afb9fdd672bad09dfb78c7699c74e891a0c700"/40}, @NFTA_TARGET_REV={0x8}, @NFTA_TARGET_NAME={0x8, 0x1, 'LED\x00'}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xa8}, 0x1, 0x0, 0x0, 0x4000850}, 0x20040040) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) socket(0x1d, 0x2, 0x6) syz_open_dev$tty1(0xc, 0x4, 0x1) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x20000000000, 0xfffffffffffffffd, 0x0, 0x0, 0x1000001002, 0x49}, 0x0, &(0x7f00000002c0)={0x3fe, 0x7, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000006}, 0x0, 0x0) r3 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_LOCK(r3, 0x40405514, &(0x7f0000000200)={0x9, 0x2, 0x0, 0xfffffff7, 'syz1\x00', 0xffffff7d}) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r3, 0xc1105511, &(0x7f0000000040)={0x9}) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(0xffffffffffffffff, 0xc1105511, &(0x7f0000000040)) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, 0x0, &(0x7f0000000080)) close_range(r0, 0xffffffffffffffff, 0x0) 1m22.303437468s ago: executing program 2 (id=1340): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000850000005000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f0000000240)='mmap_lock_acquire_returned\x00', r0}, 0x18) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) getresgid(&(0x7f0000000680), &(0x7f00000006c0), &(0x7f0000000700)) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x4c02}) readv(r2, &(0x7f00000001c0)=[{&(0x7f0000001400)=""/227, 0x1c}], 0x4) socket$kcm(0x2, 0xa, 0x2) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r1, 0x8983, &(0x7f0000000080)={0x0, 'syzkaller1\x00', {0x4}, 0x1}) 1m20.879966947s ago: executing program 2 (id=1345): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9d, 0x11e41e7a, 0x20000000, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9d, 0x11e41e7a, 0x20000000, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() (async) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) fchdir(0xffffffffffffffff) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/power/resume', 0x141a82, 0x0) write$cgroup_int(r1, &(0x7f0000000040)=0x900, 0x12) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) (async) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) (async) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) sendmmsg(r4, 0x0, 0x0, 0x0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) add_key$keyring(&(0x7f0000000000), 0x0, 0x0, 0x0, 0xfffffffffffffffe) setresgid(0xffffffffffffffff, 0xee00, 0xffffffffffffffff) syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r5) r6 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) write(r6, &(0x7f0000000000)="14000000140005b7ffccca38b90000", 0xf) bpf$TOKEN_CREATE(0x24, &(0x7f0000000340)={0x0, r3}, 0x8) (async) bpf$TOKEN_CREATE(0x24, &(0x7f0000000340)={0x0, r3}, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="1a020000040000000000000000", @ANYRES32, @ANYBLOB="0400000800"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="feffffff010000000200"/28], 0x50) r7 = socket$inet(0x2, 0x2, 0x0) r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000035c0), 0x168003, 0x0) ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r8, 0x80083314, 0x0) (async) ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r8, 0x80083314, 0x0) setsockopt$inet_mreqn(r7, 0x0, 0x23, &(0x7f0000000100)={@multicast2, @loopback}, 0xc) 1m4.677111781s ago: executing program 34 (id=1345): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9d, 0x11e41e7a, 0x20000000, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9d, 0x11e41e7a, 0x20000000, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() (async) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) fchdir(0xffffffffffffffff) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/power/resume', 0x141a82, 0x0) write$cgroup_int(r1, &(0x7f0000000040)=0x900, 0x12) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) (async) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) (async) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) sendmmsg(r4, 0x0, 0x0, 0x0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) add_key$keyring(&(0x7f0000000000), 0x0, 0x0, 0x0, 0xfffffffffffffffe) setresgid(0xffffffffffffffff, 0xee00, 0xffffffffffffffff) syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r5) r6 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) write(r6, &(0x7f0000000000)="14000000140005b7ffccca38b90000", 0xf) bpf$TOKEN_CREATE(0x24, &(0x7f0000000340)={0x0, r3}, 0x8) (async) bpf$TOKEN_CREATE(0x24, &(0x7f0000000340)={0x0, r3}, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="1a020000040000000000000000", @ANYRES32, @ANYBLOB="0400000800"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="feffffff010000000200"/28], 0x50) r7 = socket$inet(0x2, 0x2, 0x0) r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000035c0), 0x168003, 0x0) ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r8, 0x80083314, 0x0) (async) ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r8, 0x80083314, 0x0) setsockopt$inet_mreqn(r7, 0x0, 0x23, &(0x7f0000000100)={@multicast2, @loopback}, 0xc) 27.570870656s ago: executing program 3 (id=1638): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x11, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="18010000010000000000000000030000850000007b00000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x1a, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340), 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000000)={r1}, 0x4) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x11, 0x11, &(0x7f0000000840)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x401}, [@snprintf={{}, {}, {}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r1}}, @call={0x85, 0x0, 0x0, 0xe}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f00000000c0)='tlb_flush\x00', r2}, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r0}, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), r3) sendmsg$NL80211_CMD_GET_WIPHY(r3, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000002c0)={0x30, r4, 0x301, 0x0, 0x0, {{}, {@val={0x8, 0x1, 0x14}, @val={0x8}, @val={0xc, 0x99, {0x2, 0x4}}}}}, 0x30}}, 0x44) 27.570709736s ago: executing program 3 (id=1640): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0xa031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x65364000) madvise(&(0x7f00006d3000/0x4000)=nil, 0x4000, 0x66) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) remap_file_pages(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2, 0x0) 26.941518109s ago: executing program 3 (id=1643): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80202, 0x0) setrlimit(0x6, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000380)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x80, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x54, 0x4, 0x0, 0x1, [{0x50, 0x1, 0x0, 0x1, @target={{0xb}, @val={0x40, 0x2, 0x0, 0x1, [@NFTA_TARGET_INFO={0x2c, 0x3, "7339f2f10455afb9fdd672bad09dfb78c7699c74e891a0c700"/40}, @NFTA_TARGET_REV={0x8}, @NFTA_TARGET_NAME={0x8, 0x1, 'LED\x00'}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xa8}, 0x1, 0x0, 0x0, 0x4000850}, 0x20040040) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) socket(0x1d, 0x2, 0x6) syz_open_dev$tty1(0xc, 0x4, 0x1) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x20000000000, 0xfffffffffffffffd, 0x0, 0x0, 0x1000001002, 0x49}, 0x0, &(0x7f00000002c0)={0x3fe, 0x7, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000006}, 0x0, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) r2 = syz_open_dev$sndctrl(&(0x7f0000001ac0), 0x0, 0x0) r3 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_LOCK(r3, 0x40405514, &(0x7f0000000200)={0x9, 0x2, 0x0, 0xfffffff7, 'syz1\x00', 0xffffff7d}) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r3, 0xc1105511, &(0x7f0000000040)={0x9}) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r2, 0xc1105511, &(0x7f0000000040)) close_range(r0, 0xffffffffffffffff, 0x0) 26.05541258s ago: executing program 3 (id=1650): connect$bt_l2cap(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0x0, @none, 0x4, 0x2}, 0xe) prctl$PR_SET_SECCOMP(0x16, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{}]}) r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) r1 = fcntl$dupfd(r0, 0x0, r0) write$sndseq(r1, &(0x7f00000004c0)=[{}, {0x0, 0x0, 0x0, 0x0, @time={0x0, 0x7f}, {}, {}, @quote}], 0x38) mount(0x0, &(0x7f0000000240)='.\x00', &(0x7f000015bffc)='nfs\x00', 0x0, &(0x7f0000000000)) connect$bt_l2cap(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0x0, @none, 0x4, 0x2}, 0xe) (async) prctl$PR_SET_SECCOMP(0x16, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{}]}) (async) syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) (async) fcntl$dupfd(r0, 0x0, r0) (async) write$sndseq(r1, &(0x7f00000004c0)=[{}, {0x0, 0x0, 0x0, 0x0, @time={0x0, 0x7f}, {}, {}, @quote}], 0x38) (async) mount(0x0, &(0x7f0000000240)='.\x00', &(0x7f000015bffc)='nfs\x00', 0x0, &(0x7f0000000000)) (async) 25.99564018s ago: executing program 3 (id=1652): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80202, 0x0) setrlimit(0x6, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000380)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x80, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x54, 0x4, 0x0, 0x1, [{0x50, 0x1, 0x0, 0x1, @target={{0xb}, @val={0x40, 0x2, 0x0, 0x1, [@NFTA_TARGET_INFO={0x2c, 0x3, "7339f2f10455afb9fdd672bad09dfb78c7699c74e891a0c700"/40}, @NFTA_TARGET_REV={0x8}, @NFTA_TARGET_NAME={0x8, 0x1, 'LED\x00'}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xa8}, 0x1, 0x0, 0x0, 0x4000850}, 0x20040040) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) socket(0x1d, 0x2, 0x6) syz_open_dev$tty1(0xc, 0x4, 0x1) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x20000000000, 0xfffffffffffffffd, 0x0, 0x0, 0x1000001002, 0x49}, 0x0, &(0x7f00000002c0)={0x3fe, 0x7, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000006}, 0x0, 0x0) r3 = socket$inet_sctp(0x2, 0x1, 0x84) r4 = syz_open_dev$sndctrl(&(0x7f0000001ac0), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_LOCK(0xffffffffffffffff, 0x40405514, &(0x7f0000000200)={0x9, 0x2, 0x0, 0xfffffff7, 'syz1\x00', 0xffffff7d}) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(0xffffffffffffffff, 0xc1105511, &(0x7f0000000040)={0x9}) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r4, 0xc1105511, &(0x7f0000000040)) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r3, 0x84, 0x18, 0x0, &(0x7f0000000080)) close_range(r0, 0xffffffffffffffff, 0x0) 24.991565109s ago: executing program 3 (id=1657): r0 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x1c1341, 0x0) (rerun: 32) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) (async, rerun: 64) writev(r1, &(0x7f0000000340), 0x0) (async, rerun: 64) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0xffffffffffffff0d) (async, rerun: 32) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1004000) (async, rerun: 32) r3 = userfaultfd(0x80001) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000180)={0xaa, 0x68a}) (async) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000140)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) (async) r4 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r4, 0xaf01, 0x0) (async) r5 = eventfd(0xfffffff9) ioctl$VHOST_SET_LOG_FD(r4, 0x4004af07, &(0x7f0000000240)=r5) (async) ioctl$UFFDIO_REGISTER(r3, 0xc020aa04, &(0x7f0000000000)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x0, 0x2}) (async) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_AUTHENTICATE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4400c43bda7065042f5dcdd061ec55c75240a9f97c1725bc00006f63e5df4f9f11464c78f788cdd8b7f4da566f77ee7765406fbab22ab8dfce159cd829ddb1256f9f228521f7a970961d5009c1af46481cd792b3baa56c7fcf0b0a0f57cabad47988d7c22f0268259ff40160dc86adae2e31cbebe3e4b9fac8bf9198f3bbb02574d61f58335b1431bea5129d8c", @ANYRES16=r6, @ANYBLOB="010002000020000001002500000008000300", @ANYRES32=r7, @ANYBLOB="08002600800900000a000600ffffffffffff000008003500000000000a0034000202020202020000"], 0x44}, 0x1, 0x0, 0x0, 0x40000}, 0x0) (async, rerun: 64) ioctl$VIDIOC_EXPBUF(0xffffffffffffffff, 0xc0405610, &(0x7f0000000380)={0x3, 0x6, 0x7f, 0x80080, 0xffffffffffffffff}) (rerun: 64) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, &(0x7f0000000400)=0x1) (async) openat$nvme_fabrics(0xffffff9c, &(0x7f0000000040), 0x5c10c1, 0x0) (async, rerun: 64) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) (async, rerun: 64) mknodat(0xffffffffffffff9c, &(0x7f0000000200)='./file1/file4/file5\x00', 0xc000, 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file1/file4/file7\x00', 0x1c0) (async) r9 = landlock_create_ruleset(&(0x7f00000002c0)={0x2000}, 0x18, 0x0) r10 = openat$dir(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0x200000, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r9, 0x1, &(0x7f0000000340)={0x2000, r10}, 0x0) landlock_restrict_self(r9, 0x2) (async) linkat(0xffffffffffffff9c, &(0x7f0000000500)='./file1/file4/file5\x00', 0xffffffffffffff9c, &(0x7f0000000540)='./file1/file4/file7/file5\x00', 0x0) 8.579545363s ago: executing program 35 (id=1657): r0 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x1c1341, 0x0) (rerun: 32) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) (async, rerun: 64) writev(r1, &(0x7f0000000340), 0x0) (async, rerun: 64) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0xffffffffffffff0d) (async, rerun: 32) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1004000) (async, rerun: 32) r3 = userfaultfd(0x80001) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000180)={0xaa, 0x68a}) (async) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000140)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) (async) r4 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r4, 0xaf01, 0x0) (async) r5 = eventfd(0xfffffff9) ioctl$VHOST_SET_LOG_FD(r4, 0x4004af07, &(0x7f0000000240)=r5) (async) ioctl$UFFDIO_REGISTER(r3, 0xc020aa04, &(0x7f0000000000)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x0, 0x2}) (async) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_AUTHENTICATE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4400c43bda7065042f5dcdd061ec55c75240a9f97c1725bc00006f63e5df4f9f11464c78f788cdd8b7f4da566f77ee7765406fbab22ab8dfce159cd829ddb1256f9f228521f7a970961d5009c1af46481cd792b3baa56c7fcf0b0a0f57cabad47988d7c22f0268259ff40160dc86adae2e31cbebe3e4b9fac8bf9198f3bbb02574d61f58335b1431bea5129d8c", @ANYRES16=r6, @ANYBLOB="010002000020000001002500000008000300", @ANYRES32=r7, @ANYBLOB="08002600800900000a000600ffffffffffff000008003500000000000a0034000202020202020000"], 0x44}, 0x1, 0x0, 0x0, 0x40000}, 0x0) (async, rerun: 64) ioctl$VIDIOC_EXPBUF(0xffffffffffffffff, 0xc0405610, &(0x7f0000000380)={0x3, 0x6, 0x7f, 0x80080, 0xffffffffffffffff}) (rerun: 64) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, &(0x7f0000000400)=0x1) (async) openat$nvme_fabrics(0xffffff9c, &(0x7f0000000040), 0x5c10c1, 0x0) (async, rerun: 64) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) (async, rerun: 64) mknodat(0xffffffffffffff9c, &(0x7f0000000200)='./file1/file4/file5\x00', 0xc000, 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file1/file4/file7\x00', 0x1c0) (async) r9 = landlock_create_ruleset(&(0x7f00000002c0)={0x2000}, 0x18, 0x0) r10 = openat$dir(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0x200000, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r9, 0x1, &(0x7f0000000340)={0x2000, r10}, 0x0) landlock_restrict_self(r9, 0x2) (async) linkat(0xffffffffffffff9c, &(0x7f0000000500)='./file1/file4/file5\x00', 0xffffffffffffff9c, &(0x7f0000000540)='./file1/file4/file7/file5\x00', 0x0) 6.243894319s ago: executing program 5 (id=1726): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80202, 0x0) setrlimit(0x6, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000380)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x80, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x54, 0x4, 0x0, 0x1, [{0x50, 0x1, 0x0, 0x1, @target={{0xb}, @val={0x40, 0x2, 0x0, 0x1, [@NFTA_TARGET_INFO={0x2c, 0x3, "7339f2f10455afb9fdd672bad09dfb78c7699c74e891a0c700"/40}, @NFTA_TARGET_REV={0x8}, @NFTA_TARGET_NAME={0x8, 0x1, 'LED\x00'}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xa8}, 0x1, 0x0, 0x0, 0x4000850}, 0x20040040) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) socket(0x1d, 0x2, 0x6) syz_open_dev$tty1(0xc, 0x4, 0x1) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x20000000000, 0xfffffffffffffffd, 0x0, 0x0, 0x1000001002, 0x49}, 0x0, &(0x7f00000002c0)={0x3fe, 0x7, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000006}, 0x0, 0x0) r3 = socket$inet_sctp(0x2, 0x1, 0x84) r4 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_LOCK(r4, 0x40405514, &(0x7f0000000200)={0x9, 0x2, 0x0, 0xfffffff7, 'syz1\x00', 0xffffff7d}) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r4, 0xc1105511, &(0x7f0000000040)={0x9}) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(0xffffffffffffffff, 0xc1105511, &(0x7f0000000040)) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r3, 0x84, 0x18, 0x0, &(0x7f0000000080)) close_range(r0, 0xffffffffffffffff, 0x0) 6.131401178s ago: executing program 4 (id=1727): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x120000, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x11) r1 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r1, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x0, {0xa, 0x4e20, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}, 0x32) syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f00000004c0)=ANY=[@ANYBLOB="1201000002000040257d15a44000010400010902600042010000000904000001020900000524", @ANYRES16], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 5.255837493s ago: executing program 5 (id=1731): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x120000, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x11) r1 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r1, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x0, {0xa, 0x4e20, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}, 0x32) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000), 0x22301, 0x0) ioctl$SNDCTL_DSP_SETFMT(r2, 0xc0045005, &(0x7f0000000080)=0x100) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000080)={'syz_tun\x00', &(0x7f0000000100)=@ethtool_link_settings={0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, [0xa1010000, 0x0, 0x0, 0x9, 0x832]}}) syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f00000004c0)=ANY=[@ANYBLOB="1201000002000040257d15a44000010400010902600042010000000904000001020900000524", @ANYRES16], 0x0) syz_usb_connect$cdc_ecm(0x0, 0x50, &(0x7f0000000140)={{0x12, 0x1, 0x110, 0x2, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x3e, 0x1, 0x1, 0x9, 0xb0, 0x1, [{{0x9, 0x4, 0x0, 0x4, 0x2, 0x2, 0x6, 0x0, 0x5, {{0x8, 0x24, 0x6, 0x0, 0x0, "b4e8aa"}, {0x5, 0x24, 0x0, 0x7}, {0xd, 0x24, 0xf, 0x1, 0x10, 0xfff7, 0x200, 0x2}}, {[], {{0x9, 0x5, 0x82, 0x2, 0x10, 0x9, 0xe, 0x6}}, {{0x9, 0x5, 0x3, 0x2, 0x400, 0x7, 0x9, 0x1}}}}}]}}]}}, &(0x7f00000003c0)={0xa, &(0x7f00000000c0)={0xa, 0x6, 0x310, 0x2, 0x81, 0x81, 0x8, 0x98}, 0xc, &(0x7f00000001c0)={0x5, 0xf, 0xc, 0x1, [@ext_cap={0x7, 0x10, 0x2, 0x14, 0x9, 0x0, 0x81}]}, 0x6, [{0x4, &(0x7f0000000200)=@lang_id={0x4, 0x3, 0x1c12}}, {0x3a, &(0x7f0000000280)=@string={0x3a, 0x3, "af47c46589522b27910f8a8936a131f1f0497100adbe762081d55e106dacd717c805c3bc18e471f425f38f0f16010416287b4df84fcbc719"}}, {0x4, &(0x7f00000002c0)=@lang_id={0x4, 0x3, 0x3009}}, {0x3e, &(0x7f0000000300)=@string={0x3e, 0x3, "259dd3f5f47a3b00c23edaef0518a748907ac43ba6140c6d358607b6835fe06e2f3ef3d344d9d5a7c8090c6fb113160b863b76bd8f2863806cb3f9f9"}}, {0x4, &(0x7f0000000340)=@lang_id={0x4, 0x3, 0x410}}, {0x4, &(0x7f0000000380)=@lang_id={0x4, 0x3, 0x42d}}]}) syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 4.966737634s ago: executing program 7 (id=1733): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80202, 0x0) setrlimit(0x6, 0x0) writev(0xffffffffffffffff, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000380)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x80, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x54, 0x4, 0x0, 0x1, [{0x50, 0x1, 0x0, 0x1, @target={{0xb}, @val={0x40, 0x2, 0x0, 0x1, [@NFTA_TARGET_INFO={0x2c, 0x3, "7339f2f10455afb9fdd672bad09dfb78c7699c74e891a0c700"/40}, @NFTA_TARGET_REV={0x8}, @NFTA_TARGET_NAME={0x8, 0x1, 'LED\x00'}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xa8}, 0x1, 0x0, 0x0, 0x4000850}, 0x20040040) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) socket(0x1d, 0x2, 0x6) syz_open_dev$tty1(0xc, 0x4, 0x1) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x20000000000, 0xfffffffffffffffd, 0x0, 0x0, 0x1000001002, 0x49}, 0x0, &(0x7f00000002c0)={0x3fe, 0x7, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000006}, 0x0, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) r2 = syz_open_dev$sndctrl(&(0x7f0000001ac0), 0x0, 0x0) r3 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_LOCK(r3, 0x40405514, &(0x7f0000000200)={0x9, 0x2, 0x0, 0xfffffff7, 'syz1\x00', 0xffffff7d}) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r3, 0xc1105511, &(0x7f0000000040)={0x9}) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r2, 0xc1105511, &(0x7f0000000040)) close_range(r0, 0xffffffffffffffff, 0x0) 4.350345994s ago: executing program 4 (id=1734): r0 = fsopen(&(0x7f0000000140)='autofs\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f00000000c0)='\x94\x90\x96\x8a\xe2\r\x0f\xf8[O\x84`\x02d\xd1c\r\x1a\xb5a\xe0r\xa9R/\x84\xef\'\x1d\xed\f\nVt\x9b\x90\xf5d\x1a\xea\xf0\x17~g+\xbe\x82\x11\xe9\x02\x00\x00\x00\x00\x00\x00\x00\xc3\xb4tc\xe1-\x9a\xb1\xefE\xe14\xbfR:\xad\x93\f\x12\xa2\xa1o\rr\x03,\x17\x14\xbad\xe8d\x9b\xe9Q2\xc4}k\x85v\xd4\x05\x8cN\xd2\x00\x00\x00\x00\xfc\x87\x84)\xdb', &(0x7f0000000180)='@\x00\x86\x00\xae\xed[N\x99\xd0\xae\xd4Y i\xe8\x87\xd7\x8f\x9a\xe9\xd8Q\xe2\"\xab\xac\xae\xc87l\xbal\x14!\xf8\\wq\xdfK\xd0Q\x9f\xf1\xe8\x18\xbd\xbfr\x0e\x92\xab|\xa3\x80\f\xe3qFZ\xce\x1e\x80B]#\xda\x9a\xda5[\xa0R\xdc\x91\xd9E\x80g\xe0\xf3\xfe\x88\xfc\xbf\xff\xff\x8a\xabF\xb7\xccyR\x00\xfc\xdeq\xc3\xca\x89\xea]\x9e;\xd2\xc1^<5\x80\xe60d\xf3Vv\xbaQ#\x03\xe5j\xe6\x9d\x9d\xa11\xf9ge(p\x88\x90\x93\x82\x1bM\xfch\xe4,\\\xd8\xc6\x8dj\xa1\xba\x01\xc2\xd5\x8d\xbe\xc5\xf4\xf9\xb7\xd3\xa3\xd3\x91\'\xc3U\x16\x8dAZ\x1f\x01\x01\xc8\xd2\xe0\xd8uW\x8fM\xf4\x01\x8f\xfb\x99\x1a\xde\xb9p\xf0]m\xb0\xaa^\t\xdfy\xb8\xd4\xfa\x9b\n\xfc\xb9\x847z\x1d\x14\xe0\xf8\xe5\xeb\xd5\t\x97 ', 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040), 0x0, 0x0) fcntl$F_GET_RW_HINT(r1, 0x40b, &(0x7f0000000000)) syz_usb_disconnect(r1) syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000140)=ANY=[@ANYBLOB="12010002020000082505a1a440000102030109025c"], 0x0) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000003c0)=ANY=[@ANYBLOB="120100009ac0b620110f211066865578ac0109029c000100000400090400bf900b64ea00090587033b"], 0x0) r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x10000) write$char_usb(r3, &(0x7f0000001300)='7', 0x1) r4 = syz_io_uring_setup(0x66e, &(0x7f0000000240)={0x0, 0x29cc, 0x10100}, &(0x7f0000000380)=0x0, &(0x7f0000000200)=0x0) syz_io_uring_submit(r5, r6, &(0x7f0000000180)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(r4, 0x567, 0x0, 0x0, 0x0, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_disconnect(r2) r7 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r8 = dup(r7) write$6lowpan_enable(r8, &(0x7f0000000000)='0', 0xfffffd2c) syz_io_uring_setup(0x4e1, &(0x7f0000000100)={0x0, 0xcd42, 0x10100, 0x0, 0x9}, &(0x7f0000000300)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r9, r10, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd=r8, 0x0, 0x0, 0x0, {}, 0x1}) ioctl$DRM_IOCTL_GEM_OPEN(0xffffffffffffffff, 0xc010640b, &(0x7f0000000080)={0x0, 0x0}) ioctl$DRM_IOCTL_GEM_FLINK(r8, 0xc008640a, &(0x7f0000000280)={r11}) ioctl$EVIOCRMFF(r1, 0x4004550d, 0x0) 4.026209194s ago: executing program 7 (id=1735): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000e00), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000e40)={'wlan0\x00', 0x0}) (async) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x6, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() (async) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$PTP_SYS_OFFSET_EXTENDED(r4, 0xc4c03d09, 0x0) (async) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) (async) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x6) (async, rerun: 64) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) (async, rerun: 64) keyctl$reject(0x13, 0x0, 0x400, 0x8000000000000204, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@file={0x0, './file0/file0\x00'}, 0x6e) (async) sendmmsg$unix(r6, &(0x7f0000000000), 0x400000000000041, 0x0) (async) sched_setaffinity(r3, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async, rerun: 64) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) (async, rerun: 64) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, 0x0, &(0x7f0000000440)='0\x00#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xea\\Eb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D-\x98\x9f\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xb8\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6\xd7\x80Y\xc2\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\xa7\xfa\xdb\x1ce\xc1\x03\x86J\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\x81\x14l7u\x95\x96t\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xe39\xc6b\x905\xf8\xc9@h\x01\xf5\xcb\x88\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?