last executing test programs: 9m42.087642302s ago: executing program 4 (id=133): pipe2$watch_queue(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) prlimit64(0x0, 0xb, &(0x7f0000000000)={0x0, 0x5}, 0x0) r1 = gettid() socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r2, 0x5452, &(0x7f0000b28000)=0x3) fcntl$setsig(r2, 0xa, 0x12) poll(&(0x7f0000b2c000)=[{r3}], 0x2c, 0xffffffffffbffff8) dup2(r2, r3) fcntl$setown(r2, 0x8, r1) tkill(r1, 0x13) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$wireguard(0x0, 0xffffffffffffffff) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000600)={{{@in6=@loopback, @in6=@ipv4={""/10, ""/2, @initdev}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in6}}, &(0x7f00000000c0)=0xe8) setfsuid(r4) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, 0x0, 0x108) symlink(&(0x7f0000000040)='.\x00', &(0x7f0000000100)='./bus\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000400)=ANY=[@ANYBLOB=' \x00\x00\x00-\x00'], 0x20}}, 0x84) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r6, 0x1) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={0x0}, 0x18) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() socketpair$unix(0x1, 0x5, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r7 = syz_open_dev$MSR(&(0x7f00000001c0), 0x3, 0x0) read$msr(r7, &(0x7f0000019680)=""/102392, 0x18ff8) 9m41.091766509s ago: executing program 4 (id=137): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240), &(0x7f0000000000), 0x86, r0}, 0x38) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000001600)={r0, &(0x7f0000000580), &(0x7f0000000540)=""/96}, 0x20) r1 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r1, 0x0, 0x0) r2 = syz_open_dev$media(&(0x7f00000006c0), 0x2c29, 0x28004) fstat(r0, &(0x7f00000004c0)) ioctl$MEDIA_IOC_REQUEST_ALLOC(r2, 0x80047c05, &(0x7f0000000940)=0xffffffffffffffff) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, 0x0) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r3, 0x7c81, 0x0) syz_open_dev$MSR(&(0x7f00000000c0), 0x0, 0x0) syz_open_dev$hiddev(&(0x7f0000000100), 0xc, 0x101841) keyctl$set_reqkey_keyring(0xe, 0x2) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={0x0, 0x44}}, 0x4004880) 9m40.877099051s ago: executing program 4 (id=141): r0 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r1 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_VIF(r1, 0x0, 0x5, &(0x7f0000000240)={0x2, 0x0, 0x0, 0x0, @vifc_lcl_ifindex, @remote}, 0x10) setsockopt$MRT_INIT(r1, 0x0, 0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x3a) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x42c, @private1={0xfc, 0x1, '\x00', 0x1}, 0x9}, 0x1c) socket$nl_generic(0x10, 0x3, 0x10) syz_io_uring_setup(0x82e, &(0x7f0000000300)={0x0, 0x0, 0x10100}, 0x0, 0x0) syz_usb_connect(0x2, 0x24, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000011620140480b05101e8c000000010902120001000000000904"], 0x0) syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) socket$xdp(0x2c, 0x3, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) openat$nvram(0xffffffffffffff9c, &(0x7f00000001c0), 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe020010850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0xff, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_open_procfs(0x0, &(0x7f0000000000)='smaps\x00') syz_open_dev$cec(&(0x7f0000000000), 0x0, 0x82002) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r3, 0xc, 0x5, 0x1}) writev(r3, &(0x7f00000000c0)=[{&(0x7f0000000080), 0xfffffebe}], 0x1) 9m40.637371674s ago: executing program 2 (id=145): syz_usb_connect(0x0, 0x2d, &(0x7f00000003c0)=ANY=[@ANYBLOB="120100003a62db102c0a080025b40102030109021b0001000000000905c2000196760000090508002000001d07"], 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) r2 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x10, 0x0}}]}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000001080)=0x8) setsockopt$inet_sctp6_SCTP_RESET_ASSOC(r1, 0x84, 0x78, &(0x7f0000000000)=r4, 0x4) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000006c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast2, @in=@empty, 0x0, 0x0, 0x0, 0x400, 0xa, 0x0, 0x0, 0x29}, {0x0, 0x0, 0x7, 0x0, 0x0, 0x2, 0xffffffffffffffff}, {0x0, 0x40, 0x0, 0xffffffffffffffff}, 0x40000}}, 0xb8}}, 0xc844) r5 = socket(0x10, 0x803, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000280)={'batadv_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56741, 0x1, 0x25dfdbfc, {0x0, 0x0, 0x0, r7, {0x0, 0xf}, {0xffff, 0xffff}, {0x3}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x21}}]}}]}, 0x48}}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x20}, {}, {0x0, 0x0, 0x0, 0xfffffffffffffffe}}}, 0xb8}}, 0x0) syz_usb_connect(0x1, 0x373, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002394916103a0968249a1f0102030109026103020b81b0100904a90402b88c450309050f1f20000102030905090410000b062507250101ff010009041b660c56b7db02092104000301220c060905801000040107209523509eb1d9e3c4c6153afd465ad4de0a4de5d3c5027ac4b1252513d9ac9c1d054d98acf10fd1da0976a33cfa5e92ccdc1fcb96c60178879aab1e362bbcb820674921386b415abee2299f7e183710aadaf24df3ab79a55ed9a11c1cca5cbe95b572f35c06ea3a5dc6d1a032266cd48cd49b622882fb445e6be1d32cc2832a1dd23e83b300e764ea9742df346a422d019866f3967609050801100000f4410725f880d602000725010004000409050f000002080301d823b7bbcba95a558657d2f9ee91de30bb8f246c0adb7d11e1989294a334a631aa634e34bb6967f6c074a9a2e2dfcfe187bdd6f9af4cd9e1369109c7a5b6abde1c4b1998a9f6daad2a3fe8f5bfd32531f0b961997e85de2c4f5606c4dedbd657f2fe381a894f1f5b05802e0a3da5040000483c30c7a683c9fcc54af216a523b9a2253f28fd9222bfbfd2e0a3d99023f41efabfffac6a06ef3d2a71a29a6fadc87c38b4cb3e1cdd7334f4ecfa32a03cac0c3a9523febb6131de0e44e8dab25b171f55e2ce3e954e7d77995dff835315a69bf551cbcccc16951a457175d5eef6934650960ad0fb239fff02609314634a6b376509050d02f703060305090504004000ec6005072501800501000725010308040009050f00000408ff090905030008003b060909050601100004069d480584f4e2b76aa1bdd078bbf8c9e15680d82ac612240a4f80177c3c81332b718892a7e25ccf534fc388350aacc161c4bd3419082ce6ed83c93d9cacfd574081faffb58a30441f800905030010000c090607250102081000c603359f85fe9773e93c2cad9d7354713602dbefbd666168dfaf0cb9d363f32fc1d0e0052899c8bf017f4a848100fc98accf65e35a072128c0fe44409acbb4158e56408907e295450a1398fe6931ce9b1222765328a92d194e7429b708127099ad26faf1c9375bc82fa291e0c438a76cdedde715091ae4906ba096db4e45fa97f11abc142d660b82b1de3488a7c41ddf498d607ca2595fd15a044b9fd3e9c5be8e113ebd42eede1ba2d83a05ca5cae9aec30c2f87c2104de629d70c96faf2c2ba14eb5a74ce109050e014000100205090503004000e0050c090504014000080507"], &(0x7f0000000540)={0xa, &(0x7f0000000380)={0xa, 0x6, 0x310, 0x7, 0xfa, 0x7, 0x8, 0x40}, 0x5, &(0x7f0000000880)=ANY=[@ANYBLOB="050f05000037c27ff4ee43ba64ab02496eeb71ed6fd2429d3e987d82ef3101dbfee581c22878f6673f5c0ef1f08f3c04e03f32faa00155e758a16b923c213a0acd1522e6e50d31e2c75e"], 0x1, [{0xdc, &(0x7f0000000440)=@string={0xdc, 0x3, "b8673d2cf8c369d1b60125e50535e009c044a8a17b0fdb01c245944efb13f2237e8b96b48678f7448f95e3ccb9733b93fc4cbd9adf65a8737621b4fcd4aec92153fc76ee100e8b30836f552b42aa55909e3a92aceb6c26fcbaaed2cfe7a12c1fa479943ffac31eb9b6d2c0b8ed4f53ef1d1d0e3750c410973e76b5978ab3e51329630df045d76e4139b45d1982baa767695390b85d2481742aa64d4a338020fc9ac8016e04a67e86e8631a60b3c311adda92028881a9385f13d9e71046f93c4fd9fc7b4a05854b74cbcaae28f1468a48552391d6df22f86c15b6"}}]}) syz_usb_connect$cdc_ncm(0x3, 0xa5, &(0x7f0000000580)={{0x12, 0x1, 0x300, 0x2, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x93, 0x2, 0x1, 0x8, 0x40, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xa}, {0x5, 0x24, 0x0, 0xffff}, {0xd, 0x24, 0xf, 0x1, 0x8, 0x4, 0x5, 0x71}, {0x6, 0x24, 0x1a, 0x800, 0x2}, [@mdlm={0x15, 0x24, 0x12, 0x1000}, @mdlm={0x15}, @mbim_extended={0x8, 0x24, 0x1c, 0x6, 0x0, 0x1000}]}, {{0x9, 0x5, 0x81, 0x3, 0x200, 0xf3, 0x15, 0x3}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x327d421508383856, 0xb, 0x3, 0x6}}, {{0x9, 0x5, 0x3, 0x2, 0x258, 0x42, 0x2, 0x9}}}}}}}]}}, &(0x7f0000000a40)={0xa, &(0x7f0000000640)={0xa, 0x6, 0x110, 0x2, 0x9, 0x2, 0x10, 0x9}, 0x145, &(0x7f0000000680)={0x5, 0xf, 0x145, 0x6, [@ss_container_id={0x14, 0x10, 0x4, 0x1, "5ed11d36f6b1b0630890c569b0b328d4"}, @ss_container_id={0xffffffffffffff8d, 0x10, 0x4, 0x1, "1176370c17fdce3e60aa31945373ca48"}, @wireless={0xb, 0x10, 0x1, 0x2, 0x2, 0xf, 0x1, 0x6, 0xc}, @ss_cap={0x0, 0x10, 0x3, 0x0, 0x6, 0x9, 0x4, 0x100}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x8, 0x9, 0x4, 0x3}, @generic={0xf3, 0x10, 0x4, "7a2006f256ad0e4a236d84ec75d8a5a86320d808e137f27c9bf90638878a87690e878a04f010fdfe5c54a2a07fe4cf435ba98ffc2070315d820172580c2756fb4bf216f0322ba5a29370456e989dfe6673c7e0228a5ab4189d4deca27f9d41ddc57f4169d685773edca5ec47df9d4c118bbd371b1d0533f5b8b25c18e45a605de72023e58ed5acf51a2d24f660a3ef14f7337a55d85499a04c998d0f75672547e3c03f3b66ca2235d6b39cff094f70bd3e152836af28a05b8980de89dbd9a5db715ad707ff05e82bc2b6c74ac38f52bf95b319dcd4675da9f3c7e625de663c10731b16c126b9c4069b56347126948f39"}]}, 0x5, [{0x4, &(0x7f00000007c0)=@lang_id={0x4, 0x3, 0x4c0a}}, {0x4, &(0x7f0000000900)=@lang_id={0x4, 0x3, 0x40a}}, {0x4, &(0x7f0000000940)=@lang_id={0x4, 0x3, 0x448}}, {0x4, &(0x7f00000009c0)=@lang_id={0x4, 0x3, 0x81d}}, {0x4, &(0x7f0000000a00)=@lang_id={0x4, 0x3, 0x81a}}]}) pipe2$watch_queue(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r8, 0x84, 0x7b, &(0x7f0000000800)={r3}, 0x8) ioctl$TCXONC(r8, 0x540a, 0x1) 9m39.486100244s ago: executing program 2 (id=147): openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) socket$kcm(0x2, 0xa, 0x2) socket(0x10, 0x3, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000780)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000bc00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b704000000000400850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000340)={{r0, 0xffffffffffffffff}, &(0x7f00000001c0), &(0x7f0000000300)=r1}, 0x20) r3 = socket$inet_udplite(0x2, 0x2, 0x88) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000004c0)={r2, &(0x7f0000000040), &(0x7f0000000040)=@udp=r3, 0x1}, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r1, 0x5, 0xe, 0x0, &(0x7f00000003c0)="000000000000010100000001e370", 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x20}, 0x50) 9m38.957991302s ago: executing program 2 (id=151): r0 = socket$nl_generic(0x10, 0x3, 0x10) prctl$PR_SET_MM_EXE_FILE(0x39, 0xd, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) sendmsg$netlink(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)=ANY=[@ANYBLOB="1c0000002d003f00000000000000000005008d80050011802e"], 0x1c}], 0x1, 0x0, 0x0, 0x24040041}, 0x300) 9m38.163103978s ago: executing program 2 (id=152): socket$nl_generic(0x10, 0x3, 0x10) socket$inet6(0xa, 0x800000000000002, 0x0) socket$phonet_pipe(0x23, 0x5, 0x2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfffffffffffffebe}, 0x90) r0 = syz_io_uring_setup(0x24fd, &(0x7f0000000b80)={0x0, 0xfffffffd, 0x10100, 0xfffffffc, 0x33a}, 0x0, &(0x7f0000000040)=0x0) sendmsg$IPSET_CMD_TYPE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='8'], 0x38}}, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000180)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r2, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x21, 0x0, @fd=r2, 0xe5, {}, 0x1, 0x4, 0x1}) io_uring_enter(r0, 0x2d3e, 0x0, 0x0, 0x0, 0x0) 9m38.147310501s ago: executing program 4 (id=153): mkdir(&(0x7f0000000040)='./file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000000), 0xfffffffffffffdf9, &(0x7f00000000c0)={[{@index_on}, {@volatile}], [], 0x2c}) 9m37.766694376s ago: executing program 4 (id=156): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000480), r0) sendmsg$IEEE802154_LLSEC_GETPARAMS(r0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000500)={0x20, r1, 0x1, 0x4, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x20}, 0x1, 0x0, 0x3000000, 0x24000000}, 0x40000) 9m37.608415797s ago: executing program 2 (id=158): socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x90) r0 = syz_io_uring_setup(0x1458, &(0x7f00000004c0)={0x0, 0x3, 0x10180, 0x2000, 0x3ae}, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) sendmsg$IPSET_CMD_TYPE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB='9'], 0x38}}, 0x4000) socket$inet_smc(0x2b, 0x1, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r3, &(0x7f0000000180)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r3, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITEV={0x2, 0x9, 0x4004, @fd, 0x7925, 0x0, 0x0, 0x18, 0x1, {0x3}}) r4 = syz_open_dev$sndctrl(&(0x7f0000000600), 0x0, 0x8801) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r4, 0xc1105517, &(0x7f0000001340)={{0x0, 0x0, 0x0, 0x8, 'syz0\x00'}, 0x3, 0x0, 0x8, 0x0, 0x3, 0x0, 'syz1\x00', &(0x7f0000000180)=['\x00', '-[\'\x00', 'r\x0e\x81|\x0f\xa3\x8a\xb9\x8c\x94\x04\x17\v\rh\x10'], 0xc15c}) io_uring_enter(r0, 0x2d3e, 0xfffffffd, 0x0, 0x0, 0x0) 9m36.659718974s ago: executing program 32 (id=160): prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x898e0000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x400000000000041, 0x0) recvmsg(r1, &(0x7f00000001c0)={&(0x7f0000000240)=@ethernet={0x0, @local}, 0x80, &(0x7f0000000780)=[{&(0x7f00000002c0)=""/91, 0x5b}, {&(0x7f0000000340)=""/213, 0xd5}, {&(0x7f0000000c40)=""/4096, 0x1000}, {&(0x7f0000000440)=""/151, 0x97}, {&(0x7f0000000500)=""/202, 0xca}, {&(0x7f0000000600)=""/184, 0xb8}, {&(0x7f00000006c0)=""/183, 0xb7}], 0x7}, 0x10000) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket(0x2c, 0x3, 0xffffffff) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r3, &(0x7f0000000bc0)=[{&(0x7f0000000c00)="6e80000000000100000000000000000000000c812b3e15a4a16f9874c94d1a20a6e5ebd8b1c39b0bd4374167ff128e02061915a3d62755f3", 0x38}], 0x1, 0xb) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) mq_timedreceive(0xffffffffffffffff, 0x0, 0x0, 0x20000000, 0x0) getpeername$packet(r3, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000180)=0x14) r4 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_int(r4, 0x0, 0x3, &(0x7f0000000080)=0xfffffffa, 0x4) connect$inet(r4, &(0x7f0000000040)={0x2, 0x3, @multicast1}, 0x10) splice(r2, 0x0, r4, 0x0, 0x7ffd, 0x0) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000100)) r5 = getegid() setfsgid(r5) 9m36.349946908s ago: executing program 33 (id=162): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xd, 0x400009, 0x8, 0xa}, 0x0) syz_open_dev$media(0x0, 0x80, 0x101d01) socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet_udp(0x2, 0x2, 0x0) creat(&(0x7f0000000040)='./bus\x00', 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='blkio.bfq.time_recursive\x00', 0x275a, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r2, 0x10e, 0xc, &(0x7f0000000040)=0x7f, 0x4) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="240000001a0001000000ff7f0000000080000000", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\b\x00', @ANYRES32=r2], 0x24}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./file1\x00', 0x0, 0x0) fcntl$setlease(r4, 0x400, 0x1) fcntl$setlease(r4, 0x400, 0x1) sendmsg$nl_netfilter(r3, 0x0, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) r5 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) ioctl$SNDCTL_DSP_SPEED(r5, 0xc0045002, &(0x7f0000000040)=0x10000) socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=@newlink={0x44, 0x10, 0x44b, 0x0, 0x25dfdbfe, {0x7a, 0x0, 0x0, 0x0, 0x40000}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @gretap={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GRE_TOS={0x5, 0x9, 0x40}, @IFLA_GRE_PMTUDISC={0x5}]}}}]}, 0x44}}, 0x0) semget$private(0x0, 0x1, 0x5db) listen(0xffffffffffffffff, 0x2) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) 9m36.340723374s ago: executing program 2 (id=163): r0 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r1 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_VIF(r1, 0x0, 0x5, &(0x7f0000000240)={0x2, 0x0, 0x0, 0x0, @vifc_lcl_ifindex, @remote}, 0x10) setsockopt$MRT_INIT(r1, 0x0, 0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x3a) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x42c, @private1={0xfc, 0x1, '\x00', 0x1}, 0x9}, 0x1c) socket$nl_generic(0x10, 0x3, 0x10) syz_io_uring_setup(0x82e, &(0x7f0000000300)={0x0, 0x0, 0x10100}, 0x0, 0x0) syz_usb_connect(0x2, 0x24, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000011620140480b05101e8c000000010902120001000000000904"], 0x0) syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) socket$xdp(0x2c, 0x3, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) openat$nvram(0xffffffffffffff9c, &(0x7f00000001c0), 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe020010850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0xff, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_open_procfs(0x0, &(0x7f0000000000)='smaps\x00') syz_open_dev$cec(&(0x7f0000000000), 0x0, 0x82002) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r3, 0xc, 0x5, 0x1}) writev(r3, &(0x7f00000000c0)=[{&(0x7f0000000080), 0xfffffebe}], 0x1) 9m36.33872688s ago: executing program 34 (id=163): r0 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r1 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_VIF(r1, 0x0, 0x5, &(0x7f0000000240)={0x2, 0x0, 0x0, 0x0, @vifc_lcl_ifindex, @remote}, 0x10) setsockopt$MRT_INIT(r1, 0x0, 0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x3a) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x42c, @private1={0xfc, 0x1, '\x00', 0x1}, 0x9}, 0x1c) socket$nl_generic(0x10, 0x3, 0x10) syz_io_uring_setup(0x82e, &(0x7f0000000300)={0x0, 0x0, 0x10100}, 0x0, 0x0) syz_usb_connect(0x2, 0x24, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000011620140480b05101e8c000000010902120001000000000904"], 0x0) syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) socket$xdp(0x2c, 0x3, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) openat$nvram(0xffffffffffffff9c, &(0x7f00000001c0), 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe020010850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0xff, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_open_procfs(0x0, &(0x7f0000000000)='smaps\x00') syz_open_dev$cec(&(0x7f0000000000), 0x0, 0x82002) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r3, 0xc, 0x5, 0x1}) writev(r3, &(0x7f00000000c0)=[{&(0x7f0000000080), 0xfffffebe}], 0x1) 9m36.32125362s ago: executing program 4 (id=164): memfd_create(&(0x7f0000000400)='\x01\fD\xd1\x1e\x803\x00\x00\xbf\xecs \xc5\xb55nVg\x1b\xa3\x8a\xcc\xf2!PmENs\xe5\x83Uz\xc0W\xc1\xcc\x97\xd1\x8e\x81\n\xc0\xb3Ac\xfe(\x00\x13\xaeZ\x8bp\x1e\xdc\x18\xddf\xe9\xe1\t\bR) \xa9P9(\xe1-q \xb3\x80\xb9\xdfj\xed\xc2_o\xa6\x04\xf5\x9f\x04\xf1\xd5\xe3\xfa\xfd\x161\x13r\xc49\x80\x86\x1a\xbf\xf8H\xe8Cc\x84\xa6y\xb7\xbe\xf5\xcc\xc9Z\x9f\xa6\xcbX\x891\xed\a\xf9\xa6\xd8\xd0\x03\x00\x00\x00\x00\x00\x00\x00\']\by\xb5\xbcI\xbf\xacw\xda\xed\xf0^\xd35\xeb=\xc7\x82;\xb32;\xc5\xa3\xc8\xb9\xf2\xe5\xf4\x93[\x91F\x83?\xfe\xd9\x7ffvQ\xff\xc0\x8f\xe4\xb8\xa3\xbf\xceAT\x17\xc6\x81\xc0m}O\xfd\xe0\x05$\xcd\xfdkMu\x9bQ\xd8z\xe0\xd6\xe2\xbe\xf4\xd5\x16\x94\xe0\xbf0\xde\xcaS/\xf7\xeb\x89bmX0\x94T\x10\x9dx@\xce:]\xb68\xa2W\xcb\x86\b#s\xb4q6\xe88\x19\x1a\x14Z\xf3\xd7\x92\xe4bT\x02\x00\x10r\x9b~n`m:]#\x989\xc3psjO\x80n\\\xb9\x9b\xeami\xd1\x9cSL\xb6\x87\t\x9bg\xd3\xcf\xc0F\x8c\x9b\x12O\xac`\xb4\x94IH\xb0\xcd\xe9eC\xb1\x8d{\x19\xde\x19\x8e\xb5l\xa6\x1e\r)j\xec\x02\x19SM\xa6\xcf\xb9b)\xe7\xa8\x03~{\xc5\x9b\xa8I\x19j\xa5g\x877Xa\x91\x144\x064w\xc1\xe7J)\xean\xfd\xc6\xa5Y\x84\x82U\xdc\x1bQ\xd54\x01\x98\x88\xc8\xce\x94\xf8d\x9c\xba\x1e\xf3o\x87\xbc\xbaL\x87\b<\xb8o\xc8nd\xe0\xea-5P\xa0\xc7\x18\xdb\\O\xb8xT\xa1', 0x0) timerfd_create(0x0, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f00000007c0)=ANY=[@ANYBLOB, @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000030000008500000084000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000140)='sys_enter\x00', r1}, 0x10) pselect6(0x40, &(0x7f00000001c0)={0x2, 0x0, 0x3, 0xfffffffffffffffd, 0x3, 0x0, 0x0, 0xe}, 0x0, &(0x7f0000000300)={0x3ff, 0x7ef, 0x800000000000000, 0x9, 0x4, 0x0, 0x7fffffff, 0x3f8}, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x100000400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$netlink(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000005d00)=ANY=[@ANYBLOB="140100002d00010000000000fcdbdf250401f280080018000bac0f"], 0x114}], 0x1, 0x0, 0x0, 0x1}, 0x0) ioctl$F2FS_IOC_RESERVE_COMPRESS_BLOCKS(r2, 0x8008f513, &(0x7f0000000080)) socket$nl_netfilter(0x10, 0x3, 0xc) 9m36.313664624s ago: executing program 35 (id=164): memfd_create(&(0x7f0000000400)='\x01\fD\xd1\x1e\x803\x00\x00\xbf\xecs \xc5\xb55nVg\x1b\xa3\x8a\xcc\xf2!PmENs\xe5\x83Uz\xc0W\xc1\xcc\x97\xd1\x8e\x81\n\xc0\xb3Ac\xfe(\x00\x13\xaeZ\x8bp\x1e\xdc\x18\xddf\xe9\xe1\t\bR) \xa9P9(\xe1-q \xb3\x80\xb9\xdfj\xed\xc2_o\xa6\x04\xf5\x9f\x04\xf1\xd5\xe3\xfa\xfd\x161\x13r\xc49\x80\x86\x1a\xbf\xf8H\xe8Cc\x84\xa6y\xb7\xbe\xf5\xcc\xc9Z\x9f\xa6\xcbX\x891\xed\a\xf9\xa6\xd8\xd0\x03\x00\x00\x00\x00\x00\x00\x00\']\by\xb5\xbcI\xbf\xacw\xda\xed\xf0^\xd35\xeb=\xc7\x82;\xb32;\xc5\xa3\xc8\xb9\xf2\xe5\xf4\x93[\x91F\x83?