\x839\x85N\x1c\xc1\xcb\xfc\x85\xd2\n\x02\"\xf2\x81g\x90\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9a\x84\'\xa3\xf1\xd9<\xb9k', 0x0) mlock(&(0x7f0000c00000/0x400000)=nil, 0x400000) mremap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2000, 0x7, &(0x7f0000fff000/0x1000)=nil) (async) madvise(&(0x7f0000f0f000/0x2000)=nil, 0x2000, 0x15) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) (async) statx(0xffffffffffffffff, &(0x7f0000000000)='./file0/file0\x00', 0x5a6dfadb3b539498, 0x8, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$nl_xfrm(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000680)=ANY=[@ANYBLOB="3c0100001400110200000000fedbdf25ffffffff000000000000000000000000fc00000000000000000000000000000100"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="c06b6e0000000000e0000600ac1414360000000000000000000000007f2000010000000000000000000000004e200a704e210004020020206d000000", @ANYRES32=0x0, @ANYRES32=r8, @ANYBLOB="fe8000000000000000000000000000bb000004d533000000e0000002000000000000000000000000cc00000000000000c200000000000000f900000000000000000000800000000002000000000000000000000001000000000200000000000015570000000000000d0000000000000004000000000000000600000000000000060000000000000005000000040000000b0000002bbd7000033500000a00040a120000000c0015005c07350009000000"], 0x13c}}, 0x0) (async, rerun: 32) sendmsg$NL80211_CMD_GET_SCAN(r0, &(0x7f0000000f00)={0x0, 0x0, &(0x7f0000000ec0)={&(0x7f0000000380)=ANY=[@ANYBLOB="00c8a940", @ANYRES16=r1, @ANYBLOB="210f00000000000000002000000008000300", @ANYRES32=r2, @ANYBLOB], 0x1c}, 0x1, 0x0, 0x0, 0x20000015}, 0x44000) (async, rerun: 32) setreuid(0x0, 0xee00) (async, rerun: 32) request_key(&(0x7f0000000440)='rxrpc_s\x00', &(0x7f0000000480)={'syz', 0x2}, &(0x7f0000000500)='/dev/vcsu#\x00', 0xffffffffffffffff) (rerun: 32) 3.962237466s ago: executing program 5 (id=1737): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9d, 0x11e41e7a, 0x20000000, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) sendmmsg(r3, &(0x7f0000000900)=[{{0x0, 0x0, &(0x7f00000000c0)=[{0x0}], 0x1}}], 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r4) sendmsg$NLBL_CIPSOV4_C_REMOVE(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)={0x1c, r5, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20004004}, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000f40), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r4, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x55) syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=@bridge_getvlan={0x20, 0x72, 0x301, 0x0, 0x0, {}, [@BRIDGE_VLANDB_DUMP_FLAGS={0x8, 0x1, 0x1}]}, 0x20}, 0x1, 0xf00, 0x0, 0x20000010}, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount(&(0x7f00000025c0)=@sg0, &(0x7f0000000300)='./file1\x00', &(0x7f0000000000)='ntfs3\x00', 0x0, &(0x7f0000000380)='acl') 3.812647437s ago: executing program 6 (id=1739): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80202, 0x0) setrlimit(0x6, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000380)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x80, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x54, 0x4, 0x0, 0x1, [{0x50, 0x1, 0x0, 0x1, @target={{0xb}, @val={0x40, 0x2, 0x0, 0x1, [@NFTA_TARGET_INFO={0x2c, 0x3, "7339f2f10455afb9fdd672bad09dfb78c7699c74e891a0c700"/40}, @NFTA_TARGET_REV={0x8}, @NFTA_TARGET_NAME={0x8, 0x1, 'LED\x00'}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xa8}, 0x1, 0x0, 0x0, 0x4000850}, 0x20040040) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) socket(0x1d, 0x2, 0x6) syz_open_dev$tty1(0xc, 0x4, 0x1) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x20000000000, 0xfffffffffffffffd, 0x0, 0x0, 0x1000001002, 0x49}, 0x0, &(0x7f00000002c0)={0x3fe, 0x7, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000006}, 0x0, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) r3 = syz_open_dev$sndctrl(&(0x7f0000001ac0), 0x0, 0x0) r4 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_LOCK(r4, 0x40405514, &(0x7f0000000200)={0x9, 0x2, 0x0, 0xfffffff7, 'syz1\x00', 0xffffff7d}) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r3, 0xc1105511, &(0x7f0000000040)) close_range(r0, 0xffffffffffffffff, 0x0) 3.812245995s ago: executing program 7 (id=1740): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x50) r1 = openat$6lowpan_enable(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000280)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfffffffc}}, &(0x7f0000000300)='syzkaller\x00', 0x0, 0x0, 0x0, 0x1f00}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r2}, 0x10) read(r1, 0x0, 0x0) r3 = syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r3, 0xc008561c, &(0x7f0000000040)={0x98f903, 0x1}) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x18, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8}, {{0x18, 0x1, 0x1, 0x0, r4}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9, 0xfe00}, {0x6, 0x0, 0xb, 0x9, 0x0, 0x8}, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x7, 0x1, 0xb, 0x6, 0x8, 0x10}, {0x7, 0x0, 0x0, 0x8}, {}, {}, {}, {0x18, 0x8, 0x2, 0x0, r0}, {}, {0x15, 0x0, 0x0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @fallback=0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 3.580747003s ago: executing program 7 (id=1741): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x6}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9d, 0x11e41e7a, 0x20000000, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x0, 0x0, 0x3}}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x20000800}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) (async) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) (async) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) (async) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) r2 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r2, 0x8, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000480)=@newlink={0x28, 0x10, 0x801, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, 0x0, 0x8028}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x5b4efbb362ec214f}, 0x0) (async) sendmsg$nl_route(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000480)=@newlink={0x28, 0x10, 0x801, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, 0x0, 0x8028}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x5b4efbb362ec214f}, 0x0) 2.912117021s ago: executing program 6 (id=1742): socket$can_j1939(0x1d, 0x2, 0x7) bpf$MAP_CREATE(0x0, 0x0, 0x0) (async, rerun: 64) bpf$PROG_LOAD(0x5, 0x0, 0x0) (rerun: 64) socket$kcm(0x10, 0x2, 0x0) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$vcsu(&(0x7f00000000c0), 0x0, 0x440200) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) (async, rerun: 32) mbind(&(0x7f00001fa000/0x2000)=nil, 0x2000, 0x1, 0x0, 0x0, 0x0) (async, rerun: 32) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000003c0)=@newlink={0x20, 0x10, 0x437, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x192}}, 0x20}}, 0x0) (async) sendto$packet(r0, &(0x7f0000000100)="f7c837e3820f097e3bbb9ee1994d588a16599860a61ab944cee8600d27efe6d55c6e4b629c72586ed00b9656c2476d6b3b78d9b3d362665b3c6fe75b70909c2db7c59ceed24a656ad0894fdd7c8522852bc1e8d20d23ba9a26baba96ab4e531edc157179f56ef506dae98dc9b77c128f0e213fc90790046e2cbe19a187b5388ad15b4275a6d566b19e5caef09ad347da00dabc15df35dffb7156f3bac15344cd081aaf3b2dbc19194aedc04eabd3c3bf73559b3bfe8a802ce7055824a32a3467394982a85e68e5d6169035ed29c78d7f73f8dfa7945cae3dd55d7f0cff9066f6d6eeb5f73478fa68c455794695e6fe6a0dffde1d1716", 0xf6, 0x20040044, &(0x7f0000000040)={0x11, 0xd799729184b08fe1, r2, 0x1, 0x40, 0x6, @multicast}, 0x14) (async, rerun: 64) r3 = socket$xdp(0x2c, 0x3, 0x0) (rerun: 64) setsockopt$XDP_UMEM_REG(r3, 0x11b, 0x4, &(0x7f0000000080)={&(0x7f0000000000)=""/59, 0x304000, 0x800, 0x0, 0x3}, 0x20) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x60000b, 0x9) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) shmctl$SHM_INFO(0x0, 0xe, &(0x7f0000004440)=""/5) 2.818257734s ago: executing program 6 (id=1743): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80202, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000380)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x80, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x54, 0x4, 0x0, 0x1, [{0x50, 0x1, 0x0, 0x1, @target={{0xb}, @val={0x40, 0x2, 0x0, 0x1, [@NFTA_TARGET_INFO={0x2c, 0x3, "7339f2f10455afb9fdd672bad09dfb78c7699c74e891a0c700"/40}, @NFTA_TARGET_REV={0x8}, @NFTA_TARGET_NAME={0x8, 0x1, 'LED\x00'}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xa8}, 0x1, 0x0, 0x0, 0x4000850}, 0x20040040) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) socket(0x1d, 0x2, 0x6) syz_open_dev$tty1(0xc, 0x4, 0x1) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x20000000000, 0xfffffffffffffffd, 0x0, 0x0, 0x1000001002, 0x49}, 0x0, &(0x7f00000002c0)={0x3fe, 0x7, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000006}, 0x0, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) r3 = syz_open_dev$sndctrl(&(0x7f0000001ac0), 0x0, 0x0) r4 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_LOCK(r4, 0x40405514, &(0x7f0000000200)={0x9, 0x2, 0x0, 0xfffffff7, 'syz1\x00', 0xffffff7d}) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r4, 0xc1105511, &(0x7f0000000040)={0x9}) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r3, 0xc1105511, &(0x7f0000000040)) close_range(r0, 0xffffffffffffffff, 0x0) 2.689203531s ago: executing program 7 (id=1744): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x120000, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x11) r1 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r1, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x0, {0xa, 0x4e20, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}, 0x32) syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f00000004c0)=ANY=[@ANYBLOB="1201000002000040257d15a44000010400010902600042010000000904000001020900000524", @ANYRES16], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 2.550638536s ago: executing program 5 (id=1745): r0 = socket$l2tp(0x2, 0x2, 0x73) r1 = openat$sequencer(0xffffff9c, &(0x7f0000002140), 0x8000, 0x0) ioctl$SNDCTL_SEQ_GETOUTCOUNT(r1, 0x80045104, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e31, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @local}, 0x10) r2 = socket$netlink(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, 0x0) r3 = syz_open_dev$video(&(0x7f0000000000), 0x485, 0x40000) ioctl$VIDIOC_CROPCAP(r3, 0xc02c563a, &(0x7f0000000100)={0x9, {0x807fd, 0x3b, 0x744, 0x1}, {0x4, 0x1, 0x18000, 0x5}, {0xec, 0x3ff}}) chdir(&(0x7f0000000100)='./file0\x00') r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$uinput_user_dev(r4, &(0x7f0000000240)={'syz0\x00', {0xf, 0x7, 0x7, 0x1}, 0x4a, [0x5f11bec3, 0x3, 0x5, 0x40, 0x0, 0x2, 0x0, 0x7d, 0x13, 0x5, 0x0, 0x6, 0x0, 0x0, 0x4000000, 0x0, 0x1a4, 0xfffff605, 0x3, 0x0, 0x46e9, 0x7ff, 0xe2b, 0x7, 0x681c1eb6, 0x11e, 0x0, 0x0, 0x0, 0x2, 0x0, 0xffff, 0x9, 0x4, 0x0, 0x3, 0x0, 0x0, 0x5de82a4e, 0x0, 0x0, 0x0, 0xa, 0xfffffffe, 0x1, 0x0, 0x0, 0x0, 0x0, 0xe0, 0x3fd, 0x5, 0xfffffff6, 0x0, 0xf681, 0x0, 0x1ab9, 0x0, 0x0, 0x0, 0xfffffffb, 0x1c15d73a], [0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x8, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x7, 0x200, 0x2, 0x0, 0x61c5fb46, 0x10000, 0x0, 0x4, 0x10001, 0x75, 0x0, 0x4, 0x0, 0xd, 0x80000000, 0x0, 0x0, 0x9, 0x0, 0x9, 0x0, 0xff, 0x0, 0x10001, 0x3, 0x0, 0x7, 0xfffffffb, 0xbc, 0x0, 0x10, 0x0, 0x0, 0x0, 0x1, 0x0, 0x9, 0x441238ca, 0x0, 0x0, 0x0, 0xfffffff9, 0x2, 0x7fffffff, 0x6, 0x9], [0x0, 0x0, 0x3, 0x9f5, 0x0, 0xa02, 0x1c75, 0xf51, 0x0, 0x40, 0x0, 0xc7, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x205, 0x5, 0x0, 0xc, 0x0, 0x200, 0xcc0, 0x401, 0x6, 0x63, 0x0, 0x0, 0x0, 0xe, 0x921, 0x2f, 0x0, 0x0, 0x0, 0x0, 0x15960318, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6574, 0x0, 0x0, 0xcd55, 0xfb], [0x0, 0x6, 0x0, 0x2, 0x1, 0xffffffff, 0x5, 0x200, 0x0, 0xd63, 0x6, 0x0, 0x0, 0x0, 0xfffffffa, 0xfa3, 0x400, 0x0, 0x4, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x194e, 0x0, 0xe793, 0xddda, 0x3, 0x0, 0x80000001, 0x3, 0x0, 0x0, 0x101, 0x0, 0x4, 0x0, 0x40, 0x0, 0x0, 0x5, 0x0, 0x0, 0x7fff, 0x6, 0x800, 0x0, 0xd, 0x0, 0x0, 0x0, 0x0, 0x45d, 0x4, 0x0, 0xfff, 0xb2, 0x9, 0xb]}, 0x45c) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9, 0x12, r4, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuset.effective_cpus\x00', 0x275a, 0x0) sendmsg$nl_route(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000440)=ANY=[@ANYBLOB="48000000100005ff00000000000000000000004a", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32], 0x48}, 0x1, 0x0, 0x0, 0x45844}, 0x0) sendmmsg$inet(r0, &(0x7f0000000900)=[{{0x0, 0x0, 0x0}}], 0x40000cf, 0x0) 2.268304794s ago: executing program 5 (id=1746): socket$nl_route(0x10, 0x3, 0x0) setsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x8008000000010, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xe4b, 0x11e41e7a, 0x20000000, 0x3, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = creat(0x0, 0x0) r4 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r5 = io_uring_setup(0x8c3, &(0x7f0000000280)={0x0, 0x58be, 0x2, 0x2, 0xfb}) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, &(0x7f0000000000)={0x0, 0x0, 0x0, &(0x7f00000004c0)=""/243, 0x0, 0x80a0000}) io_uring_enter(r5, 0x100000, 0x2, 0xf, &(0x7f0000000000), 0x18) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r4, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe020010850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) write$qrtrtun(r3, &(0x7f0000000300)="ca0e808bb35bdabb", 0x8) mremap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2000, 0x7, &(0x7f0000fff000/0x1000)=nil) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000005c0)={r6, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f00000001c0)=[0x7], &(0x7f0000000240)=[0x2], 0x0, 0x9}}, 0x40) 1.901776641s ago: executing program 6 (id=1747): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000e00)={&(0x7f0000000c40)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x2, [@struct={0x1, 0x1, 0x0, 0x3, 0x0, 0x0, [{0x5}]}]}}, 0x0, 0x32, 0x0, 0x1, 0xfffffff8}, 0x28) socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) (async) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r3, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) (async) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r4 = socket$inet6(0xa, 0x1, 0x0) socket$key(0xf, 0x3, 0x2) (async) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f0000000000)={0x500, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="020300090a0000000000000004000000030006000000000002000000ac1414000000000000000000020001000000000000000002fffffffb030005000000000002"], 0x50}}, 0x0) (async) sendmsg$key(r5, &(0x7f0000000000)={0x500, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="020300090a0000000000000004000000030006000000000002000000ac1414000000000000000000020001000000000000000002fffffffb030005000000000002"], 0x50}}, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000180)={{{@in=@private, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@local, 0x0, 0x6c}, 0x0, @in6=@loopback, 0x0, 0x0, 0x0, 0x4}}, 0xe8) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c) socket$key(0xf, 0x3, 0x2) (async) r6 = socket$key(0xf, 0x3, 0x2) r7 = openat$drirender128(0xffffff9c, &(0x7f0000000380), 0x28001, 0x0) ioctl$DRM_IOCTL_GEM_OPEN(r7, 0xc0106442, &(0x7f0000000000)) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r8, 0xae03, 0xbe) sendmsg$key(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="02090000020000000000000000006ed50d169fd1259a4008814b921f312bdff9490675285f56e698679723b433298a597a017f02c5d6ebed91840ceb992d34"], 0x10}}, 0x0) r9 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0xba01}, 0x0) socket(0x10, 0x3, 0x0) (async) r10 = socket(0x10, 0x3, 0x0) write(r10, &(0x7f0000000000)="2400000011005f0414f9f40700090400810000000d0000000000000008000f0001000000", 0x24) (async) write(r10, &(0x7f0000000000)="2400000011005f0414f9f40700090400810000000d0000000000000008000f0001000000", 0x24) ioctl$sock_SIOCGPGRP(r9, 0x8904, &(0x7f00000000c0)) fsetxattr$security_evm(r0, &(0x7f0000000000), &(0x7f0000000040)=@md5={0x1, "f19258af52a7fcab30b49a20d0490cac"}, 0x11, 0x3) 1.901482733s ago: executing program 4 (id=1748): sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, 0x0, 0x0) sendmmsg$unix(r1, 0x0, 0x0, 0x0) recvmmsg(r0, 0x0, 0x0, 0x2, 0x0) (async) recvmmsg(r0, 0x0, 0x0, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000004000000fd0f00000700"], 0x48) (async) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000004000000fd0f00000700"], 0x48) syz_open_dev$sg(&(0x7f00000002c0), 0x0, 0x0) (async) r3 = syz_open_dev$sg(&(0x7f00000002c0), 0x0, 0x0) openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$SG_IO(r3, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x1, @buffer={0x300, 0x49, &(0x7f0000000440)=""/73}, &(0x7f0000000380)="259374c96ee3", 0x0, 0xffffffff, 0x30, 0x0, 0x0}) (async) ioctl$SG_IO(r3, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x1, @buffer={0x300, 0x49, &(0x7f0000000440)=""/73}, &(0x7f0000000380)="259374c96ee3", 0x0, 0xffffffff, 0x30, 0x0, 0x0}) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000900)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={0x0, r4}, 0x18) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={0x0, r4}, 0x18) sendmsg$ETHTOOL_MSG_LINKMODES_GET(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)={0x18, 0x0, 0x321, 0x70bd2b, 0x25dfdbfc, {}, [@HEADER={0x4}]}, 0x18}}, 0x4000000) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000700)='signal_generate\x00', r5}, 0x10) socket$unix(0x1, 0x2, 0x0) (async) r6 = socket$unix(0x1, 0x2, 0x0) bind$unix(r6, &(0x7f0000000100)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmsg$unix(r6, &(0x7f00000000c0)={&(0x7f0000000200)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x4040801}, 0x20008840) recvmmsg(r6, &(0x7f0000000c00)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x1000400000de, 0x0) syz_open_procfs$namespace(0x0, 0xfffffffffffffffe) 1.748816195s ago: executing program 6 (id=1749): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280), 0x80a02, 0x0) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7fffffff, 0x400, 0x1, 0xd, 0x1, 0x6, 0x6}, 0x1c) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xe, 0x16, &(0x7f0000001900)=ANY=[@ANYBLOB="61106000000000006113740000000000bfa00000000000000700000008ffffffd503010017740040950000000000000069163a0000000000bf67000000000000350602000fff07201706000020191800160600000ee60060bf050000000000007b650000000000006507f9ff01000000070700004d83dde4c375000000000000bf54000000000000070400000400f9ffad4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f17540faf80250aa20c669a5e12814cb1cea5d4601d295c45a6a0b9bdb7dd399703cac4f6f3be4b369226066812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a814261bdb94a05000400c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546cad3f1d5ab2af27546e7c955ccefa1f6ab689b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc8da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e0dee5eb106774a8f3e6916dfec88158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc206438b8ef4901fd03c16dfda44221b235c8ac86d8a297dff0445a15f21dce431e56723888fb126a163f16f920ae2fb494059bba8e3b680324a188076eb685d55c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20ceddf4d03723f1c932b3a6aa57f1ad2e99e0e67ab93716d20000009f0f53acbb40b4f8e2738270b31562ed834f2af97787f696649a462e7ee4bcf8b07a10fd7ed6735154beb4000000000000000000000000004000bc00f6746a9709e7e78f4ddc211bc3ebe6bd9d42ca0140a7afaab43176e65ec1118d50d1e827f3472f4445d253887a5ad103649afa17690884f800031e03a651bb96589a7e2e509bcc1d161347623cb5e7ac4629c8ab04871bc47287cd31cc43ea0ffb567b40407d000000210000000000000000005f37d8703f37ca364a601ae899a56715a0a62a34c1d926a0f6a5480a55c22fe3a5ac00000000000000000000000500002000000000fb79ea00000000000000000000e4007be511fe32fbc90e2364a55e9bb66ac64423d2d00fea2594e14d90deae46e26c596f84eba90000000000000000fffb0000000082fb0d3cc3aa39ee4b1386bab561cda886fa642994cacd473b543ccb5f0d7b63924f17c67b13631d22a11dc3c693962895496d4f6e9cc54db6c7205a6b06ff7f0000000000007f31d7c8cc5d325c5379b0363ce8bd1f61b007e1ff5f1be1969a1ba791ad46d800000000c7f26a1f37302f3b41eae59809fd05d12f6106f117b062df67d3a6473265dd1410eea68208a3f26b2989b832d8b34a34a4f08b34b3042065acaa10856e858d27adee7daf32903d3fc78700d429a2d4c8b6d803eb83eecfe4c7ff9e6ab5a52e83d089e0b1c23c0f3cdad7a8710e0254f1b11cced7bc3c8da0c44d2ebf9f6f3ff3be4d1458077c2253b0c7c7a1a9fdd63bf910dc20e5cb2a88e59febc47f1212a21f631d22bad050e9856b48ae3a03a497c37758537650fe6db89da3c41fdc3d78e046f6160e1741299e8dc29906870e6431ed1eab5d067a183f064b060a8ec12725d42e3a74863d66bee966b1574f8e01b3f34a267ff0af1cb3f1f815f8989d78854ca4d3116dbc7e2bf2402a75fd7a55733360040855ed5d1c0d634fc5fb38f84d9d87b27f8a5d91217b728f13e3ee20e69e0ffb2780b1a7af137ff7b4c6ea9604faf0453bedf0c5d744b5272b44c23488b2bdbff947c4dfa108cbb88202eeb81f428a5b3c29984864961a57ff52f657a67463d7dbf85ae9321fc2cc17dc4a29b9cba8ded5de8206c812439ab129ae818837ee15620789c524b3baf49a09d8be0fc5beecf153236c19740be9bb7d958d5e87c6c09bf71a894bad62934782cc308e936d7637e07c4a2b4dc87b0da20000d9ef418cf19e7a8c4c328be0ce91798adc2dca87ddd9d064e081383409ed2912c811ae63f03212a5331c2a4ead000000000000000000000000000000000000000000000000001386866b311bd144bc32e059658c9f8342c90c1ade31b78072841b8b5a943d62a44cea6b050c42e3c205fad6a23fb43c93da0f49d911877265e6ee443e37397ecf89021e7f579e8d3a74c12b52938d91e9de07fc8eeeb9505f4a9c26266bf5449484ccc1317c7476"], &(0x7f0000000100)='GPL\x00', 0xb, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb}, 0x48) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r2) openat$ppp(0xffffffffffffff9c, &(0x7f0000000180), 0x541402, 0x0) ioctl$TUNSETOFFLOAD(r2, 0xc004743e, 0x110e22fff6) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x4e681, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) socket$kcm(0x2, 0xa, 0x2) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) r4 = socket$unix(0x1, 0x1, 0x0) ioctl(r4, 0x8b01, &(0x7f0000000040)) syz_open_dev$tty1(0xc, 0x4, 0x1) syz_usbip_server_init(0x3) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000840), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r6, @ANYBLOB="010000030000000000000600000008000300", @ANYRES32=r7, @ANYBLOB="9038857483038e17b4e6dd1bffc89b0ba051fbd0d2c036ba3f02b4fce94cea870c574f9859927fa1a3a65363534af59107f12b92961eee8750b00d498944424b3697e137059d4540cecef37f86f4f5ce3b08242da27077df836c375c8874e45a2cc3c6254b5da2500c3b0f0fa9dc5292649c3355d628c2b11a9b259061fd0502ba3a9e6c6c0cc8eab206742463199ef135cb6841bf99a88551b6348b060e143cee"], 0x1c}, 0x1, 0x0, 0x0, 0x4c800}, 0xc0c4) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) mount$9p_fd(0x0, 0x0, &(0x7f0000000040), 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x20000000000, 0xfffffffffffffffd, 0x0, 0x0, 0x1000001000, 0x49}, 0x0, &(0x7f00000002c0)={0x3ff, 0x7, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000004}, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 1.748596248s ago: executing program 4 (id=1750): r0 = openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) write$apparmor_exec(r0, &(0x7f00000002c0)=ANY=[@ANYBLOB='exec :'], 0x15) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) (async) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_genetlink_get_family_id$tipc(0x0, 0xffffffffffffffff) syz_clone(0x9100, 0x0, 0xfffffffffffffcc8, 0x0, 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) (async) r1 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r1, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r1, 0x4010640d, &(0x7f0000000000)={0x5, 0x2}) 1.642212036s ago: executing program 4 (id=1751): r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$bt_sco(r0, &(0x7f00000000c0)={0x1f, @none}, 0x8) getsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f00000002c0)=0x1, &(0x7f0000000300)=0x4) syz_open_procfs(0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x4, @tid=r1}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) r2 = syz_init_net_socket$ax25(0x3, 0x3, 0xca) recvfrom$ax25(r2, 0x0, 0x0, 0x20, &(0x7f0000000040)={{0x3, @default, 0x4}, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @bcast, @null, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast]}, 0x48) syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), 0xffffffffffffffff) fsopen(0x0, 0x0) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r3) ptrace$getregset(0x4205, r3, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r5 = dup(r4) write$6lowpan_enable(r5, &(0x7f0000000000)='0', 0xfffffd2c) r6 = syz_io_uring_setup(0x4f6d, &(0x7f0000000740)={0x0, 0xb1ea, 0x10100, 0x800001, 0x2d7, 0x0, r5}, &(0x7f0000000180)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r7, r8, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd=r4, 0x0, 0x0, 0x0, {}, 0x1}) io_uring_enter(r6, 0x2ded, 0xef92, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000002080)={0x0, 0x3938700}, &(0x7f00000020c0)={[0x1, 0x1]}, 0x8) mount$9p_fd(0x0, 0x0, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) getpgid(0xffffffffffffffff) syz_emit_ethernet(0x42, &(0x7f00000001c0)={@local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @void, {@ipv4={0x800, @icmp={{0x8, 0x4, 0x0, 0x0, 0x34, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @remote, {[@timestamp={0x44, 0xc, 0xb, 0x0, 0x0, [0x0, 0x0]}]}}, @timestamp={0xd, 0x0, 0x0, 0x9, 0x2, 0x672d, 0xffffffff, 0x9}}}}}, 0x0) 1.075638329s ago: executing program 7 (id=1752): r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='sched\x00') writev(r0, &(0x7f00000011c0)=[{&(0x7f0000000180)='P', 0x1}], 0x1) socket$inet_mptcp(0x2, 0x1, 0x106) syz_io_uring_setup(0x57a0, &(0x7f0000000080)={0x0, 0xd498, 0x40, 0x1, 0x348}, &(0x7f0000000100), &(0x7f0000000140)) r1 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000080), 0x2) write$binfmt_aout(r1, &(0x7f0000000000)=ANY=[@ANYBLOB="03040000b500000001008aea0000feff"], 0xc8) syz_usb_connect$cdc_ncm(0x4, 0xa0, &(0x7f0000000380)=ANY=[@ANYBLOB="1a01010202f0a56f99d0f744080000004c3a450000102505a1a440000102030109028e0002010600f509040000017c73b710aaa67fb40f788fa1b700157c2617914412bb000524060001050d240f0108000000940600a317a88b045e4f0a000000000000002a0c241b0300030081030100070c241b06000700080d05007f010000000809058103050d00000904010102020d00005a05820220002003070905030206000066f4e65004419f8302106de5230b3a3eb0d759aeeab51285e6565b1d1bf99ec98c6cde9cc4a1aaaa248c57bd963bb2f400000000000036499b3a70234fc33578f70c175b8c4a52b9f7a8e0b91a85ad0f7a8d55bbc3dee6e63ac2dce3060960071b771056e8ed8a1fcc16bec9b4b48676b784f820a5d4efddc9ea8d961bfde7972b62843d06d7e9f8675450a5313f330f37a828287a9d45ed059f08f557215528f8f941840f6714b5624bc36bc78de387d45f"], 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x10000, 0x25dfdbfb, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9d, 0x11e41e7a, 0x8, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}, @m_ife={0x48, 0x3, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@RTM_NEWMDB={0x18, 0x55, 0x1e5}, 0x18}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mbind(&(0x7f00001e7000/0x2000)=nil, 0x2000, 0x8003, &(0x7f0000000000)=0x9, 0x3, 0x2) r6 = syz_open_procfs(r2, &(0x7f0000000040)='smaps_rollup\x00') madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) write$cgroup_pressure(r6, &(0x7f0000000180)={'full', 0x20, 0xfffffffffffffff8, 0x20, 0x6}, 0x2f) read$FUSE(r6, &(0x7f00000007c0)={0x2020}, 0x2020) r7 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000080), 0x2) r8 = openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x8002) write$binfmt_aout(r7, &(0x7f00000000c0)=ANY=[@ANYBLOB="03040000b500000001008aea0000feff"], 0xc8) dup3(r8, r7, 0x0) 762.585561ms ago: executing program 4 (id=1753): r0 = openat$ubi_ctrl(0xffffff9c, &(0x7f0000000340), 0x1, 0x0) ioctl$VIDIOC_CREATE_BUFS(r0, 0xc0f8565c, &(0x7f0000000380)={0x9, 0x4, 0x3, {0x3, @vbi={0x4, 0x9, 0x3, 0x38414262, [0x2, 0x7ff], [0x2, 0x6], 0x10b}}, 0xffffffff}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) syz_open_dev$hiddev(&(0x7f00000001c0), 0x500be, 0x802) ioctl$TIOCSETD(r4, 0x5423, 0x0) read$msr(r0, &(0x7f000001c500)=""/102397, 0x18ffd) r5 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x401c2, 0x0) ftruncate(r5, 0x8800000) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) recvmmsg(r7, &(0x7f00000034c0)=[{{0x0, 0x0, &(0x7f0000001e40)=[{&(0x7f0000000b80)=""/4096, 0x20001b80}, {&(0x7f0000001b80)=""/112, 0x70}], 0x2, 0x0, 0xa0028cb4}}], 0x40000000000013c, 0x700, 0x0) r8 = dup(0xffffffffffffffff) syz_io_uring_setup(0x8d2, &(0x7f00000000c0)={0x0, 0x0, 0x3010, 0x1, 0x39d}, &(0x7f0000000040)=0x0, &(0x7f0000000080)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r9, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r9, r10, &(0x7f0000000200)=@IORING_OP_LINKAT={0x27, 0x8, 0x0, r8, &(0x7f0000000280)='./file1/file0\x00', &(0x7f0000000300)='./file1/file0\x00', r8, 0x1000, 0x1}) setsockopt$SO_TIMESTAMP(r8, 0x1, 0x1d, &(0x7f0000000080)=0x9, 0x4) sendfile(r6, r5, 0x0, 0x578410eb) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) r11 = socket$kcm(0x29, 0x5, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r11, 0x0, r12, 0x0, 0xf3e, 0x0) timer_create(0x5, &(0x7f0000000000)={0x0, 0x14, 0x2}, &(0x7f0000000100)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) ioctl$KVM_SET_SREGS2(r3, 0x4140aecd, &(0x7f0000000200)={{0x4, 0x4000, 0x8, 0xff, 0x3, 0x4, 0xe, 0x9, 0x3f, 0x6, 0x80, 0x70}, {0x2, 0x3000, 0x0, 0xc, 0x23, 0x21, 0xf9, 0xc5, 0x1, 0x32, 0x2, 0xff}, {0x1000, 0xd000, 0x4, 0x8, 0x8, 0x3, 0x2, 0x2, 0x7, 0x82, 0x3, 0xd}, {0x1, 0x4000, 0x9, 0x11, 0x0, 0xc, 0x6, 0xfa, 0x3, 0x0, 0x2, 0x9}, {0xf000, 0x1, 0xe, 0x80, 0xfc, 0x40, 0x7f, 0x7, 0xb1, 0x99, 0x8, 0x3}, {0x4cdda800, 0x5000, 0x9, 0xe4, 0x3, 0xcb, 0x8, 0x7, 0x8, 0x7, 0x2a, 0x7}, {0x8080000, 0xeeee8000, 0x8, 0xfb, 0x8, 0x6, 0xf, 0x6, 0x9, 0x5, 0xb2}, {0x6000, 0x8000000, 0x9, 0x2, 0x16, 0x4, 0x0, 0x3, 0x0, 0xf8, 0x5, 0xb}, {0x8000000, 0x1}, {0xd000, 0xa469}, 0x80000001, 0x0, 0xdddd0000, 0x420020, 0xf, 0x5400, 0xeeee8000, 0x1, [0x400000000000008, 0x70000, 0x103, 0x7fffffffffffffff]}) connect$tipc(r1, &(0x7f0000000000)=@id={0x1e, 0x3, 0x0, {0x4e24, 0x4}}, 0x10) 158.423263ms ago: executing program 6 (id=1754): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000240)={0x1, &(0x7f0000000200)=[{0x6, 0xff, 0x7, 0x7fc00002}]}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x6, 0x3, 0x7fff0001}]}) unshare(0x6a040000) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000001800)=@newtaction={0x1a4, 0x30, 0x871a15abc695fa3d, 0x70bd28, 0x0, {}, [{0x190, 0x1, [@m_simple={0x18c, 0xf, 0x0, 0x0, {{0xb}, {0xa0, 0x2, 0x0, 0x1, [@TCA_DEF_PARMS={0x18, 0x2, {0x8, 0x7, 0x7, 0x8, 0x8}}, @TCA_DEF_PARMS={0x18, 0x2, {0x1, 0x1ff, 0x7, 0xe, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7, 0x9, 0x5, 0xffffffff, 0x4c}}, @TCA_DEF_PARMS={0x18, 0x2, {0x5, 0x1, 0x0, 0x8, 0x4000}}, @TCA_DEF_PARMS={0x18, 0x2, {0x2, 0x8, 0xffffffffffffffff, 0x7, 0x8}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x7, 0xffffffffffffffff, 0x800, 0x2}}, @TCA_DEF_DATA={0xb, 0x3, 'ctinfo\x00'}]}, {0xc1, 0x6, "7cc78517eb18e94e6b9f2b6cfb0d7677ad785698ed07277c9806e3648210337926d4fd2d8687a0614f8a68d2035f3e4b3ac22693c252feacb3a3a405e2c4dfcafe53c5b506a899dd6416e810d4697c322daad84681426bc448076c310364ea3f5d548b9deec95b7de5feb349513fe7a1c8cbd40b4ff435b2c91096a47b3c32a9a67d6c4a5a21bd294f98eeeefcce080f75d207de8320cde44cf801a015fcfc50099cab603eb49fca13d3bbc19e2f2a41f94e978c5fcbd40ac14e023bec"}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0x1a4}, 0x1, 0x0, 0x0, 0x4048810}, 0x0) syz_emit_vhci(0x0, 0x0) sendmsg$TCPDIAG_GETSOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket(0xa, 0x1, 0x0) connect$tipc(r1, 0x0, 0x0) symlink(&(0x7f0000000040)='.\x00', &(0x7f0000000100)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='.\x00', 0x0) mkdir(&(0x7f00000004c0)='./bus\x00', 0x0) lsetxattr$security_capability(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200), &(0x7f0000000380)=@v2={0x2000000, [{0x7, 0xa3}, {0x4, 0x2}]}, 0x14, 0x1) read$FUSE(0xffffffffffffffff, 0x0, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000500)={[{@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f00000001c0)='./bus\x00') lchown(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) connect$unix(r1, 0x0, 0xb7) recvmmsg(r0, 0x0, 0x0, 0x2, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000007c0)='children\x00') preadv(r2, &(0x7f0000000280)=[{&(0x7f0000000140)=""/28, 0x1c}, {&(0x7f00000003c0)=""/135, 0x87}, {&(0x7f0000000800)=""/4096, 0x1000}], 0x3, 0x4, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = openat$adsp1(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r3, 0xc004500a, &(0x7f0000000000)=0xffff0018) unshare(0x8000000) r4 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCGPKT(r4, 0x80045438, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000540)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000480)={&(0x7f00000019c0)=@deltfilter={0x52c, 0x2d, 0x200, 0x70bd28, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0x2, 0x7}, {0x10, 0x4}, {0xfff1, 0xc}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4c0, 0x2, [@TCA_MATCHALL_ACT={0x4b4, 0x2, [@m_gact={0x140, 0x0, 0x0, 0x0, {{0x9}, {0x7c, 0x2, 0x0, 0x1, [@TCA_GACT_PROB={0xc, 0x3, {0x1, 0x1279, 0x8}}, @TCA_GACT_PROB={0xc, 0x3, {0x1, 0x7a2, 0x6}}, @TCA_GACT_PARMS={0x18, 0x2, {0x5, 0x1, 0x6, 0x4, 0x6}}, @TCA_GACT_PARMS={0x18, 0x2, {0x9, 0xffffffef, 0x20000000, 0x7, 0x2}}, @TCA_GACT_PARMS={0x18, 0x2, {0x28aa, 0x80000000, 0xffffffffffffffff, 0x4, 0x5}}, @TCA_GACT_PROB={0xc, 0x3, {0x0, 0x376, 0x20000000}}, @TCA_GACT_PROB={0xc, 0x3, {0x1, 0x1f9c, 0x2}}]}, {0x9a, 0x6, "9dbbe1fd7e122931735ed1a863c8680e870ed7d50d3b2a533bf544fdb7bba053189f9ae996185e4bcdfecb1fceb64ec1a9923b4bf4fa19df906cb9f1deb4120a0cc0a97676d5d4096aaa2ca35a71253a2b4195aa76be326f3a502f926ed83aceb72346b1f6fbf1c86c69f7638567018b20eadc03a22878ca369f1ad3fde590d40f6eff89e19f9b13f9672942e03faf934de7da3a201a"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1, 0x1}}}}, @m_nat={0x10c, 0xd, 0x0, 0x0, {{0x8}, {0xa4, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x3, 0x9, 0x1, 0x1, 0x4}, @empty, @empty, 0xff, 0x1}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x7fff, 0x6, 0x6, 0x7ff, 0xecd}, @broadcast, @remote, 0xff000000}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x5, 0x10, 0x4, 0x1, 0x7}, @dev={0xac, 0x14, 0x14, 0x1b}, @multicast2}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x5, 0xf, 0x20000000, 0x2, 0x1}, @multicast1, @remote, 0xff000000, 0x1}}]}, {0x44, 0x6, "60f68ebef15a93cd2cc84e0fc59cad0ddf2121b0bca739e724271f91b1fb4232ac30d88180776ba42a5ca4e15868cc547dd841fe3bfddfc4a7005e5cca3d3c2c"}, {0xc}, {0xc, 0x8, {0x3, 0x2}}}}, @m_connmark={0x154, 0x14, 0x0, 0x0, {{0xd}, {0x58, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0xf211, 0x2, 0x2, 0x65, 0xffffff7f}, 0x2ab}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0xb80b, 0x4c, 0x0, 0x7, 0xff}, 0xfff9}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0xfffffff7, 0xfffffffa, 0x6, 0x8, 0x8}, 0x6}}]}, {0xd0, 0x6, "87da01d8f697e893b203fc31583567786019566f4eabb52c8ac3d29c4183b90b3a2339e6ba2cc3d8a7b9cd8898978590b0a39251cb7903d6366e7442db4e3fb3e7a5f559ef12b992378378c38937f92cc54b2e9e63e3c4cbc95c17de430d4ccb6f2450f63c61ba978fd5a109b8089811722267aa13cd6ee204552eb6c05debe1893d800d6e9a36aa1ea4aabce3c90040e89c6b670c32e193ea180186b2eb047d37ec6250d628991c6b5a33619d6d4bfae15b2b5b6863bd30552606c28274ee2552e6ab5e732ae5798fb930bb"}, {0xc}, {0xc, 0x8, {0x1, 0x2}}}}, @m_vlan={0x110, 0x19, 0x0, 0x0, {{0x9}, {0x24, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_PRIORITY={0x5, 0x6, 0x6}, @TCA_VLAN_PUSH_VLAN_PRIORITY={0x5, 0x6, 0x2}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0xae9}, @TCA_VLAN_PUSH_VLAN_PRIORITY={0x5, 0x6, 0x1}]}, {0xc3, 0x6, "e8fe0244c628c63cc17adbfa1a934ba9348ef57cad74db79f1bfc6b80f247c82dfc07a9dd486e171a4efcef31712a34c4684687a0a9d41addd0b2952a59d3567df989ced9e0602fd67a56ef6c2ba74afd1f99749873bc4c9b015b186063841d55686b39924eec60303ff9b7cebbb1ec6df05909cc9c4d66f1dc0ed586cab0590f32d1355c624dce25e4f76895a5a13cd74fb622c188a9cd3c57732ac4493c097c244e93a9d097564ea82b066bd20a09bcb0bd003839ecc94c2fd1d25c0bff5"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}, @TCA_MATCHALL_CLASSID={0x8, 0x1, {0xc}}]}}, @TCA_RATE={0x6, 0x5, {0x80, 0x7}}, @TCA_CHAIN={0x8, 0xb, 0xa}, @TCA_RATE={0x6, 0x5, {0x2, 0x3}}, @TCA_RATE={0x6, 0x5, {0x4, 0x7}}, @TCA_CHAIN={0x8, 0xb, 0xfffffffa}, @TCA_CHAIN={0x8, 0xb, 0x26}, @TCA_RATE={0x6, 0x5, {0x7, 0x4}}]}, 0x52c}, 0x1, 0x0, 0x0, 0x40000}, 0x4) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000680), 0x40000, 0x19) 0s ago: executing program 5 (id=1755): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80202, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000380)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x80, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x54, 0x4, 0x0, 0x1, [{0x50, 0x1, 0x0, 0x1, @target={{0xb}, @val={0x40, 0x2, 0x0, 0x1, [@NFTA_TARGET_INFO={0x2c, 0x3, "7339f2f10455afb9fdd672bad09dfb78c7699c74e891a0c700"/40}, @NFTA_TARGET_REV={0x8}, @NFTA_TARGET_NAME={0x8, 0x1, 'LED\x00'}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xa8}, 0x1, 0x0, 0x0, 0x4000850}, 0x20040040) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) socket(0x1d, 0x2, 0x6) syz_open_dev$tty1(0xc, 0x4, 0x1) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x20000000000, 0xfffffffffffffffd, 0x0, 0x0, 0x1000001002, 0x49}, 0x0, &(0x7f00000002c0)={0x3fe, 0x7, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000006}, 0x0, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) r3 = syz_open_dev$sndctrl(&(0x7f0000001ac0), 0x0, 0x0) r4 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_LOCK(r4, 0x40405514, &(0x7f0000000200)={0x9, 0x2, 0x0, 0xfffffff7, 'syz1\x00', 0xffffff7d}) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r4, 0xc1105511, &(0x7f0000000040)={0x9}) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r3, 0xc1105511, &(0x7f0000000040)) close_range(r0, 0xffffffffffffffff, 0x0) kernel console output (not intermixed with test programs): 55, skipping remainder of the config [ 168.155123][ T841] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 168.216567][ T9378] netlink: 8 bytes leftover after parsing attributes in process `syz.0.842'. [ 168.223427][ T9378] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(4) [ 168.226100][ T9378] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 168.230711][ T9378] vhci_hcd vhci_hcd.0: Device attached [ 168.406858][ T841] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 168.410621][ T841] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 168.425091][ T841] usb 8-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 168.428892][ T841] usb 8-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 168.431643][ T841] usb 8-1: Product: syz [ 168.433146][ T841] usb 8-1: Manufacturer: syz [ 168.438854][ T841] cdc_wdm 8-1:1.0: skipping garbage [ 168.440805][ T841] cdc_wdm 8-1:1.0: skipping garbage [ 168.445519][ T841] cdc_wdm 8-1:1.0: cdc-wdm0: USB WDM device [ 168.447800][ T841] cdc_wdm 8-1:1.0: Unknown control protocol [ 168.529942][ T842] usb 37-1: new low-speed USB device number 2 using vhci_hcd [ 168.636824][ C2] net_ratelimit: 126 callbacks suppressed [ 168.636875][ C2] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 169.024471][ T9397] netlink: 4 bytes leftover after parsing attributes in process `syz.2.844'. [ 169.738260][ C3] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 170.795969][ T9386] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 170.819574][ T29] usb 8-1: USB disconnect, device number 13 [ 170.849785][ C2] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 171.426708][ T9379] vhci_hcd: connection reset by peer [ 171.430465][ T8000] vhci_hcd: stop threads [ 171.431997][ T8000] vhci_hcd: release socket [ 171.433653][ T8000] vhci_hcd: disconnect device [ 171.961639][ C2] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 173.084114][ C2] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 174.003609][ T842] vhci_hcd: vhci_device speed not set [ 174.185289][ C2] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 175.297199][ C3] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 176.408923][ C2] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 177.520812][ C3] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 177.828021][ T9419] fuse: Unknown parameter '0x0000000000000003' [ 177.859338][ T9423] netlink: 'syz.1.851': attribute type 4 has an invalid length. [ 178.066495][ T6066] usb 7-1: new high-speed USB device number 18 using dummy_hcd [ 178.226293][ T6066] usb 7-1: Using ep0 maxpacket: 8 [ 178.231778][ T6066] usb 7-1: config index 0 descriptor too short (expected 301, got 45) [ 178.237273][ T6066] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 178.238091][ T9435] input: syz1 as /devices/virtual/input/input21 [ 178.246082][ T6066] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 178.322544][ T6066] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 178.326225][ T6066] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 178.331040][ T6066] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 178.334008][ T6066] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 178.564527][ T6066] usb 7-1: GET_CAPABILITIES returned 0 [ 178.566461][ T6066] usbtmc 7-1:16.0: can't read capabilities [ 178.643250][ C2] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 178.815933][ T6066] usb 7-1: USB disconnect, device number 18 [ 178.935521][ T9453] netlink: 'syz.0.855': attribute type 1 has an invalid length. [ 178.938242][ T9453] netlink: 20 bytes leftover after parsing attributes in process `syz.0.855'. [ 179.041471][ T9455] mkiss: ax0: crc mode is auto. [ 179.199053][ T9455] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 179.744396][ C2] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 179.835899][ T9482] fuse: Unknown parameter '0x0000000000000003' [ 179.914650][ T9490] 9pnet_fd: Insufficient options for proto=fd [ 179.989084][ T6057] libceph: connect (1)[c::]:6789 error -101 [ 179.991306][ T6057] libceph: mon0 (1)[c::]:6789 connect error [ 180.155026][ T9492] ceph: No mds server is up or the cluster is laggy [ 180.158718][ T9500] netlink: 44 bytes leftover after parsing attributes in process `syz.1.864'. [ 180.586502][ T9516] fuse: Unknown parameter '0x0000000000000003' [ 180.856236][ C2] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 181.083419][ T9524] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(5) [ 181.086232][ T9524] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 181.090828][ T9524] vhci_hcd vhci_hcd.0: Device attached [ 181.135962][ T9524] netdevsim netdevsim2: Direct firmware load for @ failed with error -2 [ 181.139598][ T9524] netdevsim netdevsim2: Falling back to sysfs fallback for: @ [ 181.193325][ T9528] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.873'. [ 181.311031][ T9531] netlink: 8 bytes leftover after parsing attributes in process `syz.0.873'. [ 181.446365][ T6066] usb 42-1: SetAddress Request (6) to port 0 [ 181.452064][ T6066] usb 42-1: new SuperSpeed USB device number 6 using vhci_hcd [ 181.539036][ T9537] netlink: 4 bytes leftover after parsing attributes in process `syz.1.874'. [ 181.547093][ T9537] netlink: 173 bytes leftover after parsing attributes in process `syz.1.874'. [ 181.551117][ T9537] netlink: 277 bytes leftover after parsing attributes in process `syz.1.874'. [ 181.554116][ T9537] netlink: 277 bytes leftover after parsing attributes in process `syz.1.874'. [ 181.684172][ T9539] trusted_key: encrypted_key: keyword 'update' not allowed when called from .instantiate method [ 181.777889][ T9525] vhci_hcd: connection reset by peer [ 181.781700][ T7992] vhci_hcd: stop threads [ 181.783458][ T7992] vhci_hcd: release socket [ 181.786876][ T7992] vhci_hcd: disconnect device [ 181.968137][ C2] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 182.113252][ T9543] netlink: 12 bytes leftover after parsing attributes in process `syz.0.876'. [ 182.236653][ T9550] team0: No ports can be present during mode change [ 182.239835][ T9550] netlink: 4 bytes leftover after parsing attributes in process `syz.0.877'. [ 182.340993][ T9550] team_slave_0: left promiscuous mode [ 182.343738][ T9550] team_slave_0: left allmulticast mode [ 182.351312][ T9550] team0 (unregistering): Port device team_slave_0 removed [ 182.355427][ T9550] team_slave_1: left promiscuous mode [ 182.357915][ T9550] team_slave_1: left allmulticast mode [ 182.367140][ T9550] team0 (unregistering): Port device team_slave_1 removed [ 183.079838][ C2] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 183.392635][ T9594] fuse: Unknown parameter 'fd0x0000000000000003' [ 183.722861][ T29] libceph: connect (1)[c::]:6789 error -101 [ 183.726296][ T29] libceph: mon0 (1)[c::]:6789 connect error [ 183.750921][ T9602] ceph: No mds server is up or the cluster is laggy [ 183.805836][ T9607] vxfs: WRONG superblock magic 00000000 at 1 [ 183.808970][ T9607] vxfs: WRONG superblock magic 00000000 at 8 [ 183.810951][ T9607] vxfs: can't find superblock. [ 184.191721][ C2] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 184.439204][ T9622] fuse: Unknown parameter 'fd0x0000000000000003' [ 184.560403][ T9633] netlink: 'syz.2.895': attribute type 1 has an invalid length. [ 184.563069][ T9633] __nla_validate_parse: 1 callbacks suppressed [ 184.563082][ T9633] netlink: 224 bytes leftover after parsing attributes in process `syz.2.895'. [ 184.568394][ T9633] netlink: 8 bytes leftover after parsing attributes in process `syz.2.895'. [ 184.599531][ T9628] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 184.601576][ T9628] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 184.744572][ T9638] netlink: 8 bytes leftover after parsing attributes in process `syz.0.903'. [ 185.314158][ C2] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 185.315542][ T40] audit: type=1800 audit(2000000091.589:760): pid=9650 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=set_data cause=unavailable-hash-algorithm