\xfe\xd9\x7ffvQ\xff\xc0\x8f\xe4\xb8\xa3\xbf\xceAT\x17\xc6\x81\xc0m}O\xfd\xe0\x05$\xcd\xfdkMu\x9bQ\xd8z\xe0\xd6\xe2\xbe\xf4\xd5\x16\x94\xe0\xbf0\xde\xcaS/\xf7\xeb\x89bmX0\x94T\x10\x9dx@\xce:]\xb68\xa2W\xcb\x86\b#s\xb4q6\xe88\x19\x1a\x14Z\xf3\xd7\x92\xe4bT\x02\x00\x10r\x9b~n`m:]#\x989\xc3psjO\x80n\\\xb9\x9b\xeami\xd1\x9cSL\xb6\x87\t\x9bg\xd3\xcf\xc0F\x8c\x9b\x12O\xac`\xb4\x94IH\xb0\xcd\xe9eC\xb1\x8d{\x19\xde\x19\x8e\xb5l\xa6\x1e\r)j\xec\x02\x19SM\xa6\xcf\xb9b)\xe7\xa8\x03~{\xc5\x9b\xa8I\x19j\xa5g\x877Xa\x91\x144\x064w\xc1\xe7J)\xean\xfd\xc6\xa5Y\x84\x82U\xdc\x1bQ\xd54\x01\x98\x88\xc8\xce\x94\xf8d\x9c\xba\x1e\xf3o\x87\xbc\xbaL\x87\b<\xb8o\xc8nd\xe0\xea-5P\xa0\xc7\x18\xdb\\O\xb8xT\xa1', 0x0) timerfd_create(0x0, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f00000007c0)=ANY=[@ANYBLOB, @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000030000008500000084000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000140)='sys_enter\x00', r1}, 0x10) pselect6(0x40, &(0x7f00000001c0)={0x2, 0x0, 0x3, 0xfffffffffffffffd, 0x3, 0x0, 0x0, 0xe}, 0x0, &(0x7f0000000300)={0x3ff, 0x7ef, 0x800000000000000, 0x9, 0x4, 0x0, 0x7fffffff, 0x3f8}, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x100000400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$netlink(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000005d00)=ANY=[@ANYBLOB="140100002d00010000000000fcdbdf250401f280080018000bac0f"], 0x114}], 0x1, 0x0, 0x0, 0x1}, 0x0) ioctl$F2FS_IOC_RESERVE_COMPRESS_BLOCKS(r2, 0x8008f513, &(0x7f0000000080)) socket$nl_netfilter(0x10, 0x3, 0xc) 2m45.791524359s ago: executing program 7 (id=1736): r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYBLOB="5400000012000103feffffff000000000000000000000000000000000000000000ebe4edc600000000000000000000000000000000000000db4b310dfd2d22cc227d"], 0x54}}, 0x0) capset(&(0x7f0000000000)={0x20071026}, &(0x7f0000000040)={0x200000, 0x200003, 0x0, 0x0, 0x7, 0x3}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), r0) 2m45.598842312s ago: executing program 7 (id=1737): r0 = semget(0x0, 0x0, 0x428) semctl$GETALL(r0, 0x0, 0xd, &(0x7f0000000000)=""/4096) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mknod(&(0x7f0000000540)='./file1\x00', 0x0, 0x0) stat(&(0x7f0000000100)='./file1\x00', &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setuid(r3) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f00000002c0)=ANY=[@ANYBLOB="b7000000010003c3bfa30000000000000703000020feffff720af0fff8ffffff71a4f0ff0000000065040200000000ff2d400500000000003400000001ed00007b030000000000001d440000000000007a0a00fe00ffffffdb03000000000000b5000000000000009500000000000000023bc065b78111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168e51815548000000000000000275daf51efd601b6bf01c8e8b1b526375ee4dd6fcd82e4fee5bef7af9aa0d7f300c095199fe3ff3128e599b0eaebbdbd732c9cc00eec36574a8f6456e2ccae25ea21714eca8cf5d803e04d83b46e21557c0afc646cb7790b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2400000000000000800643a98d9ec21ead2ed51b104d4d91af25b845b9f75dd08d123deda8ebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987af1714e72ba7616536fd9aa58f2477184b6a89adaf17b0baf587aef370a2d426a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe7226a40409d6e37c4f46756d31cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d64364c82770c8204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee7d26b34381fcb59b854e9d5a17f4720082f13d000000225d85ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67051d355d84ce97bb0c6b4a595e487efbb2d71cde2c10f0bc6980fe78683ac5c0c31032599ddd71063be9261eee52216d009f4c52048ef8c126aeef5f510a8f1aded94a129e4aec6e8d9ab06faffc3a15d96c2ea3e2e04cfe031b287539d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d38df9ba60248d9a0d61282dfb15eb6841bb64a1b3045024a982f3c48153baae2c4e7bf37548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c3560811ea6c3560a43364d402ccdd9069bd50b994fd6a34ee18022a579dfc0229cc0dc9881610270928eaeb883418f562ae00003ea96d10f172c0374d6eed826407000000000000004a9c5a90ff59d54d1f92ecc48899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f5c0b000000000000eedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea52acb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d851680f6f2f9a6a8906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f4ca2195234648e0a1ca50db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa19faf67256b56a41fd355b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145eb6dc5f6a9037d2283c42efc54fa84323a3304f41ff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538c6ee6ba65893ff1f928ba7554ba583fef3ec7932f5954f31a878e2fae6691df8b4b7ecd27ce82f7df3e7d1daac43738612e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d6d0355f3be6135425f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e96753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e96735600000554f327a353511ccedde99493c31ac05a7b57f03ca91a01ba2c60ca99e8ebc15ecb4d91675767999d146aef7799738b292fd64bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d40460780000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120968308c31db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd0000000069ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c204bbec8d722824c0ebca8db1ea4a003fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9e0600f86909bc90addb7b9aee813df534aac4b32fd691b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a000000000000000000000000000006acc19808d7cf29bc974b0ea92499a419aa095e203c1bafbb9b9a7c2bca3f0a18ee4952f2d325a56390578f12205db653a536f0100e0eda300a43a13bd1b9f3322405d1efd78e578dc6b3fb84f3738a4b6caa84feda91f3edb32231ec75300000000000087efa51c5d95ecba4e50e529d1e8c89600e809dc3d0a2f65579e23457949a50f2d0455cf79a43746979f99f6a1527f004f1e37a3926937e84fb478199dc1020f4beb98b88b5e7885e9a617aa6c8e10d4202c5afeb06e2f9115558ea12f92d7ae630b8234fb46351f5d7d68f93d44086b3f03b20d546fa66a72e38207c9d20035ab63de71a30f1240de52536941242d23896ab74a3c6670fdc49c14f34fc4eadd6db8d80eba439772bf60a1db1829f1a57d3f18f4edaeb5d37918e6fddcd821da67a0785585a4443440dc65600e64a6a2744c46570e8f46da1ab990ca053cbfe801000000000000000000000000000000d55d7182af2ea5f8d0ad495e3eb9421963a5a683c3dcb2d300aa3b2cfe946d2348c35f5d67d68ac07c8f84b3679e77c2e629ecec7c12c35d6b6971b8ae13cc00956d2227db60c0a461ed2b3ecfb16d19037c8c88c91dda1f904fbbc864e95ad43d6dd6d5eadbcea25682ba4b91e14c3fbfdfd1d680aa1af102d97681656bf56ff0674237ce097d39008cc3257778de878bcd37467386f993be6d20c93a7791e7f2a155ce379b4cda2500108052aeb9bd03ff6d4c5dbda9ff485d6576a492d436d52edcd420e7deaa4343a0add3941ae7c5f58af43866ca64750f43e583ca1ceb3a805e46beef9dca77a4edcbb42aa0caf0bbd6cec72d85540293cb4849b0610800000000000000000000000000000000f9814d5f6c8673c143ff2f901e71b8818665b56f7a03afe3d900007656859db4cb06aaaf9f02cfab5b9e61cc00e8e19429921b8df4c4c53bddea4cc48737842952ff08aeac15685df194ca89da8cf6d29a2be9779181fd5d105af5786094d9130f5826b18b9667b971a994f3fd069629a1052f441e96884f90c91f4a974242aabfc8adbadc9ca27955b5c90f0bd9a46ed044272383d3768871a9c8cfd7948aea445c55684351002ed4a4af45341de8e5e1f33624bd2ec1591dd00bbe05000000f89a928662e9b9449db34394fc5e946fadaee576e28ac0feab4e3585ed43d206218f524083840a78b7236bb7f5e42b5376642f8ad4028d4ead407240e7467d1b37afe20690d7672c7e926fded95cf805516ad836eb730619a05af36fb28329d6feb33219cc9164461a8ba3afd5949b9a6046c53663df30a049414089c1ae8f3476236b05dde8dda4843a62c591f8d2b1a62d0db8dc826219bd87398b33e140792297d023ef52de2e75b9dbbfb8712ccc15c69cfb4c6c1bc2ae74621e536b9d3f09a15dada1561a8192d65cc59d7ed5a6bd61000000000000000000000000000000000000000000000000000000000000000000000000f637782e317d492b2392fd0ea81397a80227f271bad21d688af35a2bd02c15d20f3d62a50e20260642c25f304c8034a5f4d8e45e701dbd84294d1096e715662b8223e10e98c4c38451fc5c702084e3fa9b184e0d0fba44acf3bb8a846cf680dfbf312cddfdb2043288fa6b67fa762c8b75d4478756ef240f2b314e4d77a3afb4fcec92248327004d1dac7ac87a6f8cb04d82acc307d60e4713bd9a8f29091d3048c669a5f5439e0a906ce098d177b9579882586511cfe6a23e57c44d1654899f077b5636e4181f3de6b814bedcac5290ad8018bbe4424edc6d9b0e61b404bb7a2d4883bbc200de8332029cbc04a0bc52fa83bac200c486555ac097239cbab397527d1a861f13ecbe58245a06e3aeddf0768889a16b53d63c8af48030f16350259147edc7854bf6f8d0a9bb3391eded5c61a80fc008777fce152934970530672aa97794d4de4b596c9f3dd095286d4012d440213ae73ebe95e3c92cb3787d426963f2295df0e7be334af7822036d20cade5d0808fc19759959bb9e2789c37d7249510671873b650408ad814f0c8e287e5687b88a8c51c6ef3cb61a8cab9c6"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffd00}, 0x48) r7 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x44, 0x0, 0x0) setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x1, &(0x7f0000000300)=0xfff, 0x4) ioctl$KVM_RUN(r7, 0xae80, 0x0) semctl$GETVAL(r0, 0x4, 0xc, &(0x7f0000001000)=""/103) syz_open_dev$tty1(0xc, 0x4, 0x2) r8 = socket$inet_smc(0x2b, 0x1, 0x0) shutdown(r8, 0x1) 2m44.331515921s ago: executing program 7 (id=1740): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000007c0)=ANY=[@ANYBLOB="fc0000001900010027bd7000ffffffffac1414bb000000000000000000000000ac1414aa00000000000000000000000000030000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000000feffffffffff01000000000000000000020000000000000000000000000000000039059e4dc90b0c71ffffffffffffff0000000000000000000000000000000000000000004b00000000000000000000550000fffffffffffffffa020000000044000800ac1414bb00000000000000000000000000000000320000000000000020010000000000000000000000000000fdffffff020000000000000000000000ffffffff"], 0xfc}, 0x1, 0x0, 0x0, 0x8081}, 0x800) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r2 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0x7b, &(0x7f0000000000)=@assoc_value, &(0x7f0000000080)=0x8) r3 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r3, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r3, &(0x7f0000001c00)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)=""/69, 0x45}, 0xd50d}], 0x1, 0x822b, 0x0) umount2(0x0, 0x20) setsockopt$inet6_int(r3, 0x29, 0x4a, &(0x7f0000000040)=0x7, 0x4) setsockopt$inet6_int(r3, 0x29, 0x4d, &(0x7f0000000180)=0x8, 0x4) r4 = socket$inet6(0xa, 0x80000, 0xd) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f0000000180)={{0x12, 0x1, 0x0, 0xee, 0xf, 0xf5, 0x40, 0x1199, 0xb000, 0xe538, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x2, 0xda, 0x86, 0x71, 0x0, [], [{{0x9, 0x5, 0x6, 0x2}}, {{0x9, 0x5, 0x82, 0x2}}]}}]}}]}}, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, 0x0) sendto$inet6(r4, 0x0, 0x0, 0x2409c8c1, &(0x7f0000000240)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) sendto$inet6(r4, &(0x7f0000001400), 0x0, 0x0, 0x0, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a68000000060a09040000000000000000020000000900010073797a30000000000900020073797a32000000003c000480380001800b00010064796e73657400002800028009000100"], 0x90}}, 0x0) 2m40.965637348s ago: executing program 7 (id=1751): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000ddffffff850000002d00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000340)={'veth0_virt_wifi\x00', 0x2000}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) getsockopt$sock_cred(r2, 0x1, 0x11, 0xffffffffffffffff, &(0x7f00000004c0)) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000300)='sched_switch\x00', r0}, 0x10) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x19, 0x1, 0x70bd2a, 0x0, {{@in=@dev={0xac, 0x14, 0x14, 0x2c}, @in6=@local, 0x4e22, 0x0, 0x4e24, 0x7, 0xa, 0x0, 0x60}, {0x0, 0xffffffff, 0xfffffffffffffffe, 0x40000000, 0x0, 0x1a, 0x4, 0xfffffffffffffff6}, {0x77, 0x5, 0x0, 0x95}, 0x8, 0x0, 0x1}}, 0xb8}}, 0xc0e1ed0507c55408) connect$inet6(r3, &(0x7f0000000240)={0xa, 0x4e22, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x3}, 0x1c) sendto$inet6(r3, 0x0, 0x0, 0x200000c1, &(0x7f00000000c0)={0xa, 0x4e1d, 0xff, @remote}, 0x18) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x5, &(0x7f0000000700)=ANY=[@ANYBLOB="18020000fffd3fff0000000000000000850000004100000085000000d000000095"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r5, 0x11, 0x2100, 0x0, &(0x7f0000000100), 0x0, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x100) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f00000005c0)=ANY=[@ANYBLOB="b40500000000000079108f0000000000070000000000000095000000000000000637f79d237f"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x22e, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='devtmpfs\x00', 0x0, 0x0) syz_open_dev$video4linux(&(0x7f0000000500), 0x20, 0x400) ioctl$VIDIOC_SUBDEV_S_CROP(0xffffffffffffffff, 0xc038563c, &(0x7f0000000100)={0x1, 0x0, {0x6, 0x291e57e5, 0x2, 0x3}}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r6 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r6, &(0x7f0000002700)=""/102392, 0x18ff8) openat(0xffffffffffffff9c, 0x0, 0xc0042, 0x1fe) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r7 = gettid() process_vm_writev(r7, &(0x7f0000000000)=[{&(0x7f00008f9f09)=""/247, 0xf7}], 0x1, &(0x7f0000121000)=[{&(0x7f0000217f28)=""/231, 0xffffff4e}], 0x23a, 0x0) 2m40.185814794s ago: executing program 7 (id=1754): bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xc, 0x16, &(0x7f0000000240)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000080000003d0301000000000095000000000000006926000000000000bf67000000000000570600000fff07006706000002000000070600000ee60000bf150000000000003d650000000000006507000002000000070700004c0000001f750000000000006154000000000000070400000400f9ffad43010000000000950000000000000005000000000000009500000000000000"], &(0x7f0000000100)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0xffffffffffffff28}, 0x48) keyctl$instantiate_iov(0x14, 0x0, &(0x7f0000003580)=[{0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0xffffffffffffffff}], 0x9, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000000)=@ieee802154={0x24, @long}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000080)=""/51, 0x33}, {&(0x7f0000000140)=""/122, 0x7a}], 0x2, &(0x7f0000000300)=""/141, 0x8d}, 0x100) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000100)=""/33, 0x21) sendmsg$NFNL_MSG_ACCT_DEL(r0, &(0x7f0000000440)={&(0x7f0000000200), 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x40, 0x3, 0x7, 0x801, 0x0, 0x0, {0x2, 0x0, 0x5}, [@NFACCT_PKTS={0xc, 0x2, 0x1, 0x0, 0x890}, @NFACCT_FLAGS={0x8}, @NFACCT_QUOTA={0xc, 0x6, 0x1, 0x0, 0x81}, @NFACCT_BYTES={0xc, 0x3, 0x1, 0x0, 0x800}]}, 0x40}, 0x1, 0x0, 0x0, 0x81}, 0x400c860) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xc, 0x16, &(0x7f0000000240)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000080000003d0301000000000095000000000000006926000000000000bf67000000000000570600000fff07006706000002000000070600000ee60000bf150000000000003d650000000000006507000002000000070700004c0000001f750000000000006154000000000000070400000400f9ffad43010000000000950000000000000005000000000000009500000000000000"], &(0x7f0000000100)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0xffffffffffffff28}, 0x48) (async) keyctl$instantiate_iov(0x14, 0x0, &(0x7f0000003580)=[{0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0xffffffffffffffff}], 0x9, 0x0) (async) recvmsg(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000000)=@ieee802154={0x24, @long}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000080)=""/51, 0x33}, {&(0x7f0000000140)=""/122, 0x7a}], 0x2, &(0x7f0000000300)=""/141, 0x8d}, 0x100) (async) openat(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x0, 0x0) (async) getdents64(r0, &(0x7f0000000100)=""/33, 0x21) (async) sendmsg$NFNL_MSG_ACCT_DEL(r0, &(0x7f0000000440)={&(0x7f0000000200), 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x40, 0x3, 0x7, 0x801, 0x0, 0x0, {0x2, 0x0, 0x5}, [@NFACCT_PKTS={0xc, 0x2, 0x1, 0x0, 0x890}, @NFACCT_FLAGS={0x8}, @NFACCT_QUOTA={0xc, 0x6, 0x1, 0x0, 0x81}, @NFACCT_BYTES={0xc, 0x3, 0x1, 0x0, 0x800}]}, 0x40}, 0x1, 0x0, 0x0, 0x81}, 0x400c860) (async) 2m39.842932751s ago: executing program 7 (id=1757): fanotify_init(0x2972bf0627f51a4a, 0x2) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000740)=@newlink={0x80, 0x10, 0x403, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x74, 0x0, 0x1810, 0x55007}, [@IFLA_LINKINFO={0x60, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x50, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_QUERIER={0x5, 0x19, 0x2}, @IFLA_BR_MCAST_SNOOPING={0x5}, @IFLA_BR_AGEING_TIME={0x8, 0x4, 0x84}, @IFLA_BR_MCAST_ROUTER={0x5, 0x16, 0x1}, @IFLA_BR_GROUP_ADDR={0xa, 0x14, @link_local}, @IFLA_BR_NF_CALL_ARPTABLES={0x5, 0x26, 0x1}, @IFLA_BR_MCAST_MEMBERSHIP_INTVL={0xc, 0x1f, 0x3}, @IFLA_BR_MCAST_QUERY_RESPONSE_INTVL={0xc, 0x22, 0x1000}]}}}]}, 0x80}, 0x1, 0x0, 0x0, 0x800}, 0x0) r1 = syz_usb_connect(0x5, 0x24, &(0x7f0000001280)=ANY=[@ANYBLOB="12010003001f66088f0510660548020003010902120001049570810904008100ffffff02"], &(0x7f0000001700)={0xffffffa0, 0x0, 0x0, 0x0, 0x23}) r2 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) writev(r2, &(0x7f00000000c0)=[{&(0x7f00000002c0)='\x00', 0x1}], 0x1) syz_usb_control_io$printer(r1, &(0x7f0000000600)={0x14, &(0x7f0000000480)={0x40, 0x31, 0xfd, {0xfd, 0x6, "0f5a65397cb98ebf74bb5c377524619667d1199d7080cc86d8318336466ecaab049a9d2f051a17f0961ff3e5b829bd0f41dead21c93c42ee17a1510a2da6e435e7cae5c9235cc876557e7bd8c5a28eea5babab1a466ba910fc494216030c3f6a9936f6f1054c10a49e125cbcaf7ce7679653a9638766356cdd686ee6b734e1ee6b3ed3d6ab920e9d56c97228b9326da1690c0647723ea9723e497d920d9afe36cf7a9b9d604b61ac6ddbfcd1b41aea052ff1c0d0deeb4ae88bd875de75a0845496fd8a2f0d765f303e271444f394116b72c188408c106fb79f97f505797aade07b95bdc5da9d629a3e310e2fda1e11dd7fe7f2ef37bafdf451d8ff"}}, &(0x7f0000000100)=ANY=[@ANYBLOB="00030443c6ba47bbfeffb100"]}, &(0x7f0000000880)={0x34, &(0x7f00000008c0)=ANY=[@ANYBLOB="0016930000001ae0661a3c9d5f5063f8466f951b34e89ddf7cf13da584eac42967aad0602d26997fbc0b28934b8f6d0833b21daa93abd6466d0af426e1ca17818f56718d60fd04734469df5ca2b9275969a5bb1720d2a4fc8afc218bc113398defb8c2215397fbb204c5d3ad90bc10491d100b72047b6c872e812629742d49f4668d574ca1c830209ffac0960878173137d9183af379df6a416193ba327b1d7016862873c8c3033acf034462e4e3443503e8006603124b34b4cbfb7a5d145d164efe73fc8ccc668548dd13a25d73e18dbb37e0c3aab1e16d2ddd1177e79f5a9eda7a211d1044b3f4f768377006ca4bf941c5c19670b390febd0d420b8060013a01d929f8e2843850124cc14d3f3b240f25402be12a6bc05290f49558c84343c2eb1f543426be74219a583ed4c30d19294ec90305a7637759d7e08b4964c9e6be46ca04518381975289a46a7bb821a4d666700d7e9014f2c901169ac32621c5fd1613fe9e194c2b5d3572441ed16a60f5bfd8fab62727ff4599ae98db115e148d0b2cfa9f4b75f5bd234e9203e48d7e45db02a4a76fc7cbf7296794c8a66d6840e90bc063bdcaf9f58967a9d55f5301032b17426d6febdc332ad39bc3d2ff0580f9349080b100"/466], &(0x7f0000000700)={0x0, 0xa, 0x1, 0x3}, &(0x7f0000000740)={0x0, 0x8, 0x1, 0xff}, &(0x7f0000000780)=ANY=[@ANYBLOB="2000590000000057c2fe6c4cddb395a56aa2805db60dc92c83a967539c09000000a28be01d99202bb3ba1f2c747d34c2bb936f8f210ac15a7f5c6bdb2f29c4469e3f60f99889f52ab1f0cc5b1611575c79d529f240f52106eefa4378000000"], 0x0, &(0x7f0000000840)={0x20, 0x0, 0x1, 0x2}}) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) getsockopt$bt_BT_DEFER_SETUP(r3, 0x112, 0x7, 0x0, &(0x7f0000000200)) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000180)={0x0, 0xf, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="18000000240001030000000000000000010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x24008000}, 0x4044004) recvmmsg(r4, &(0x7f00000015c0)=[{{0x0, 0x0, 0x0}, 0x4008101}, {{0x0, 0x0, 0x0}, 0x10000}, {{0x0, 0x0, 0x0}, 0x1}, {{0x0, 0x0, &(0x7f0000001a00)}, 0x80000000}, {{&(0x7f0000000000)=@ethernet={0x0, @random}, 0x80, 0x0}, 0x9}, {{0x0, 0x0, 0x0}, 0x7}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}, 0x3}], 0x8, 0x0, 0x0) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x3, &(0x7f0000000140)=0xfffff801, 0x4) sendto$inet(0xffffffffffffffff, &(0x7f0000000040)='\f\x00', 0x2, 0x0, &(0x7f0000000340)={0x2, 0x80}, 0x10) r5 = syz_open_dev$usbfs(&(0x7f0000000000), 0x76, 0x103381) ioctl$USBDEVFS_DROP_PRIVILEGES(r5, 0x4004551e, &(0x7f00000000c0)=0xffffffff) r6 = syz_io_uring_setup(0x8ed, 0x0, 0x0, 0x0) io_uring_enter(r6, 0x4c3b, 0x1412, 0x10, &(0x7f00000001c0)={[0xd]}, 0x6) ioctl$USBDEVFS_RESET(r5, 0x5514) syz_usb_connect$hid(0x4, 0x3f, &(0x7f0000000040)=ANY=[@ANYBLOB="f29be634d13dd0dfef0ef77340000102030109022d00010105b0070904000701830103e509210900fa1122a10c09058103000402770a09050203080008ff08"], &(0x7f0000000400)={0x0, 0x0, 0x5, &(0x7f0000000180)=ANY=[]}) 2m24.784808271s ago: executing program 36 (id=1757): fanotify_init(0x2972bf0627f51a4a, 0x2) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000740)=@newlink={0x80, 0x10, 0x403, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x74, 0x0, 0x1810, 0x55007}, [@IFLA_LINKINFO={0x60, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x50, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_QUERIER={0x5, 0x19, 0x2}, @IFLA_BR_MCAST_SNOOPING={0x5}, @IFLA_BR_AGEING_TIME={0x8, 0x4, 0x84}, @IFLA_BR_MCAST_ROUTER={0x5, 0x16, 0x1}, @IFLA_BR_GROUP_ADDR={0xa, 0x14, @link_local}, @IFLA_BR_NF_CALL_ARPTABLES={0x5, 0x26, 0x1}, @IFLA_BR_MCAST_MEMBERSHIP_INTVL={0xc, 0x1f, 0x3}, @IFLA_BR_MCAST_QUERY_RESPONSE_INTVL={0xc, 0x22, 0x1000}]}}}]}, 0x80}, 0x1, 0x0, 0x0, 0x800}, 0x0) r1 = syz_usb_connect(0x5, 0x24, &(0x7f0000001280)=ANY=[@ANYBLOB="12010003001f66088f0510660548020003010902120001049570810904008100ffffff02"], &(0x7f0000001700)={0xffffffa0, 0x0, 0x0, 0x0, 0x23}) r2 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) writev(r2, &(0x7f00000000c0)=[{&(0x7f00000002c0)='\x00', 0x1}], 0x1) syz_usb_control_io$printer(r1, &(0x7f0000000600)={0x14, &(0x7f0000000480)={0x40, 0x31, 0xfd, {0xfd, 0x6, "0f5a65397cb98ebf74bb5c377524619667d1199d7080cc86d8318336466ecaab049a9d2f051a17f0961ff3e5b829bd0f41dead21c93c42ee17a1510a2da6e435e7cae5c9235cc876557e7bd8c5a28eea5babab1a466ba910fc494216030c3f6a9936f6f1054c10a49e125cbcaf7ce7679653a9638766356cdd686ee6b734e1ee6b3ed3d6ab920e9d56c97228b9326da1690c0647723ea9723e497d920d9afe36cf7a9b9d604b61ac6ddbfcd1b41aea052ff1c0d0deeb4ae88bd875de75a0845496fd8a2f0d765f303e271444f394116b72c188408c106fb79f97f505797aade07b95bdc5da9d629a3e310e2fda1e11dd7fe7f2ef37bafdf451d8ff"}}, &(0x7f0000000100)=ANY=[@ANYBLOB="00030443c6ba47bbfeffb100"]}, &(0x7f0000000880)={0x34, &(0x7f00000008c0)=ANY=[@ANYBLOB="0016930000001ae0661a3c9d5f5063f8466f951b34e89ddf7cf13da584eac42967aad0602d26997fbc0b28934b8f6d0833b21daa93abd6466d0af426e1ca17818f56718d60fd04734469df5ca2b9275969a5bb1720d2a4fc8afc218bc113398defb8c2215397fbb204c5d3ad90bc10491d100b72047b6c872e812629742d49f4668d574ca1c830209ffac0960878173137d9183af379df6a416193ba327b1d7016862873c8c3033acf034462e4e3443503e8006603124b34b4cbfb7a5d145d164efe73fc8ccc668548dd13a25d73e18dbb37e0c3aab1e16d2ddd1177e79f5a9eda7a211d1044b3f4f768377006ca4bf941c5c19670b390febd0d420b8060013a01d929f8e2843850124cc14d3f3b240f25402be12a6bc05290f49558c84343c2eb1f543426be74219a583ed4c30d19294ec90305a7637759d7e08b4964c9e6be46ca04518381975289a46a7bb821a4d666700d7e9014f2c901169ac32621c5fd1613fe9e194c2b5d3572441ed16a60f5bfd8fab62727ff4599ae98db115e148d0b2cfa9f4b75f5bd234e9203e48d7e45db02a4a76fc7cbf7296794c8a66d6840e90bc063bdcaf9f58967a9d55f5301032b17426d6febdc332ad39bc3d2ff0580f9349080b100"/466], &(0x7f0000000700)={0x0, 0xa, 0x1, 0x3}, &(0x7f0000000740)={0x0, 0x8, 0x1, 0xff}, &(0x7f0000000780)=ANY=[@ANYBLOB="2000590000000057c2fe6c4cddb395a56aa2805db60dc92c83a967539c09000000a28be01d99202bb3ba1f2c747d34c2bb936f8f210ac15a7f5c6bdb2f29c4469e3f60f99889f52ab1f0cc5b1611575c79d529f240f52106eefa4378000000"], 0x0, &(0x7f0000000840)={0x20, 0x0, 0x1, 0x2}}) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) getsockopt$bt_BT_DEFER_SETUP(r3, 0x112, 0x7, 0x0, &(0x7f0000000200)) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000180)={0x0, 0xf, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="18000000240001030000000000000000010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x24008000}, 0x4044004) recvmmsg(r4, &(0x7f00000015c0)=[{{0x0, 0x0, 0x0}, 0x4008101}, {{0x0, 0x0, 0x0}, 0x10000}, {{0x0, 0x0, 0x0}, 0x1}, {{0x0, 0x0, &(0x7f0000001a00)}, 0x80000000}, {{&(0x7f0000000000)=@ethernet={0x0, @random}, 0x80, 0x0}, 0x9}, {{0x0, 0x0, 0x0}, 0x7}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}, 0x3}], 0x8, 0x0, 0x0) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x3, &(0x7f0000000140)=0xfffff801, 0x4) sendto$inet(0xffffffffffffffff, &(0x7f0000000040)='\f\x00', 0x2, 0x0, &(0x7f0000000340)={0x2, 0x80}, 0x10) r5 = syz_open_dev$usbfs(&(0x7f0000000000), 0x76, 0x103381) ioctl$USBDEVFS_DROP_PRIVILEGES(r5, 0x4004551e, &(0x7f00000000c0)=0xffffffff) r6 = syz_io_uring_setup(0x8ed, 0x0, 0x0, 0x0) io_uring_enter(r6, 0x4c3b, 0x1412, 0x10, &(0x7f00000001c0)={[0xd]}, 0x6) ioctl$USBDEVFS_RESET(r5, 0x5514) syz_usb_connect$hid(0x4, 0x3f, &(0x7f0000000040)=ANY=[@ANYBLOB="f29be634d13dd0dfef0ef77340000102030109022d00010105b0070904000701830103e509210900fa1122a10c09058103000402770a09050203080008ff08"], &(0x7f0000000400)={0x0, 0x0, 0x5, &(0x7f0000000180)=ANY=[]}) 2m2.163229647s ago: executing program 9 (id=1910): socket$tipc(0x1e, 0x5, 0x0) r0 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r0, &(0x7f0000000080)=@name={0x1e, 0x2, 0x0, {{0x42}}}, 0x10) close(r0) r1 = syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x34, 0x70, 0x9d, 0x40, 0x55f, 0xc230, 0xb6ac, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xf2, 0xa7, 0xcc}}]}}]}}, 0x0) syz_usb_control_io$uac1(r1, 0x0, &(0x7f0000000000)={0x24, &(0x7f0000000640)={0x0, 0x0, 0x1, '5'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat$smackfs_cipso(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/fs/smackfs/cipso\x00', 0x2, 0x0) write$smackfs_cipso(r2, 0x0, 0xa4) 2m0.530941929s ago: executing program 9 (id=1918): socket(0x10, 0x3, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x8, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000001480)=ANY=[@ANYBLOB="180000eeffffffffffffff00d30ea1c17dcbb0962fe18238a649ebb4121325a39699a27b91d047ab25ce569ff62320eb87fe2035dcbf2be7a43d24ee54967c292a1e8b7116babb0ccd4de9a46f9492184c486422e8113db10e3c313c83fdac08267e654b089478b730deffbf1f82d0bf9588cd039de35337a56db8581ea56cd5b447ea8744aa6f2f259f16ea06e3ca353dc41086348a854deeb1c93bcb6e0ec59fa31abfd4d877baca7c34f33c49a86ae8e923dbf317d778882b880eecb6ba0cd1e1607c41c0f55e5f82e475e6968fe3b6f1fb831a0fd2b50fef03078dca215f35c392396facff56a51b5f83d0ebceec01447a8e5f4eb60269d63f482db3"], &(0x7f0000000000)='syzkaller\x00'}, 0x90) r2 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r1}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x3, 0x8, &(0x7f0000003780)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd1200000000000085000000d0000000b70000000000000095000000000000003fba6a7d36d9b18ed812a2e2c49e8020a6f4e0e4a9446ca2b5f1cc1a100a9af698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f010c5077da80fb982c1e9400c603146cea484a415b76966118b64f751a0f241b072e90080008002d75593a280000c93e64c227c95aa0b784625704f07a72c2918451ebdcf4cef7f9606056fe5c34664c0af9360a1f7a5e6b607130c89f18c0c1089d8b85880000c29c48b45ef4adf634be763288d01aa27ae8b09e13e79ab20b0b8ed8fb7a68af2ad0000000000000006f803c6468082089b302d7bff8f06f7f918d65eae391cb41336023cdcedb5e0125ebbcebddcf10cb2364149215108355ee570f8078be5cab389cd65e7133719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad23000000803a90bce6dc3a13871765df961c2ed3b1006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f40cfd7c3a1d37dc4887b1586602d985430cea0162ab3fcf4509c926abfb076719237c8d0e60b0eea24492a660583eecdbf5bcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9f081d6a08000000ea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d60532be9c4d2ec7c32f2095e63c8cdc28f74d043ed8dba2f23b01a9aeb980aff9fa3a64709270c701db801f44cf945b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142bdda5e6c5d50b83bae616b5054d1e7c13b1355d6f4a8245eaa4997da9c77af4c0eb97fca585ec6bf58351d599e9b61e8caab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a41326eea31ae4e0f75057df3c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57010000009700ce0b4b8bc22941330000000000000000000300000000000000000000000010008bc0d955f2a83366b99711e6e8861c46495ba585a4b2d02edc3e28dd279a896249ed85b9806f0b6c4a000000002b43dcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffff7f00000000df73be83bb7d5ad883ef3b7cda42013d53046da21b40216e14ba2d6af8656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff72943327d830689da6b53ffffffff631c7771429d1200000033ed846197fcff5e1c7c3d1d6e3a52872baef9753fffffffffffffe09fec2271fe010cd7bb2366fde4a59429738fcc917a57f94f6c453cea623cc5ee0c2a5ff870ce5dfd3467decb05cfd9fcd41df54cdbd9d10a64c108285e71b5565b1768ee58969c41595229df17bcad70fb4021428ce978275d5bc8955778567bc79e13b78249788f11f708008b75d4fe32b561d46ea3abe0fa4d30dc94ef241875f3b4b6ab7929a57affe7d7fa29822aea68a660e717a04becff0f719107000000000000002d7e927123d8ecbbc55bf404571be54c72d978cf2804107f0238abccd32368e57040906df0042e19000000000000002c06f815312e086dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef44cd1fe582786105c7df8be4877084d4173731efe895efc71f665c4d75cf2458e35d2c9062ece84c99e061887a20639b41c8c12ee86c50804042b3eac1f879b136345cf67ca3fb2b5e518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad055e4af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457ac0eaaa99bf0bdc14ae358c3b377327ac9ecc34f24c9ae153ec60ac0694da85bff9f5f4df9b3fdf242b985bf16b99c9cc0ad1857036f1a985f369191ae954febb3df464bfe0f773ee9afe72f32a2befb89d3777399f5874c553a2ebe9061fe86e669642e09bb6d163118e4cbe024fd452277c3887d6116c6cc9d8046c216c1f8a9778cb26e22a2a998de5eaeadea2a40da8daccf080842a486721737390cbf3a74cb2003efb9a101b51ab63e9600040000b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde6e4a4304e50c349f4f9ecee27defd83871c5191e10096e7e60fc3541a2c905a1a95e9571bf38aebd15172f94e3245c582909e2a3bce109b6000000000000000000d6d5210d7560eb92d6a97a27602b81f7636df1535bef1497f90100000000000000abf9010000007740890200d627e87306703be8672dc84eeadba6a41891c170d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e7a45319f18101288a0268893373750d10a3fc22dd704e4214de5946912d6c98cd1a900d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69b93e9960ff5f76062adae283d9756237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff85000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66018d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a31c72ad53bc19faa5401120000793ac48c1b539c75ab40743b00020000a1f68df75cf43f8ecc8d3726602111b40e761fd210a1920382f14d12ca3c3431ee97471c781d0d1280fb00818654a53b6df4b2c97cc1c98d85fda8f80fe908b65550b441233151122b41a8d73062197655b7f0469250a5989cef0e10773920ed3ccee42d2c3eb80159da5c002511e6eb93842054cfce2ac306cb6e472db3fd67a49b6855a694a8d359add43907003223a47a7fae4f3748d5a432825bc40a03aaef1c8488d86dc211dd2a3ba71e0f45492ef1f8b65ccb3dcd251a61b152d02c29ca0a3328fa7753a5cddea1acaae55ae8263fb284b7a6ab2a8826c1b948207c498cf4824ab1ea3225a53072423b907c6682f8999e0311da5b8378bc841e1787e3a8128dda381a26cb2b365702ff8a27831375b2ddaa2f56e21169f7ca4fd9655ccd4a584acd244e965a0afedaff7c415ff682a4044b3381cc2df28278c9a6824c52048a7cfabda294925cc0956bffa8e950ff5e49f41ae600d830207bf728cd9807933c3c16d80bbea611a18becc2dc38ca0a6f5740f340b76edcd1f539bd43007231dcef58c7b88b5aeedaf9626cb51ce1737c10ab37d4f98a934b0f900e0eb639878a1200629f5503cf679154d27681d7a3744cbcd42af59407c9c8e39c5271868917954e604352ba26171d004f1cb2976fab3fa19c7d3ef9678bff79f5155524f061378f94fb453786c3a6f78b10d383b49e31d1568bd43ee34ce6e6be235aa6207285665c2fba773671da41959f51610963b48930658e2d6125a26085001345b0473240b7e5e91811312c43663e76f711d7219ecdec75c7ea1cf0f8f8fff40247d59bbde2ebb8659197e0f37a71be1b12a182ed7de3acba28561a04b807f7a4647e2ea6d8fb92541d07c3d5e4ba077d3cad9f8ba1919592014c00c8eccb2ca5d48ba7b1c3fb185a4bb79700cf51f818b0c701c8de47d12281a67bdaf4b0c50bee9e8f5936250df2e15c1172e7ea6619f7db330700d1e9e42a035e6fd532f61fbfed9c4a7124a1e38eee50a6bbcd1d4e3f68c3f27dd9a70f1a7c6046237ddfb0b26e197322226367d998010458cd4df10af249ce717f6f45e5176e0ddae3054d7289d4e13ab0912703ee39ce264572b89194fdf7acecc35cf8309d4b680a08eed367dad855fce210f1a7c7222dd360eafb4bef7d58bf83362930af6e3f3f851abdc0003bdf9401b533019e90feb069189100007a82df8d9b5f44ebf9355e7b1b01c9470608d4f306d21004730396a4d6c6d46e1ffac97aa93c36123532a36186575266be4981c847160079421d0137801e553069f8d025c40f287378810defc7f2ed4e15f6af17b21153394f8bcfa6a23a77c8d61c9bbc127a57b8d631f36558d9093dee08bc53d97a8003363421738650a26c8fd87b13026799caf58e59951b125e7f161ca34e2c0dd65a23d01a3cb191e743de07247c7f993cf01166fa2ac1ba02f60550e63a7f50422e478c6b5d87f9bd0567a279a9d85a3c0db25c43bd0529ad783b9d64aaac1b793afb44b7126e17d2b7c0d6be650de7eeef3f3605af344015d03c3e7819145cb9fe1978c98bf9cf10773db59505ae33708c728844c872dfd2cb0b29754f928c59306ce105ca18cb72f0944d0e4fea0a0abd0285bdaf1b000000c089d640c2facb0d1e6243873ac4b1e1068c45c715b68effb7d58d1f9e726dbf6bd910ca4ce0e075658ede42192cf393a50dcc197b03402fed75083628e5dd380000000000000018037064b05e73ec00c710f1ffc5737d397d555d1cf8859cc05fea8dc3c6a5b3b6fa1c81707479db1833d593a271253aa11efdb36b74784f2fc286814848022e8ee541bc179813297a0a4cc3c8f80c28701185bea091f32475e859479b734727afc110e1abcff460172fd1b4ae3c0e2a4bf94a060069000010000087c7572a1e7596f89e5c3d5e70640c90815f77b7b13d0000000085a1e1e84900000000000000000000000000b422fc160a458ee5a91a2471e6e56fdabec6c73ce8983fc68f0b7cdcdde632e6f54a07620e8aa116ce9e84fc3cd5e8288a333dcebb233da9186796995ba69487d8f77d2f8800f02d690fc70a08b231cad1bdcf3740a95d4dd1cfe0f417f275493cf33b19ffff93dfdaf7eb00b8ad87cdf7c21bab5af8e2bac54ee5597e6508c1158124a538c36f9bb11fea7d8b8c7e954b1bc7811654a6636b33f271d0923e9ecd1b724b8feffadfc23c07000000f0785fb722f346d6a5dffe1884d4d0cd8f00000092c85ed44db68ab800000000000000406e6ed9b219ad07125381087298e75965d1cc5932ddf9e66351ba332a34bee3e3d562c914c629933f0b8724cf680889ade72558d191d9890c69a718f9018586c5131c8dc8e0379bafda1a0fd2997ff115215ce23dca8db7236c1554cdaaadcce2f31834c1bd1908d8e1b361034db56be76acb7654a195bc3e98df3a5dffd5b0783883ef7da3433110e37f7c7cb7f3800de7f99abf910d6949e062747a9c87dcfcc716d6a9c0ec53b9cffe3cfd1df69a76f373d7f997edb9b80bdea1a99c2a6fbb25e035deadaadd7917ebfedd6304a19491769476208684e343f86b4d55a7dbbb07283cb1e35a139d24ebc5b4f8e35a82d3a7f84cb1e02a5a92b53567088be0b1ca023ccd518c0e0715b1c8760801a419ebd2e26440ff7493019bdb655cc88d72d6d7b6bca5a2e19b63ec52fcc49a729f11ab377f7132c543d29646a9378eea0761b7ed9d2172e33ed87c6513c843b180cc00000000006bedf2ed716ca43a941119b96d82b26d9061de240d85ec2cfa462bd52104489bb7a7548d7cc53627031e909c69cb824233975a1ea645de63522407c3a240a37e946f30ebf075ea97846a0a8d2286f3f446b1b99ab83a12ddf8a1c06294eadc3eb3e339591afd5c00000000000000000000000000000000000000000000000000579dad8347a3d16976bb7483840b32db0158fb6c809349333325a7866ca5d3133e33ef1a183cefdb65a79fa71800988c8445029e024822dbcfcab49c3a0aec9bd43e6e14078b260700d849a2aa14c9b593f6dcb1de334c065ecfd65031606e55949c185bcda9fde4f9b46a76b8a24bbcd31b22373eb0473248150cd179405ee1af1183b0c0ce3483dc1d9bf732b0751b78fb211d6706b55960c6431afbc02b3c7e08086573939290bb9e590a3875f02a828bf209d0000000000000000000000000001545f0ec539c3b58facd2f62dc3307a6c91d6b", @ANYRES16, @ANYRESOCT=r2, @ANYBLOB="75924ee09ff7dea3675e799a1be0936ac444ace1c4f6d2c259552e00e2aac0418089f5a8039f7e9b477fb813dc611d651ab905c5e7befe4f4b6ebf24", @ANYBLOB="676db7c68a58440cca18a4a8bcfeec8edbe911c755553b5cd3179a0a5d0a247573c869ebe887e05f534b1711ff485fde1de626bb428b330e932f5212a4aa52133d4de4e57a97ff02e9cf8c3b9971e8121e00dc8c48390d673b0612523ae46f91e63f8da331e194c723d6e04e500db2a7631520ce8cbcecebca14c3e7"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x26, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, r0}, 0x94) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4080c}, 0x2000c845) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000001280)=ANY=[], 0x17) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() r4 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0x14, 0x0, &(0x7f0000000540)) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r3, 0x8, &(0x7f0000000400)=0x2) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$binfmt_format(0xffffffffffffff9c, &(0x7f0000001580)='/proc/sys/fs/binfmt_misc/syz0\x00', 0x2, 0x0) setxattr$incfs_metadata(&(0x7f0000000800)='./cgroup\x00', &(0x7f0000000840), &(0x7f0000000880)="22cff58056", 0x5, 0x1) removexattr(&(0x7f0000000200)='./cgroup\x00', &(0x7f0000000240)=@known='user.incfs.metadata\x00') r7 = socket$inet_smc(0x2b, 0x1, 0x0) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000001c0), r9) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)={0x44, r10, 0x1, 0x0, 0x0, {0x4, 0x74, 0x609}, [@NLBL_UNLABEL_A_IPV4MASK={0x8, 0x2}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'bond0\x00'}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @mcast2}]}, 0x44}, 0x1, 0xffffffff00000003}, 0x0) ioctl$sock_ifreq(r7, 0x89a2, &(0x7f0000000280)={'bridge0\x00', @ifru_settings={0x43, 0x0, @sync=0x0}}) socket$kcm(0x10, 0x0, 0x10) 1m59.327497202s ago: executing program 9 (id=1920): syz_emit_ethernet(0xfef3, &(0x7f0000000200)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa86dd6012010000641100fe"], 0x0) 1m59.039301817s ago: executing program 9 (id=1922): pread64(0xffffffffffffffff, &(0x7f0000000000)=""/2, 0x2, 0x9) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f0000000040)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000080), 0x141000, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000140)={0x0, 0x18, 0x7fff, r1, 0x0, &(0x7f0000000100)={0x980908, 0x5, '\x00', @string=&(0x7f00000000c0)=0x5}}) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)={0x1b, 0x0, 0x0, 0xfffffff5, 0x0, r0, 0x8001, '\x00', 0x0, r1, 0x4, 0x1, 0x4}, 0x50) newfstatat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x800) ioctl$NS_GET_OWNER_UID(r1, 0xb704, &(0x7f0000000340)=0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0/file0\x00', &(0x7f0000000240), 0xa0042, &(0x7f0000000380)={[{@redirect_dir_on}, {@xino_off}, {@index_off}, {@default_permissions}, {@uuid_null}, {@nfs_export_on}], [{@fowner_lt={'fowner<', r3}}, {@rootcontext={'rootcontext', 0x3d, 'user_u'}}, {@euid_eq={'euid', 0x3d, r5}}, {@uid_lt={'uid<', 0xee00}}]}) fcntl$setlease(r0, 0x400, 0x2) r6 = fsopen(&(0x7f0000000440)='qnx6\x00', 0x1) fsetxattr$security_ima(r2, &(0x7f0000000480), &(0x7f00000004c0)=@v1={0x2, "f4269c"}, 0x4, 0x1) setsockopt$bt_hci_HCI_DATA_DIR(r1, 0x0, 0x1, &(0x7f0000000500)=0x1, 0x4) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000700)=0x0) ioctl$NS_GET_OWNER_UID(r1, 0xb704, &(0x7f0000000740)=0x0) read$FUSE(r1, &(0x7f0000000c00)={0x2020, 0x0, 0x0, 0x0}, 0x2020) r10 = getpgrp(0xffffffffffffffff) r11 = getgid() r12 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000002c40), 0x800, 0x0) ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000002c80)={0x1ab, 0x10000, {0xffffffffffffffff}, {r3}, 0x3, 0x8fd}) r14 = syz_clone3(&(0x7f0000002e80)={0x3c108000, &(0x7f0000002cc0), &(0x7f0000002d00), &(0x7f0000002d40), {0x22}, &(0x7f0000002d80)=""/20, 0x14, &(0x7f0000002dc0)=""/92, &(0x7f0000002e40)=[0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff], 0x6, {r0}}, 0x58) r15 = getegid() r16 = gettid() r17 = fcntl$getown(r6, 0x9) r18 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000003540), 0x0, 0x0) r19 = getpgrp(0xffffffffffffffff) getgroups(0x2, &(0x7f0000003580)=[r4, r4]) r21 = openat$smackfs_logging(0xffffffffffffff9c, &(0x7f0000003ac0), 0x2, 0x0) r22 = ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000003b00)=0x0) sendmmsg$unix(r1, &(0x7f0000004600)=[{{&(0x7f0000000540)=@abs={0x1, 0x0, 0x4e24}, 0x6e, &(0x7f00000006c0)=[{&(0x7f00000005c0)="05bdb925eb81d010ec1e77bc5940653eafe167e742fea03e72e934529b79962a958c741fabb782519cfa5bb88874987a4b77d70f45f659822b9862a01ef1f4c6bd0dc1e21e5f15a78a4e3d81e337e9b9a5d4dea74ac27e127d9ce0", 0x5b}, {&(0x7f0000000640)="87d09a54eb7bf717fad3def03a42fb819e363fef6d911801f9aa6d125559fcf2fb4ec94c8fcc35c8ab09", 0x2a}, {&(0x7f0000000680)="2fb041756c0a6e4c880cdaeafa48623f8deaf695d2616c4c6cf14adf992e83c8a00a68c38b52", 0x26}], 0x3, &(0x7f0000000780)=[@rights={{0x18, 0x1, 0x1, [r6, r2]}}, @cred={{0x1c, 0x1, 0x2, {r7, r8, r4}}}], 0x38}}, {{&(0x7f00000007c0)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000b80)=[{&(0x7f0000000840)="56b72f3f0a41d285ce0f725d69e3395891430b40e86973285bb4d410458ce10341f210b00a4988f3a8c3585b17ed7abbf6eb23bce63758f526248d08004dd54a8dcea9e62bc05b61f8d17178f48c5cff649c297e580b73614592aa77713fb9b4691f05a08c1480180a61f927", 