comm="syz.3.907" name="/newroot/235/file0" dev="tmpfs" ino=1316 res=0 errno=0 [ 185.367909][ T40] audit: type=1800 audit(2000000091.636:761): pid=9649 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=set_data cause=unavailable-hash-algorithm comm="syz.3.907" name="/newroot/235/file0" dev="tmpfs" ino=1316 res=0 errno=0 [ 185.615362][ T9672] netlink: 'syz.3.913': attribute type 11 has an invalid length. [ 185.617842][ T9672] netlink: 36 bytes leftover after parsing attributes in process `syz.3.913'. [ 186.415413][ C2] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 186.635675][ T40] audit: type=1804 audit(2000000092.815:762): pid=9694 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.918" name="/newroot/237/bus" dev="tmpfs" ino=1305 res=1 errno=0 [ 186.757564][ T63] Bluetooth: hci2: command 0x0c1a tx timeout [ 186.760174][ T63] Bluetooth: hci1: command 0x0c1a tx timeout [ 186.858030][ T6066] usb 42-1: device descriptor read/8, error -110 [ 187.347474][ T6066] usb usb42-port1: attempt power cycle [ 187.527190][ C2] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 187.554920][ T9700] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 187.557607][ T9700] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 187.561980][ T9700] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 187.564290][ T9700] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 187.773039][ T40] audit: type=1804 audit(2000000093.890:763): pid=9714 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.922" name="/newroot/239/bus/bus" dev="overlay" ino=1322 res=1 errno=0 [ 187.789876][ T40] audit: type=1804 audit(2000000093.909:764): pid=9714 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.922" name="/newroot/239/bus/bus" dev="overlay" ino=1322 res=1 errno=0 [ 187.998248][ T6066] usb usb42-port1: unable to enumerate USB device [ 188.153872][ T9721] netlink: 132 bytes leftover after parsing attributes in process `syz.0.926'. [ 188.157736][ T9721] netlink: 132 bytes leftover after parsing attributes in process `syz.0.926'. [ 188.638954][ C2] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 188.970413][ T6057] usb 6-1: new high-speed USB device number 20 using dummy_hcd [ 189.078133][ T9745] netlink: 4 bytes leftover after parsing attributes in process `syz.2.933'. [ 189.132050][ T9745] netlink: 4 bytes leftover after parsing attributes in process `syz.2.933'. [ 189.134993][ T9745] netlink: 4 bytes leftover after parsing attributes in process `syz.2.933'. [ 189.137893][ T9745] netlink: 4 bytes leftover after parsing attributes in process `syz.2.933'. [ 189.152414][ T6057] usb 6-1: Using ep0 maxpacket: 32 [ 189.155475][ T6057] usb 6-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 189.158405][ T6057] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 189.162443][ T6057] usb 6-1: config 0 descriptor?? [ 189.391837][ T6057] dvb-usb: found a 'Elgato EyeTV Sat' in cold state, will try to load a firmware [ 189.421868][ T6057] usb 6-1: Direct firmware load for dvb-usb-az6027-03.fw failed with error -2 [ 189.430556][ T6057] usb 6-1: Falling back to sysfs fallback for: dvb-usb-az6027-03.fw [ 189.761525][ C2] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 189.970800][ T9760] program syz.1.937 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 190.862681][ C2] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 191.889967][ T9791] sp0: Synchronizing with TNC [ 191.974470][ C2] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 192.006849][ T842] usb 7-1: new high-speed USB device number 19 using dummy_hcd [ 192.190257][ T842] usb 7-1: Using ep0 maxpacket: 32 [ 192.194065][ T842] usb 7-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 192.197731][ T842] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 192.202381][ T842] usb 7-1: config 0 descriptor?? [ 192.284928][ T10] usb 8-1: new high-speed USB device number 14 using dummy_hcd [ 192.423008][ T842] dvb-usb: found a 'Elgato EyeTV Sat' in cold state, will try to load a firmware [ 192.434501][ T10] usb 8-1: device descriptor read/64, error -71 [ 192.701755][ T10] usb 8-1: new high-speed USB device number 15 using dummy_hcd [ 192.768569][ T9799] fuse: Unknown parameter '' [ 192.851247][ T10] usb 8-1: device descriptor read/64, error -71 [ 192.969137][ T10] usb usb8-port1: attempt power cycle [ 193.096928][ C2] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 193.418034][ T10] usb 8-1: new high-speed USB device number 16 using dummy_hcd [ 193.514886][ T10] usb 8-1: device descriptor read/8, error -71 [ 193.679944][ T9811] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(6) [ 193.682068][ T9811] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 193.686450][ T9811] vhci_hcd vhci_hcd.0: Device attached [ 193.770649][ T10] usb 8-1: new high-speed USB device number 17 using dummy_hcd [ 193.792451][ T10] usb 8-1: device descriptor read/8, error -71 [ 193.911602][ T10] usb usb8-port1: unable to enumerate USB device [ 193.973637][ T53] usb 38-1: SetAddress Request (2) to port 0 [ 193.978796][ T53] usb 38-1: new SuperSpeed USB device number 2 using vhci_hcd [ 193.993074][ T9812] vhci_hcd: connection closed [ 193.994515][ T7994] vhci_hcd: stop threads [ 193.999299][ T7994] vhci_hcd: release socket [ 194.003109][ T7994] vhci_hcd: disconnect device [ 194.005700][ T53] usb 38-1: enqueue for inactive port 0 [ 194.208781][ C2] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 194.394294][ T9824] __nla_validate_parse: 61 callbacks suppressed [ 194.394307][ T9824] netlink: 16 bytes leftover after parsing attributes in process `syz.2.958'. [ 194.466483][ T53] usb usb38-port1: attempt power cycle [ 194.653440][ T9846] fuse: Bad value for 'fd' [ 195.104628][ T53] usb usb38-port1: unable to enumerate USB device [ 195.309952][ C2] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 195.617995][ T9866] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 195.636305][ T9870] nbd_handle_cmd: 2 callbacks suppressed [ 195.636327][ T9870] block nbd3: Attempted send on invalid socket [ 195.643751][ T9870] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x1000 phys_seg 1 prio class 3 [ 195.647678][ T9870] XFS (nbd3): SB validate failed with error -5. [ 195.966941][ T9891] netlink: 12 bytes leftover after parsing attributes in process `syz.2.975'. [ 196.421955][ C2] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 197.544272][ C2] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 197.996661][ T9912] Mount JFS Failure: -22 [ 197.998568][ T9912] jfs_mount failed w/return code = -22 [ 198.645533][ C2] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 198.996906][ T7991] tipc: Subscription rejected, illegal request [ 199.123756][ T9977] bond0: option ad_select: unable to set because the bond device is up [ 199.405436][ T40] audit: type=1326 audit(2000000104.778:765): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9989 comm="syz.1.1004" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf708e579 code=0x7ffc0000 [ 199.417189][ T40] audit: type=1326 audit(2000000104.778:766): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9989 comm="syz.1.1004" exe="/syz-executor" sig=0 arch=40000003 syscall=36 compat=1 ip=0xf708e579 code=0x7ffc0000 [ 199.441815][ T40] audit: type=1326 audit(2000000104.806:767): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9989 comm="syz.1.1004" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf708e579 code=0x7ffc0000 [ 199.451160][ T40] audit: type=1326 audit(2000000104.806:768): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9989 comm="syz.1.1004" exe="/syz-executor" sig=0 arch=40000003 syscall=357 compat=1 ip=0xf708e579 code=0x7ffc0000 [ 199.460311][ T40] audit: type=1326 audit(2000000104.806:769): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9989 comm="syz.1.1004" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf708e579 code=0x7ffc0000 [ 199.469634][ T40] audit: type=1326 audit(2000000104.806:770): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9989 comm="syz.1.1004" exe="/syz-executor" sig=0 arch=40000003 syscall=6 compat=1 ip=0xf708e579 code=0x7ffc0000 [ 199.478278][ T40] audit: type=1326 audit(2000000104.806:771): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9989 comm="syz.1.1004" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf708e579 code=0x7ffc0000 [ 199.484905][ T9992] 9pnet_fd: Insufficient options for proto=fd [ 199.487151][ T40] audit: type=1326 audit(2000000104.806:772): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9989 comm="syz.1.1004" exe="/syz-executor" sig=0 arch=40000003 syscall=357 compat=1 ip=0xf708e579 code=0x7ffc0000 [ 199.498267][ T40] audit: type=1326 audit(2000000104.816:773): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9989 comm="syz.1.1004" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf708e579 code=0x7ffc0000 [ 199.507336][ T40] audit: type=1326 audit(2000000104.816:774): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9989 comm="syz.1.1004" exe="/syz-executor" sig=0 arch=40000003 syscall=357 compat=1 ip=0xf708e579 code=0x7ffc0000 [ 199.648116][T10014] netem: change failed [ 199.757209][ C2] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 199.848301][ T1421] ieee802154 phy0 wpan0: encryption failed: -22 [ 199.850876][ T1421] ieee802154 phy1 wpan1: encryption failed: -22 [ 200.879704][ C2] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 201.257221][T10044] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1019'. [ 201.283042][T10044] cgroup: subsys name conflicts with all [ 201.980866][ C2] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 202.083435][T10071] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 202.317556][T10073] loop2: detected capacity change from 0 to 7 [ 202.322656][T10073] Dev loop2: unable to read RDB block 7 [ 202.325076][T10073] loop2: AHDI p1 p2 p3 [ 202.326515][T10073] loop2: partition table partially beyond EOD, truncated [ 202.328842][T10073] loop2: p3 start 335544320 is beyond EOD, truncated [ 202.989032][T10081] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1029'. [ 203.103504][ C2] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 203.116952][T10106] netlink: 'syz.2.1036': attribute type 1 has an invalid length. [ 203.119659][T10106] netlink: 224 bytes leftover after parsing attributes in process `syz.2.1036'. [ 203.732147][T10122] af_packet: tpacket_rcv: packet too big, clamped from 44 to 4294967272. macoff=96 [ 203.894656][ T6019] usb 8-1: new high-speed USB device number 18 using dummy_hcd [ 203.975267][T10144] tmpfs: Bad value for 'mpol' [ 203.995710][T10144] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1044'. [ 204.033676][ T6019] usb 8-1: device descriptor read/64, error -71 [ 204.204529][ C2] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 204.290094][ T6019] usb 8-1: new high-speed USB device number 19 using dummy_hcd [ 204.429122][ T6019] usb 8-1: device descriptor read/64, error -71 [ 204.549173][ T6019] usb usb8-port1: attempt power cycle [ 204.931639][ T6019] usb 8-1: new high-speed USB device number 20 using dummy_hcd [ 204.953662][ T6019] usb 8-1: device descriptor read/8, error -71 [ 205.220223][ T6019] usb 8-1: new high-speed USB device number 21 using dummy_hcd [ 205.252625][ T6019] usb 8-1: device descriptor read/8, error -71 [ 205.327014][ C2] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 205.369967][ T6019] usb usb8-port1: unable to enumerate USB device [ 206.438879][ C2] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 207.539974][ C2] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 207.734859][T10204] openvswitch: netlink: ERSPAN option length err (len 256, max 255). [ 207.740969][T10204] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1061'. [ 208.651902][ C2] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 208.673018][T10230] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(6) [ 208.675170][T10230] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 208.685155][T10230] vhci_hcd vhci_hcd.0: Device attached [ 208.940576][ T6066] usb 39-1: new low-speed USB device number 3 using vhci_hcd [ 209.122970][ T40] kauditd_printk_skb: 111 callbacks suppressed [ 209.122985][ T40] audit: type=1326 audit(2000000113.870:886): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10239 comm="syz.2.1070" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf709e579 code=0x0 [ 209.605566][T10245] netlink: 'syz.3.1071': attribute type 21 has an invalid length. [ 209.763607][ C2] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 209.887388][T10231] vhci_hcd: connection reset by peer [ 209.889956][ T8002] vhci_hcd: stop threads [ 209.893134][ T8002] vhci_hcd: release socket [ 209.897084][ T8002] vhci_hcd: disconnect device [ 210.011766][T10259] /dev/sr0: Can't open blockdev [ 210.319353][T10275] comedi comedi3: board detection failed [ 210.332877][T10275] comedi comedi3: board detection failed [ 210.426650][T10281] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1080'. [ 210.875527][ C2] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 211.210179][T10287] fuse: Bad value for 'group_id' [ 211.212226][T10287] fuse: Bad value for 'group_id' [ 211.446782][T10302] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(7) [ 211.448869][T10302] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 211.452491][T10302] vhci_hcd vhci_hcd.0: Device attached [ 211.754199][T10303] vhci_hcd: connection closed [ 211.754938][ T7993] vhci_hcd: stop threads [ 211.758233][ T7993] vhci_hcd: release socket [ 211.760267][ T7993] vhci_hcd: disconnect device [ 211.816583][ T53] usb 44-1: enqueue for inactive port 0 [ 211.987246][ C2] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 212.353377][ T53] usb usb44-port1: attempt power cycle [ 212.502318][T10318] tipc: Started in network mode [ 212.512143][T10318] tipc: Node identity 52b2f525f785, cluster identity 4711 [ 212.514574][T10318] tipc: Enabled bearer , priority 0 [ 212.519735][T10319] netlink: 212376 bytes leftover after parsing attributes in process `syz.1.1090'. [ 212.522393][T10318] syzkaller0: entered promiscuous mode [ 212.524921][T10318] syzkaller0: entered allmulticast mode [ 212.551154][T10318] tipc: Resetting bearer [ 212.563553][T10317] tipc: Resetting bearer [ 212.587246][T10317] tipc: Disabling bearer [ 213.099065][ C2] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 213.284917][ T53] usb usb44-port1: unable to enumerate USB device [ 214.221605][ C2] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 214.371299][ T6066] vhci_hcd: vhci_device speed not set [ 214.485538][T10346] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1099'. [ 214.491084][T10346] program syz.1.1099 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 215.323056][ C2] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 215.416586][ T63] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 215.422219][ T63] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 215.425471][ T63] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 215.430199][ T63] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 215.433077][ T63] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 215.442177][ T5971] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 215.444715][ T5971] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 215.447548][ T5971] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 215.450423][ T5971] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 215.454212][ T5971] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 215.642484][T10371] chnl_net:caif_netlink_parms(): no params data found [ 215.737045][T10371] bridge0: port 1(bridge_slave_0) entered blocking state [ 215.740387][T10371] bridge0: port 1(bridge_slave_0) entered disabled state [ 215.743428][T10371] bridge_slave_0: entered allmulticast mode [ 215.747437][T10371] bridge_slave_0: entered promiscuous mode [ 215.752401][T10371] bridge0: port 2(bridge_slave_1) entered blocking state [ 215.755426][T10371] bridge0: port 2(bridge_slave_1) entered disabled state [ 215.758818][T10371] bridge_slave_1: entered allmulticast mode [ 215.763059][T10371] bridge_slave_1: entered promiscuous mode [ 215.809113][T10371] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 215.824192][T10371] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 215.861055][T10371] team0: Port device team_slave_0 added [ 215.864335][T10371] team0: Port device team_slave_1 added [ 215.894466][T10371] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 215.896772][T10371] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 215.905430][T10371] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 215.910343][T10371] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 215.913111][T10371] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 215.921558][T10371] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 215.962233][T10371] hsr_slave_0: entered promiscuous mode [ 215.964907][T10371] hsr_slave_1: entered promiscuous mode [ 215.967043][T10371] debugfs: 'hsr0' already exists in 'hsr' [ 215.968903][T10371] Cannot create hsr debugfs directory [ 216.042055][ T8002] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 216.119886][ T8002] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 216.142822][T10371] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 216.147335][T10371] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 216.151671][T10371] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 216.157270][T10371] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 216.176205][T10371] bridge0: port 2(bridge_slave_1) entered blocking state [ 216.178619][T10371] bridge0: port 2(bridge_slave_1) entered forwarding state [ 216.181048][T10371] bridge0: port 1(bridge_slave_0) entered blocking state [ 216.183367][T10371] bridge0: port 1(bridge_slave_0) entered forwarding state [ 216.223003][ T8002] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 216.307084][ T7996] bridge0: port 1(bridge_slave_0) entered disabled state [ 216.319857][ T7996] bridge0: port 2(bridge_slave_1) entered disabled state [ 216.413612][ T8002] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 216.435566][ C2] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 216.444503][T10371] 8021q: adding VLAN 0 to HW filter on device bond0 [ 216.460918][T10371] 8021q: adding VLAN 0 to HW filter on device team0 [ 216.471650][ T1218] bridge0: port 1(bridge_slave_0) entered blocking state [ 216.473864][ T1218] bridge0: port 1(bridge_slave_0) entered forwarding state [ 216.489742][ T7993] bridge0: port 2(bridge_slave_1) entered blocking state [ 216.492116][ T7993] bridge0: port 2(bridge_slave_1) entered forwarding state [ 216.571967][ T8002] bridge_slave_1: left allmulticast mode [ 216.578746][ T8002] bridge_slave_1: left promiscuous mode [ 216.582559][ T8002] bridge0: port 2(bridge_slave_1) entered disabled state [ 216.598248][ T8002] bridge_slave_0: left allmulticast mode [ 216.600099][ T8002] bridge_slave_0: left promiscuous mode [ 216.602007][ T8002] bridge0: port 1(bridge_slave_0) entered disabled state [ 217.120380][ T8002] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 217.123497][ T8002] bond_slave_0: left promiscuous mode [ 217.125290][ T8002] bond_slave_0: left allmulticast mode [ 217.128481][ T8002] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 217.131777][ T8002] bond_slave_1: left promiscuous mode [ 217.134231][ T8002] bond_slave_1: left allmulticast mode [ 217.137595][ T8002] bond0 (unregistering): Released all slaves [ 217.226072][ T8002] bond1 (unregistering): Released all slaves [ 217.320411][ T8002] bond2 (unregistering): Released all slaves [ 217.490296][T10371] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 217.546659][ C2] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 217.636076][ T63] Bluetooth: hci4: command tx timeout [ 217.671779][T10371] veth0_vlan: entered promiscuous mode [ 217.677388][T10371] veth1_vlan: entered promiscuous mode [ 217.694986][T10371] veth0_macvtap: entered promiscuous mode [ 217.700270][T10371] veth1_macvtap: entered promiscuous mode [ 217.709548][T10371] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 217.715548][T10371] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 217.726175][ T7996] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 217.729807][ T7996] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 217.743560][ T7996] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 217.752470][ T7996] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 217.809880][ T8003] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 217.812319][ T8003] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 217.829702][ T7996] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 217.834020][ T7996] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 217.871814][ T8002] hsr_slave_0: left promiscuous mode [ 217.911177][ T8002] hsr_slave_1: left promiscuous mode [ 217.913778][ T8002] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 217.916975][ T8002] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 217.920209][ T8002] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 217.957625][ T8002] veth1_macvtap: left promiscuous mode [ 217.960421][ T8002] veth0_macvtap: left allmulticast mode [ 217.962862][ T8002] veth0_macvtap: left promiscuous mode [ 218.668888][ C2] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 219.770041][ C2] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 219.866325][ T63] Bluetooth: hci4: command tx timeout [ 220.305023][T10452] sch_fq: defrate 53322 ignored. [ 220.334140][T10455] dvmrp0: entered allmulticast mode [ 220.710969][ T60] usb 8-1: new high-speed USB device number 22 using dummy_hcd [ 220.871194][ T60] usb 8-1: Using ep0 maxpacket: 32 [ 220.874150][ T60] usb 8-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 220.877035][ T60] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 220.880778][ T60] usb 8-1: config 0 descriptor?? [ 220.892611][ C2] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 221.104023][ T60] dvb-usb: found a 'Elgato EyeTV Sat' in cold state, will try to load a firmware [ 221.993735][ C2] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 222.079470][ T63] Bluetooth: hci4: command tx timeout [ 222.234240][T10486] netlink: 5 bytes leftover after parsing attributes in process `syz.1.1127'. [ 222.238097][T10486] 0ªX¹¦D: renamed from macvtap0 (while UP) [ 222.285749][T10486] 0ªX¹¦D: entered allmulticast mode [ 222.293044][T10486] veth0_macvtap: entered allmulticast mode [ 222.298269][T10486] A link change request failed with some changes committed already. Interface 30ªX¹¦D may have been left with an inconsistent configuration, please check. [ 222.356978][T10486] usb 1-1: USB disconnect, device number 3 [ 222.450035][T10495] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1130'. [ 222.455132][T10496] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1130'. [ 222.459051][T10496] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1130'. [ 222.464120][T10496] netlink: 'syz.2.1130': attribute type 13 has an invalid length. [ 222.467788][T10496] netlink: 'syz.2.1130': attribute type 11 has an invalid length. [ 222.524083][T10499] hub 1-0:1.0: USB hub found [ 222.525988][T10499] hub 1-0:1.0: 6 ports detected [ 222.539405][T10501] FAULT_INJECTION: forcing a failure. [ 222.539405][T10501] name failslab, interval 1, probability 0, space 0, times 0 [ 222.543296][T10501] CPU: 2 UID: 0 PID: 10501 Comm: syz.2.1131 Not tainted syzkaller #0 PREEMPT(full) [ 222.543314][T10501] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 222.543321][T10501] Call Trace: [ 222.543325][T10501] [ 222.543329][T10501] dump_stack_lvl+0x16c/0x1f0 [ 222.543367][T10501] should_fail_ex+0x512/0x640 [ 222.543388][T10501] ? fs_reclaim_acquire+0xae/0x150 [ 222.543405][T10501] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 