0x6c}, {&(0x7f00000008c0)="f6a0c0ee3357ff0d3a2a7d99eb54d79a9fd3b764a38b2d12ef27f5cbd1a79e2138f8f0ef12d6d484a0a83821273e24c4c145aae8357741a71de8af1ec20fce4ab4cb640520c3eab7620dab609702a120e019bcb1878ac78e16a190372a8de159e363c925c91846429a71b90a5d464d304c23f62567971518d3e8aef575b0c1051b6d2983f49d08dae6cab3a46578912c03aa4a09d26ebfbfedb16687cea12a9a560e583d2c53757a75ad49d51860ed07968e1972e9bbd6bf1f3ad69f40dc74d4e1bffb7805d7a7009fa87313474c11b563b29fe8ff2aa95a064d8735", 0xdc}, {&(0x7f00000009c0)}, {&(0x7f0000000a00)="78a027ba426c799b5fb8010acd826400c05d59344c83febd4b50649c5cc089c4553d7c5ce554e657ba42610f7eeb7d3512aa2385f379a465bf090d0aff8f1df06fb1c05b14a2aa69736da2e1ed947bbb238852b3f5c579666545e30a5d83d969d0f925b75b7990d78d84fc695a91c8c74900e600a8143f32a7ff4b13fab91ab4f8acebca85482d4ce180a5bca6e2538ed1db7b2214383ee93b069a2a7c15db56851f4b9648568e40f21c42fdbc9b", 0xae}, {&(0x7f0000000ac0)="8bc28187fe70b82b1ff1d16adc0c9dd8cdd1737928827903782b8fd0ba7d8f25afe7de66f4f2f9e2cb902a0d427db51de45a1ca7f16761eb4c196418fa4048e9a39532bd164031c258a26379d8f04d023682c4e1c9e33b44afe057e9296556deb7ab698dc73a890ebd22e4442613a80c0046c3a874deb3915b95f07e60027cd50648c6e5d9fda9af15594f893ae26958cf905bdee89fc8f2c80a5be04a1cec9a55dc80b6769b7cdbec612e3decf917e4a2e15e2657", 0xb5}], 0x5, &(0x7f0000002f00)=[@cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, r9, r4}}}, @cred={{0x1c, 0x1, 0x2, {r10, r5, r11}}}, @rights={{0x30, 0x1, 0x1, [r2, r6, r1, r1, r1, r6, r2, r6]}}, @rights={{0x38, 0x1, 0x1, [r1, r6, r0, r12, r6, r0, r2, r1, r2, 0xffffffffffffffff]}}, @cred={{0x1c, 0x1, 0x2, {r13, r5, r4}}}, @cred={{0x1c, 0x1, 0x2, {r14, r3, r15}}}], 0xe8, 0x24}}, {{0x0, 0x0, &(0x7f00000032c0)=[{&(0x7f0000003000)="c15b1f86a21139b05501d6f7c2791cb31a63d71d4d0cfeee753a2adde12edcac9355eaacee3c41ef233012dc665eeba1b29e698ef336b0eb94261bc5c6c3bbcc31985eb97659491df58e5fc99c7d5b0d14c7fa3b119c195b0828481d6b06487dc2eea221c56fd05d6d7be97215d7fc574fee512a526a90d1127512630eea299b026c36500504a80aa28b0d9b0608b544c9605adb43f63aefb8d41ddb0299207ad6ded959f1d0d5d84d382b9ee528b920b857c13b55c44bfababb0280a2c0d9a5b2f265f874e5c9ab497fb1b244", 0xcd}, {&(0x7f0000003100)="538e824f7ab82ddf14c434e134fe7a3ac7d0357e9dceb724525f59aec35702b9d0f2e9d202d0717fa1ae2ebdff202d2c23731030b32fc1159d059eab658ac00f83824565d8d49aef2eade6e4da0136e9476d8685b6d9dd178aae5406525251f55fbb98c98bc97fbfd2d67fb99147d5f603f75d57cc4fbdefa72bb3", 0x7b}, {&(0x7f0000003180)="0119815ea9", 0x5}, {&(0x7f00000031c0)="ad64f3443c99b3a89874d1375bec85076468bb60c249ad3519f9abc8fa8ad5e4b7854c34a909737b83009662ccac84b7de6b558ee447dee8007ffbfe489f846d6e74e8e3281a3ee7fc8b6c9a94ea58c63191c45d16a0ab7ce3e38d28e9cb99298e68e258590fa15aac1847d667ad1509f266f077d7854852752c77eafc295795e4be85276f7837c6fd8672b6fa873c663b7f370efeeac66a2577bc3798a0fd976344e6637e47ded5523796c7219a75ef8ae6bd79dc0fe3137689a19d87f37d8973f7016a702cca31c8f54149c11c2a5e18cfc831f945972200fcc3e4c137", 0xde}], 0x4, 0x0, 0x0, 0x4000004}}, {{&(0x7f0000003300)=@file={0x0, './file0/file0\x00'}, 0x6e, &(0x7f0000003500)=[{&(0x7f0000003380)="531a1db9276ad3c375a0e44bb7648e0365ca3cfe12d05cb3d8a854a8f884f6daa3e53ea4788ae1ac4e9675e9c716d3dab55e1110685e1c369e00f1bfe3", 0x3d}, {&(0x7f00000033c0)="917153ab0b9ab432175ab8bef8cd8b630347acc5979af4115366d5a686722139ba0c7b81a6f3faa6d12f49af3b6986fbe4ccca6ee69db2fc069900b917a5db04db02dbe67071ed7799ad3a022e009f864992c37581ec0ac6e6cc913d7e7756f45354ea0183e6e5fc5596908970d26fb07d1101", 0x73}, {&(0x7f0000003440)="f50b8f5702765fc0e944a1c0fa7ed0bcb9287b0695fcd94634bc77b31db5b892ac1c83c4983bd5573d2d93fd132d44115dc7cdf9625f06086528c04a2fbe688fe906d499c7d34093a46afabd267db408d9b105f5a14dcfe1891842f1c58343e8795745bb06bc1f5253bdb14caf17ff48b9a3205f2d0b82d59c8088f8ec90f6ca7f4167e75f00b346d6a6b03418a2583d55202dfb58be0ea1", 0x98}], 0x3, &(0x7f00000035c0)=[@cred={{0x1c, 0x1, 0x2, {r16, r3, r4}}}, @cred={{0x1c, 0x1, 0x2, {r17, r3, r4}}}, @rights={{0x1c, 0x1, 0x1, [r6, r0, r0]}}, @rights={{0x24, 0x1, 0x1, [r18, r0, r6, 0xffffffffffffffff, r1]}}, @cred={{0x1c, 0x1, 0x2, {r19, r5, r20}}}], 0xa8, 0x40d0}}, {{&(0x7f0000003680)=@abs={0x1, 0x0, 0x4e22}, 0x6e, &(0x7f0000003a40)=[{&(0x7f0000003700)="343cc3cb7a62e4d7cd0a902a927b4e8de91ed642d88a82b21e8fb40cddbba007d7301b38211ceeaa92463aff457d88e2977e4c58368c02830979c12cac2f35395782267c9365102ec8f350e6cf3991c79b783189de7864bbfef2ea84d029d7740cb8482ba99849e43ef430cbe2e76d9c564ae0a3c57fc2d921ceb3996c3b3ce3b6813567cda331419f3e9c06a03c48509229bb1469a2a2e66b565483a208432fa0458cfa0077cf1738439c528ecbdd37213d5b25e9c426ccec9c89780d9ba26dee9d9338fa1f1ed444073f7119b7d6e2af1bbe5c5503dd975fb6b3bebd82de4d7a5eed31444f4ca75bad40867cffeb63bbca4cf804", 0xf5}, {&(0x7f0000003800)="936bbf7d66dfb08fee0932661aca5d8da402a689c656d7d16c94fdad101b23de559dc749530e", 0x26}, {&(0x7f0000003840)="c2650bff503ea068d7226028607f3843ac885966b51901d7d65897c71376eb419d87b281f7d731427209ab3380c9fc0c9816cbe78e2337ac7cfc2997d52f32156a59bba2216a2a3e42da63db16e4de312c0b9ce95ae5f8fc3d3de96f03479ba8d9207c244d77ae69179933dad4239ce469c80b0e7dd84ae4f77bf126ce38a00ea1cbe05f07e76c661c", 0x89}, {&(0x7f0000003900)="32c944133cebbf79a8b7b177a773ab17d77a3092cf28360284417cf5a35c761e7c685c8c8190820b2aaef4122e71ddba788a1d682112cf8de8c327512d26a4a834632b0ceafb61b9aec2f9a9b82bb9fdde7ba14dbf7a55125695bfbc11d289f08a1e12b9a1086eb924a07e2f631f56c6a84ddbe9ede52487cc94682127e3af7a6686b2d11b806ac5e4366af4e38d3b7ffadecc0de6bd60cea24700db6f3fe2b1c678104b3806d4fe0c366940d62dd02b0176fe39cf64902dcb65", 0xba}, {&(0x7f00000039c0)="a78ea4e5621851ecad324625d488b9f24eb81e7b1dbb0f4d652db8d704773e363d8266f7e5de19f432560826d181282b434562100d7b1f0ae55b711e", 0x3c}, {&(0x7f0000003a00)="34dd4b2bb795d318402ba958c4c2e65f51a0343092a7d6fd5b689457c38cf5a5a77256938574d07a7272edb5c55d624ba83cc8b25b5f1eddc1e85d263d6c", 0x3e}], 0x6, &(0x7f0000003c40)=[@rights={{0x28, 0x1, 0x1, [r1, r2, r2, r21, r22, r6]}}, @cred={{0x1c, 0x1, 0x2, {0x0, r3, r4}}}, @cred={{0x1c, 0x1, 0x2, {r23, r5, r4}}}, @cred={{0x1c, 0x1, 0x2, {0x0, r5, r4}}}, @rights={{0x18, 0x1, 0x1, [r6, r6]}}, @rights={{0x1c, 0x1, 0x1, [r6, r0, r6]}}, @rights={{0x2c, 0x1, 0x1, [r0, r0, 0xffffffffffffffff, r2, 0xffffffffffffffff, r2, 0xffffffffffffffff]}}, @rights={{0x24, 0x1, 0x1, [r1, 0xffffffffffffffff, r1, r0, r2]}}], 0x118, 0x8000}}, {{&(0x7f0000003d80)=@file={0x0, './file0/file0\x00'}, 0x6e, &(0x7f0000003fc0)=[{&(0x7f0000003e00)="825a9c364be2ad6bfc763076405c585ea490393da1b1f12291fe0aa86c06dfe8e85bb61724b8bba95c8dee858e41cfe52d3ccc0a13f74c8fb198baf31d0978d624eb8cb52246788ed59584c0eb0c2006747b0c354a43ee66e8b60bab5911aff117205884ed3f25dc31e0740f0822ec584540dac93e8b3c269c74debcd0775b054040b9cce271b8006223d89b085b20bd90b8efb91f", 0x95}, {&(0x7f0000003ec0)="71f76ac14725f8746d2bd2b44a8d797fca0eed2f5f8275a4c0844a98ea200201773c2a46e978c503984f849695c5c9035a84733b97eba442f29f4ba8f377f2d3f768d080266837b029f3b4fabf7065f8d940b83a10dcf1f7bd0cae9cf2bd293e27aa50174e6d013e15879fc68622facc127525bc17e9bc5c594540fc87ec16defea34c2ed2a9f1b0213185dee5140784a805cf851adef495ad46be01c061816e05bbaccc46779ff5239989ffb94809659279b501165385ea06f31a0b5ad30f257a3899f658d008f98f3a76497b55fd7341fe", 0xd2}], 0x2, &(0x7f0000004500)=[@rights={{0x14, 0x1, 0x1, [r1]}}, @rights={{0x24, 0x1, 0x1, [r2, r0, r2, r0, r0]}}, @cred={{0x1c}}, @cred={{0x1c, 0x1, 0x2, {0x0, 0xffffffffffffffff, r4}}}, @rights={{0x30, 0x1, 0x1, [r6, r6, r2, r2, r1, r6, r1, 0xffffffffffffffff]}}, @rights={{0x30, 0x1, 0x1, [r0, r6, r2, 0xffffffffffffffff, 0xffffffffffffffff, r2, r6, r2]}}], 0xe0, 0x20000012}}], 0x6, 0x44010) 1m58.795983824s ago: executing program 9 (id=1925): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0201, 0x0) ioctl$SNDCTL_DSP_CHANNELS(r1, 0xc0045006, &(0x7f0000000180)=0x2) (async) r2 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) (async) write$dsp(r1, &(0x7f00000012c0)="a5", 0x1) r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_async', 0x80004, 0x6) fsetxattr(r3, &(0x7f0000000280)=@known='user.incfs.size\x00', 0x0, 0x0, 0x3) read$dsp(r2, &(0x7f0000001380)=""/229, 0xe5) (async) r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_GET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000012c0)={0x3c, r4, 0x1, 0x70bd25, 0x25dfdbfc, {}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_PORT_INDEX={0x8, 0x3, 0x3}]}, 0x3c}, 0x1, 0x0, 0x0, 0x10}, 0x84) 1m57.184355334s ago: executing program 9 (id=1931): sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="1800000024000103000000"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000) r0 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101301) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, &(0x7f0000000380)={0x0, 0x0, "5a77bd319e86aeb879ca62cdab2a0000000086d85b25a5665a3247e500f61681905db88235f8a5447dd2a2ed6e91626f068881e50f6853772b21a140efb76cba37ff3111d6847e8b9398a654717af75fc008daefba68e6222103472bc55704cdb737ae996ed831f3b802549db3a8ffff7d34171113d806726615380fe65a6a0a72e1ac2b60bd6276fd8bb6363d10f70da60fd53ded22c87eb2be500e4a62fb73c33424b437bb192c9d06ea6ed04983fe5c5ca033dfce0a82575ef1d7ee686be0fc58e384f93a13f4e8bbf599394bb0a3a9ca1864f0a35d6cc38fca32ad6b39905a9727d2001457df7be7e1aefe363590d1f600"}) ioctl$USBDEVFS_CLEAR_HALT(r0, 0xc0105502, &(0x7f0000000300)={0x1, 0x1}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) r3 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r3, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000003c0)={'wlan0\x00'}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x8040, 0x0) ioctl$TCSETS(r4, 0x40045431, &(0x7f0000005c40)={0x0, 0x0, 0x1, 0x0, 0x80, "ff00f7000000000000000000af88008300"}) r5 = syz_open_pts(r4, 0x141601) r6 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r6}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x3938700}, {0x0, 0x3938700}}, 0x0) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) write(r5, &(0x7f0000000000)="d5", 0xfffffedf) ioctl$TCSETSF(r5, 0x5404, &(0x7f0000000080)={0x8, 0x20000000, 0xfffffffc, 0x7, 0x5, "682341f2fd71a6a76177920ea7e60c1acfa4a5"}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) recvmmsg(r3, &(0x7f0000007840), 0x0, 0xa000, 0x0) r7 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000040), 0x46003, 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(0xffffffffffffffff, 0x80047c05, &(0x7f0000000240)=0xffffffffffffffff) ioctl$VIDIOC_QBUF(r7, 0xc058560f, &(0x7f0000000540)=@multiplanar_userptr={0x0, 0x4, 0x4, 0x4000, 0x10000, {}, {0x4, 0x8, 0x0, 0x7f, 0x3, 0x9a, "88c4a8b4"}, 0x0, 0x2, {&(0x7f00000004c0)=[{0x2, 0xf, {&(0x7f0000000140)}, 0x9}, {0x7f, 0x9c5, {&(0x7f00000001c0)}, 0x5}]}, 0x0, 0x0, r8}) syz_io_uring_setup(0x497, 0x0, 0x0, &(0x7f0000000280)) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, 0x0, 0x0, 0x4) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, 0x0) 1m41.84887032s ago: executing program 37 (id=1931): sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="1800000024000103000000"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000) r0 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101301) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, &(0x7f0000000380)={0x0, 0x0, "5a77bd319e86aeb879ca62cdab2a0000000086d85b25a5665a3247e500f61681905db88235f8a5447dd2a2ed6e91626f068881e50f6853772b21a140efb76cba37ff3111d6847e8b9398a654717af75fc008daefba68e6222103472bc55704cdb737ae996ed831f3b802549db3a8ffff7d34171113d806726615380fe65a6a0a72e1ac2b60bd6276fd8bb6363d10f70da60fd53ded22c87eb2be500e4a62fb73c33424b437bb192c9d06ea6ed04983fe5c5ca033dfce0a82575ef1d7ee686be0fc58e384f93a13f4e8bbf599394bb0a3a9ca1864f0a35d6cc38fca32ad6b39905a9727d2001457df7be7e1aefe363590d1f600"}) ioctl$USBDEVFS_CLEAR_HALT(r0, 0xc0105502, &(0x7f0000000300)={0x1, 0x1}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) r3 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r3, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000003c0)={'wlan0\x00'}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x8040, 0x0) ioctl$TCSETS(r4, 0x40045431, &(0x7f0000005c40)={0x0, 0x0, 0x1, 0x0, 0x80, "ff00f7000000000000000000af88008300"}) r5 = syz_open_pts(r4, 0x141601) r6 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r6}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x3938700}, {0x0, 0x3938700}}, 0x0) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) write(r5, &(0x7f0000000000)="d5", 0xfffffedf) ioctl$TCSETSF(r5, 0x5404, &(0x7f0000000080)={0x8, 0x20000000, 0xfffffffc, 0x7, 0x5, "682341f2fd71a6a76177920ea7e60c1acfa4a5"}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) recvmmsg(r3, &(0x7f0000007840), 0x0, 0xa000, 0x0) r7 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000040), 0x46003, 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(0xffffffffffffffff, 0x80047c05, &(0x7f0000000240)=0xffffffffffffffff) ioctl$VIDIOC_QBUF(r7, 0xc058560f, &(0x7f0000000540)=@multiplanar_userptr={0x0, 0x4, 0x4, 0x4000, 0x10000, {}, {0x4, 0x8, 0x0, 0x7f, 0x3, 0x9a, "88c4a8b4"}, 0x0, 0x2, {&(0x7f00000004c0)=[{0x2, 0xf, {&(0x7f0000000140)}, 0x9}, {0x7f, 0x9c5, {&(0x7f00000001c0)}, 0x5}]}, 0x0, 0x0, r8}) syz_io_uring_setup(0x497, 0x0, 0x0, &(0x7f0000000280)) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, 0x0, 0x0, 0x4) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, 0x0) 51.583618748s ago: executing program 3 (id=2168): bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x9, 0x4, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000006112000000000000950000000000000051fa7824c74186dc02ec0696c37b64e3b24da3180100000005345c0f63cdc2e82818254950ee03568b8809a1f04c7c4750eabfafcb9531b31e6a86827d1010c5a909ab98e00e19644a88e95ba26d1c9eecddb2d11c541418ceeb29b9b6829c6e433822bdb3cc85244aab66c1aae9314d7381fcfeb970bea672010000000000000043144648a07a975bd89dc398712376610faa54f12495b4659be8673086f6f3543205d4bc4ce05b8b961103673dff7f158052e62bfbdcddde6985f3f1ac5d9a94cc53207899762a07282a1914452d11858e795a3ca30a101af5574f9035f2b5f703e5be7e4acf8b78c2834ae5805fffee38a9a0033d520bcf6b08ede50899d4b9bdf85c71c5ed44039aab46419496362e54cfad05b4004ac71a003d7b85d07191bed4e5a8908263722d4146f7ed569985439baa355cf3d8731f5e7a237bc06d035a8d601f21746d880819f38b34a495040000000071c2f0cce8c93cc17e9afa314fcb2ba15d646c5b9f87d988c9fbd2b9d9b4e2d71753b1549fa734f0b2e5fcf9549804cddad721971637f9c9730a9cc384eed30345979db9c93e1c52f42cad0a4d4f9436d3f39b0ed09c395dc6e970366087a8e4daeeb1b017006f25caf0cbcefd13d68839893e39c588eb032905f91cafa4996dbf0cc8228d02a3092c0830b8f587a5624515298b2d4eb2bde6f9a2eb83d53f710c490ecd085d2811a7555c53030000007f00000000bfa6478eb96b079c277e2910b7ccdc3d672ed34aa65278c549e2abb549ad954884289130bc71cee2b7de62bf48129ae1af052a2d46a6165eb0954dac7265f1f425735acf6377793946b3229e861d8ea49806b3b533345d36ecef9df700000000f337b1ceb2d8a65dcdcd895d7ba37098d2593fdaaef445af5bee02019c000000aaae37f044bcadeb0f6846582b7653665aa336db9f0384d3c7ddf79c2e0000000000000000000000000000000000000000000000e154aa0d3e41986a668ee1e5ef93a8ceac75f44aae95e26742f895f287111f8ee86f7e3ffb63cfb0e345cf7fc63dd2b0d30977899c6f03640040af4db71f7452bfc79a05118d8bb42b63b195771e42f9942ec626bd4b5461b74324012164e8"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sock}, 0x70) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000ac0)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x9, 0x4, &(0x7f0000000280)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sock, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000240)=ANY=[@ANYRES32=r1, @ANYRES32=r0, @ANYBLOB="02"], 0x10) sendmsg$IPCTNL_MSG_EXP_GET(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000380)=ANY=[@ANYBLOB="40000000010205000000000000000000020000002c0002801400018008000100ac1414aa08000200ac1414bb06000340000000000c000280050001"], 0x40}}, 0x80) 51.420071208s ago: executing program 3 (id=2170): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000008000)={0x15, 0x3, &(0x7f0000000900)=ANY=[@ANYBLOB="b700000000000000070000000000000095000000000000005b1953e7203b3833b487e3c4bd4540e4b6e87b7891e0f159182f542be18de00d9d95e1c4a6b62a3c065fc1a7b4c144cc2508eba2540e3425abc138dbaf9f6da59d9c77cbe2a8a9666a08ed1704c6bb2e422f01d64cae3050d7bd3c10b0e80d9483a2e36568cf0c6a1b78d9ca2f8065a1d7b4b0eeeecaa3c865de68042c9ab36e8a43b97955b04e5351f99c682a939832582c0dfd64028580c33fca4ca652f4c4e116c16e0f76fd9379599b54e06a8662f81fe375751e06007efabbd87b82d35367257d1bc15f92370261aace269013bc00b86daae71e253200000000b1467c86aff0ee8ff6c53939acb3866e8247eff7c10f000200000e6bd59e5b4dbc12ce8f0a5f816382fc66bcf14bb83ce2336b93b90594b78301e696503eea3404fe7dc3a8a5f9fde10f53e458e9efbe57fb52e85ea5346ed9f42418aefc6052afd588f8ae73eaab3af38936bfdadc91cda3983de6513ef3c2e58a54ffb1921aab1df971cdc2b2ab17bc9e421b5991b6036f845313a4a5f9d8a36472d7d758d73e9be967ca3fdae7d7ba03a8d9e5962c67ca30e5b6eb3c524c22632e47f18c879f0564361ef35aba5ed3f2d1b0bc6954e7e2dc49106ce8a49b48812ad3f5f8391c14ecde831be42d15bdc797c2b9ab30a8e90d7d53784e7add8e5bd5b6797a63e48efa0eb4d1df88ea8b388e94c6a15ac4e22447dad331244a38a5a2e294905611bfeadcac35f6ccf6af94191954c6b840a3092ef94d1e0e23019fbbdcd5b47e4a565ce42d0bbd7b14f9df1139c15ee4d687fe0861a8210071ebeb63606d28dcb5404e077400bd04453c49d0e2e0bb2700000046a4e564ba31c3d62f2d0fb6b7630f66f086e36885c3634a522888f1c4049361cfb8914f59073ba6a8a6ea283acfa3d3bc40e7a70f71b27686ac5307918ac06f1a396fe1accc74e9eabfea"], &(0x7f0000003ff6)='syzkaller\x00', 0x1, 0xc3, &(0x7f00000002c0)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_reuseport}, 0x48) r3 = socket(0x10, 0x800000000080002, 0x2) setsockopt$sock_attach_bpf(r3, 0x1, 0x34, &(0x7f00000000c0)=r2, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'sit0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=@newqdisc={0x74, 0x24, 0x4ee4e6a52ff56541, 0x3f000000, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xfff1, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}, @TCA_STAB={0x44, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x7, 0xc6, 0xfffa, 0x2, 0x0, 0x9, 0x81}}, {0x4}}, {{0x1c, 0x1, {0x7, 0x5, 0x4, 0x1f5b, 0x2, 0x1, 0x49b6324}}, {0x4}}]}]}, 0x74}}, 0x0) 51.352366113s ago: executing program 3 (id=2171): r0 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000400)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_route(0x10, 0x3, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) add_key$fscrypt_v1(&(0x7f0000000440), &(0x7f0000000480)={'fscrypt:', @auto=[0x39, 0x0, 0x0, 0x62, 0x38, 0x0, 0x0, 0x0, 0x35, 0x63, 0x0, 0x0, 0x0, 0x0, 0x0, 0x64]}, &(0x7f00000004c0)={0x0, "3e82554dc8ccfbc2e85ec82d4ee9df60f6ae16b1a5f2c848722ba3b132e4fde178c945bd950b0477e801fc8a1be9b4ebbe9c2289a6b0aa00"}, 0x48, 0xfffffffffffffffe) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff}, 0x80) keyctl$KEYCTL_WATCH_KEY(0x20, 0x0, r5, 0x1f) add_key$keyring(&(0x7f0000000100), &(0x7f0000000180)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) close_range(r4, 0xffffffffffffffff, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) fchdir(r0) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') mount(&(0x7f0000000000), &(0x7f0000000040)='./cgroup\x00', 0x0, 0x1001, 0x0) mount$bind(&(0x7f0000000080)='./cgroup\x00', &(0x7f00000000c0)='./cgroup\x00', 0x0, 0x2080, 0x0) 50.410656297s ago: executing program 3 (id=2174): socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, 0x0, 0x0) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x8905, &(0x7f0000000080)={'veth0_to_bond\x00', &(0x7f0000000000)=@ethtool_rxfh={0x47, 0x6, 0x7a, 0xc45, 0x9, "cfe534", 0x7, [0x7, 0x0, 0x10000]}}) 48.565148s ago: executing program 3 (id=2184): r0 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000400)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_route(0x10, 0x3, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) add_key$fscrypt_v1(&(0x7f0000000440), &(0x7f0000000480)={'fscrypt:', @auto=[0x39, 0x0, 0x0, 0x62, 0x38, 0x0, 0x0, 0x0, 0x35, 0x63, 0x0, 0x0, 0x0, 0x0, 0x0, 0x64]}, &(0x7f00000004c0)={0x0, "3e82554dc8ccfbc2e85ec82d4ee9df60f6ae16b1a5f2c848722ba3b132e4fde178c945bd950b0477e801fc8a1be9b4ebbe9c2289a6b0aa00"}, 0x48, 0xfffffffffffffffe) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff}, 0x80) keyctl$KEYCTL_WATCH_KEY(0x20, 0x0, r5, 0x1f) add_key$keyring(&(0x7f0000000100), &(0x7f0000000180)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) close_range(r4, 0xffffffffffffffff, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) fchdir(r0) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') mount(&(0x7f0000000000), &(0x7f0000000040)='./cgroup\x00', 0x0, 0x1001, 0x0) mount$bind(&(0x7f0000000080)='./cgroup\x00', &(0x7f00000000c0)='./cgroup\x00', 0x0, 0x2080, 0x0) 47.25183922s ago: executing program 3 (id=2191): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000180)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x110a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0xfffffffffffffd87, &(0x7f0000000440)={0x0}, 0x1, 0x0, 0x0, 0x8000}, 0x11) r5 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0xc, &(0x7f0000000040)={0x80}, 0x213) prlimit64(0x0, 0x8, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000340)={0x0, 0x0}) sched_setscheduler(r6, 0x1, &(0x7f0000000080)=0x7) r7 = getpid() sched_setscheduler(r7, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r9, &(0x7f0000000180)=@file={0x1, './file0\x00'}, 0x6e) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000000480)='./binderfs2/binder-control\x00', 0x800, 0x0) sendmmsg$unix(r9, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r8, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB="180006000000000000000000000000009500000000000000ce9ccac533754dd695cd1606d0f2eee68ffc06de96165a4051821b3b3ea5d0a0270ecdf5a32d431e6e6584153a8de3bc8511bb119440e4fa6633044620c9ebd3f691a536cf043edcf40fa22d475bcbaaecc01ee432105634656597c62b5a07b7ca113cad1c3d011ea62fabf746d090355b94bf38a660781b976a0f4fac38df8a18fa7c639e1d22865a666f31ae3aa3ea01e357b0f8722ecff5891f9592bbc5af98312e7b6a937935547faea7dd9293126316b13b0af9b449070d1b1069f3f7985d313781d6009e"], &(0x7f0000000080)='syzkaller\x00'}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000400)='objagg_obj_root_create\x00', r10}, 0x74) r11 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x109301) ioctl$USBDEVFS_RESET(r11, 0x5514) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r12 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r12}, 0x10) 31.119203544s ago: executing program 38 (id=2191): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000180)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x110a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0xfffffffffffffd87, &(0x7f0000000440)={0x0}, 0x1, 0x0, 0x0, 0x8000}, 0x11) r5 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0xc, &(0x7f0000000040)={0x80}, 0x213) prlimit64(0x0, 0x8, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000340)={0x0, 0x0}) sched_setscheduler(r6, 0x1, &(0x7f0000000080)=0x7) r7 = getpid() sched_setscheduler(r7, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r9, &(0x7f0000000180)=@file={0x1, './file0\x00'}, 0x6e) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000000480)='./binderfs2/binder-control\x00', 0x800, 0x0) sendmmsg$unix(r9, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r8, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB="180006000000000000000000000000009500000000000000ce9ccac533754dd695cd1606d0f2eee68ffc06de96165a4051821b3b3ea5d0a0270ecdf5a32d431e6e6584153a8de3bc8511bb119440e4fa6633044620c9ebd3f691a536cf043edcf40fa22d475bcbaaecc01ee432105634656597c62b5a07b7ca113cad1c3d011ea62fabf746d090355b94bf38a660781b976a0f4fac38df8a18fa7c639e1d22865a666f31ae3aa3ea01e357b0f8722ecff5891f9592bbc5af98312e7b6a937935547faea7dd9293126316b13b0af9b449070d1b1069f3f7985d313781d6009e"], &(0x7f0000000080)='syzkaller\x00'}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000400)='objagg_obj_root_create\x00', r10}, 0x74) r11 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x109301) ioctl$USBDEVFS_RESET(r11, 0x5514) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r12 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r12}, 0x10) 9.944116167s ago: executing program 5 (id=2370): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) mkdirat(0xffffffffffffffff, &(0x7f0000000040)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000180)='map_files\x00') r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000500000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6f2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f00000000c0)='mmap_lock_acquire_returned\x00', r2}, 0x10) fchdir(r1) sendmmsg$unix(r0, &(0x7f0000000d40)=[{{&(0x7f0000000080)=@abs={0x1, 0x30, 0x30}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0xe03f0300}}], 0x1, 0x0) 9.867893707s ago: executing program 0 (id=2371): r0 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x82, 0x0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x3, 0xc, &(0x7f00000008c0)=@framed={{0x18, 0x2, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x5d}, [@call={0x85, 0x0, 0x0, 0x30}, @printk={@s, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x9b}}]}, &(0x7f0000000800)='GPL\x00', 0x0, 0x0, 0x0, 0x1e00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0xd, 0x3, &(0x7f0000001300)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1}}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x8, '\x00', 0x0, 0x9}, 0x94) r3 = fsopen(&(0x7f00000003c0)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x0, 0x0) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000100)={r2, r4, 0x3, 0x0, @val=@iter={0x0}}, 0x20) ioctl$UFFDIO_COPY(r4, 0xc028aa03, &(0x7f0000000000)={&(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff2000/0xe000)=nil, 0x4000, 0x7}) 9.823263854s ago: executing program 1 (id=2373): bpf$MAP_CREATE(0x0, &(0x7f0000003200)=ANY=[@ANYBLOB="1e000000000000"], 0x48) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f0000001580), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_PMKSA(r3, 0x0, 0x4) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="74010000", @ANYRES16=r4, @ANYBLOB="11060000000000000000010000000800050001000000200108803c0000801400040002000000ac1e00010000000000000000240001000000000000000000000000000000000000000000000000000000000000000000e0000080a400098028000080060001000a0000001400020020010000000000000000000000000001050003000100000028000080060001000a00000014000200ff010000000000000000000000000001050003002aea091428000080060001000a00000014000200ff010000000000000000000000000001050003000300000028020080060001000a00000014000200ff0100000000000000000000000000010500030000000000240001000000000000000000000000000000000000000000000000000000000000000000140004000200000000000000000000000000000024000300000000000000000000000000000000000000000000000000000000000000000014000200776731"], 0x174}}, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r5 = openat$cuse(0xffffffffffffff9c, &(0x7f00000022c0), 0x2, 0x0) preadv(r5, &(0x7f000001fb80)=[{&(0x7f0000000280)=""/52, 0x34}, {&(0x7f0000002300)=""/4096, 0x1000}, {&(0x7f00000011c0)=""/4096, 0x1000}], 0x3, 0x0, 0x0) sendmsg$ETHTOOL_MSG_FEATURES_SET(r3, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000001}, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r6 = openat2(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)={0x109400, 0x184}, 0x18) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x50, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$TCFLSH(r6, 0x540b, 0x0) syz_emit_vhci(&(0x7f00000003c0)=ANY=[@ANYBLOB="043e0c0201e6"], 0xf) socket$nl_route(0x10, 0x3, 0x0) dup(0xffffffffffffffff) syz_usb_connect(0x0, 0x3d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000a6ff0540cdabeecdb9050000000109022bfd000000000009049c00020103510009050313000000000007a5010300000009050f"], 0x0) 9.728065396s ago: executing program 5 (id=2374): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'syz_tun\x00', 0x0}) r2 = syz_open_dev$vim2m(&(0x7f00000000c0), 0x7f, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r2, 0xc0d05605, &(0x7f0000000140)={0x1, @pix_mp={0x0, 0x0, 0x32314247}}) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=@newlink={0x44, 0x10, 0x503, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x14615, 0xef}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r1}]}, 0x44}}, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'syz_tun\x00'}) (async) syz_open_dev$vim2m(&(0x7f00000000c0), 0x7f, 0x2) (async) ioctl$vim2m_VIDIOC_S_FMT(r2, 0xc0d05605, &(0x7f0000000140)={0x1, @pix_mp={0x0, 0x0, 0x32314247}}) (async) socket$netlink(0x10, 0x3, 0x0) (async) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=@newlink={0x44, 0x10, 0x503, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x14615, 0xef}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r1}]}, 0x44}}, 0x0) (async) 9.700176241s ago: executing program 8 (id=2375): socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) r0 = socket$inet_sctp(0x2, 0x5, 0x84) r1 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25GSUBSCRIP(r1, 0x89e0, &(0x7f0000000200)={'tunl0\x00', 0x0, 0x1000}) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, 0x0, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(0xffffffffffffffff, 0x84, 0x6d, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) close_range(r4, r4, 0x2) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x2, 0x0, 0x7fff0000}]}) close_range(r5, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000019680)=""/102392, 0x18ff8) r7 = socket(0x2, 0x80805, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000400)=@dellink={0x60, 0x11, 0x100, 0x70bd25, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x4103, 0x6040}, [@IFLA_PROP_LIST={0x40, 0x34, 0x0, 0x1, [{0x14, 0x35, 'wg1\x00'}, {0x14, 0x35, 'batadv_slave_1\x00'}, {0x14, 0x35, 'pim6reg\x00'}]}]}, 0x60}}, 0x0) r9 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r9, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000200)={r2, 0x1c, &(0x7f0000000300)=[@in6={0xa, 0x4e22, 0x7fffffff, @empty, 0x80}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r9, 0x84, 0x7a, &(0x7f0000000340)={r10, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000040)=0x84) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r7, 0x84, 0x71, &(0x7f0000000000)={r11, 0x81}, &(0x7f00000000c0)=0x8) 9.550152343s ago: executing program 0 (id=2376): prlimit64(0x0, 0xf, &(0x7f0000000040)={0xa}, 0x0) r0 = add_key$user(0x0, 0x0, &(0x7f00000000c0), 0x0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f00000191c0)={0x0, r0, r0}, 0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) getpid() r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'bond0\x00'}) r2 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0) write$tcp_congestion(r2, &(0x7f0000000100)='reno\x00', 0x5) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000380)={'wlan0\x00', 0x0}) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8000}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r7 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r7, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$SMC_PNETID_DEL(0xffffffffffffffff, 0x0, 0x0) setsockopt$IPT_SO_SET_REPLACE(r6, 0x0, 0x40, &(0x7f0000000580)=@raw={'raw\x00', 0x8, 0x3, 0x3b0, 0x0, 0x43, 0xa0, 0x1d0, 0x98, 0x318, 0x178, 0x178, 0x318, 0x178, 0x49, 0x0, {[{{@ip={@loopback, @local, 0x0, 0x0, 'veth0_to_bond\x00', 'ip6erspan0\x00'}, 0x12a, 0x1b0, 0x1d0, 0x0, {0x0, 0x7a010000}, [@common=@inet=@recent0={{0xf8}, {0x0, 0x0, 0x8, 0x0, 'syz0\x00'}}, @common=@unspec=@helper={{0x48}, {0x0, 'ftp-20000\x00'}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0xe8, 0x148, 0x0, {}, [@common=@unspec=@connbytes={{0x38}, {[{0xb}]}}, @common=@set={{0x40}, {{0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x300]}}}]}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv4=@multicast1}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x410) sendmsg$NL80211_CMD_TRIGGER_SCAN(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r5, @ANYBLOB="01002dbd7000fbdbdf252100000008000300", @ANYRES32=r4, @ANYBLOB="04002c80"], 0x20}, 0x1, 0x0, 0x0, 0x20}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x17, 0x3, &(0x7f0000000200)=@framed, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sysctl=0x12, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0xa0) openat(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup\x00', 0x0, 0x0) unshare(0x2040400) r8 = socket$xdp(0x2c, 0x3, 0x0) bind$xdp(r8, 0x0, 0x0) 8.483485294s ago: executing program 5 (id=2377): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000060000000000000000850000000f000000c5000000a000020095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) r4 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000200)='i2c_write\x00', r3}, 0x10) close(r3) close_range(r4, 0xffffffffffffffff, 0x0) (async) close_range(r4, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x74, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000140)={[0x20000000007, 0x80, 0x7fffffff, 0x4000000000800002, 0xffffffffffff7ffc, 0x7, 0x3e, 0x6, 0x2, 0x40000, 0x5, 0xfda, 0x10000000009, 0x1, 0x2, 0x1002], 0x1, 0xc0111}) (async) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000140)={[0x20000000007, 0x80, 0x7fffffff, 0x4000000000800002, 0xffffffffffff7ffc, 0x7, 0x3e, 0x6, 0x2, 0x40000, 0x5, 0xfda, 0x10000000009, 0x1, 0x2, 0x1002], 0x1, 0xc0111}) sendmsg$NLBL_CIPSOV4_C_ADD(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000380)={0x14, 0x0, 0x1, 0x0, 0xfffffffe}, 0x14}}, 0x0) (async) sendmsg$NLBL_CIPSOV4_C_ADD(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000380)={0x14, 0x0, 0x1, 0x0, 0xfffffffe}, 0x14}}, 0x0) sendmsg$IPCTNL_MSG_CT_GET_DYING(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x100000}, 0xc, 0x0}, 0x24044801) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={0x0, 0xa4}, 0x1, 0x0, 0x0, 0x8004}, 0x0) r5 = socket(0x10, 0x803, 0x0) sendto(r5, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000006c80)=[{{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000400)=""/13, 0xd}], 0x1}, 0x7}], 0x1, 0x2043, 0x0) (async) recvmmsg(0xffffffffffffffff, &(0x7f0000006c80)=[{{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000400)=""/13, 0xd}], 0x1}, 0x7}], 0x1, 0x2043, 0x0) recvmmsg(r5, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x321}, {&(0x7f0000000280)=""/85, 0x21}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000580)=""/106, 0x659}, {&(0x7f0000000980)=""/73, 0xd}, {&(0x7f0000000200)=""/77, 0x69}, {&(0x7f00000007c0)=""/141, 0xc4}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}, 0x5}], 0x4000000000003b4, 0x2000, &(0x7f0000003700)={0x77359400}) ioctl$KVM_RUN(r2, 0xae80, 0x0) (async) ioctl$KVM_RUN(r2, 0xae80, 0x0) 8.482593582s ago: executing program 0 (id=2378): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="74010000100063d129bd7000fbdbdf25fe8000000000000000000000000000aafe8000000000000000000000000000aa00000000000000000000000011000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fc0100000000000000000000000000000000000033000000ac1414bb00000000000000000000000001000000000000000000000000000000000000000000000002000000000000000b000000000000000000000000000000820000000000000000010000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000084000100636d6163286165732900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e001"], 0x174}, 0x1, 0x0, 0x0, 0x40000}, 0x4004) fsetxattr$trusted_overlay_upper(0xffffffffffffffff, 0x0, &(0x7f0000000140)={0x0, 0xfb, 0x39, 0x0, 0x8, "c9ce46cac8e5c1061e77dbb43507743b", "04c645eb3e013f7cc56dbd53dbd1cf461ccb98f429798f4019ca936a206b4b50edf37641"}, 0x39, 0x1) r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$int_in(r1, 0x40000000af01, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000080), 0x8, 0x10000) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r2, 0xc04064a0, &(0x7f00000002c0)={&(0x7f00000001c0)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000240)=[0x0], &(0x7f0000000280)=[0x0, 0x0], 0x4, 0x6, 0x1, 0x2}) openat$smackfs_revoke_subject(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) syz_io_uring_setup(0x111, &(0x7f0000000340)={0x0, 0x0, 0x2, 0x4}, &(0x7f0000000140)=0x0, &(0x7f0000000280)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0x200, 0x0, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r4 = getpid() setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000380)=@raw={'raw\x00', 0x8, 0x3, 0x240, 0xd8, 0xa, 0xd0e0000, 0xd8, 0x100, 0x1a8, 0x1d8, 0x1d8, 0x1a8, 0x1d8, 0x3, 0x0, {[{{@ip={@local, @multicast2, 0xffffff00, 0xff, 'veth0\x00', 'team0\x00', {}, {}, 0x2, 0x3, 0x40}, 0x0, 0x70, 0xd8}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x1, 0xffff, 0x800, 0x1, 'syz1\x00', 'syz0\x00', {0x3}}}}, {{@uncond, 0x0, 0x70, 0xd0}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x1, [0x4, 0x2, 0x4, 0x3, 0x5, 0x3], 0x5, 0x5}, {0x0, [0x6, 0x6, 0x1, 0x7, 0x5, 0x5], 0x3, 0x3}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2a0) sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) r8 = openat$6lowpan_enable(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) writev(r8, &(0x7f0000000240)=[{&(0x7f0000001680)='0', 0x1}, {&(0x7f0000000080)='+', 0x1}], 0x2) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NL80211_CMD_JOIN_IBSS(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000006c0)=ANY=[@ANYBLOB='x\x00\x00\f', @ANYRES16=r9, @ANYBLOB="010129bd7000000000002b00000008000300", @ANYRES32=r7, @ANYBLOB="0a00340001010101010100000a000600505050505050000004002a00"], 0x38}, 0x1, 0x0, 0x0, 0x200040c1}, 0x800) syz_usb_control_io$printer(0xffffffffffffffff, &(0x7f0000000c00)={0x14, &(0x7f0000000ac0)={0x20, 0x22, 0xde, {0xde, 0x21, "4939248ebdacd506c210722f6d9a66bd126e5e3ff951c59588166b63fde181a8cc4abb2a228824d9e634adff04c79c506ff71f6a4f75e6fa46a9bb75865b650b51c5f0703cec3ccf566ebb4891c39ebd29f298a72de41b1243d124df29b310bfa844108d4e132243e0513c6c8ad55c8d591ed42befb737c27bb3ca6bf39afd2ad99d117d05f485f26334b31864a72941dde3f9b483f4452382025cd0ab6f0dd525fc2b69f3516e29fe782ba23323a0a57025c8fcbbd0c8290a97880ffca3f29ce17420ea54a5ca6ece8b09fdb339eb62bf924c83881cb6045f5cb176"}}, &(0x7f0000000bc0)={0x0, 0x3, 0x35, @string={0x35, 0x3, "ed6af0d044989fabe605a1ffd2a752ac1f7b49362aed07496735fb5f10eb90b233fdf3801643cca7cc8be2fcb877128c125243"}}}, &(0x7f0000000e80)={0x34, &(0x7f0000000c40)={0x20, 0x15, 0xa2, "7bdc5a8efafe114957f5953e591912fcf1e1bea354b67b85081f9b92c3a68205fca04b837dfc563c9183ac025c64c609af87366a56e2ac7a095efb9b084d7b6870b9c42ab09529af10ba7e88a2a714f7196698df90dabbf7d93c94dedd77d1860a05c91280141315dd354eaf215ba134a92b8653ff598634f69f2723faa3ead41da36b4bb4969ad8c316da9080e03f55f69ca6de3fdaec0363882870e00d25d6f295"}, &(0x7f0000000d00)={0x0, 0xa, 0x1, 0xa}, &(0x7f0000000d40)={0x0, 0x8, 0x1, 0x2}, &(0x7f0000000d80)={0x20, 0x0, 0x57, {0x55, "6b47183ac4462008d4b7d8cd6c969122d7d5d8b3118e6cb15d65b9623335289edef5765620fd17e408f8e0c736945d31f4c1cc5f5a77895c3c1041fe16101235a3bd27e1b4697e69f06876dac29772f89ab01ef0a2"}}, &(0x7f0000000e00)={0x20, 0x1, 0x1, 0x4d}, &(0x7f0000000e40)={0x20, 0x0, 0x1, 0x9}}) r10 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) writev(r10, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1) 8.367494132s ago: executing program 6 (id=2379): bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000000c0)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00', 0x0}, 0x30) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c01000019000100000000000000000020010000000000000000000000000000ac1414aa00000000000000000000000000000000000000000a00"], 0x13c}}, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x13, &(0x7f0000000180)=ANY=[@ANYBLOB="180000001800000000000008000000001801000020786c2500000000002020207b0af8ff00000000bfa100000000020007010000f8ffffffb702000008000000b7030000000000008500000006000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000060000009500000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) unshare(0x22020600) syz_emit_ethernet(0x3e, &(0x7f0000000340)=ANY=[@ANYBLOB="aaaaaaaaaaaa0009000000e086dd603000bb00082b00fc020000000000000000000000000000fe8000000000000000000000000000aa0000000000089078"], 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000380)='sched\x00') openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00'}, 0x10) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="160000000000000004000000ff00000000000000", @ANYRES32=0x1, @ANYBLOB="d6ece13b94c01edc5c5b4c349b3bd600000000000000ad4afff2000000000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x3, 0xc, &(0x7f00000005c0)=ANY=[@ANYBLOB="180000008cf1c7847f00000000000000000000000018110000", @ANYRES64=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020005000000ffb703000000000000b704000000000000850000005700000095", @ANYBLOB="ee6f7cc5d17e802c2c97c9349f6a7eb618d082daa47a962f0eb575d071b64acc47170a5085ccfb07b2bd34f1394c28c6f319a81e0664831d938ec9c36bbc18b0f352b9cbe2a7a50b0f7fa7cd3e53e3357712326a"], 0x0}, 0x94) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x16, 0xc, &(0x7f0000000680)=ANY=[@ANYRES16=0x0, @ANYRES32=r4, @ANYRES16=r3, @ANYRESDEC=r0, @ANYRESHEX=r7, @ANYRESOCT=r5], &(0x7f0000000300)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='kmem_cache_free\x00', r10}, 0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r9, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000058"], 