222.543421][T10501] should_failslab+0xc2/0x120 [ 222.543435][T10501] __kmalloc_noprof+0xd2/0x510 [ 222.543450][T10501] tomoyo_realpath_from_path+0xc2/0x6e0 [ 222.543467][T10501] ? tomoyo_profile+0x47/0x60 [ 222.543478][T10501] tomoyo_path_number_perm+0x245/0x580 [ 222.543490][T10501] ? tomoyo_path_number_perm+0x237/0x580 [ 222.543504][T10501] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 222.543531][T10501] ? find_held_lock+0x2b/0x80 [ 222.543542][T10501] ? hook_file_ioctl_common+0x145/0x410 [ 222.543560][T10501] ? __fget_files+0x20e/0x3c0 [ 222.543575][T10501] security_file_ioctl_compat+0x9b/0x240 [ 222.543590][T10501] __ia32_compat_sys_ioctl+0xc3/0x370 [ 222.543609][T10501] __do_fast_syscall_32+0x7c/0x3a0 [ 222.543625][T10501] do_fast_syscall_32+0x32/0x80 [ 222.543639][T10501] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 222.543652][T10501] RIP: 0023:0xf709e579 [ 222.543661][T10501] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 [ 222.543672][T10501] RSP: 002b:00000000f548e55c EFLAGS: 00000296 ORIG_RAX: 0000000000000036 [ 222.543683][T10501] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000c03064b7 [ 222.543689][T10501] RDX: 0000000080000200 RSI: 0000000000000000 RDI: 0000000000000000 [ 222.543695][T10501] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 222.543701][T10501] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 [ 222.543707][T10501] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 222.543725][T10501] [ 222.543729][T10501] ERROR: Out of memory at tomoyo_realpath_from_path. [ 222.752787][ T59] usb 1-1: new high-speed USB device number 4 using ehci-pci [ 222.949370][ T59] usb 1-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 222.953244][ T59] usb 1-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 222.965409][ T59] usb 1-1: Product: QEMU USB Tablet [ 222.969035][ T59] usb 1-1: Manufacturer: QEMU [ 222.970889][ T59] usb 1-1: SerialNumber: 28754-0000:00:1d.7-1 [ 223.025062][ T59] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.7/usb1/1-1/1-1:1.0/0003:0627:0001.0008/input/input22 [ 223.105573][ C2] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 223.139497][ T59] hid-generic 0003:0627:0001.0008: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.7-1/input0 [ 223.623615][T10527] new mount options do not match the existing superblock, will be ignored [ 223.721800][T10531] orangefs: client-core tried to read wrong size [ 223.724999][T10531] ***************************************************** [ 223.729979][T10531] ORANGEFS Device Error: You cannot open the device file [ 223.729998][T10531] [ 223.729998][T10531] /dev/pvfs2-req more than once. Please make sure that [ 223.729998][T10531] there are no [ 223.736221][T10531] instances of a program using this device [ 223.736221][T10531] currently running. (You must verify this!) [ 223.746647][T10531] For example, you can use the lsof program as follows: [ 223.755661][T10531] 'lsof | grep pvfs2-req' (run this as root) [ 223.758752][T10531] open_access_count = 1 [ 223.760603][T10531] ***************************************************** [ 223.769139][T10537] comedi comedi3: comedi_config --init_data is deprecated [ 224.217374][ C2] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 224.303211][ T63] Bluetooth: hci4: command tx timeout [ 225.339863][ C2] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 226.042700][T10613] FAULT_INJECTION: forcing a failure. [ 226.042700][T10613] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 226.047436][T10613] CPU: 3 UID: 0 PID: 10613 Comm: syz.4.1160 Not tainted syzkaller #0 PREEMPT(full) [ 226.047462][T10613] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 226.047472][T10613] Call Trace: [ 226.047478][T10613] [ 226.047485][T10613] dump_stack_lvl+0x16c/0x1f0 [ 226.047512][T10613] should_fail_ex+0x512/0x640 [ 226.047539][T10613] _copy_from_iter+0x29f/0x1720 [ 226.047572][T10613] ? __pfx__copy_from_iter+0x10/0x10 [ 226.047598][T10613] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 226.047628][T10613] copy_page_from_iter+0xde/0x180 [ 226.047666][T10613] tun_build_skb.constprop.0+0x2e8/0x1500 [ 226.047692][T10613] ? __pfx_tun_build_skb.constprop.0+0x10/0x10 [ 226.047711][T10613] ? unwind_get_return_address+0x59/0xa0 [ 226.047730][T10613] ? arch_stack_walk+0xa6/0x100 [ 226.047750][T10613] ? __lock_acquire+0x62e/0x1ce0 [ 226.047791][T10613] tun_get_user+0x14ae/0x3ce0 [ 226.047820][T10613] ? __pfx_tun_get_user+0x10/0x10 [ 226.047840][T10613] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 226.047871][T10613] ? find_held_lock+0x2b/0x80 [ 226.047887][T10613] ? tun_get+0x191/0x370 [ 226.047913][T10613] tun_chr_write_iter+0xdc/0x210 [ 226.047931][T10613] vfs_write+0x7d0/0x11d0 [ 226.047951][T10613] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 226.047971][T10613] ? __pfx_vfs_write+0x10/0x10 [ 226.047988][T10613] ? find_held_lock+0x2b/0x80 [ 226.048014][T10613] ksys_write+0x12a/0x250 [ 226.048034][T10613] ? __pfx_ksys_write+0x10/0x10 [ 226.048053][T10613] ? rcu_is_watching+0x12/0xc0 [ 226.048070][T10613] __do_fast_syscall_32+0x7c/0x3a0 [ 226.048092][T10613] do_fast_syscall_32+0x32/0x80 [ 226.048114][T10613] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 226.048134][T10613] RIP: 0023:0xf704e579 [ 226.048149][T10613] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 [ 226.048164][T10613] RSP: 002b:00000000f543e520 EFLAGS: 00000293 ORIG_RAX: 0000000000000004 [ 226.048181][T10613] RAX: ffffffffffffffda RBX: 00000000000000c8 RCX: 00000000800001c0 [ 226.048191][T10613] RDX: 0000000000000042 RSI: 00000000f73b4ff4 RDI: 0000000000000000 [ 226.048202][T10613] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 226.048241][T10613] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 [ 226.048250][T10613] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 226.048271][T10613] [ 226.441107][ C2] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 226.624587][T10633] use of bytesused == 0 is deprecated and will be removed in the future, [ 226.628282][T10633] use the actual size instead. [ 227.563498][ C2] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 228.568432][ T53] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 228.664699][ C2] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 228.709079][ T53] usb 9-1: device descriptor read/64, error -71 [ 228.768347][T10668] 9pnet_virtio: no channels available for device syz [ 229.092312][ T53] usb 9-1: new high-speed USB device number 3 using dummy_hcd [ 229.776483][ C2] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 230.009906][ T53] usb 9-1: device descriptor read/64, error -71 [ 230.236304][ T53] usb usb9-port1: attempt power cycle [ 230.599645][ T53] usb 9-1: new high-speed USB device number 4 using dummy_hcd [ 230.621742][ T53] usb 9-1: device descriptor read/8, error -71 [ 230.626419][T10695] ref_tracker: memory allocation failure, unreliable refcount tracker. [ 230.877711][ T53] usb 9-1: new high-speed USB device number 5 using dummy_hcd [ 230.899008][ C2] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 230.899665][ T53] usb 9-1: device descriptor read/8, error -71 [ 231.017107][ T53] usb usb9-port1: unable to enumerate USB device [ 231.851293][T10719] MTD: Couldn't look up '/dev/sg0': -15 [ 232.000176][ C2] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 232.474958][ T40] audit: type=1800 audit(2000000135.712:887): pid=10737 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.1195" name="bus" dev="overlay" ino=1788 res=0 errno=0 [ 232.502782][T10733] netlink: 'syz.3.1194': attribute type 1 has an invalid length. [ 232.621948][T10738] loop7: detected capacity change from 0 to 7 [ 232.697886][T10736] ubi6: attaching mtd0 [ 232.699528][T10736] ubi6 error: ubi_attach_mtd_dev: bad VID header (33278) or data offsets (33342) [ 232.736787][T10742] 8021q: adding VLAN 0 to HW filter on device bond2 [ 232.769456][T10742] veth3: entered promiscuous mode [ 232.789118][T10736] netlink: 'syz.1.1193': attribute type 5 has an invalid length. [ 232.855789][T10744] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1196'. [ 232.875748][T10738] Dev loop7: unable to read RDB block 7 [ 232.876311][ C1] invalid error, dev loop7, sector 0 op 0x1:(WRITE) flags 0x800 phys_seg 1 prio class 3 [ 232.881386][T10738] loop7: unable to read partition table [ 232.881576][ C1] Buffer I/O error on dev loop7, logical block 0, lost async page write [ 232.883388][T10738] loop7: partition table beyond EOD, truncated [ 232.890109][T10738] loop_reread_partitions: partition scan of loop7 (úùƒå¡™‰ü¾CêjÌ–ã¢P=ý?ã}X‹ºÐ œëÜ%õ«`ÉæÖ€ù…ˆ{í©Ö˜Èµ4FLQkÝŠ) failed (rc=-5) [ 233.012903][T10750] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1197'. [ 233.122688][ C2] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 233.303486][T10760] netlink: 1284 bytes leftover after parsing attributes in process `syz.4.1198'. [ 234.189329][T10774] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1204'. [ 234.234507][ C2] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 234.439667][T10792] tmpfs: Bad value for 'mpol' [ 234.441724][T10792] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1211'. [ 234.657815][T10801] netlink: 'syz.1.1214': attribute type 10 has an invalid length. [ 234.660463][T10801] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1214'. [ 234.663424][T10801] dummy0: entered promiscuous mode [ 234.667157][T10801] bridge0: port 2(dummy0) entered blocking state [ 234.669738][T10801] bridge0: port 2(dummy0) entered disabled state [ 234.673370][T10801] dummy0: entered allmulticast mode [ 234.676260][T10801] bridge0: port 2(dummy0) entered blocking state [ 234.678274][T10801] bridge0: port 2(dummy0) entered forwarding state [ 235.346896][ C2] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 235.355211][T10816] netlink: 'syz.4.1217': attribute type 4 has an invalid length. [ 235.367014][T10821] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1218'. [ 235.371457][T10812] netlink: 56 bytes leftover after parsing attributes in process `syz.4.1217'. [ 235.371859][T10821] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1218'. [ 235.650958][T10827] workqueue: Failed to create a rescuer kthread for wq "ceph-completion": -EINTR [ 236.447569][ C2] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 236.681689][T10860] netlink: 48 bytes leftover after parsing attributes in process `syz.3.1229'. [ 236.689086][T10860] block nbd3: Attempted send on invalid socket [ 236.691555][T10860] I/O error, dev nbd3, sector 64 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 3 [ 236.695885][T10860] block nbd3: Attempted send on invalid socket [ 236.698240][T10860] I/O error, dev nbd3, sector 120 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 3 [ 236.707683][T10860] Mount JFS Failure: -5 [ 236.709185][T10860] jfs_mount failed w/return code = -5 [ 238.024638][ T40] audit: type=1326 audit(2000000140.894:888): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10890 comm="syz.2.1239" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf709e579 code=0x0 [ 239.885894][ T40] audit: type=1804 audit(2000000142.634:889): pid=10912 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.1245" name="/newroot/38/file0" dev="tmpfs" ino=219 res=1 errno=0 [ 239.982223][T10915] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(9) [ 239.985008][T10915] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 239.989660][T10915] vhci_hcd vhci_hcd.0: Device attached [ 240.049531][T10917] vhci_hcd: connection closed [ 240.052568][ T8002] vhci_hcd: stop threads [ 240.055565][ T8002] vhci_hcd: release socket [ 240.057040][ T8002] vhci_hcd: disconnect device [ 240.814432][T10951] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 240.816958][T10952] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 240.823460][T10952] overlayfs: failed to set xattr on upper [ 240.825286][T10952] overlayfs: ...falling back to redirect_dir=nofollow. [ 240.827530][T10952] overlayfs: ...falling back to index=off. [ 240.829551][T10952] overlayfs: ...falling back to uuid=null. [ 241.657321][T10964] __nla_validate_parse: 2 callbacks suppressed [ 241.657339][T10964] netlink: 80 bytes leftover after parsing attributes in process `syz.4.1257'. [ 241.956463][T10970] netfs: Couldn't get user pages (rc=-14) [ 242.663948][T10976] netlink: 64 bytes leftover after parsing attributes in process `syz.4.1260'. [ 244.435563][T10998] fuse: Unknown parameter ' [ 244.435563][T10998] £¾ÛŸãj¦žB‚@Ÿ×ЪÎÂs&ºí‚\Yfi&£v' [ 244.865948][T11021] can0: slcan on ttyS3. [ 246.937763][T11050] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1281'. [ 248.132703][T11021] can0 (unregistered): slcan off ttyS3. [ 248.326331][T11072] Invalid source name [ 248.531788][T11073] netlink: 'syz.2.1286': attribute type 10 has an invalid length. [ 248.644725][T11073] veth0_vlan: left promiscuous mode [ 248.649041][T11073] veth0_vlan: entered promiscuous mode [ 248.657740][T11073] team0: Device veth0_vlan failed to register rx_handler [ 249.491218][T11096] can0: slcan on ttyS3. [ 249.768112][ T6040] usb 9-1: new high-speed USB device number 6 using dummy_hcd [ 249.936117][ T6040] usb 9-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 249.939414][ T6040] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 249.942835][ T6040] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 249.946901][ T6040] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 249.960617][ T6040] usb 9-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 249.963894][ T6040] usb 9-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 249.966631][ T6040] usb 9-1: Product: syz [ 249.968165][ T6040] usb 9-1: Manufacturer: syz [ 250.001389][ T6040] cdc_wdm 9-1:1.0: skipping garbage [ 250.003525][ T6040] cdc_wdm 9-1:1.0: skipping garbage [ 250.015802][ T6040] cdc_wdm 9-1:1.0: cdc-wdm0: USB WDM device [ 250.017900][ T6040] cdc_wdm 9-1:1.0: Unknown control protocol [ 250.232239][T11099] Bluetooth: MGMT ver 1.23 [ 250.282243][T11096] can0 (unregistered): slcan off ttyS3. [ 250.286673][ T6040] usb 9-1: USB disconnect, device number 6 [ 250.962883][ T5971] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 250.966256][ T5971] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 250.969402][ T5971] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 250.973427][ T5971] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 250.978542][ T5971] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 251.052907][T11113] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1297'. [ 251.075792][T11109] chnl_net:caif_netlink_parms(): no params data found [ 251.144467][T11109] bridge0: port 1(bridge_slave_0) entered blocking state [ 251.146851][T11109] bridge0: port 1(bridge_slave_0) entered disabled state [ 251.149392][T11109] bridge_slave_0: entered allmulticast mode [ 251.152111][T11109] bridge_slave_0: entered promiscuous mode [ 251.155640][T11109] bridge0: port 2(bridge_slave_1) entered blocking state [ 251.158189][T11109] bridge0: port 2(bridge_slave_1) entered disabled state [ 251.160607][T11109] bridge_slave_1: entered allmulticast mode [ 251.163314][T11109] bridge_slave_1: entered promiscuous mode [ 251.200132][T11109] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 251.205112][T11109] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 251.238259][T11109] team0: Port device team_slave_0 added [ 251.241511][T11109] team0: Port device team_slave_1 added [ 251.277495][T11109] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 251.279943][T11109] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 251.288045][T11109] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 251.292395][T11109] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 251.294771][T11109] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 251.302822][T11109] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 251.346297][T11109] hsr_slave_0: entered promiscuous mode [ 251.349085][T11109] hsr_slave_1: entered promiscuous mode [ 251.351280][T11109] debugfs: 'hsr0' already exists in 'hsr' [ 251.353160][T11109] Cannot create hsr debugfs directory [ 251.498053][T11109] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 251.503230][T11109] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 251.507597][T11109] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 251.514658][T11109] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 251.532667][T11109] bridge0: port 2(bridge_slave_1) entered blocking state [ 251.535024][T11109] bridge0: port 2(bridge_slave_1) entered forwarding state [ 251.537440][T11109] bridge0: port 1(bridge_slave_0) entered blocking state [ 251.539658][T11109] bridge0: port 1(bridge_slave_0) entered forwarding state [ 251.569955][T11109] 8021q: adding VLAN 0 to HW filter on device bond0 [ 251.580439][ T8009] bridge0: port 1(bridge_slave_0) entered disabled state [ 251.583796][ T8009] bridge0: port 2(bridge_slave_1) entered disabled state [ 251.596301][T11109] 8021q: adding VLAN 0 to HW filter on device team0 [ 251.605011][ T8009] bridge0: port 1(bridge_slave_0) entered blocking state [ 251.607933][ T8009] bridge0: port 1(bridge_slave_0) entered forwarding state [ 251.614602][T10927] bridge0: port 2(bridge_slave_1) entered blocking state [ 251.617009][T10927] bridge0: port 2(bridge_slave_1) entered forwarding state [ 251.751601][T11109] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 251.901050][T11137] binder: 11136:11137 ioctl c0306201 800008c0 returned -14 [ 251.909588][T11109] veth0_vlan: entered promiscuous mode [ 251.916269][T11109] veth1_vlan: entered promiscuous mode [ 251.936990][T11109] veth0_macvtap: entered promiscuous mode [ 251.946759][T11109] veth1_macvtap: entered promiscuous mode [ 251.959847][T11109] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 251.968165][T11109] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 251.977100][ T8000] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 251.979991][ T8000] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 251.984842][ T8000] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 251.987632][ T8000] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 252.027052][ T8000] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 252.029558][ T8000] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 252.037102][T11151] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(6) [ 252.039189][T11151] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 252.041317][T10926] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 252.041924][T11151] vhci_hcd vhci_hcd.0: Device attached [ 252.044212][T10926] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 252.056509][T11151] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1299'. [ 252.063322][T11151] futex_wake_op: syz.4.1299 tries to shift op by 144; fix this program [ 252.323695][ T6066] usb 46-1: SetAddress Request (2) to port 0 [ 252.330287][ T6066] usb 46-1: new SuperSpeed USB device number 2 using vhci_hcd [ 253.034761][ T63] Bluetooth: hci3: unexpected event 0x14 length: 20 > 6 [ 253.066085][T11152] vhci_hcd: connection reset by peer [ 253.071572][ T8008] vhci_hcd: stop threads [ 253.072970][ T8008] vhci_hcd: release socket [ 253.075708][ T8008] vhci_hcd: disconnect device [ 253.210540][ T63] Bluetooth: hci3: command tx timeout [ 253.247058][ T40] audit: type=1326 audit(2000000155.140:890): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11169 comm="syz.2.1306" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709e579 code=0x7ffc0000 [ 253.254265][ T40] audit: type=1326 audit(2000000155.140:891): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11169 comm="syz.2.1306" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709e579 code=0x7ffc0000 [ 253.260968][ T40] audit: type=1326 audit(2000000155.150:892): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11169 comm="syz.2.1306" exe="/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf709e579 code=0x7ffc0000 [ 253.268537][ T40] audit: type=1326 audit(2000000155.150:893): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11169 comm="syz.2.1306" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709e579 code=0x7ffc0000 [ 253.275726][ T40] audit: type=1326 audit(2000000155.150:894): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11169 comm="syz.2.1306" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709e579 code=0x7ffc0000 [ 253.283518][ T40] audit: type=1326 audit(2000000155.150:895): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11169 comm="syz.2.1306" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf709e579 code=0x7ffc0000 [ 253.290463][ T40] audit: type=1326 audit(2000000155.150:896): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11169 comm="syz.2.1306" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709e579 code=0x7ffc0000 [ 253.297345][ T40] audit: type=1326 audit(2000000155.150:897): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11169 comm="syz.2.1306" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709e579 code=0x7ffc0000 [ 253.303975][ T40] audit: type=1326 audit(2000000155.150:898): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11169 comm="syz.2.1306" exe="/syz-executor" sig=0 arch=40000003 syscall=370 compat=1 ip=0xf709e579 code=0x7ffc0000 [ 253.310754][ T40] audit: type=1326 audit(2000000155.150:899): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11169 comm="syz.2.1306" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709e579 code=0x7ffc0000 [ 254.583260][ T60] dvb-usb: did not find the firmware file 'dvb-usb-az6027-03.fw' (status -2). You can use /scripts/get_dvb_firmware to get the firmware [ 254.587191][ T6057] dvb-usb: did not find the firmware file 'dvb-usb-az6027-03.fw' (status -110). You can use /scripts/get_dvb_firmware to get the firmware [ 254.589637][ T842] dvb-usb: did not find the firmware file 'dvb-usb-az6027-03.fw' (status -2). You can use /scripts/get_dvb_firmware to get the firmware [ 254.598866][ T842] dvb_usb_az6027 7-1:0.0: probe with driver dvb_usb_az6027 failed with error -2 [ 254.601956][ T60] dvb_usb_az6027 8-1:0.0: probe with driver dvb_usb_az6027 failed with error -2 [ 254.609965][ T842] usb 7-1: USB disconnect, device number 19 [ 254.616659][ T6057] dvb_usb_az6027 6-1:0.0: probe with driver dvb_usb_az6027 failed with error -110 [ 254.627787][ T6057] usb 6-1: USB disconnect, device number 20 [ 254.671386][ T60] usb 8-1: USB disconnect, device number 22 [ 254.891120][T11190] netlink: 'syz.4.1312': attribute type 1 has an invalid length. [ 255.058761][T11198] netlink: 176 bytes leftover after parsing attributes in process `syz.3.1314'. [ 255.166652][ T842] usb 7-1: new high-speed USB device number 20 using dummy_hcd [ 255.337850][ T6019] usb 10-1: new high-speed USB device number 2 using dummy_hcd [ 255.350349][ T842] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 255.353803][ T842] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 255.359246][ T842] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 255.367914][ T842] usb 7-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 255.378692][ T842] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 255.390555][ T842] usb 7-1: config 0 descriptor?? [ 255.433942][ T63] Bluetooth: hci3: command tx timeout [ 255.510680][ T6019] usb 10-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 255.515374][ T6019] usb 10-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 255.519537][ T6019] usb 10-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 255.523192][ T6019] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 255.534439][T11199] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 255.542914][ T6019] usb 10-1: Quirk or no altset; falling back to MIDI 1.0 [ 255.873574][ T842] plantronics 0003:047F:FFFF.0009: hiddev0,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 256.335906][ C1] plantronics 