0x0}, 0x94) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000140)={'pim6reg1\x00', 0x20}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 8.206154103s ago: executing program 5 (id=2380): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = syz_io_uring_setup(0x239, &(0x7f0000000380)={0x0, 0xa005, 0x10100, 0x0, 0x4}, &(0x7f0000000080)=0x0, &(0x7f0000000100)=0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000180)={0x26, 'rng\x00', 0x0, 0x0, 'stdrng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, 0x0, 0x0) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f00000002c0)="7799", 0x2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, {0x230}}) io_uring_enter(r2, 0x2ded, 0x4000, 0x0, 0x0, 0x0) r6 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r6, 0xc0285700, &(0x7f0000000100)={0x1, "fa02c8098000", 0xffffffffffffffff}) r8 = openat$sw_sync(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r8, 0xc0285700, &(0x7f0000000040)={0x80109, "fa02946a000000001dda524f03000000000000000000003673000000002000", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r9, 0xc0303e03, &(0x7f0000000080)={"6739669f274d13b691ebe45bebe3f5b53e0ca34dd02acecdc67c5e3126628168", r7, 0xffffffffffffffff}) ioctl$HIDIOCGRDESC(r1, 0x90044802, &(0x7f0000000400)) ppoll(&(0x7f0000000000)=[{r10, 0x200}], 0x1, 0x0, 0x0, 0x0) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) r11 = getpgrp(0x0) r12 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r13 = io_uring_setup(0x71b9, &(0x7f00000000c0)={0x0, 0xc63b}) io_uring_register$IORING_REGISTER_CLOCK(r13, 0x1d, &(0x7f0000000040)={0x7}, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005938d74010973077339600000001090212"], 0x0) kcmp(r11, r12, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) 6.780712664s ago: executing program 8 (id=2381): r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCSISO7816(r0, 0xc0285443, &(0x7f0000000300)={0x4, 0x8, 0x1, 0x5, 0x6}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) r2 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000327000/0x3000)=nil) r3 = shmat(r2, &(0x7f0000001000/0x3000)=nil, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) shmdt(r3) r4 = syz_open_procfs(0x0, &(0x7f0000000240)='mountinfo\x00') readv(r4, &(0x7f0000000a00)=[{&(0x7f0000000140)=""/222, 0xde}, {0x0}, {&(0x7f0000000580)=""/225, 0xe1}], 0x3) getsockopt$inet_mreqn(r4, 0x0, 0x23, &(0x7f0000000340)={@empty, @loopback, 0x0}, &(0x7f0000000400)=0xc) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@bloom_filter={0x1e, 0x100, 0x6, 0x6, 0x200, r4, 0x2, '\x00', r5, r4, 0x1, 0x0, 0x4, 0xc}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000140)={{r6}, &(0x7f0000000180), &(0x7f0000000100)=r1}, 0x20) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000080)={r6, &(0x7f0000000300), 0x0}, 0x20) r7 = syz_open_dev$vcsa(&(0x7f0000000000), 0x1, 0x0) poll(&(0x7f0000000040)=[{r7}], 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r8 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r9 = dup(r8) write$6lowpan_enable(r9, &(0x7f0000000000)='0', 0xfffffd2c) r10 = syz_io_uring_setup(0x23e, &(0x7f0000000380)={0x0, 0xce0a, 0x10100, 0x3, 0x370, 0x0, r9}, &(0x7f0000000180)=0x0, &(0x7f00000001c0)=0x0) r13 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r13, 0x4601, &(0x7f0000000100)={0x400, 0xa, 0x0, 0x0, 0x0, 0x180, 0x0, 0x0, {}, {}, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1}) syz_io_uring_submit(r11, r12, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, {}, 0x1}) io_uring_enter(r10, 0x708, 0x41e3, 0x0, 0x0, 0x0) io_setup(0x8, &(0x7f0000000680)=0x0) io_pgetevents(r14, 0x2, 0x2, &(0x7f00000000c0)=[{}, {}], 0x0, 0x0) ioctl$TCFLSH(r0, 0x5608, 0x0) 6.579850204s ago: executing program 1 (id=2382): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = fsopen(0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x1) r3 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r3, &(0x7f0000002700)=""/102392, 0x18ff8) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000007e00), r4) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r4, &(0x7f0000007f80)={0x0, 0x0, &(0x7f0000007f40)={0x0}, 0x1, 0x0, 0x0, 0x40040}, 0x40000) fsmount(r2, 0x0, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'netdevsim0\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000440)={0x0, 0x700, &(0x7f0000000580)={&(0x7f00000002c0)=@newlink={0x44, 0x10, 0x403, 0x70bd2b, 0x0, {0x0, 0x0, 0x4, 0x0, 0x3ef, 0xf00}, [@IFLA_LINK={0x8, 0x5, r6}, @IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @vlan={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6, 0x1, 0x2}]}}}]}, 0x44}}, 0x4004850) r7 = syz_genetlink_get_family_id$devlink(&(0x7f0000000200), r1) sendmsg$DEVLINK_CMD_PORT_GET(r1, &(0x7f0000000380)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000340)={&(0x7f0000000240)={0xac, r7, 0x10, 0x70bd2d, 0x25dfdbff, {}, [{{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x1}}}]}, 0xac}, 0x1, 0x0, 0x0, 0x20048845}, 0x1) r8 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_DEBUG_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000080)={0x44, r8, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_DEBUG_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}, @ETHTOOL_A_DEBUG_MSGMASK={0x18, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_BITS={0x10, 0x3, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8}]}]}]}]}, 0x44}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$TIPC_NL_PEER_REMOVE(r1, &(0x7f0000000740)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000700)={&(0x7f0000000400)={0x2b4, r9, 0x20, 0x70bd2c, 0x25dfdbfe, {}, [@TIPC_NLA_MON={0x2c, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xc}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x69}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x2}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x6}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x800}]}, @TIPC_NLA_BEARER={0x108, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x8}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e24, @private=0xa010100}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x9, @empty, 0x62}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e21, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0xd5}}, {0x20, 0x2, @in6={0xa, 0x4e24, 0x7, @empty, 0x367}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x200}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}]}]}, @TIPC_NLA_PUBL={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x800}]}, @TIPC_NLA_MEDIA={0xc, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_NODE={0x8, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY_MASTER={0x4}]}, @TIPC_NLA_MON={0x14, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xd}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xed0}]}, @TIPC_NLA_LINK={0x28, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3e5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x926e}]}]}, @TIPC_NLA_BEARER={0x110, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e20, @rand_addr=0x64010101}}, {0x20, 0x2, @in6={0xa, 0x4e20, 0x6, @empty, 0x7}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x24000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x100}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x40}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7ff}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e24, 0x6, @local, 0x800}}, {0x20, 0x2, @in6={0xa, 0x4e21, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x55cb3af0}}}}, @TIPC_NLA_BEARER_NAME={0x9, 0x1, @l2={'eth', 0x3a, '\x00'}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @l2={'ib', 0x3a, 'vlan0\x00'}}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x51f1, @private=0xa010100}}, {0x20, 0x2, @in6={0xa, 0x4e20, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0xb}}}}]}]}, 0x2b4}, 0x1, 0x0, 0x0, 0x20008001}, 0x4000) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="bc010000190001000000000003000000ac141425000000000000000000000000fe8000000000000000000000000000aa00000000fffd00060a000080", @ANYRESHEX=r8, @ANYRES32=r1, @ANYRESOCT=r1], 0x1bc}, 0x1, 0x0, 0x0, 0x20000040}, 0x10) 6.504779813s ago: executing program 0 (id=2383): syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(0xffffffffffffffff, 0xc01864c6, &(0x7f0000000080)={&(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0], 0x4, 0x40000, 0x0, 0xffffffffffffffff}) pidfd_send_signal(r0, 0xc, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) pipe2(&(0x7f0000000000)={0x0, 0x0}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r3, 0x0, r5, 0x0, 0x8000f28, 0x8) splice(r4, 0x0, r3, 0x0, 0x33fe0, 0x1) write$cgroup_devices(r5, 0x0, 0x8) close_range(r2, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'veth1_to_hsr\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0xfffffffc, 0x25dfdbf9, {0x0, 0x0, 0x0, r6, {0x0, 0x3}, {0xffff, 0xffff}, {0xf}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_WASH={0x8, 0xd, 0xfffffffe}, @TCA_CAKE_DIFFSERV_MODE={0x8, 0x3, 0x1}]}}]}, 0x44}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[@ANYBLOB="800000001000030400000000fcdbdf2500007400", @ANYRES32=0x0, @ANYBLOB="1018000007500500620012800b000100ee5b91408550565da5359ef5e5aa62726964676500005000028005001900020000000500170000000000080004008400000005001620010000000a0014000180c2000000000005002600010000000c001f0003000000000000000c0022000400000000000000d570e9d0c06f7b9071522f2cbab9bde1481211fbb40ac624c24a64fd8af610aa6ecd503e4d57d27282d6650010000000000000f8aefac8bf4a293c2d17359026eded2d044bc0f4437fa4256d93c601e1130080ae8bbc6d5284131fdfab266a57f24df8496f0255c09a0206287d0b8ad7c5a213f142d59ba4304b8847b15fb6d90263a84c3343e00323f1c1fa1bed65abca4af82ca7f7ea341300586edae461effe44b45e4836e6"], 0x80}, 0x1, 0x0, 0x0, 0x800}, 0x0) 5.865368217s ago: executing program 1 (id=2384): write$smackfs_ipv6host(0xffffffffffffffff, 0x0, 0xd2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './cgroup\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = open(&(0x7f0000000500)='./cgroup\x00', 0x145142, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x143042, 0x0) pwritev2(r4, &(0x7f0000000100)=[{&(0x7f0000000080)="ff", 0xabfb}], 0x1, 0x5405, 0x0, 0x0) copy_file_range(r4, &(0x7f0000000000)=0x3ff, r4, 0x0, 0x6, 0x0) sendfile(r3, r3, 0x0, 0x800000009) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newtaction={0x48, 0x30, 0x53b, 0x0, 0x0, {0x9}, [{0x34, 0x1, [@m_sample={0x30, 0x1, 0x0, 0x0, {{0xb}, {0x4}, {0x4}, {0xc}, {0xc, 0x4, {0x3}}}}]}]}, 0x48}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000000c0)=ANY=[@ANYRESHEX=r3, @ANYRES32=0x0, @ANYBLOB="20dd0100", @ANYRES32=0x0, @ANYBLOB="01000300ac1e000100040000000000000000400086dd0000"], 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x0) mmap$snddsp_status(&(0x7f00008d5000/0x3000)=nil, 0x1000, 0x4, 0x1012, 0xffffffffffffffff, 0x82000000) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03003f000b05d25a806c8c6394f90324fc60100002000a000300053582c137153e3704020180fc0b09000c00", 0x33fe0}], 0x1}, 0x0) 5.799935295s ago: executing program 6 (id=2385): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x18, 0x5, &(0x7f00000000c0)=ANY=[@ANYBLOB="180000001400000000000000ff000000850000000e000000850000000700000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) socket$inet6(0xa, 0x1, 0x8001) r1 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000000)='kmem_cache_free\x00', r0}, 0x18) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000140)={r1, r0, 0x0, r0}, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000400), r3) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000100)={'wpan0\x00'}) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00'}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) mremap(&(0x7f0000151000/0x3000)=nil, 0x3000, 0xa000, 0x3, &(0x7f0000ff5000/0xa000)=nil) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket(0x840000000002, 0x3, 0xff) read$FUSE(0xffffffffffffffff, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r6 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$IOCTL_GET_NUM_DEVICES(r6, 0x40046104, &(0x7f00000002c0)) openat$udambuf(0xffffffffffffff9c, &(0x7f00000000c0), 0x2) unshare(0x480) landlock_create_ruleset(&(0x7f0000000180)={0x100, 0x2, 0x1}, 0x18, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f000000e400)={0x2020}, 0x2020) 5.598461607s ago: executing program 0 (id=2386): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000040)={0x0, @rand_addr, @local}, &(0x7f00000000c0)=0xc) r2 = syz_open_dev$vim2m(&(0x7f0000000380), 0x2, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r2, 0xc0d05605, &(0x7f00000000c0)={0x1, @pix_mp={0x0, 0x0, 0x34565348, 0x0, 0x0, [{}, {}, {}, {0x4}]}}) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="d5"], 0x24}, 0x1, 0x0, 0x0, 0x41}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_io_uring_setup(0x0, &(0x7f0000000580)={0x0, 0x226f, 0x13500, 0x0, 0xeffffffd}, &(0x7f0000000240), &(0x7f0000000300)) r3 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'bond0\x00', 0x0}) (async) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000800)=ANY=[@ANYBLOB="48010000100013070000000000000000fe880000000000000000000000000001ac1e000100"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ac14142800000000000000000000000000000000330000002001000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000023500000200000000000000000000000c001c00", @ANYRES32=r4, @ANYBLOB="06000300000000000000613100000000000000000001000000000000000000a62defcd00000000000000003069794cb9ed1cd1ea00"/80], 0x148}}, 0x0) (async) ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000100)={0x1, "ff0f000000000000f5a72d866b0000000000f0ffdefe00"}) (async) r6 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x8, 0xf, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x1c000000, 0x0, 0x0, 0x0, 0xffff}, {{0x18, 0x1, 0x1, 0x0, r6}, {}, {}, {0x85, 0x0, 0x0, 0x54}}, {{0x5, 0x0, 0x3}}, [], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x5}}}, &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @cgroup_skb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r8 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r8, 0xc0184800, &(0x7f0000000100)={0x4, r7}) ioctl$DMA_BUF_SET_NAME_A(r9, 0x40086203, &(0x7f00000001c0)='\x02\x00\x00\x00\x05\x00\x00\x00-control\x00') write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8000, 0xc95a, 0xf, 0x8, 0x80, 0x2, 0x7, 0x7f, 0xa9, 0x4d, 0x6, 0x5f, 0x9, 0x15, 0xffff2d37, 0xff7fff01, 0x6, 0x5, 0x7, 0x5, 0x6, 0x0, 0x7, 0x3c5b, 0x1, 0x24, 0xd, 0x1, 0x0, 0xffffffff, 0xe661, 0x4, 0x7, 0x5, 0x8, 0x4c74, 0x10000, 0x242, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x17, 0x1, 0x7, 0x5, 0x3e, 0x18e, 0x6, 0x6, 0x0, 0x6, 0x4, 0x8, 0x3ff, 0x80, 0x0, 0x5, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432f6, 0xc8, 0xf1, 0xe, 0x2bf, 0x6c7, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x2f, 0xe, 0x312, 0x66abcbd2, 0xea4, 0x0, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x5, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x381, 0x4, 0xb, 0x4, 0x9, 0x8, 0x40, 0x6, 0x47, 0x8000, 0x1, 0xfe000000, 0xffff, 0x2, 0x4, 0x9, 0x3, 0x3, 0x4000009, 0x6, 0x0, 0x3, 0xbc45, 0x48c93690, 0x42, 0x3], [0x7, 0x408, 0x3ff, 0x5, 0xfffffffd, 0x100, 0x4, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x5, 0x9, 0x86, 0x3, 0x303c, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x4, 0x6d01, 0x6, 0x38, 0x200, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x4, 0xa9, 0x5, 0x6, 0xac8, 0xbf, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0xa, 0xffffffff, 0x5, 0x1c, 0x120000, 0x7ff, 0x2006, 0x80a2ed, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xce4, 0x1ff, 0x2, 0x57, 0x5, 0x3, 0x2, 0x10000, 0x4, 0x7fff, 0xffff, 0xa620, 0x1, 0x5, 0x1, 0x2000002, 0x150, 0x60a7, 0x6, 0x16, 0xffffffff, 0x80000000, 0x5, 0x5, 0xc8, 0x1, 0xfffff000, 0x10000, 0x3, 0x7e, 0x100, 0x9622, 0x7, 0xaf, 0x20000008, 0x5, 0x226, 0x2, 0x5, 0x0, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x530e, 0x6c1b, 0x0, 0x4, 0x5, 0x7ff, 0xd7, 0x200, 0xb, 0xfffffff8]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) (async) r10 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0006}]}) close_range(r10, 0xffffffffffffffff, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup.net/syz0\x00', 0x1ff) recvmmsg$unix(r1, &(0x7f0000000040), 0x0, 0x100, 0x0) write(r1, &(0x7f0000000100)="1400000052004f7fb3e4bf80a000080000000000", 0x14) (async) r11 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000001180)=ANY=[@ANYBLOB="12010000090003206d0414c34000ffff000109022400010400a000090400000103010100093700086ce82201000905815f"], 0x0) syz_usb_control_io(r11, &(0x7f00000001c0)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0xfb, 0x10, 0x0, 0xe6, 0x9, 0x400, 0x9}}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB='T\x00'/20, @ANYRES32=0x0, @ANYBLOB="00000000a8000600340012800b0001006272696467650000240002800c002000080000000000000005002a00000000000c0023000500000000000000"], 0x54}}, 0x24008040) socket$alg(0x26, 0x5, 0x0) 4.660721368s ago: executing program 1 (id=2387): socket$inet_udp(0x2, 0x2, 0x0) (async) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) connect$inet(r0, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40080}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) openat(0xffffffffffffff9c, &(0x7f00000002c0)='./file1\x00', 0x8042, 0x0) (async) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./file1\x00', 0x8042, 0x0) setreuid(0x0, 0xee01) fcntl$setlease(r2, 0x400, 0x1) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='cmdline\x00') (async) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='cmdline\x00') read$nci(r6, 0x0, 0x0) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) keyctl$clear(0x7, 0x0) r7 = openat$nullb(0xffffffffffffff9c, 0x0, 0x4000, 0x0) preadv2(r7, &(0x7f0000000080)=[{&(0x7f0000001200)=""/4096, 0x100000}], 0xc4, 0x0, 0x0, 0x9) (async) preadv2(r7, &(0x7f0000000080)=[{&(0x7f0000001200)=""/4096, 0x100000}], 0xc4, 0x0, 0x0, 0x9) socket$inet6(0xa, 0x80002, 0x0) (async) r8 = socket$inet6(0xa, 0x80002, 0x0) sendto$inet6(r8, 0x0, 0x0, 0x4008000, &(0x7f0000000280)={0xa, 0x4e1f, 0x80000, @loopback, 0x7}, 0x1c) (async) sendto$inet6(r8, 0x0, 0x0, 0x4008000, &(0x7f0000000280)={0xa, 0x4e1f, 0x80000, @loopback, 0x7}, 0x1c) sendto$inet6(r8, 0x0, 0x0, 0xc001, 0x0, 0x0) (async) sendto$inet6(r8, 0x0, 0x0, 0xc001, 0x0, 0x0) setsockopt$inet6_udp_int(r8, 0x11, 0x1, &(0x7f0000000080), 0x4) (async) setsockopt$inet6_udp_int(r8, 0x11, 0x1, &(0x7f0000000080), 0x4) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000040)={0x100000011, @multicast2, 0x0, 0x0, 'rr\x00', 0x0, 0x80001088, 0x73}, 0x2c) 4.495891095s ago: executing program 8 (id=2388): prlimit64(0x0, 0xf, &(0x7f0000000040)={0xa}, 0x0) r0 = add_key$user(0x0, 0x0, &(0x7f00000000c0), 0x0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f00000191c0)={0x0, r0, r0}, 0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) getpid() r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'bond0\x00'}) r2 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0) write$tcp_congestion(r2, &(0x7f0000000100)='reno\x00', 0x5) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000380)={'wlan0\x00', 0x0}) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8000}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r7 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r7, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$SMC_PNETID_DEL(0xffffffffffffffff, 0x0, 0x0) setsockopt$IPT_SO_SET_REPLACE(r6, 0x0, 0x40, &(0x7f0000000580)=@raw={'raw\x00', 0x8, 0x3, 0x3b0, 0x0, 0x43, 0xa0, 0x1d0, 0x98, 0x318, 0x178, 0x178, 0x318, 0x178, 0x49, 0x0, {[{{@ip={@loopback, @local, 0x0, 0x0, 'veth0_to_bond\x00', 'ip6erspan0\x00'}, 0x12a, 0x1b0, 0x1d0, 0x0, {0x0, 0x7a010000}, [@common=@inet=@recent0={{0xf8}, {0x0, 0x0, 0x8, 0x0, 'syz0\x00'}}, @common=@unspec=@helper={{0x48}, {0x0, 'ftp-20000\x00'}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0xe8, 0x148, 0x0, {}, [@common=@unspec=@connbytes={{0x38}, {[{0xb}]}}, @common=@set={{0x40}, {{0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x300]}}}]}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv4=@multicast1}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x410) sendmsg$NL80211_CMD_TRIGGER_SCAN(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r5, @ANYBLOB="01002dbd7000fbdbdf252100000008000300", @ANYRES32=r4, @ANYBLOB="04002c80"], 0x20}, 0x1, 0x0, 0x0, 0x20}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x17, 0x3, &(0x7f0000000200)=@framed, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sysctl=0x12, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0xa0) openat(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup\x00', 0x0, 0x0) unshare(0x2040400) r8 = socket$xdp(0x2c, 0x3, 0x0) bind$xdp(r8, 0x0, 0x0) 4.290325778s ago: executing program 5 (id=2389): memfd_create(&(0x7f0000000000)='\xfb\"a&\x8fe\x11\x8c\xd64\xf9 \x00\x00\x00\x00\x00\x12\x1a\'<\xf5\xbeV\x12\xaal\xfa\xf0o\xd8\xb1,\xbd>M\xe3\x98?\xd9\x96\xab\xc7\x06F\x9b\xab\xc8\x1e\x89]\x13bZ\x8d /#k\x95\x9eLV(\x8a\x0e\x93\x93Vc]mP\xbativ\xce\xa4K\xfb\xf2\xe0\xbf\x9d\xa1\xa2\xcd\xb39\xb4\x17a9\x1c\x82\x1aLT\xd0\xb9\x1a\xafB\x95\xb4\xcf\x91X\x8c\x87\xc2\xa1\x1b\xfe\xe7\xbc\xf7\xeb\xdeL\x1d\x98Zq\xcc%\x98\xb0Yc\xec\xb7\xb5m(9\xde\xd3\xefB\xd4\xee\xb5\xee\xe0\xaa\xdd\x00\xb1jOB\xdas\xe3\xb47}%)\xb9\xbf{\xce\x94^\xec\xdf\xbcW\xe0I\x0e\xa4\x1e}\x06\vK\xed\x11\x880\x0e\x9c\xaeVU\x88\xb0\x842kgA]\x1e\x88\xecif\xee\xba\x8b\xc6\"\xcej\x84\x06\x8a\x99\x80\xd7\xcf\x96\xed\x89\x1e6\x93+\xec#\x1d2\xb8\x80Z\xf7\x06\xbe\xc9[L\xc5\xc9\xb5\xd6{\xee\xce\x17\x89\xa6r\xc5j\xec\x1b\xaa\x996\x14e\xcf\x8axQ\x8fXeT\'0.\x85\xa2\xc8\xb3c\t\xe8\x1a\x89\xecL\xcf\xd8\xb5\xfb\xbc\tX\x88\xbe\xf4@[\xb2\xd5\x8c\xb9\x0e\x17\x8b\xce\xd09\xd2\xfb\x9e\xef\xabR\x88\x17\x9et\xf7\x9c\x01\x91\xacH\xdb\xf9\xcb\x7fh\x83>\x8e\xe1=\xedR\xc9\xe68h\x19\xafLD\x94\x93\xebT\x15\x817\x9d#\xea\xd2\xa8\xfb^\x8c\x87#\x10', 0x7) ioctl$VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f00000004c0)={0xf, 0xa, 0x3, 0x0, 0x4}) syz_usb_connect(0x2, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201000009968810524711004f320102030109021b0001000000000904000001ff0132000905"], 0x0) writev(0xffffffffffffffff, &(0x7f0000000480)=[{&(0x7f0000000180)="e577098412c0e3b43d0c4bcfaf70342f21b857458f6579fc645884a2d2b9b4f0d7b87aff7a7635803d65c1ff80c5c464ea9bb93899764254b5cfa22b2fc8f52485f71bf79f6369afbc6fe1a635509ba0ae37a4a2da3a0048fbde28a8275433aa9ca630a318e5d943695aa195c4ddd8b6cc0ff7752d88e78cf66cc4d18dcd0edcc4eb959cfcbe097f47620f8e30379631fb6789b0bc17674c9a3a53edbf0fcc5f4f8ce9c011b1642d25ac426f5a5c45e040290ffa", 0xb4}, {&(0x7f0000000240)="c7daebebd152a6b45a675488362367c2c88669fd8905c34aabb647de94fd0e7a1519a854e23523c3e056158b432bf5c972cdd3ece648a5db7776178a397ae52e02fd1f8d48deb38f454a8e8e5b1598438bd0a90a749ca058e324b9bc6a55cfbfcd19cf2aec9ef340ba25478de34df0ff7306c18caa28c68a8b1a7053ba15007cc20c6210b15c1330151768979bad02b82d0c0bc700c33ec14ac961a0d387", 0x9e}, {&(0x7f0000000300)="b7f9ee89331ffd8413e2cdd2cb538ec252370bbc9361e8db6330de69d0aa668b5b79a8f57b0142a73da40001be5ec36333193a8bc36a2c8be81bbedaaa1b3a5b56dd6ff00bf7f41fcc0077abf36a0654c571f0f2e0df5c2e1d75af0189d15a9904de023d7bceeae7", 0x68}, {&(0x7f0000000380)="85fae43c0b05477ee32af2e8707280d215b096d57c7cf7a89a9dff7691bc722eddf8619a325883d17f7601ce2b75dc14fe5b63fc278540c17bf31be542a49fbbfcda07f1914ccb3388b6f946575c134506bca56f4940a75c57e35f256d755c9f3f2504aa89cde2baa9ae51bffd66ef76cbf9b1258a3c36751e3c39f818c5e3808dbb88bf03364fc4c76a42b676649277dd61f7966bf7e6b72257e9f3a6c1d3e5b2946a86dc7502c99dfa684f1e3c6b285d37454ff21ad7dade764852bf93de2f58df052ba3f01c7929ba40662d43f6dc997700b37832d6456a53b9", 0xdb}], 0x4) 3.629490822s ago: executing program 8 (id=2390): r0 = io_uring_setup(0x27e0, &(0x7f0000000000)={0x0, 0x0, 0x1000, 0x0, 0x1a4}) r1 = io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_PERSONALITY(r0, 0x1b, 0x20000009, r1) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, 0x0) r2 = userfaultfd(0x80800) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x48}) read(r2, &(0x7f0000000140)=""/238, 0x20) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000100)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x0, 0x10, &(0x7f0000000580)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r4, &(0x7f0000000300)=ANY=[@ANYBLOB="1500000065ffff017f000e0800395032303030"], 0x15) r5 = dup(r4) open(&(0x7f0000000100)='./file0\x00', 0x440, 0x0) write$FUSE_BMAP(r5, &(0x7f0000000000)={0x18, 0x0, 0x0, {0x3b9}}, 0x18) write$FUSE_INIT(r5, &(0x7f0000000200)={0x50, 0x0, 0x0, {0x7, 0x2b, 0x0, 0x8004000, 0x7, 0x8, 0x8000, 0x4, 0x0, 0x0, 0x10, 0x5}}, 0x50) write$FUSE_GETXATTR(r5, &(0x7f00000000c0)={0x18}, 0x18) write$FUSE_DIRENTPLUS(r5, &(0x7f00000005c0)=ANY=[@ANYBLOB="b900"], 0xb8) mount$9p_fd(0x0, &(0x7f0000000400)='./file0\x00', &(0x7f0000000080), 0x1010412, &(0x7f0000000700)={'trans=fd,', {'rfdno', 0x3d, r3}, 0x2c, {'wfdno', 0x3d, r5}, 0x2c, {[{@cache_fscache}]}}) r6 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x22) r7 = syz_open_dev$dri(&(0x7f0000000080), 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x4, 0x11, r7, 0x100000) writev(r6, &(0x7f0000000000)=[{&(0x7f00000006c0)='\t', 0x201e}], 0x1) getsockopt$inet6_IPV6_XFRM_POLICY(r5, 0x29, 0x23, &(0x7f0000000240)={{{@in=@multicast2, @in6=@private2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@private0}}, &(0x7f0000000340)=0xe8) quotactl_fd$Q_QUOTAON(r2, 0xffffffff80000200, r8, &(0x7f0000000080)='./file0\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) 3.200012357s ago: executing program 6 (id=2391): syz_open_dev$dri(0x0, 0x1ff, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x181040, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f000001aa40)=""/102400, 0x19000) openat$procfs(0xffffffffffffff9c, &(0x7f00000021c0)='/proc/asound/timers\x00', 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x0, 0x2, @empty}, 0x27) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x1, &(0x7f0000000140)=@gcm_128={{0x303}, "87ee8ac6c46dad33", "2607080d7f4fcf00fd4ef2dece6c7c58", '\x00', '#\x00'}, 0x28) sendmsg$inet(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f0000000240)="6e37cff5b5", 0x5}], 0x1}, 0x0) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x2, &(0x7f0000000680)=@gcm_128={{0x303}, "000037d7009400", "c0b6c5b29ca2b838d41ac2fc7ddf972d", "e9be1eae", "bb10000000000001"}, 0x28) readv(r1, &(0x7f0000000e40)=[{&(0x7f0000000f40)=""/250, 0xfa}], 0x1) 3.03314152s ago: executing program 6 (id=2392): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r1 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$IMADDTIMER(r1, 0x80044940, &(0x7f0000000040)) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') mount$9p_fd(0x0, &(0x7f00000001c0)='.\x00', &(0x7f0000000180), 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRESHEX=r2]) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r3, 0x4068aea3, &(0x7f0000000140)={0x79, 0x0, 0x1}) r4 = semget$private(0x0, 0x3, 0x0) semop(r4, &(0x7f0000000100)=[{0x2, 0xd5db}], 0x1) semctl$SETALL(r4, 0x0, 0x11, &(0x7f0000000080)) getresuid(&(0x7f0000000080)=0x0, &(0x7f0000000100), &(0x7f00000001c0)) r6 = getegid() getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@private0, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in6=@loopback}}, &(0x7f00000003c0)=0xe8) getgroups(0x2, &(0x7f0000000400)=[0xee00, 0xee00]) semctl$IPC_SET(r4, 0x0, 0x1, &(0x7f0000000440)={{0x1, r5, r6, r7, r8, 0x9, 0x15}, 0x2, 0x9, 0x0, 0x0, 0x0, 0x0, 0x401}) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r9 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='ext4_mb_release_group_pa\x00', 0xffffffffffffffff, 0x0, 0x4}, 0x18) r10 = dup(r9) ioctl$KVM_SET_MSRS(r10, 0xc008ae88, &(0x7f00000000c0)=ANY=[@ANYBLOB="820000000000000071000040"]) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xa, 0x3, &(0x7f00000004c0)=ANY=[@ANYBLOB="660a000000000000616d96e8118e00040000009500000000000000"], &(0x7f0000000000)='GPL\x00'}, 0x94) r11 = socket$kcm(0x29, 0x2, 0x0) accept(r11, 0x0, 0x0) 2.970126382s ago: executing program 5 (id=2393): sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0xd7aeb000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x10) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) chdir(&(0x7f00000000c0)='./file0\x00') fspick(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x8000000) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) lsetxattr$security_evm(0x0, &(0x7f00000003c0), &(0x7f0000000400)=@v2={0x3, 0x1, 0x8, 0x7}, 0x9, 0x1) chdir(&(0x7f00000001c0)='./bus\x00') r3 = socket$igmp6(0xa, 0x3, 0x2) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x50, 0x20}]}, 0x10) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) socket$nl_rdma(0x10, 0x3, 0x14) 2.263581479s ago: executing program 1 (id=2394): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = fsopen(0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x1) r3 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r3, &(0x7f0000002700)=""/102392, 0x18ff8) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000007e00), r4) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r4, &(0x7f0000007f80)={0x0, 0x0, &(0x7f0000007f40)={0x0}, 0x1, 0x0, 0x0, 0x40040}, 0x40000) fsmount(r2, 0x0, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'netdevsim0\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000440)={0x0, 0x700, &(0x7f0000000580)={&(0x7f00000002c0)=@newlink={0x44, 0x10, 0x403, 0x70bd2b, 0x0, {0x0, 0x0, 0x4, 0x0, 0x3ef, 0xf00}, [@IFLA_LINK={0x8, 0x5, r6}, @IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @vlan={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6, 0x1, 0x2}]}}}]}, 0x44}}, 0x4004850) r7 = syz_genetlink_get_family_id$devlink(&(0x7f0000000200), r1) sendmsg$DEVLINK_CMD_PORT_GET(r1, &(0x7f0000000380)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000340)={&(0x7f0000000240)={0xac, r7, 0x10, 0x70bd2d, 0x25dfdbff, {}, [{{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x1}}}]}, 0xac}, 0x1, 0x0, 0x0, 0x20048845}, 0x1) r8 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_DEBUG_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000080)={0x44, r8, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_DEBUG_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}, @ETHTOOL_A_DEBUG_MSGMASK={0x18, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_BITS={0x10, 0x3, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8}]}]}]}]}, 0x44}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$TIPC_NL_PEER_REMOVE(r1, &(0x7f0000000740)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000700)={&(0x7f0000000400)={0x2b4, r9, 0x20, 0x70bd2c, 0x25dfdbfe, {}, [@TIPC_NLA_MON={0x2c, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xc}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x69}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x2}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x6}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x800}]}, @TIPC_NLA_BEARER={0x108, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x8}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e24, @private=0xa010100}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x9, @empty, 0x62}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e21, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0xd5}}, {0x20, 0x2, @in6={0xa, 0x4e24, 0x7, @empty, 0x367}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x200}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}]}]}, @TIPC_NLA_PUBL={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x800}]}, @TIPC_NLA_MEDIA={0xc, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_NODE={0x8, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY_MASTER={0x4}]}, @TIPC_NLA_MON={0x14, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xd}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xed0}]}, @TIPC_NLA_LINK={0x28, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3e5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x926e}]}]}, @TIPC_NLA_BEARER={0x110, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e20, @rand_addr=0x64010101}}, {0x20, 0x2, @in6={0xa, 0x4e20, 0x6, @empty, 0x7}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x24000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x100}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x40}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7ff}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e24, 0x6, @local, 0x800}}, {0x20, 0x2, @in6={0xa, 0x4e21, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x55cb3af0}}}}, @TIPC_NLA_BEARER_NAME={0x9, 0x1, @l2={'eth', 0x3a, '\x00'}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @l2={'ib', 0x3a, 'vlan0\x00'}}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x51f1, @private=0xa010100}}, {0x20, 0x2, @in6={0xa, 0x4e20, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0xb}}}}]}]}, 0x2b4}, 0x1, 0x0, 0x0, 0x20008001}, 0x4000) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="bc010000190001000000000003000000ac141425000000000000000000000000fe8000000000000000000000000000aa00000000fffd00060a000080", @ANYRESHEX=r8, @ANYRES32=r1, @ANYRESOCT=r1], 0x1bc}, 0x1, 0x0, 0x0, 0x20000040}, 0x10) 2.213566067s ago: executing program 0 (id=2395): ioctl$vim2m_VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, &(0x7f0000000200)={0x13, 0x2, 0x1, "bc57499e007105bf0000000100000000e40300", 0x50424752}) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) fremovexattr(0xffffffffffffffff, 0x0) (async) r0 = syz_io_uring_setup(0x10d2, &(0x7f0000000480)={0x0, 0x7732, 0x80, 0x1, 0x222}, &(0x7f0000000100)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) (async) connect$inet6(0xffffffffffffffff, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) (async) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) (async) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_REMOVE={0x7, 0x15523ea56aa22b9a, 0x0, 0x0, 0x0, 0x12345}) io_uring_enter(r0, 0x47be, 0x0, 0x0, 0x0, 0x0) (async) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2, 0xc3072, 0xffffffffffffffff, 0x200000) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) (async) r3 = socket$rxrpc(0x21, 0x2, 0x2) r4 = syz_open_dev$mouse(&(0x7f0000000080), 0xe, 0x100) (async) r5 = io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000140)=@IORING_OP_MKDIRAT={0x25, 0x46, 0x0, r4, 0x0, &(0x7f00000000c0)='./file0\x00', 0x45, 0x0, 0x0, {0x0, r5}}) (async) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) (async) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 1.50830048s ago: executing program 6 (id=2396): bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x9, 0x4, &(0x7f0000000280)=ANY=[@ANYBLOB], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sock}, 0x94) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET(r0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000380)=ANY=[@ANYBLOB="40000000010205000000000000000000020000002c0002801400018008000100ac1414aa08000200ac1414bb06000340000000000c000280050001"], 0x40}}, 0x80) 1.45251356s ago: executing program 8 (id=2397): r0 = socket$kcm(0x2, 0x5, 0x84) sendmsg$inet(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f00000003c0)=[{0x0}], 0x1}, 0x8001) r1 = socket$kcm(0x10, 0x2, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000001c0)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x6770c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$inet(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000000)="5c00000012006b03000000d86e6c1d0002847ea622fb564500004e23e3f58e76110165f450e71b0075e3002500028d459e37000f0000000000bf9367b47e51f60a64c9f4d4938037e786a6d0bdd700"/92, 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) 1.429009829s ago: executing program 1 (id=2398): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="18020000000000000000000000000001850000002c00000095000000000000004495e980d4ab43a654dbda1289491fde9751ca443daaa97c18e213"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, '\x00', 0x0, @xdp}, 0x70) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)=@newlink={0x44, 0x10, 0x801, 0x70bd28, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x42004}, [@IFLA_XDP={0x1c, 0x2b, 0x0, 0x1, [@IFLA_XDP_EXPECTED_FD={0x8, 0x8, r0}, @IFLA_XDP_FLAGS={0x8, 0x3, 0x19}, @IFLA_XDP_FD={0x8, 0x1, r1}]}, @IFLA_GROUP={0x8}]}, 0x44}}, 0x0) r2 = syz_io_uring_setup(0x497, &(0x7f0000000200)={0x0, 0x7279, 0x0, 0x2, 0x35f}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f00000002c0)=@IORING_OP_ASYNC_CANCEL={0xe, 0x40, 0x0, 0x0, 0x0, 0x91a2, 0x0, 0x0, 0x1}) r5 = syz_io_uring_setup(0x10e, &(0x7f0000000140)={0x0, 0x334e, 0x10, 0x3, 0x801}, &(0x7f00000003c0)=0x0, &(0x7f0000000300)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r6, r7, &(0x7f0000000000)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, &(0x7f0000000040)='./file0/file0\x00', 0x60, 0x185100}) io_uring_enter(r5, 0x7277, 0x0, 0x0, 0x0, 0x0) io_uring_enter(r2, 0x3512, 0x0, 0x0, 0x0, 0x0) syz_usb_connect(0x2, 0x91, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0xe5, 0x20, 0x4f, 0x20, 0x5e3, 0x572c, 0x278, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x7f, 0x1, 0x0, 0x0, 0x90, 0x0, [{{0x9, 0x4, 0x14, 0x0, 0x2, 0x9, 0x4b, 0xc2, 0x0, [@cdc_ecm={{0xb, 0x24, 0x6, 0x0, 0x0, "af285ac3fe16"}, {0x5, 0x24, 0x0, 0x4}, {0xd, 0x24, 0xf, 0x1, 0xffffff66, 0x3, 0xfffc, 0xd}, [@country_functional={0xa, 0x24, 0x7, 0x3, 0x65, [0x94, 0x0]}, @network_terminal={0x7, 0x24, 0xa, 0xf, 0x0, 0x1, 0xfa}, @dmm={0x7, 0x24, 0x14, 0x1e09, 0xf}]}], [{{0x9, 0x5, 0x0, 0x2, 0x3ff}}, {{0x9, 0x5, 0x82, 0x2, 0x8, 0x0, 0x0, 0x0, [@generic={0x26, 0x30, "49362b3fb591ece03980802713131c6ff0b1cc2106ded9c02ae4068793c28713c570dda7"}]}}]}}]}}]}}, 0x0) 164.248804ms ago: executing program 6 (id=2399): r0 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r2 = socket$kcm(0x2b, 0x1, 0x0) setsockopt$sock_attach_bpf(r2, 0x0, 0x61, 0x0, 0xa4d4) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = io_uring_setup(0xf08, &(0x7f000000c480)={0x0, 0x4e43, 0x400, 0x20001, 0x2}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r5 = memfd_create(&(0x7f0000000b40)='Y\xff\xff\x00\x00\x00\x00\x00K\xb2\x02\x80B\xe9\xe8\xcc\xde\x06\x00l\xa8\x1aJ\xaf\xb2M\xba\xb8_\x05U\xcd<|>\x9e\xec^\x0e\xbe\x18+-\x9b\x893\x02\x00\xa6\x1f+\xb3\xc5\x90z5\xe0\xdfi\xb7\x9f\xb4QW\xc9\xc9\x92\x03\t\x00\x00\x00\x00\x00\xb2\x0f\xee\xbe\f8\xcc\x7f\x00\x00\x00Z\x81\x00\x00\x00\x00\x18I\x13\xf1\xa2x\x04\x81R\xd45R\xae\x84\xcdN\xf7\xf6\b~\xed_M^dQ:\xbc\xafq\x88\x19nSF|;]\xe1A\x8c\x8a\x98\xd7|\xadNaC\xa6\xf9\xa7>c\x84\xd8\xfa\xf1\r\xb1\xfd\xbf!\xc7u\xccP\xdd\x13~\x89\xcf\x85\xca\xa0%\xc6\xc7\x11\x00\x00\x00\x00\x00\x00\x00?M9\\\av~\'\xd9\xb0\xacdya]8\x9d\xb7\v\xf39\xc5{\x9c!\x0f/\xb8g8\xb9\x8d\x19\xe2\xca\x01y\x83\xe7\ng\x87\xd93\xd8\x12\x8cXc5%\x03\x8d`\xdayC\x9b\x9a\xd9c\xe9\xb4\v\x99\x87\xe4\x00\x8a\x8eS\x8e\f\x05ZH\xa2\x0e\xbc\x9c\x95\b2Cf6\x9a\xe7\xb9\x86\xbe\xd0\xda\x91\xc1sl\x11PA\x93\xa5\x93\xc8\xf1w\x7fp6z\xbf\xe8[\'u\xb8\xd2$K\x12\rt\x87\x00\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00r\xe2`\xdf\xd2\xb3\xaf\xe9\xc4!Z\xb4&\xa2\x12\xe2i\x91kC$A\xafR\xb3\xff\x1d=Z\x0e\xde\x99\xec\x10\xb4+\x13\'\x92>\x14\x00\a\xb6R\x8b\xdcz\xc3\xd1Y\xd6\xd9;s \xb0\x938\xb7D9\xdcN\xbd\xdbn\xe35\xa7\x02\x9c\xc1\xd9\x13?\xc9\xd7\xab\x9c\xf3\x82\xd1\xee^kk\xce\xdbn\x02\x1f\x80\t\xdbr\xa9\xcc\xf1\xcb\x9f@\x8c\xfc\x02W/p\x97\xb0\xbd\x8f\xdb|n2a\xee\x95u\x83\xca\x8a>}\xd3\xd0\xff6.pa\x17\xe3e\xd2\x7f\xf6\xbc\x9d\x112\x1b\x14p\xa1\xd6u\xefn\xb4\xa3\x05D\x8c\xc5l\xcc\b\xeb\xf42\xe9\xf15\xf3\xf2\xee\xd6\xed\t\xb3\xf7\x1a\x7f\xe6\xb4z\x19\xe1\xb4w\xf7\xa6\xd7\\\xfa\x96\xe2\xf9\xb1\x81\xba\xdfg\xadI\x1c\xde*_\xd5\xdf\xeeA\xcd \x91\xc9\xd4\xd1\xcd*.t\x80]\xd5~\xfb\xfb>\x9d\x91Kq]N\x87\x0f\x04L\xd4(\xf2G \xfdr~:\xc4\xc3\xfe\x14G\xadG~^l\xe0:(Y`\x0e\x90\xfa\x1c\xb6\f6\x92B\x92\xd3\xa9BG\xd2*AB\x1e\x01\xf0m+\x02\x87\x81aj;\xb6y.g\xeb\xc4\x0f\xd3\x85\xa5\x00\xa1\xa6iP\x0f\x02\x14\x90q\x94\xab\xb3\x0f\x01=\x06\x98\xa8\x87\xd9=\xce\xbef<\x1d\v\xba[\xd8]\x9e\xf30\xb8\xf1\b\x06M\x18w\xdc\x0e\x98?