0003:047F:FFFF.0009: hid_field_extract() called with n (132) > 32! (swapper/1) [ 256.543240][T11223] sp0: Synchronizing with TNC [ 256.962743][ T10] usb 8-1: new high-speed USB device number 23 using dummy_hcd [ 257.123083][ T10] usb 8-1: Using ep0 maxpacket: 32 [ 257.126575][ T10] usb 8-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 257.129856][ T10] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 257.133848][ T10] usb 8-1: config 0 descriptor?? [ 257.353334][ T10] dvb-usb: found a 'Elgato EyeTV Sat' in cold state, will try to load a firmware [ 257.357123][ T10] usb 8-1: Direct firmware load for dvb-usb-az6027-03.fw failed with error -2 [ 257.359870][ T10] usb 8-1: Falling back to sysfs fallback for: dvb-usb-az6027-03.fw [ 257.391064][T11148] usb 7-1: reset high-speed USB device number 20 using dummy_hcd [ 257.668403][ T63] Bluetooth: hci3: command tx timeout [ 257.743488][ T6066] usb 46-1: device descriptor read/8, error -110 [ 258.070977][ T8015] usb 10-1: USB disconnect, device number 2 [ 258.164308][ T6066] usb usb46-port1: attempt power cycle [ 258.291997][T11252] can0: slcan on ttyS3. [ 258.342401][T11252] can0 (unregistered): slcan off ttyS3. [ 258.374866][T11246] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1326'. [ 258.378028][T11246] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1326'. [ 258.381452][T11246] netlink: 'syz.5.1326': attribute type 14 has an invalid length. [ 258.544028][ T6040] usb 7-1: USB disconnect, device number 20 [ 258.780640][ T6066] usb usb46-port1: unable to enumerate USB device [ 258.855003][ T6019] usb 10-1: new high-speed USB device number 3 using dummy_hcd [ 259.004833][ T6019] usb 10-1: device descriptor read/64, error -71 [ 259.774369][ T6019] usb 10-1: new high-speed USB device number 4 using dummy_hcd [ 259.881311][ T63] Bluetooth: hci3: command tx timeout [ 259.889051][T11285] can0: slcan on ttyS3. [ 259.958121][T11285] can0 (unregistered): slcan off ttyS3. [ 259.968947][T11286] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 260.095106][ T6019] usb 10-1: device descriptor read/64, error -71 [ 260.100417][T11286] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 260.168061][T11286] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 260.213052][ T6019] usb usb10-port1: attempt power cycle [ 260.252922][T11286] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 260.331945][ T8009] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 260.344083][ T8009] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 260.354834][ T8000] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 260.367625][ T7992] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 260.586919][ T6019] usb 10-1: new high-speed USB device number 5 using dummy_hcd [ 260.609271][ T6019] usb 10-1: device descriptor read/8, error -71 [ 260.864800][ T6019] usb 10-1: new high-speed USB device number 6 using dummy_hcd [ 260.888301][ T6019] usb 10-1: device descriptor read/8, error -71 [ 261.017485][ T6019] usb usb10-port1: unable to enumerate USB device [ 261.449076][T11309] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 261.452455][T11309] block device autoloading is deprecated and will be removed. [ 261.476026][T11309] random: crng reseeded on system resumption [ 261.880892][T11313] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1347'. [ 261.885151][T11313] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1347'. [ 262.006709][T11315] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(11) [ 262.008829][T11315] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 262.011496][T11315] vhci_hcd vhci_hcd.0: Device attached [ 262.029110][T11313] geneve2: entered promiscuous mode [ 262.031299][T11313] geneve2: entered allmulticast mode [ 262.087232][T11318] vhci_hcd: connection closed [ 262.087427][ T7992] vhci_hcd: stop threads [ 262.090075][ T7992] vhci_hcd: release socket [ 262.091400][ T7992] vhci_hcd: disconnect device [ 263.305522][T11329] can0: slcan on ttyS3. [ 263.377606][T11327] can0 (unregistered): slcan off ttyS3. [ 263.383278][T11327] netlink: 156 bytes leftover after parsing attributes in process `syz.4.1349'. [ 263.783462][ T6057] usb 10-1: new high-speed USB device number 7 using dummy_hcd [ 263.933029][ T6057] usb 10-1: device descriptor read/64, error -71 [ 264.064300][T11345] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1356'. [ 264.091197][T11347] netlink: 'syz.3.1357': attribute type 1 has an invalid length. [ 264.202564][ T6057] usb 10-1: new high-speed USB device number 8 using dummy_hcd [ 264.339817][ T6057] usb 10-1: device descriptor read/64, error -71 [ 264.445174][T11358] netlink: 48 bytes leftover after parsing attributes in process `syz.4.1361'. [ 264.457410][ T6057] usb usb10-port1: attempt power cycle [ 264.831038][ T6057] usb 10-1: new high-speed USB device number 9 using dummy_hcd [ 264.865643][ T6057] usb 10-1: device descriptor read/8, error -71 [ 265.141148][ T6057] usb 10-1: new high-speed USB device number 10 using dummy_hcd [ 265.176332][ T6057] usb 10-1: device descriptor read/8, error -71 [ 265.290916][ T6057] usb usb10-port1: unable to enumerate USB device [ 265.380793][T11366] can0: slcan on ttyS3. [ 265.528783][ T1421] ieee802154 phy0 wpan0: encryption failed: -22 [ 265.531141][ T1421] ieee802154 phy1 wpan1: encryption failed: -22 [ 265.632909][ T60] usb 9-1: new high-speed USB device number 7 using dummy_hcd [ 265.795607][ T60] usb 9-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 265.798454][ T60] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 265.801630][ T60] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 265.804528][ T60] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 265.808829][ T60] usb 9-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 265.811946][ T60] usb 9-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 265.814597][ T60] usb 9-1: Product: syz [ 265.815950][ T60] usb 9-1: Manufacturer: syz [ 265.819665][ T60] cdc_wdm 9-1:1.0: skipping garbage [ 265.821350][ T60] cdc_wdm 9-1:1.0: skipping garbage [ 265.823216][ T60] cdc_wdm 9-1:1.0: probe with driver cdc_wdm failed with error -22 [ 266.082268][T11366] can0 (unregistered): slcan off ttyS3. [ 266.087468][ T6066] usb 9-1: USB disconnect, device number 7 [ 266.345707][T11383] pim6reg: entered allmulticast mode [ 266.348819][T11383] pim6reg: left allmulticast mode [ 267.262148][T11403] netlink: 44 bytes leftover after parsing attributes in process `syz.3.1374'. [ 267.958811][T11415] can0: slcan on ttyS3. [ 268.209224][ T6066] usb 9-1: new high-speed USB device number 8 using dummy_hcd [ 268.262715][ T8015] usb 10-1: new high-speed USB device number 11 using dummy_hcd [ 268.370835][ T6066] usb 9-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 268.373586][ T6066] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 268.376572][ T6066] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 268.379245][ T6066] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 268.383600][ T6066] usb 9-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 268.386441][ T6066] usb 9-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 268.388853][ T6066] usb 9-1: Product: syz [ 268.390169][ T6066] usb 9-1: Manufacturer: syz [ 268.395694][ T6066] cdc_wdm 9-1:1.0: skipping garbage [ 268.397349][ T6066] cdc_wdm 9-1:1.0: skipping garbage [ 268.398989][ T6066] cdc_wdm 9-1:1.0: probe with driver cdc_wdm failed with error -22 [ 268.401993][ T8015] usb 10-1: device descriptor read/64, error -71 [ 268.679997][T11415] can0 (unregistered): slcan off ttyS3. [ 268.680051][ T8015] usb 10-1: new high-speed USB device number 12 using dummy_hcd [ 268.685260][ T6040] usb 9-1: USB disconnect, device number 8 [ 268.819304][ T8015] usb 10-1: device descriptor read/64, error -71 [ 268.949927][ T8015] usb usb10-port1: attempt power cycle [ 269.253892][T11423] netlink: 52 bytes leftover after parsing attributes in process `syz.4.1381'. [ 269.256706][T11423] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1381'. [ 269.259629][T11423] netlink: 52 bytes leftover after parsing attributes in process `syz.4.1381'. [ 269.262407][T11423] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1381'. [ 269.265150][T11423] netlink: 52 bytes leftover after parsing attributes in process `syz.4.1381'. [ 269.308999][T11430] netlink: 76 bytes leftover after parsing attributes in process `syz.3.1384'. [ 269.331709][ T8015] usb 10-1: new high-speed USB device number 13 using dummy_hcd [ 269.365910][ T8015] usb 10-1: device descriptor read/8, error -71 [ 269.390831][T11447] netlink: 'syz.3.1388': attribute type 1 has an invalid length. [ 269.393310][T11447] netlink: 244 bytes leftover after parsing attributes in process `syz.3.1388'. [ 269.421795][T11449] can0: slcan on ttyS3. [ 269.631131][ T8015] usb 10-1: new high-speed USB device number 14 using dummy_hcd [ 269.653052][ T8015] usb 10-1: device descriptor read/8, error -71 [ 269.770950][ T8015] usb usb10-port1: unable to enumerate USB device [ 270.425034][ T40] kauditd_printk_skb: 690 callbacks suppressed [ 270.425045][ T40] audit: type=1326 audit(2000000171.211:1590): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11458 comm="syz.4.1393" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf704e579 code=0x0 [ 271.000091][ C2] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 271.362474][T11474] 9pnet_fd: Insufficient options for proto=fd [ 271.397082][T11477] program syz.4.1398 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 271.400832][T11477] ata1.00: non-matching transfer count (2048/0) [ 271.600981][T11487] 0: renamed from geneve1 (while UP) [ 271.908202][T11148] usb 10-1: new high-speed USB device number 15 using dummy_hcd [ 272.057863][T11148] usb 10-1: device descriptor read/64, error -71 [ 272.346497][T11148] usb 10-1: new high-speed USB device number 16 using dummy_hcd [ 272.485447][T11148] usb 10-1: device descriptor read/64, error -71 [ 272.613924][T11148] usb usb10-port1: attempt power cycle [ 272.691069][T11449] can0 (unregistered): slcan off ttyS3. [ 272.977607][T11148] usb 10-1: new high-speed USB device number 17 using dummy_hcd [ 272.999399][T11148] usb 10-1: device descriptor read/8, error -71 [ 273.256056][T11148] usb 10-1: new high-speed USB device number 18 using dummy_hcd [ 273.277308][T11148] usb 10-1: device descriptor read/8, error -71 [ 273.394346][T11148] usb usb10-port1: unable to enumerate USB device [ 274.989723][T11529] can0: slcan on ttyS3. [ 275.243685][ T1465] usb 9-1: new high-speed USB device number 9 using dummy_hcd [ 275.393333][ T1465] usb 9-1: device descriptor read/64, error -71 [ 275.649987][ T1465] usb 9-1: new high-speed USB device number 10 using dummy_hcd [ 275.788971][ T1465] usb 9-1: device descriptor read/64, error -71 [ 275.908176][ T1465] usb usb9-port1: attempt power cycle [ 276.280711][ T1465] usb 9-1: new high-speed USB device number 11 using dummy_hcd [ 276.304138][ T1465] usb 9-1: device descriptor read/8, error -71 [ 276.633665][ T1465] usb 9-1: new high-speed USB device number 12 using dummy_hcd [ 276.666211][ T1465] usb 9-1: device descriptor read/8, error -71 [ 276.794265][ T1465] usb usb9-port1: unable to enumerate USB device [ 277.136010][ T6057] usb 10-1: new high-speed USB device number 19 using dummy_hcd [ 277.277380][ T6057] usb 10-1: device descriptor read/64, error -71 [ 277.542093][ T6057] usb 10-1: new high-speed USB device number 20 using dummy_hcd [ 277.691779][ T6057] usb 10-1: device descriptor read/64, error -71 [ 277.763828][ T5971] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 277.767484][ T5971] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 277.772688][ T5971] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 277.776615][ T5971] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 277.780106][ T5971] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 277.830919][ T6057] usb usb10-port1: attempt power cycle [ 277.883391][T11551] chnl_net:caif_netlink_parms(): no params data found [ 277.944542][T11551] bridge0: port 1(bridge_slave_0) entered blocking state [ 277.946849][T11551] bridge0: port 1(bridge_slave_0) entered disabled state [ 277.949250][T11551] bridge_slave_0: entered allmulticast mode [ 277.951867][T11551] bridge_slave_0: entered promiscuous mode [ 277.955024][T11551] bridge0: port 2(bridge_slave_1) entered blocking state [ 277.957360][T11551] bridge0: port 2(bridge_slave_1) entered disabled state [ 277.959705][T11551] bridge_slave_1: entered allmulticast mode [ 277.962441][T11551] bridge_slave_1: entered promiscuous mode [ 277.994526][T11551] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 278.000417][T11551] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 278.031472][T11551] team0: Port device team_slave_0 added [ 278.035506][T11551] team0: Port device team_slave_1 added [ 278.064451][T11551] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 278.067897][T11551] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 278.075930][T11551] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 278.081080][T11551] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 278.083252][T11551] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 278.092947][T11551] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 278.130239][T11551] hsr_slave_0: entered promiscuous mode [ 278.132485][T11551] hsr_slave_1: entered promiscuous mode [ 278.134528][T11551] debugfs: 'hsr0' already exists in 'hsr' [ 278.136370][T11551] Cannot create hsr debugfs directory [ 278.205691][ T6057] usb 10-1: new high-speed USB device number 21 using dummy_hcd [ 278.227845][ T6057] usb 10-1: device descriptor read/8, error -71 [ 278.249004][T11529] can0 (unregistered): slcan off ttyS3. [ 278.253932][T11551] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 278.260266][T11551] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 278.267459][T11551] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 278.274302][T11551] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 278.300057][T11551] bridge0: port 2(bridge_slave_1) entered blocking state [ 278.302738][T11551] bridge0: port 2(bridge_slave_1) entered forwarding state [ 278.305269][T11551] bridge0: port 1(bridge_slave_0) entered blocking state [ 278.308285][T11551] bridge0: port 1(bridge_slave_0) entered forwarding state [ 278.343758][T11551] 8021q: adding VLAN 0 to HW filter on device bond0 [ 278.353708][T10926] bridge0: port 1(bridge_slave_0) entered disabled state [ 278.359278][T10926] bridge0: port 2(bridge_slave_1) entered disabled state [ 278.372528][T11551] 8021q: adding VLAN 0 to HW filter on device team0 [ 278.382123][ T7992] bridge0: port 1(bridge_slave_0) entered blocking state [ 278.384886][ T7992] bridge0: port 1(bridge_slave_0) entered forwarding state [ 278.390707][ T8008] bridge0: port 2(bridge_slave_1) entered blocking state [ 278.393042][ T8008] bridge0: port 2(bridge_slave_1) entered forwarding state [ 278.482913][ T6057] usb 10-1: new high-speed USB device number 22 using dummy_hcd [ 278.514437][T11551] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 278.516044][ T6057] usb 10-1: device descriptor read/8, error -71 [ 278.632667][ T6057] usb usb10-port1: unable to enumerate USB device [ 278.657746][T11551] veth0_vlan: entered promiscuous mode [ 278.662712][T11551] veth1_vlan: entered promiscuous mode [ 278.676862][T11551] veth0_macvtap: entered promiscuous mode [ 278.682910][T11551] veth1_macvtap: entered promiscuous mode [ 278.693919][T11551] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 278.702232][T11551] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 278.711517][T10927] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 278.714379][T10927] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 278.717468][T10927] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 278.722474][T10927] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 278.757891][T10927] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 278.760527][T10927] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 278.775938][T10927] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 278.778409][T10927] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 279.401788][T11590] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1423'. [ 279.780629][T11601] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1425'. [ 279.783499][T11601] bridge_slave_1: left allmulticast mode [ 279.785376][T11601] bridge_slave_1: left promiscuous mode [ 279.787428][T11601] bridge0: port 2(bridge_slave_1) entered disabled state [ 279.793359][T11601] bridge_slave_0: left allmulticast mode [ 279.795218][T11601] bridge_slave_0: left promiscuous mode [ 279.797363][T11601] bridge0: port 1(bridge_slave_0) entered disabled state [ 279.837403][T11602] netlink: 'syz.4.1425': attribute type 1 has an invalid length. [ 279.840066][T11602] netlink: 224 bytes leftover after parsing attributes in process `syz.4.1425'. [ 279.979806][ T5971] Bluetooth: hci2: command tx timeout [ 280.186678][T11607] can0: slcan on ttyS3. [ 280.292883][T11610] netlink: 24 bytes leftover after parsing attributes in process `syz.6.1428'. [ 280.514148][ T6066] usb 10-1: new high-speed USB device number 23 using dummy_hcd [ 280.653141][ T6066] usb 10-1: device descriptor read/64, error -71 [ 280.909676][ T6066] usb 10-1: new high-speed USB device number 24 using dummy_hcd [ 281.048673][ T6066] usb 10-1: device descriptor read/64, error -71 [ 281.333205][ T6066] usb usb10-port1: attempt power cycle [ 281.647378][ T1465] usb 11-1: new full-speed USB device number 2 using dummy_hcd [ 281.821256][ T1465] usb 11-1: unable to get BOS descriptor or descriptor too short [ 281.825216][ T1465] usb 11-1: not running at top speed; connect to a high speed hub [ 281.829902][ T1465] usb 11-1: config 13 has an invalid interface number: 90 but max is 0 [ 281.833410][ T1465] usb 11-1: config 13 has no interface number 0 [ 281.836179][ T1465] usb 11-1: config 13 interface 90 altsetting 0 has an endpoint descriptor with address 0x9F, changing to 0x8F [ 281.845431][ T1465] usb 11-1: New USB device found, idVendor=0499, idProduct=100d, bcdDevice=81.b7 [ 281.848659][ T1465] usb 11-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 281.851333][ T1465] usb 11-1: Product: syz [ 281.852776][ T1465] usb 11-1: Manufacturer: syz [ 281.854290][ T1465] usb 11-1: SerialNumber: syz [ 282.077506][T11629] sch_tbf: burst 1821 is lower than device lo mtu (65550) ! [ 282.110120][T11631] tipc: Can't bind to reserved service type 1 [ 282.128375][ T6066] usb 10-1: new high-speed USB device number 25 using dummy_hcd [ 282.150648][ T6066] usb 10-1: device descriptor read/8, error -71 [ 282.175828][ T5971] block nbd4: Receive control failed (result -32) [ 282.182991][T11623] block nbd4: shutting down sockets [ 282.184592][T11631] netlink: 'syz.3.1435': attribute type 1 has an invalid length. [ 282.188496][T11631] netlink: 'syz.3.1435': attribute type 1 has an invalid length. [ 282.191310][T11631] netlink: 'syz.3.1435': attribute type 1 has an invalid length. [ 282.194851][T11631] nbd: error processing sock list [ 282.201994][T11631] block nbd0: shutting down sockets [ 282.213979][ T5971] Bluetooth: hci2: command tx timeout [ 282.406360][ T6066] usb 10-1: new high-speed USB device number 26 using dummy_hcd [ 282.436791][ T6066] usb 10-1: device descriptor read/8, error -71 [ 282.556283][ T6066] usb usb10-port1: unable to enumerate USB device [ 282.819788][ T1465] usb 11-1: Quirk or no altset; falling back to MIDI 1.0 [ 282.838175][ T1465] snd-usb-audio 11-1:13.90: probe with driver snd-usb-audio failed with error -2 [ 282.842077][ T1465] usb 11-1: USB disconnect, device number 2 [ 283.457290][T11607] can0 (unregistered): slcan off ttyS3. [ 283.553793][T11656] vlan0: entered promiscuous mode [ 284.438310][ T5971] Bluetooth: hci2: command tx timeout [ 284.455082][T11661] cdrom: dropping to single frame dma [ 284.637354][T11679] loop7: detected capacity change from 0 to 7 [ 284.642323][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 284.645316][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 284.648127][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 284.651099][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 284.661478][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 284.664838][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 284.672205][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 284.676446][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 284.680120][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 284.684085][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 284.692083][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 284.695942][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 284.701789][T11679] ldm_validate_partition_table(): Disk read failed. [ 284.704203][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 284.708005][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 284.713520][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 284.716786][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 284.719731][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 284.722730][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 284.725648][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 284.728827][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 284.731701][T11679] Dev loop7: unable to read RDB block 0 [ 284.736434][T11679] loop7: unable to read partition table [ 284.738687][T11679] loop7: partition table beyond EOD, truncated [ 284.741399][T11679] loop_reread_partitions: partition scan of loop7 () failed (rc=-5) [ 284.864687][T11688] can0: slcan on ttyS3. [ 285.132565][ T60] usb 10-1: new high-speed USB device number 27 using dummy_hcd [ 285.271565][ T60] usb 10-1: device descriptor read/64, error -71 [ 285.528426][ T60] usb 10-1: new high-speed USB device number 28 using dummy_hcd [ 285.688614][ T60] usb 10-1: device descriptor read/64, error -71 [ 285.814037][ T60] usb usb10-port1: attempt power cycle [ 286.192332][ T60] usb 10-1: new high-speed USB device number 29 using dummy_hcd [ 286.232813][ T60] usb 10-1: device descriptor read/8, error -71 [ 286.419083][T11720] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 286.421856][T11720] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 286.501721][ T60] usb 10-1: new high-speed USB device number 30 using dummy_hcd [ 286.522962][ T60] usb 10-1: device descriptor read/8, error -71 [ 286.640850][ T60] usb usb10-port1: unable to enumerate USB device [ 286.650583][ T5971] Bluetooth: hci2: command tx timeout [ 286.671997][ T842] usb 9-1: new high-speed USB device number 13 using dummy_hcd [ 286.832319][ T842] usb 9-1: Using ep0 maxpacket: 16 [ 286.835305][ T842] usb 9-1: config 0 has an invalid interface number: 214 but max is 0 [ 286.837914][ T842] usb 9-1: config 0 has no interface number 0 [ 286.839881][ T842] usb 9-1: config 0 interface 214 altsetting 0 endpoint 0x83 has invalid maxpacket 1023, setting to 64 [ 286.845115][ T842] usb 9-1: New USB device found, idVendor=0596, idProduct=0001, bcdDevice= 5.f5 [ 286.848125][ T842] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 286.850751][ T842] usb 9-1: Product: syz [ 286.852065][ T842] usb 9-1: Manufacturer: syz [ 286.853502][ T842] usb 9-1: SerialNumber: syz [ 286.856615][ T842] usb 9-1: config 0 descriptor?? [ 287.625106][ T842] usbtouchscreen 9-1:0.214: Failed to read FW rev: -71 [ 287.627563][ T842] usbtouchscreen 9-1:0.214: probe with driver usbtouchscreen failed with error -71 [ 287.631741][ T842] usb 9-1: USB disconnect, device number 13 [ 288.138934][T11688] can0 (unregistered): slcan off ttyS3. [ 291.322418][ T1465] usb 11-1: new high-speed USB device number 3 using dummy_hcd [ 291.493365][ T1465] usb 11-1: Using ep0 maxpacket: 32 [ 291.496321][ T1465] usb 11-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 291.499277][ T1465] usb 11-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 291.502954][ T1465] usb 11-1: config 0 descriptor?? [ 291.723021][ T1465] dvb-usb: found a 'Elgato EyeTV Sat' in cold state, will try to load a firmware [ 292.517218][T11878] netlink: 64 bytes leftover after parsing attributes in process `syz.6.1498'. [ 292.741658][T11904] vhci_hcd vhci_hcd.0: pdev(6) rhport(0) sockfd(10) [ 292.743751][T11904] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 292.747490][T11904] vhci_hcd vhci_hcd.0: Device attached [ 292.750988][T11909] vhci_hcd: connection closed [ 292.751186][ T8000] vhci_hcd: stop threads [ 292.755657][ T8000] vhci_hcd: release socket [ 292.758754][ T8000] vhci_hcd: disconnect device [ 293.607069][ T8006] syzkaller0: tun_net_xmit 76 [ 293.609317][ T8006] syzkaller0: tun_net_xmit 48 [ 293.615106][T11934] syzkaller0: create flow: hash 2859670002 index 1 [ 293.631730][ T6066] syzkaller0: tun_net_xmit 76 [ 293.656858][T11933] syzkaller0: delete flow: hash 2859670002 index 1 [ 293.727709][ T6019] usb 9-1: new high-speed USB device number 14 using dummy_hcd [ 293.910608][ T6019] usb 9-1: too many configurations: 9, using maximum allowed: 8 [ 293.913976][ T6019] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 293.916881][ T6019] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 293.920744][ T6019] usb 9-1: config 0 interface 0 has no altsetting 0 [ 293.926556][ T6019] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 293.929402][ T6019] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 293.932787][ T6019] usb 9-1: config 0 interface 0 has no altsetting 0 [ 293.938771][ T6019] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 293.942023][ T6019] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 293.945756][ T6019] usb 9-1: config 0 interface 0 has no altsetting 0 [ 293.949260][ T6019] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 293.960921][ T6019] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 293.964541][ T6019] usb 9-1: config 0 interface 0 has no altsetting 0 [ 293.974641][ T6019] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 293.981924][ T6019] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 293.985398][ T6019] usb 9-1: config 0 interface 0 has no altsetting 0 [ 293.990535][ T6019] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 293.993325][ T6019] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 293.997150][ T6019] usb 9-1: config 0 interface 0 has no altsetting 0 [ 294.000600][ T6019] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 294.003346][ T6019] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 294.006821][ T6019] usb 9-1: config 0 interface 0 has no altsetting 0 [ 294.009964][ T6019] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 294.012709][ T6019] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 294.016445][ T6019] usb 9-1: config 0 interface 0 has no altsetting 0 [ 294.020415][ T6019] usb 9-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 294.023238][ T6019] usb 9-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 294.026198][ T6019] usb 9-1: Product: syz [ 294.028169][ T6019] usb 9-1: Manufacturer: syz [ 294.029642][ T6019] usb 9-1: SerialNumber: syz [ 294.032728][ T6019] usb 9-1: config 0 descriptor?? [ 294.038723][ T6019] yurex 9-1:0.0: USB YUREX device now attached to Yurex #0 [ 294.253622][T11943] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 294.256302][T11943] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 294.263610][ T60] usb 9-1: USB disconnect, device number 14 [ 294.266926][ T60] yurex 9-1:0.0: USB YUREX #0 now disconnected [ 294.510587][T11947] netlink: 240 bytes leftover after parsing attributes in process `syz.6.1514'. [ 294.987501][T11952] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1516'. [ 295.460226][T11976] fuse: Bad value for 'fd' [ 295.461837][T11975] fuse: Bad value for 'fd' [ 295.504659][T11974] bond0: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 295.511272][T11974] bond0: (slave ipvlan2): The slave device specified does not support setting the MAC address [ 295.514780][T11974] bond0: (slave ipvlan2): Error -95 calling set_mac_address [ 295.650301][T11982] fuse: Bad value for 'rootmode' [ 295.742806][T11986] dlm: no local IP address has been set [ 295.746724][T11986] dlm: cannot start dlm midcomms -107 [ 296.080580][T12015] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1535'. [ 296.125742][T12016] netlink: 'syz.3.1535': attribute type 29 has an invalid length. [ 296.509951][T12005] 9pnet_virtio: no channels available for device syz [ 296.799006][T12024] netlink: 32 bytes leftover after parsing attributes in process `syz.5.1537'. [ 297.238177][T12040] vhci_hcd vhci_hcd.0: pdev(6) rhport(0) sockfd(11) [ 297.240340][T12040] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 297.242979][T12040] vhci_hcd vhci_hcd.0: Device attached [ 297.249310][T12040] vhci_hcd vhci_hcd.0: pdev(6) rhport(1) sockfd(15) [ 297.251455][T12040] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 297.254299][T12040] vhci_hcd vhci_hcd.0: Device attached [ 297.260339][T12040] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 297.266099][T12040] vhci_hcd vhci_hcd.0: pdev(6) rhport(0) sockfd(20) [ 297.268700][T12040] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 297.272997][T12040] vhci_hcd vhci_hcd.0: Device attached [ 297.277020][T12040] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 297.286775][T12040] vhci_hcd vhci_hcd.0: pdev(6) rhport(1) sockfd(24) [ 297.289477][T12040] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 297.293693][T12040] vhci_hcd vhci_hcd.0: Device attached [ 297.297226][T12040] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 297.342741][T12047] vhci_hcd: connection closed [ 297.344270][T12041] vhci_hcd: connection closed [ 297.344793][ T75] vhci_hcd: stop threads [ 297.346134][T12045] vhci_hcd: connection closed [ 297.346836][T12043] vhci_hcd: connection closed [ 297.347505][ T75] vhci_hcd: release socket [ 297.354266][ T75] vhci_hcd: disconnect device [ 297.358046][ T75] vhci_hcd: stop threads [ 297.359462][ T75] vhci_hcd: release socket [ 297.360976][ T75] vhci_hcd: disconnect device [ 297.362630][ T75] vhci_hcd: stop threads [ 297.364035][ T75] vhci_hcd: release socket [ 297.365572][ T75] vhci_hcd: disconnect device [ 297.367769][ T75] vhci_hcd: stop threads [ 297.369250][ T75] vhci_hcd: release socket [ 297.370716][ T75] vhci_hcd: disconnect device [ 297.488583][T12058] Bluetooth: hci0: too big key_count value 34945 [ 297.621300][T12069] tmpfs: Bad value for 'mpol' [ 297.905917][T12083] fuse: Unknown parameter 'group_io' [ 297.946346][T12081] device ioctl magic numbers don't match! Did you rebuild pvfs2-client-core/libpvfs2? [cmd 89e0, magic 89 != 6b] [ 300.169905][T12115] netlink: 'syz.5.1560': attribute type 1 has an invalid length. [ 300.172329][T12115] netlink: 220 bytes leftover after parsing attributes in process `syz.5.1560'. [ 300.678315][T12125] IPVS: set_ctl: invalid protocol: 43 224.0.0.1:20002 [ 301.189782][ T63] Bluetooth: hci2: command 0x0405 tx timeout [ 301.483790][ T40] audit: type=1326 audit(2000000200.255:1591): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12129 comm="syz.6.1563" exe="/syz-executor" sig=0 arch=40000003 syscall=20 compat=1 ip=0xf7ff5579 code=0x7ffc0000 [ 301.490748][ T40] audit: type=1326 audit(2000000200.255:1592): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12129 comm="syz.6.1563" exe="/syz-executor" sig=0 arch=40000003 syscall=173 compat=1 ip=0xf7ff55a7 code=0x7ffc0000 [ 301.497221][ T40] audit: type=1326 audit(2000000200.255:1593): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12129 comm="syz.6.1563" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff5579 code=0x7ffc0000 [ 301.505255][ T40] audit: type=1326 audit(2000000200.255:1594): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12129 comm="syz.6.1563" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff5579 code=0x7ffc0000 [ 301.513186][ T40] audit: type=1326 audit(2000000200.255:1595): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12129 comm="syz.6.1563" exe="/syz-executor" sig=0 arch=40000003 syscall=20 compat=1 ip=0xf7ff5579 code=0x7ffc0000 [ 301.521399][ T40] audit: type=1326 audit(2000000200.255:1596): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12129 comm="syz.6.1563" exe="/syz-executor" sig=0 arch=40000003 syscall=173 compat=1 ip=0xf7ff55a7 code=0x7ffc0000 [ 301.530118][ T40] audit: type=1326 audit(2000000200.255:1597): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12129 comm="syz.6.1563" exe="/syz-executor" sig=0 arch=40000003 syscall=20 compat=1 ip=0xf7ff5579 code=0x7ffc0000 [ 301.538907][ T40] audit: type=1326 audit(2000000200.255:1598): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12129 comm="syz.6.1563" exe="/syz-executor" sig=0 arch=40000003 syscall=173 compat=1 ip=0xf7ff55a7 code=0x7ffc0000 [ 301.547042][ T40] audit: type=1326 audit(2000000200.255:1599): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12129 comm="syz.6.1563" exe="/syz-executor" sig=0 arch=40000003 syscall=20 compat=1 ip=0xf7ff5579 code=0x7ffc0000 [ 301.555340][ T40] audit: type=1326 audit(2000000200.255:1600): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12129 comm="syz.6.1563" exe="/syz-executor" sig=0 arch=40000003 syscall=173 compat=1 ip=0xf7ff55a7 code=0x7ffc0000 [ 301.564443][T12132] netlink: 84 bytes leftover after parsing attributes in process `syz.6.1563'. [ 301.855415][T12138] device ioctl magic numbers don't match! Did you rebuild pvfs2-client-core/libpvfs2? [cmd 89e0, magic 89 != 6b] [ 302.208434][T12097] Set syz1 is full, maxelem 65536 reached [ 303.376412][T12173] overlayfs: failed to resolve './file1': -2 [ 303.380222][T12173] overlayfs: failed to resolve './file1': -2 [ 303.731389][T12192] mkiss: ax0: crc mode is auto. [ 303.846982][T12205] netlink: 'syz.6.1581': attribute type 10 has an invalid length. [ 303.855876][T12205] 8021q: adding VLAN 0 to HW filter on device team0 [ 303.861064][T12205] bond0: (slave team0): Enslaving as an active interface with an up link [ 303.868480][T12203] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 303.877267][T12203] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 305.056163][T12249] can0: slcan on ttyS3. [ 305.115297][T12247] netlink: 'syz.6.1591': attribute type 5 has an invalid length. [ 305.124133][ T842] usb 9-1: new high-speed USB device number 15 using dummy_hcd [ 305.181797][T12252] netlink: 24 bytes leftover after parsing attributes in process `syz.6.1594'. [ 305.186418][T12252] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1594'. [ 305.273661][ T842] usb 9-1: device descriptor read/64, error -71 [ 305.327089][ T60] usb 10-1: new high-speed USB device number 31 using dummy_hcd [ 305.510373][ T60] usb 10-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 305.513258][ T60] usb 10-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 305.516777][ T60] usb 10-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 305.519701][ T60] usb 10-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 305.525469][ T60] usb 10-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 305.528426][ T60] usb 10-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 305.531024][ T60] usb 10-1: Product: syz [ 305.532462][ T60] usb 10-1: Manufacturer: syz [ 305.536903][ T60] cdc_wdm 10-1:1.0: probe with driver cdc_wdm failed with error -22 [ 305.551589][ T842] usb 9-1: new high-speed USB device number 16 using dummy_hcd [ 305.690723][ T842] usb 9-1: device descriptor read/64, error -71 [ 305.808571][T12249] can0 (unregistered): slcan off ttyS3. [ 305.813923][ T6019] usb 10-1: USB disconnect, device number 31 [ 305.819557][ T842] usb usb9-port1: attempt power cycle [ 306.182415][ T842] usb 9-1: new high-speed USB device number 17 using dummy_hcd [ 306.225124][ T842] usb 9-1: device descriptor read/8, error -71 [ 306.450367][T12269] device ioctl magic numbers don't match! Did you rebuild pvfs2-client-core/libpvfs2? [cmd 89e0, magic 89 != 6b] [ 306.514651][ T842] usb 9-1: new high-speed USB device number 18 using dummy_hcd [ 306.536705][ T842] usb 9-1: device descriptor read/8, error -71 [ 306.540631][T12279] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 306.567916][T12280] netlink: 'syz.5.1602': attribute type 1 has an invalid length. [ 306.608855][T12279] netlink: 36 bytes leftover after parsing attributes in process `syz.5.1602'. [ 306.664198][ T842] usb usb9-port1: unable to enumerate USB device [ 307.748507][T12302] can0: slcan on ttyS3. [ 308.031827][ T6040] usb 10-1: new high-speed USB device number 32 using dummy_hcd [ 308.113208][T12311] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1610'. [ 308.164497][T12309] device ioctl magic numbers don't match! Did you rebuild pvfs2-client-core/libpvfs2? [cmd 89e0, magic 89 != 6b] [ 308.199387][ T6040] usb 10-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 308.207982][ T6040] usb 10-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 308.218239][ T6040] usb 10-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 308.223849][ T6040] usb 10-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 308.231502][ T6040] usb 10-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 308.237635][ T6040] usb 10-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 308.241396][ T6040] usb 10-1: Product: syz [ 308.243355][ T6040] usb 10-1: Manufacturer: syz [ 308.255825][ T6040] cdc_wdm 10-1:1.0: probe with driver cdc_wdm failed with error -22 [ 308.524406][T12302] can0 (unregistered): slcan off ttyS3. [ 308.530840][ T6040] usb 10-1: USB disconnect, device number 32 [ 309.173519][T12334] program syz.5.1616 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 309.881422][ T6066] usb 9-1: new high-speed USB device number 19 using dummy_hcd [ 309.963406][T12345] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1620'. [ 310.012440][T12346] device ioctl magic numbers don't match! Did you rebuild pvfs2-client-core/libpvfs2? [cmd 89e0, magic 89 != 6b] [ 310.020291][ T6066] usb 9-1: device descriptor read/64, error -71 [ 310.071288][T12349] netlink: 24 bytes leftover after parsing attributes in process `syz.6.1621'. [ 310.077712][T12349] netlink: 16 bytes leftover after parsing attributes in process `syz.6.1621'. [ 310.287549][ T6066] usb 9-1: new high-speed USB device number 20 using dummy_hcd [ 310.437329][ T6066] usb 9-1: device descriptor read/64, error -71 [ 310.565796][ T6066] usb usb9-port1: attempt power cycle [ 310.928893][ T6066] usb 9-1: new high-speed USB device number 21 using dummy_hcd [ 310.950895][ T6066] usb 9-1: device descriptor read/8, error -71 [ 310.980373][T12361] can0: slcan on ttyS3. [ 311.207388][ T6066] usb 9-1: new high-speed USB device number 22 using dummy_hcd [ 311.228926][ T6066] usb 9-1: device descriptor read/8, error -71 [ 311.356939][ T6066] usb usb9-port1: unable to enumerate USB device [ 314.061334][ T60] usb 10-1: new high-speed USB device number 33 using dummy_hcd [ 314.200341][ T60] usb 10-1: device descriptor read/64, error -71 [ 314.467524][ T60] usb 10-1: new high-speed USB device number 34 using dummy_hcd [ 314.510607][T12361] can0 (unregistered): slcan off ttyS3. [ 314.608014][ T60] usb 10-1: device descriptor read/64, error -71 [ 314.642561][T12403] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1635'. [ 314.724336][ T60] usb usb10-port1: attempt power cycle [ 315.087549][ T60] usb 10-1: new high-speed USB device number 35 using dummy_hcd [ 315.234848][T12424] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 315.624188][ T60] usb 10-1: device descriptor read/8, error -71 [ 316.000149][T12434] syz.6.1645 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 316.124547][ T60] usb 10-1: new high-speed USB device number 36 using dummy_hcd [ 316.157570][ T60] usb 10-1: device descriptor read/8, error -71 [ 316.185815][T12441] comedi comedi2: dt2815: I/O port conflict (0x36fc6f39,2) [ 316.191374][T12441] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 316.201913][T12441] CIFS mount error: No usable UNC path provided in device string! [ 316.201913][T12441] [ 316.205195][T12441] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 316.295667][ T60] usb usb10-port1: unable to enumerate USB device [ 316.699431][T12464] device ioctl magic numbers don't match! Did you rebuild pvfs2-client-core/libpvfs2? [cmd 89e0, magic 89 != 6b] [ 317.339877][T12472] netlink: 56 bytes leftover after parsing attributes in process `syz.5.1656'. [ 317.360203][ T12] netdevsim netdevsim5 netdevsim0: set [1, 1] type 2 family 0 port 20000 - 0 [ 317.365023][ T8009] netdevsim netdevsim5 netdevsim1: set [1, 1] type 2 family 0 port 20000 - 0 [ 317.367828][ T8009] netdevsim netdevsim5 netdevsim2: set [1, 1] type 2 family 0 port 20000 - 0 [ 317.370630][ T8009] netdevsim netdevsim5 netdevsim3: set [1, 1] type 2 family 0 port 20000 - 0 [ 317.537126][T12482] netlink: 320 bytes leftover after parsing attributes in process `syz.5.1658'. [ 319.323916][T12496] No control pipe specified [ 319.734608][T12502] fuse: Bad value for 'fd' [ 322.147644][T12521] can0: slcan on ttyS3. [ 322.410659][ T842] usb 10-1: new high-speed USB device number 37 using dummy_hcd [ 322.583442][ T842] usb 10-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 322.586297][ T842] usb 10-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 322.589554][ T842] usb 10-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 322.592482][ T842] usb 10-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 322.598054][ T842] usb 10-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 322.600881][ T842] usb 10-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 322.603459][ T842] usb 10-1: Product: syz [ 322.604807][ T842] usb 10-1: Manufacturer: syz [ 322.608796][ T842] cdc_wdm 10-1:1.0: probe with driver cdc_wdm failed with error -22 [ 322.913138][T12521] can0 (unregistered): slcan off ttyS3. [ 322.926380][ T841] usb 10-1: USB disconnect, device number 37 [ 324.186799][T12530] netlink: 20 bytes leftover after parsing attributes in process `syz.5.1670'. [ 325.737757][ T10] dvb-usb: did not find the firmware file 'dvb-usb-az6027-03.fw' (status -110). You can use /scripts/get_dvb_firmware to get the firmware [ 325.738295][ T1465] dvb-usb: did not find the firmware file 'dvb-usb-az6027-03.fw' (status -2). You can use /scripts/get_dvb_firmware to get the firmware [ 325.742421][ T10] dvb_usb_az6027 8-1:0.0: probe with driver dvb_usb_az6027 failed with error -110 [ 325.749096][ T1465] dvb_usb_az6027 11-1:0.0: probe with driver dvb_usb_az6027 failed with error -2 [ 325.752227][ T10] usb 8-1: USB disconnect, device number 23 [ 325.767957][ T1465] usb 11-1: USB disconnect, device number 3 [ 325.995803][T10927] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 326.041611][T12559] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 326.044432][T12559] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 326.158796][T10927] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 326.164731][T12559] overlay: Unknown parameter '//bus' [ 326.274167][T10927] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 326.351182][T10927] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 326.590282][T10927] dvmrp0 (unregistering): left allmulticast mode [ 326.750994][T10927] bond0 (unregistering): left promiscuous mode [ 326.753539][T10927] bond_slave_0: left promiscuous mode [ 326.756865][T10927] bond_slave_1: left promiscuous mode [ 326.760053][T10927] mac80211_hwsim hwsim5 wlan1: left promiscuous mode [ 326.770026][T10927] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 326.773641][T10927] bond_slave_0: left allmulticast mode [ 326.781970][T10927] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 326.786839][T10927] bond_slave_1: left allmulticast mode [ 326.791551][T10927] bond0 (unregistering): (slave wlan1): Releasing backup interface [ 326.794506][T10927] mac80211_hwsim hwsim5 wlan1: left allmulticast mode [ 326.797178][T10927] bond0 (unregistering): Released all slaves [ 326.808188][T10927] bond1 (unregistering): Released all slaves [ 326.906378][T10927] tipc: Disabling bearer [ 326.913398][T10927] tipc: Left network mode [ 327.199373][T10927] dummy0: left promiscuous mode [ 327.220138][T10927] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 327.228550][T10927] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 327.250605][T10927] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 327.258341][T10927] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 327.535490][T10927] veth1_macvtap: left promiscuous mode [ 327.545111][T10927] veth0_macvtap: left promiscuous mode [ 328.603249][T10927] team0 (unregistering): Port device team_slave_1 removed [ 328.680021][T10927] team0 (unregistering): Port device team_slave_0 removed [ 329.353204][T12600] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 329.645004][T10927] IPVS: stop unused estimator thread 0... [ 329.875508][T12619] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1691'. [ 330.537301][T12626] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(11) [ 330.539461][T12626] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 330.542094][T12626] vhci_hcd vhci_hcd.0: Device attached [ 330.548347][T12629] vhci_hcd: connection closed [ 330.548729][T10926] vhci_hcd: stop threads [ 330.551649][T10926] vhci_hcd: release socket [ 330.553085][T10926] vhci_hcd: disconnect device [ 331.221282][ T1421] ieee802154 phy0 wpan0: encryption failed: -22 [ 332.068094][T12656] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1699'. [ 332.181820][ T842] usb 10-1: new high-speed USB device number 38 using dummy_hcd [ 332.429281][ T842] usb 10-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 332.432595][ T842] usb 10-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 332.436052][ T842] usb 10-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 332.442486][ T842] usb 10-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 332.445658][ T842] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 332.448194][ T842] usb 10-1: Product: syz [ 332.449625][ T842] usb 10-1: Manufacturer: syz [ 332.451098][ T842] usb 10-1: SerialNumber: syz [ 332.455379][ T842] hub 10-1:1.0: bad descriptor, ignoring hub [ 332.457300][ T842] hub 10-1:1.0: probe with driver hub failed with error -5 [ 332.640970][T12639] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 332.680834][ T842] usblp 10-1:1.0: usblp0: USB Unidirectional printer dev 38 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 332.698766][T12659] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 332.956129][T12666] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1703'. [ 332.959230][T12666] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1703'. [ 333.015955][ T842] usb 10-1: USB disconnect, device number 38 [ 333.018921][ T842] usblp0: removed [ 333.077550][T12675] ufs: You didn't specify the type of your ufs filesystem [ 333.077550][T12675] [ 333.077550][T12675] mount -t ufs -o ufstype=sun|sunx86|44bsd|ufs2|5xbsd|old|hp|nextstep|nextstep-cd|openstep ... [ 333.077550][T12675] [ 333.077550][T12675] >>>WARNING<<< Wrong ufstype may corrupt your filesystem, default is ufstype=old [ 333.087921][T12675] ufs: ufstype=old is supported read-only [ 333.092596][T12675] blk_print_req_error: 5 callbacks suppressed [ 333.092650][T12675] I/O error, dev loop13, sector 16 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 333.357823][ T842] usb 10-1: new high-speed USB device number 39 using dummy_hcd [ 333.522780][ T842] usb 10-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 333.526565][ T842] usb 10-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 333.530421][ T842] usb 10-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 333.536966][ T842] usb 10-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 333.540918][ T842] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 333.543510][ T842] usb 10-1: Product: syz [ 333.544842][ T842] usb 10-1: Manufacturer: syz [ 333.546324][ T842] usb 10-1: SerialNumber: syz [ 333.550073][ T842] hub 10-1:1.0: bad descriptor, ignoring hub [ 333.552099][ T842] hub 10-1:1.0: probe with driver hub failed with error -5 [ 333.769730][ T842] usblp 10-1:1.0: usblp0: USB Unidirectional printer dev 39 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 333.807899][ T842] usb 10-1: USB disconnect, device number 39 [ 333.819215][ T842] usblp0: removed [ 333.901180][ T63] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 333.905902][ T63] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 333.908826][ T63] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 333.912638][ T63] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 333.916908][ T63] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 333.952837][T12688] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1709'. [ 333.958826][T12688] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1709'. [ 334.023479][T12681] chnl_net:caif_netlink_parms(): no params data found [ 334.028033][T12692] netlink: 152 bytes leftover after parsing attributes in process `syz.6.1709'. [ 334.037882][T12692] program syz.6.1709 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 334.092282][T12681] bridge0: port 1(bridge_slave_0) entered blocking state [ 334.094576][T12681] bridge0: port 1(bridge_slave_0) entered disabled state [ 334.097049][T12681] bridge_slave_0: entered allmulticast mode [ 334.099843][T12681] bridge_slave_0: entered promiscuous mode [ 334.102951][T12681] bridge0: port 2(bridge_slave_1) entered blocking state [ 334.105210][T12681] bridge0: port 2(bridge_slave_1) entered disabled state [ 334.107506][T12681] bridge_slave_1: entered allmulticast mode [ 334.110052][T12681] bridge_slave_1: entered promiscuous mode [ 334.145357][T12681] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 334.149983][T12681] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 334.184120][T12681] team0: Port device team_slave_0 added [ 334.187426][T12681] team0: Port device team_slave_1 added [ 334.217779][T12681] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 334.219941][T12681] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 334.228673][T12681] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 334.232601][T12681] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 334.234727][T12681] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 334.242444][T12681] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 334.282032][T12681] hsr_slave_0: entered promiscuous mode [ 334.284313][T12681] hsr_slave_1: entered promiscuous mode [ 334.286425][T12681] debugfs: 'hsr0' already exists in 'hsr' [ 334.288392][T12681] Cannot create hsr debugfs directory [ 334.428537][T12702] netdevsim netdevsim5 : renamed from netdevsim0 (while UP) [ 334.456542][T12681] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 334.461895][T12681] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 334.467371][T12681] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 334.471773][T12681] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 334.528259][T12681] 8021q: adding VLAN 0 to HW filter on device bond0 [ 334.553155][T12681] 8021q: adding VLAN 0 to HW filter on device team0 [ 334.561846][ T8006] bridge0: port 1(bridge_slave_0) entered blocking state [ 334.564171][ T8006] bridge0: port 1(bridge_slave_0) entered forwarding state [ 334.573221][ T8006] bridge0: port 2(bridge_slave_1) entered blocking state [ 334.574059][T12710] overlayfs: workdir and upperdir must reside under the same mount [ 334.575465][ T8006] bridge0: port 2(bridge_slave_1) entered forwarding state [ 334.582908][T12710] netlink: 44 bytes leftover after parsing attributes in process `syz.5.1713'. [ 334.586262][T12710] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1713'. [ 334.592981][T12710] bridge0: port 2(bridge_slave_1) entered disabled state [ 334.597197][T12710] bridge0: port 1(bridge_slave_0) entered disabled state [ 334.705759][T12681] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 334.859033][T12681] veth0_vlan: entered promiscuous mode [ 334.864931][T12681] veth1_vlan: entered promiscuous mode [ 334.884921][T12681] veth0_macvtap: entered promiscuous mode [ 334.890776][T12681] veth1_macvtap: entered promiscuous mode [ 334.899588][T12681] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 334.909195][T12681] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 334.914657][ T8008] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 334.918580][ T8008] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 334.922422][ T8008] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 334.925208][ T8008] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 334.982623][ T8008] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 334.992693][ T8008] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 334.995506][T12735] netlink: 91 bytes leftover after parsing attributes in process `syz.4.1717'. [ 335.038698][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 335.041289][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 336.098494][ T63] Bluetooth: hci1: command tx timeout [ 336.205494][T12771] can0: slcan on ttyS3. [ 336.468981][ T6019] usb 9-1: new high-speed USB device number 23 using dummy_hcd [ 336.687247][ T6019] usb 9-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 336.994062][ T6019] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 337.120921][ T6019] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 337.124272][ T6019] usb 9-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 337.131135][ T6019] usb 9-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 337.134369][ T6019] usb 9-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 337.138897][ T6019] usb 9-1: Product: syz [ 337.140386][ T6019] usb 9-1: Manufacturer: syz [ 337.146146][ T6019] cdc_wdm 9-1:1.0: probe with driver cdc_wdm failed with error -22 [ 337.249209][ T10] usb 11-1: new high-speed USB device number 4 using dummy_hcd [ 337.313376][ T7211] usb 10-1: new high-speed USB device number 40 using dummy_hcd [ 337.410033][T12771] can0 (unregistered): slcan off ttyS3. [ 337.410975][ T10] usb 11-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 337.414535][ T10] usb 11-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 337.415373][ T6019] usb 9-1: USB disconnect, device number 23 [ 337.417916][ T10] usb 11-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 337.422764][ T10] usb 11-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 337.429729][ T10] usb 11-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 337.433042][ T10] usb 11-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 337.435640][ T10] usb 11-1: Product: syz [ 337.437015][ T10] usb 11-1: Manufacturer: syz [ 337.445363][ T10] cdc_wdm 11-1:1.0: probe with driver cdc_wdm failed with error -22 [ 337.496636][ T7211] usb 10-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 337.499388][ T7211] usb 10-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 337.502583][ T7211] usb 10-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 337.505484][ T7211] usb 10-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 337.511017][ T7211] usb 10-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 337.513925][ T7211] usb 10-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 337.516573][ T7211] usb 10-1: Product: syz [ 337.518053][ T7211] usb 10-1: Manufacturer: syz [ 337.521980][ T7211] cdc_wdm 10-1:1.0: probe with driver cdc_wdm failed with error -22 [ 337.658921][T12781] FAULT_INJECTION: forcing a failure. [ 337.658921][T12781] name failslab, interval 1, probability 0, space 0, times 0 [ 337.662900][T12781] CPU: 0 UID: 0 PID: 12781 Comm: syz.6.1730 Not tainted syzkaller #0 PREEMPT(full) [ 337.662915][T12781] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 337.662930][T12781] Call Trace: [ 337.662936][T12781] [ 337.662941][T12781] dump_stack_lvl+0x16c/0x1f0 [ 337.662960][T12781] should_fail_ex+0x512/0x640 [ 337.662975][T12781] ? fs_reclaim_acquire+0xae/0x150 [ 337.662992][T12781] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 337.663007][T12781] should_failslab+0xc2/0x120 [ 337.663021][T12781] __kmalloc_noprof+0xd2/0x510 [ 337.663037][T12781] tomoyo_realpath_from_path+0xc2/0x6e0 [ 337.663054][T12781] ? tomoyo_profile+0x47/0x60 [ 337.663064][T12781] tomoyo_path_number_perm+0x245/0x580 [ 337.663077][T12781] ? tomoyo_path_number_perm+0x237/0x580 [ 337.663091][T12781] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 337.663118][T12781] ? find_held_lock+0x2b/0x80 [ 337.663129][T12781] ? hook_file_ioctl_common+0x145/0x410 [ 337.663147][T12781] ? __fget_files+0x20e/0x3c0 [ 337.663161][T12781] security_file_ioctl_compat+0x9b/0x240 [ 337.663176][T12781] __ia32_compat_sys_ioctl+0xc3/0x370 [ 337.663211][T12781] __do_fast_syscall_32+0x7c/0x3a0 [ 337.663228][T12781] do_fast_syscall_32+0x32/0x80 [ 337.663243][T12781] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 337.663257][T12781] RIP: 0023:0xf7ff5579 [ 337.663266][T12781] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 [ 337.663276][T12781] RSP: 002b:00000000f551655c EFLAGS: 00000296 ORIG_RAX: 0000000000000036 [ 337.663287][T12781] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000005437 [ 337.663293][T12781] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 337.663300][T12781] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 337.663306][T12781] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 [ 337.663312][T12781] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 337.663325][T12781] [ 337.663364][T12781] ERROR: Out of memory at tomoyo_realpath_from_path. [ 337.731606][ T6019] usb 11-1: USB disconnect, device number 4 [ 337.736813][T12783] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 337.739603][T12783] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 337.744641][ T7211] usb 10-1: USB disconnect, device number 40 [ 338.318372][ T63] Bluetooth: hci1: command tx timeout [ 338.522044][ T10] usb 9-1: new high-speed USB device number 24 using dummy_hcd [ 338.683253][ T10] usb 9-1: Using ep0 maxpacket: 8 [ 338.686358][ T10] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 338.689658][ T10] usb 9-1: config 0 has no interfaces? [ 338.693453][ T10] usb 9-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 338.696203][ T10] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 338.698553][ T10] usb 9-1: Product: syz [ 338.699854][ T10] usb 9-1: Manufacturer: syz [ 338.701271][ T10] usb 9-1: SerialNumber: syz [ 338.784338][ T10] usb 9-1: config 0 descriptor?? [ 338.784404][T12816] /dev/sg0: Can't lookup blockdev [ 338.821665][T12821] bridge0: port 2(bridge_slave_1) entered disabled state [ 338.824094][T12821] bridge0: port 1(bridge_slave_0) entered disabled state [ 338.999475][T12821] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 339.006770][T12821] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 339.056933][T12794] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 339.061698][T12794] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 339.153372][ T8009] netdevsim netdevsim7 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 339.156619][ T8009] netdevsim netdevsim7 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 339.159792][ T8009] netdevsim netdevsim7 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 339.165451][ T8009] netdevsim netdevsim7 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 339.686741][T12832] can0: slcan on ttyS3. [ 339.838677][ T10] usb 9-1: USB disconnect, device number 24 [ 339.923299][T12835] 9pnet_virtio: no channels available for device syz [ 339.943252][ T6040] usb 12-1: new high-speed USB device number 2 using dummy_hcd [ 340.142465][ T6040] usb 12-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 340.145259][ T6040] usb 12-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 340.148481][ T6040] usb 12-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 340.151241][ T6040] usb 12-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 340.167918][ T6040] usb 12-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 340.170820][ T6040] usb 12-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 340.173303][ T6040] usb 12-1: Product: syz [ 340.174667][ T6040] usb 12-1: Manufacturer: syz [ 340.194831][ T6040] cdc_wdm 12-1:1.0: probe with driver cdc_wdm failed with error -22 [ 340.470268][T12832] can0 (unregistered): slcan off ttyS3. [ 340.497449][ T6040] usb 12-1: USB disconnect, device number 2 [ 340.542069][ T63] Bluetooth: hci1: command tx timeout [ 340.659089][T12856] vhci_hcd vhci_hcd.0: pdev(6) rhport(0) sockfd(11) [ 340.661316][T12856] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 340.664671][T12856] vhci_hcd vhci_hcd.0: Device attached [ 340.756219][T12859] vhci_hcd: connection closed [ 340.758956][ T8008] vhci_hcd: stop threads [ 340.762044][ T8008] vhci_hcd: release socket [ 340.763470][ T8008] vhci_hcd: disconnect device [ 342.381793][T12880] overlayfs: failed to resolve './file1': -2 [ 342.628686][T12880] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 342.631235][T12880] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 342.641836][T12880] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 342.650529][T12880] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 342.658147][T12880] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 342.705311][T12880] Oops: general protection fault, probably for non-canonical address 0xdffffc000000000b: 0000 [#1] SMP KASAN NOPTI [ 342.710286][T12880] KASAN: null-ptr-deref in range [0x0000000000000058-0x000000000000005f] [ 342.715412][T12880] CPU: 2 UID: 0 PID: 12880 Comm: syz.6.1754 Not tainted syzkaller #0 PREEMPT(full) [ 342.719127][T12880] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 342.723524][T12880] RIP: 0010:klist_put+0x4d/0x1b0 [ 342.725609][T12880] Code: c1 ea 03 80 3c 02 00 0f 85 5f 01 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 23 49 83 e4 fe 49 8d 7c 24 58 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 2e 01 00 00 4c 89 e7 4d 8b 74 24 58 e8 8c 3e 0d [ 342.733585][T12880] RSP: 0018:ffffc90003a7f2f0 EFLAGS: 00010202 [ 342.736158][T12880] RAX: dffffc0000000000 RBX: ffff88805bcd4460 RCX: ffffc900275f1000 [ 342.739422][T12880] RDX: 000000000000000b RSI: ffffffff8b861035 RDI: 0000000000000058 [ 342.742685][T12880] RBP: 0000000000000001 R08: 0000000000000000 R09: fffffbfff211ceec [ 342.745832][T12880] R10: ffffffff908e7763 R11: 000000000000001e R12: 0000000000000000 [ 342.748298][T12880] R13: 0000000000000001 R14: 1ffff9200074fe66 R15: ffffffff908e7720 [ 342.750790][T12880] FS: 0000000000000000(0000) GS:ffff8880976c3000(0063) knlGS:00000000f54f5b40 [ 342.753533][T12880] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 342.755709][T12880] CR2: 000000000c2dd6b2 CR3: 0000000056885000 CR4: 0000000000352ef0 [ 342.758441][T12880] Call Trace: [ 342.759548][T12880] [ 342.760508][T12880] klist_remove+0x13f/0x2e0 [ 342.761974][T12880] ? kobject_move+0x15d/0x260 [ 342.763490][T12880] ? __pfx_klist_remove+0x10/0x10 [ 342.765268][T12880] ? __pfx_kobject_move+0x10/0x10 [ 342.767164][T12880] ? get_device_parent+0x1ed/0x4e0 [ 342.768823][T12880] device_move+0x12d/0x10d0 [ 342.770282][T12880] hci_conn_del_sysfs+0x81/0x180 [ 342.771891][T12880] hci_conn_del+0x5b3/0xe70 [ 342.773346][T12880] hci_abort_conn_sync+0x76a/0xb20 [ 342.775043][T12880] ? __pfx_hci_abort_conn_sync+0x10/0x10 [ 342.776848][T12880] ? find_held_lock+0x2b/0x80 [ 342.778357][T12880] ? hci_disconnect_all_sync.constprop.0+0x77/0x3c0 [ 342.780452][T12880] ? hci_disconnect_all_sync.constprop.0+0x77/0x3c0 [ 342.782537][T12880] hci_disconnect_all_sync.constprop.0+0x104/0x3c0 [ 342.784638][T12880] hci_suspend_sync+0x821/0xb20 [ 342.786233][T12880] ? __pfx_enable_work+0x10/0x10 [ 342.787823][T12880] ? __pfx_hci_suspend_sync+0x10/0x10 [ 342.789577][T12880] hci_suspend_dev+0x308/0x500 [ 342.791108][T12880] ? __pfx_hci_suspend_dev+0x10/0x10 [ 342.792794][T12880] ? rcu_barrier+0x341/0x6e0 [ 342.794277][T12880] ? kobject_get+0xbb/0x150 [ 342.795800][T12880] hci_suspend_notifier+0x28d/0x2f0 [ 342.797444][T12880] notifier_call_chain+0xbc/0x410 [ 342.799039][T12880] ? __pfx_hci_suspend_notifier+0x10/0x10 [ 342.800827][T12880] blocking_notifier_call_chain_robust+0xc8/0x160 [ 342.802845][T12880] ? __pfx_blocking_notifier_call_chain_robust+0x10/0x10 [ 342.805114][T12880] ? do_raw_spin_unlock+0x172/0x230 [ 342.806767][T12880] pm_notifier_call_chain_robust+0x27/0x60 [ 342.808645][T12880] snapshot_open+0x189/0x2b0 [ 342.810126][T12880] ? __pfx_snapshot_open+0x10/0x10 [ 342.811766][T12880] misc_open+0x35a/0x420 [ 342.813121][T12880] ? __pfx_misc_open+0x10/0x10 [ 342.814678][T12880] chrdev_open+0x234/0x6a0 [ 342.816151][T12880] ? __pfx_apparmor_file_open+0x10/0x10 [ 342.817893][T12880] ? __pfx_chrdev_open+0x10/0x10 [ 342.819468][T12880] ? fsnotify_open_perm_and_set_mode+0x17c/0xa60 [ 342.821451][T12880] do_dentry_open+0x982/0x1530 [ 342.822979][T12880] ? __pfx_chrdev_open+0x10/0x10 [ 342.824429][T12880] vfs_open+0x82/0x3f0 [ 342.825763][T12880] path_openat+0x1de4/0x2cb0 [ 342.827213][T12880] ? __pfx_path_openat+0x10/0x10 [ 342.828873][T12880] ? __lock_acquire+0xb97/0x1ce0 [ 342.830481][T12880] do_filp_open+0x20b/0x470 [ 342.832049][T12880] ? __pfx_do_filp_open+0x10/0x10 [ 342.833675][T12880] ? _raw_spin_unlock+0x28/0x50 [ 342.835283][T12880] ? alloc_fd+0x471/0x7d0 [ 342.836624][T12880] do_sys_openat2+0x11b/0x1d0 [ 342.838173][T12880] ? __pfx_do_sys_openat2+0x10/0x10 [ 342.839858][T12880] ? fput+0x9b/0xd0 [ 342.841104][T12880] ? __sys_sendmsg+0x18c/0x220 [ 342.842652][T12880] __ia32_compat_sys_openat+0x16d/0x210 [ 342.844432][T12880] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 342.846384][T12880] ? rcu_is_watching+0x12/0xc0 [ 342.847938][T12880] __do_fast_syscall_32+0x7c/0x3a0 [ 342.849592][T12880] do_fast_syscall_32+0x32/0x80 [ 342.851163][T12880] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 342.853165][T12880] RIP: 0023:0xf7ff5579 [ 342.854473][T12880] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 [ 342.860540][T12880] RSP: 002b:00000000f54f555c EFLAGS: 00000296 ORIG_RAX: 0000000000000127 [ 342.863097][T12880] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000680 [ 342.865618][T12880] RDX: 0000000000040000 RSI: 0000000000000019 RDI: 0000000000000000 [ 342.868009][T12880] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 342.870508][T12880] R10: 0000000000000000 R11: 0000000000000296 R12: 0000000000000000 [ 342.873000][T12880] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 342.875551][T12880] [ 342.876549][T12880] Modules linked in: [ 342.877871][ C2] vkms_vblank_simulate: vblank timer overrun [ 342.879137][ T5971] Bluetooth: hci1: command tx timeout [ 342.880172][T12880] ---[ end trace 0000000000000000 ]--- SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 342.891443][T12880] RIP: 0010:klist_put+0x4d/0x1b0 [ 342.893670][T12880] Code: c1 ea 03 80 3c 02 00 0f 85 5f 01 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 23 49 83 e4 fe 49 8d 7c 24 58 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 2e 01 00 00 4c 89 e7 4d 8b 74 24 58 e8 8c 3e 0d [ 342.911318][T12880] RSP: 0018:ffffc90003a7f2f0 EFLAGS: 00010202 [ 342.913381][T12880] RAX: dffffc0000000000 RBX: ffff88805bcd4460 RCX: ffffc900275f1000 [ 342.916760][T12880] RDX: 000000000000000b RSI: ffffffff8b861035 RDI: 0000000000000058 [ 342.920206][T12880] RBP: 0000000000000001 R08: 0000000000000000 R09: fffffbfff211ceec [ 342.925954][T12880] R10: ffffffff908e7763 R11: 000000000000001e R12: 0000000000000000 [ 342.939281][T12880] R13: 0000000000000001 R14: 1ffff9200074fe66 R15: ffffffff908e7720 [ 342.968294][T12880] FS: 0000000000000000(0000) GS:ffff8880976c3000(0063) knlGS:00000000f54f5b40 [ 342.992965][T12880] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 343.017441][T12880] CR2: 00000000f54d4ba8 CR3: 0000000056885000 CR4: 0000000000352ef0 [ 343.043703][T12880] Kernel panic - not syncing: Fatal exception [ 343.047001][T12880] Kernel Offset: disabled [ 343.048896][T12880] Rebooting in 86400 seconds.. VM DIAGNOSIS: 11:36:42 Registers: info registers vcpu 0 CPU#0 RAX=0000000000000000 RBX=ffffc90006807b60 RCX=0000000000000000 RDX=0000000000000000 RSI=ffffffff85151a94 RDI=ffffc90006807b60 RBP=ffffc90006807b20 RSP=ffffc90006807a80 R8 =0000000000000001 R9 =0000000000000000 R10=0000000000000001 R11=0000000000000000 R12=0000000000000000 R13=ffffc90006807b60 R14=ffffc90006807b28 R15=0000000000000000 RIP=ffffffff85151abd RFL=00000046 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] FS =0000 0000000000000000 ffffffff 00c00000 GS =0063 ffff8880974c3000 ffffffff 00d0f300 DPL=3 DS [-WA] LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=000000008081a000 CR3=000000004f6e4000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00000000000000ff ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 4e4f4954504f5f4e 4153410063657865 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 1 CPU#1 RAX=0000000000000000 RBX=ffff88802b441d60 RCX=ffffffff81af11e1 RDX=ffff888022634880 RSI=ffffffff81af11bb RDI=0000000000000005 RBP=0000000000000003 RSP=ffffc9000497f888 R8 =0000000000000005 R9 =0000000000000000 R10=0000000000000001 R11=0000000000000001 R12=dffffc0000000000 R13=ffffed10056883ad R14=0000000000000001 R15=0000000000000002 RIP=ffffffff81af11bd RFL=00000293 [--S-A-C] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff8880975c3000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe000004a000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00000000350f9ffc CR3=000000000e380000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00000000000000ff ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 4e4f4954504f5f4e 4153410063657865 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 2 CPU#2 RAX=0000000000000030 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff85617045 RDI=ffffffff9b0f9700 RBP=ffffffff9b0f96c0 RSP=ffffc90003a7ecf0 R8 =0000000000000001 R9 =000000000000001f R10=0000000000000000 R11=000000004153414b R12=0000000000000000 R13=0000000000000030 R14=ffffffff9b0f96c0 R15=ffffffff85616fe0 RIP=ffffffff8561706f RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] FS =0000 0000000000000000 ffffffff 00c00000 GS =0063 ffff8880976c3000 ffffffff 00d0f300 DPL=3 DS [-WA] LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000091000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe000008f000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=000000000c2dd6b2 CR3=0000000056885000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00000000000000ff ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 4e4f4954504f5f4e 4153410063657865 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 3 CPU#3 RAX=0000000000499b0c RBX=0000000000000003 RCX=ffffffff8b90abf9 RDX=ffffed10056a6656 RSI=ffffffff8c162c80 RDI=ffffffff8190ccb1 RBP=ffffed1003863000 RSP=ffffc9000048fdf8 R8 =0000000000000000 R9 =ffffed10056a6655 R10=ffff88802b5332ab R11=ffffffff9b0aa0d0 R12=0000000000000003 R13=ffff88801c318000 R14=ffffffff90ab8290 R15=0000000000000000 RIP=ffffffff8b90975f RFL=00000286 [--S--P-] CPL=0 II=0 A20=1 SMM=0 HLT=1 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff8880977c3000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe00000d8000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe00000d6000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=0000000080005000 CR3=000000004a1b5000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00000000000000ff ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 4e4f4954504f5f4e 4153410063657865 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000