\x04G\xf9\x99\xab\xc1\xc0z\xe9Fu\x03\x9aj\xc0]\xb47\xd5\xb8]\x98y@\x8c\x8fM\x8c],\x1b\x03\xaa\'gv\xeb\xbf\xa8d\"\x94e3Q\xfci\xdf\xad\x819\xd1\xf3\xaa\xc8i\xf2\x8a\xc4CU3\x87Ns\x9f\x9f\xcd\x05\x06g\x9aRBg\x98\x10Ch\x1c\x96\xd3\xce', 0x7) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2000002, 0x13, r5, 0x0) pread64(r5, &(0x7f0000000140)=""/146, 0x92, 0x2) setresuid(0x0, 0xee00, 0xffffffffffffffff) r6 = io_uring_setup(0x7625, &(0x7f0000000600)={0x0, 0x1e28, 0x0, 0x0, 0x28b, 0x0, r4}) io_uring_register$IORING_REGISTER_FILES(r6, 0x1e, &(0x7f0000000000)=[r4], 0x1) sendmsg$nl_route_sched(r3, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newqdisc={0xa0, 0x24, 0xf0b, 0x70bd2b, 0x0, {0x0, 0x0, 0x12, r1, {}, {0xffff, 0xffff}, {0x2}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x70, 0x2, [@TCA_TAPRIO_ATTR_FLAGS={0x8, 0xa, 0x1}, @TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x1], 0x0, [0x8, 0x6, 0x3c, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], [0x0, 0x8]}}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x4}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8, 0x5, 0x1}]}}]}, 0xa0}}, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'hsr0\x00', 0x0}) socket$kcm(0x29, 0x5, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r4, 0x89f1, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000140)={'ip6gre0\x00', r7, 0x4, 0x5, 0x4, 0x2, 0x9, @remote, @dev={0xfe, 0x80, '\x00', 0x10}, 0x10, 0x7, 0xa595, 0x6}}) syz_usb_connect(0x0, 0x34, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000092df5510ac05269289b201020301090222000100000000090400000103e900000905000000000000000705d77b"], 0x0) 0s ago: executing program 8 (id=2400): r0 = syz_usb_connect(0x0, 0x36, &(0x7f00000002c0)=ANY=[@ANYBLOB="1201000014da2108ab12a390eb1e000000010902240001b30000040904410017ff5d810009050f1f01040000000905830300b3"], 0x0) ioctl$EVIOCSCLOCKID(0xffffffffffffffff, 0x400445a0, &(0x7f0000000080)=0xb309) syz_usb_connect$cdc_ncm(0x6, 0x0, 0x0, &(0x7f0000000900)={0xa, &(0x7f00000003c0)={0xa, 0x6, 0x310, 0x7f, 0x8, 0xf, 0x10, 0x3}, 0x0, 0x0}) r1 = io_uring_setup(0x1d7e, &(0x7f00000004c0)) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r1, 0xd, 0x0, 0x20) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x8, &(0x7f0000000080)=ANY=[]) r2 = syz_open_dev$evdev(&(0x7f0000000880), 0x200000000000002, 0x862b01) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, 0x0, 0x0) write$char_usb(r2, &(0x7f0000000040)="e2", 0x2250) mount$tmpfs(0x0, 0x0, 0x0, 0x1000000, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x6) ioctl$KVM_SET_MSRS(r5, 0x4008ae89, &(0x7f00000000c0)=ANY=[@ANYBLOB="010000000000000099000040"]) syz_open_dev$MSR(0x0, 0x0, 0x0) kernel console output (not intermixed with test programs): ct channel medium [ 401.650099][ T9802] set match dimension is over the limit! [ 402.492684][ T9810] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 405.184854][ T9831] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes. [ 405.319323][ T5925] usbhid 9-1:0.0: can't add hid device: -71 [ 405.326164][ T5925] usbhid 9-1:0.0: probe with driver usbhid failed with error -71 [ 405.439632][ T5925] usb 9-1: USB disconnect, device number 29 [ 406.927699][ T9854] netlink: 'syz.5.1088': attribute type 1 has an invalid length. [ 407.099846][ T9854] bond1: entered promiscuous mode [ 407.126451][ T9854] 8021q: adding VLAN 0 to HW filter on device bond1 [ 407.316612][ T9856] 8021q: adding VLAN 0 to HW filter on device bond2 [ 407.354743][ T9856] bond1: (slave bond2): making interface the new active one [ 407.397039][ T9856] bond2: entered promiscuous mode [ 407.427406][ T9856] bond1: (slave bond2): Enslaving as an active interface with an up link [ 410.262563][ T9884] netlink: 104 bytes leftover after parsing attributes in process `syz.5.1097'. [ 411.506194][ T9894] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 412.250995][ T9901] 9pnet_fd: Insufficient options for proto=fd [ 412.940545][ T5952] usb 8-1: new high-speed USB device number 25 using dummy_hcd [ 413.133567][ T5952] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 414.279266][ T5952] usb 8-1: config 0 interface 0 has no altsetting 0 [ 415.334194][ T5952] usb 8-1: New USB device found, idVendor=10fd, idProduct=1513, bcdDevice=7e.ce [ 415.364793][ T5952] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 416.320702][ T5952] usb 8-1: Product: syz [ 416.325592][ T5952] usb 8-1: Manufacturer: syz [ 416.330232][ T5952] usb 8-1: SerialNumber: syz [ 416.410112][ T5952] usb 8-1: config 0 descriptor?? [ 416.438251][ T5952] usb 8-1: can't set config #0, error -71 [ 416.479715][ T5952] usb 8-1: USB disconnect, device number 25 [ 416.498200][ T9970] overlayfs: failed to clone upperpath [ 416.649332][ T9974] netlink: 'syz.7.1111': attribute type 10 has an invalid length. [ 416.682126][ T9974] bond0: (slave wlan1): Opening slave failed [ 416.715777][ T9976] ipt_ECN: cannot use operation on non-tcp rule [ 422.052691][ T5841] usb 9-1: new high-speed USB device number 30 using dummy_hcd [ 422.163821][T10029] ipt_ECN: cannot use operation on non-tcp rule [ 422.203462][ T5841] usb 9-1: device descriptor read/64, error -71 [ 422.722433][T10040] netlink: 20 bytes leftover after parsing attributes in process `syz.5.1129'. [ 423.388419][ T5841] usb 9-1: new high-speed USB device number 31 using dummy_hcd [ 423.539954][ T5841] usb 9-1: device descriptor read/64, error -71 [ 423.672251][ T5841] usb usb9-port1: attempt power cycle [ 423.715917][T10050] delete_channel: no stack [ 424.071345][ T5841] usb 9-1: new high-speed USB device number 32 using dummy_hcd [ 424.681910][T10063] ipt_ECN: cannot use operation on non-tcp rule [ 424.823469][ T5841] usb 9-1: device descriptor read/8, error -71 [ 429.321525][T10084] xt_hashlimit: size too large, truncated to 1048576 [ 429.346829][T10083] netlink: 'syz.8.1142': attribute type 1 has an invalid length. [ 429.717408][T10092] af_packet: tpacket_rcv: packet too big, clamped from 2906 to 4294967272. macoff=96 [ 430.372717][T10103] IPv6: NLM_F_CREATE should be specified when creating new route [ 430.998302][T10109] trusted_key: encrypted_key: insufficient parameters specified [ 431.181477][ T5841] usb 9-1: new high-speed USB device number 34 using dummy_hcd [ 431.369083][ T5841] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 431.428535][ T5841] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 431.461775][ T5841] usb 9-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 431.478468][ T5841] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 431.491388][ T30] kauditd_printk_skb: 64 callbacks suppressed [ 431.491408][ T30] audit: type=1326 audit(1752253785.692:155): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10124 comm="syz.5.1158" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f95e638e929 code=0x7ffc0000 [ 431.522551][ T5841] usb 9-1: config 0 descriptor?? [ 431.546639][ T30] audit: type=1326 audit(1752253785.692:156): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10124 comm="syz.5.1158" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f95e638e929 code=0x7ffc0000 [ 431.639513][ T30] audit: type=1326 audit(1752253785.692:157): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10124 comm="syz.5.1158" exe="/root/syz-executor" sig=0 arch=c000003e syscall=154 compat=0 ip=0x7f95e638e929 code=0x7ffc0000 [ 431.709231][ T30] audit: type=1326 audit(1752253785.692:158): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10124 comm="syz.5.1158" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f95e638e929 code=0x7ffc0000 [ 431.761303][ T30] audit: type=1326 audit(1752253785.692:159): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10124 comm="syz.5.1158" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f95e638e929 code=0x7ffc0000 [ 431.938248][T10142] xt_TPROXY: Can be used only with -p tcp or -p udp [ 432.219216][ T5841] usb 9-1: string descriptor 0 read error: -22 [ 433.048396][T10148] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 433.075158][T10148] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 433.092219][ T5841] input: HID 256c:006d as /devices/platform/dummy_hcd.8/usb9/9-1/9-1:0.0/0003:256C:006D.0007/input/input9 [ 433.222589][ T5841] uclogic 0003:256C:006D.0007: input,hidraw0: USB HID v0.00 Device [HID 256c:006d] on usb-dummy_hcd.8-1/input0 [ 433.357810][ T5841] usb 9-1: USB disconnect, device number 34 [ 433.555800][T10160] fido_id[10160]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.8/usb9/report_descriptor': No such file or directory [ 433.917552][ T30] audit: type=1400 audit(1752253788.112:160): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="*" object="_" requested=w pid=10172 comm="syz.6.1174" saddr=172.30.0.7 daddr=172.20.20.170 netif=wpan0 [ 434.043312][T10175] netlink: 'syz.8.1175': attribute type 1 has an invalid length. [ 434.081524][T10175] netlink: 'syz.8.1175': attribute type 2 has an invalid length. [ 434.458154][T10187] openvswitch: netlink: IP tunnel dst address not specified [ 434.477098][T10187] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1180'. [ 434.553745][ T5841] usb 9-1: new low-speed USB device number 35 using dummy_hcd [ 436.996983][T10188] syz.7.1179 (10188): drop_caches: 2 [ 437.004585][T10188] syz.7.1179 (10188): drop_caches: 2 [ 438.903974][T10224] tipc: Failed to remove unknown binding: 66,1,1/0:1727633571/1727633573 [ 438.914311][T10224] tipc: Failed to remove unknown binding: 66,1,1/0:1727633571/1727633573 [ 438.935683][T10224] tipc: Failed to remove unknown binding: 66,1,1/0:1727633571/1727633573 [ 440.290541][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.297447][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.464941][T10241] netlink: 44 bytes leftover after parsing attributes in process `syz.5.1196'. [ 440.501351][T10241] netlink: 43 bytes leftover after parsing attributes in process `syz.5.1196'. [ 440.510450][T10241] netlink: 'syz.5.1196': attribute type 5 has an invalid length. [ 440.561322][T10241] netlink: 43 bytes leftover after parsing attributes in process `syz.5.1196'. [ 440.644206][ T5896] usb 9-1: new full-speed USB device number 36 using dummy_hcd [ 440.923442][ T5896] usb 9-1: New USB device found, idVendor=056e, idProduct=4010, bcdDevice=20.1c [ 440.951991][ T5896] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 441.030139][ T5896] usb 9-1: config 0 descriptor?? [ 441.949286][ T5896] pegasus 9-1:0.0: probe with driver pegasus failed with error -32 [ 442.133172][T10263] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1204'. [ 442.470380][T10273] 9pnet_fd: Insufficient options for proto=fd [ 443.298285][T10275] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 443.352525][T10275] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 443.589637][T10282] overlayfs: failed to resolve './file0': -2 [ 443.805017][T10288] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 443.814274][T10288] overlayfs: option "uuid=on" requires an upper fs, falling back to uuid=null. [ 443.823789][T10288] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 443.893271][T10280] cgroup: noprefix used incorrectly [ 445.546215][ T5896] usb 9-1: USB disconnect, device number 36 [ 445.573784][T10309] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1219'. [ 449.984924][T10351] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1230'. [ 455.576694][T10391] kAFS: No cell specified [ 459.221889][T10407] netlink: 'syz.5.1247': attribute type 1 has an invalid length. [ 460.161434][ T10] usb 8-1: new high-speed USB device number 26 using dummy_hcd [ 460.371303][ T10] usb 8-1: Using ep0 maxpacket: 32 [ 460.389747][ T10] usb 8-1: config 0 has an invalid interface number: 51 but max is 0 [ 460.398223][ T10] usb 8-1: config 0 has no interface number 0 [ 460.454880][ T10] usb 8-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 460.490635][ T10] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 460.520315][ T10] usb 8-1: Product: syz [ 460.548843][ T10] usb 8-1: Manufacturer: syz [ 460.563272][ T10] usb 8-1: SerialNumber: syz [ 460.584617][ T10] usb 8-1: config 0 descriptor?? [ 460.608468][ T10] quatech2 8-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 460.694381][T10442] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1258'. [ 460.721239][T10442] openvswitch: netlink: Flow actions attr not present in new flow. [ 464.019569][ C0] quatech-serial ttyUSB0: qt2_process_read_urb - unsupported command 127 [ 464.032358][ T10] usb 8-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 464.066116][ T10] usb 8-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 464.419851][T10457] netlink: 104 bytes leftover after parsing attributes in process `syz.8.1261'. [ 465.040337][ C0] usb 8-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 465.041748][ T5958] usb 8-1: USB disconnect, device number 26 [ 465.127397][ T5958] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 465.200651][ T5958] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 465.458569][T10467] sctp: [Deprecated]: syz.7.1265 (pid 10467) Use of struct sctp_assoc_value in delayed_ack socket option. [ 465.458569][T10467] Use struct sctp_sack_info instead [ 465.462064][ T5958] quatech2 8-1:0.51: device disconnected [ 466.290727][T10474] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 466.733341][T10467] fanotify: failed to encode fid (type=0, len=0, err=-2) [ 468.752365][ T5925] usb 8-1: new high-speed USB device number 27 using dummy_hcd [ 468.956410][ T5925] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 468.977441][ T5925] usb 8-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8E has invalid maxpacket 0 [ 469.020745][ T5925] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 469.048105][ T5925] usb 8-1: config 0 interface 0 altsetting 0 bulk endpoint 0xA has invalid maxpacket 0 [ 469.065874][ T5925] usb 8-1: New USB device found, idVendor=05ab, idProduct=0301, bcdDevice= 1.00 [ 469.096209][ T5925] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 469.115670][ T5925] usb 8-1: Product: syz [ 469.120213][ T5925] usb 8-1: Manufacturer: syz [ 469.127021][ T5925] usb 8-1: SerialNumber: syz [ 469.166221][ T5925] usb 8-1: config 0 descriptor?? [ 469.200199][ T5925] ums-isd200 8-1:0.0: USB Mass Storage device detected [ 469.469061][ T5925] ums-isd200 8-1:0.0: probe with driver ums-isd200 failed with error -22 [ 469.693325][ T5949] usb 8-1: USB disconnect, device number 27 [ 470.759857][T10526] netlink: 16 bytes leftover after parsing attributes in process `syz.6.1283'. [ 470.779531][T10526] netlink: 3 bytes leftover after parsing attributes in process `syz.6.1283'. [ 470.805559][T10520] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1280'. [ 470.813219][T10526] x_tables: duplicate underflow at hook 2 [ 470.880509][T10526] netlink: 168 bytes leftover after parsing attributes in process `syz.6.1283'. [ 472.542398][T10543] netlink: 'syz.8.1288': attribute type 29 has an invalid length. [ 472.555888][T10543] netlink: 'syz.8.1288': attribute type 29 has an invalid length. [ 474.374966][T10575] overlayfs: failed to clone lowerpath [ 476.275955][T10593] xt_CT: No such helper "syz1" [ 476.429127][ T30] audit: type=1326 audit(1752253830.632:161): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10597 comm="syz.6.1307" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fba0498e929 code=0x0 [ 476.538182][T10602] overlayfs: failed to clone upperpath [ 476.671800][ T30] audit: type=1800 audit(1752253830.802:162): pid=10603 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz.5.1305" name="nullb0" dev="tmpfs" ino=670 res=0 errno=0 [ 476.715792][ T30] audit: type=1326 audit(1752253830.912:163): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10578 comm="syz.0.1299" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fedbfb2ab19 code=0x7ffc0000 [ 476.767034][ T30] audit: type=1326 audit(1752253830.912:164): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10578 comm="syz.0.1299" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fedbfb8e929 code=0x7ffc0000 [ 476.798341][ T30] audit: type=1326 audit(1752253830.912:165): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10578 comm="syz.0.1299" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fedbfb8e929 code=0x7ffc0000 [ 476.823154][ T30] audit: type=1326 audit(1752253830.912:166): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10578 comm="syz.0.1299" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fedbfb8e929 code=0x7ffc0000 [ 476.844725][ C1] vkms_vblank_simulate: vblank timer overrun [ 476.853708][ T30] audit: type=1326 audit(1752253830.912:167): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10578 comm="syz.0.1299" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fedbfb8e929 code=0x7ffc0000 [ 476.875628][ C1] vkms_vblank_simulate: vblank timer overrun [ 476.949394][ T30] audit: type=1326 audit(1752253830.912:168): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10578 comm="syz.0.1299" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fedbfb8e929 code=0x7ffc0000 [ 476.975715][ T30] audit: type=1326 audit(1752253830.912:169): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10578 comm="syz.0.1299" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fedbfb8e929 code=0x7ffc0000 [ 477.001585][ T30] audit: type=1326 audit(1752253830.912:170): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10578 comm="syz.0.1299" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fedbfb2ab19 code=0x7ffc0000 [ 477.031288][ T5925] usb 8-1: new high-speed USB device number 28 using dummy_hcd [ 477.161351][ T5925] usb 8-1: device descriptor read/64, error -71 [ 477.394897][T10613] netlink: 8 bytes leftover after parsing attributes in process `syz.8.1306'. [ 477.492285][ T5925] usb 8-1: new high-speed USB device number 29 using dummy_hcd [ 477.895335][ T5925] usb 8-1: device descriptor read/64, error -71 [ 478.045379][ T5925] usb usb8-port1: attempt power cycle [ 478.741327][ T5925] usb 8-1: new high-speed USB device number 30 using dummy_hcd [ 478.772694][T10630] delete_channel: no stack [ 478.800166][ T5925] usb 8-1: device descriptor read/8, error -71 [ 478.846261][T10632] unknown channel width for channel at 909000KHz? [ 478.874138][T10632] unknown channel width for channel at 909000KHz? [ 478.882894][T10632] unknown channel width for channel at 909000KHz? [ 479.052768][ T5925] usb 8-1: new high-speed USB device number 31 using dummy_hcd [ 479.082345][ T5925] usb 8-1: device descriptor read/8, error -71 [ 479.144912][T10637] 8021q: VLANs not supported on vcan0 [ 479.192640][ T5925] usb usb8-port1: unable to enumerate USB device [ 479.231373][ T5896] usb 9-1: new full-speed USB device number 37 using dummy_hcd [ 479.287466][T10646] netlink: 312 bytes leftover after parsing attributes in process `syz.6.1321'. [ 479.393401][ T5896] usb 9-1: config 0 has an invalid interface number: 220 but max is 3 [ 479.411220][ T5896] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 479.431237][ T5896] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 4 [ 479.440269][ T5896] usb 9-1: config 0 has no interface number 0 [ 479.446519][ T5896] usb 9-1: config 0 interface 220 altsetting 167 endpoint 0xF has an invalid bInterval 58, changing to 4 [ 479.457875][ T5896] usb 9-1: config 0 interface 220 altsetting 167 endpoint 0x2 has invalid wMaxPacketSize 0 [ 479.468062][ T5896] usb 9-1: config 0 interface 220 has no altsetting 0 [ 479.477707][ T5896] usb 9-1: New USB device found, idVendor=2e24, idProduct=5d52, bcdDevice=15.da [ 479.487642][ T5896] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 479.495869][ T5896] usb 9-1: Product: syz [ 479.500340][ T5896] usb 9-1: Manufacturer: syz [ 479.505028][ T5896] usb 9-1: SerialNumber: syz [ 479.521633][ T5896] usb 9-1: config 0 descriptor?? [ 480.121140][ T5896] usb 9-1: USB disconnect, device number 37 [ 481.624015][T10675] vlan4: entered allmulticast mode [ 481.682270][T10675] bond0: entered allmulticast mode [ 481.751604][T10675] bond_slave_0: entered allmulticast mode [ 482.251079][T10675] bond_slave_1: entered allmulticast mode [ 482.348379][T10686] netlink: 108 bytes leftover after parsing attributes in process `syz.6.1334'. [ 482.427270][T10686] netlink: 16 bytes leftover after parsing attributes in process `syz.6.1334'. [ 482.440608][T10686] netlink: 16 bytes leftover after parsing attributes in process `syz.6.1334'. [ 483.375570][T10694] netlink: 'syz.7.1336': attribute type 10 has an invalid length. [ 483.419731][T10694] syz_tun: entered promiscuous mode [ 483.429260][T10694] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 484.607425][T10723] bridge0: port 2(bridge_slave_1) entered disabled state [ 484.615001][T10723] bridge0: port 2(bridge_slave_1) entered blocking state [ 484.622258][T10723] bridge0: port 2(bridge_slave_1) entered forwarding state [ 485.859502][ T5925] kernel write not supported for file /snd/seq (pid: 5925 comm: kworker/1:5) [ 485.971538][ T5958] usb 9-1: new high-speed USB device number 38 using dummy_hcd [ 486.097673][T10751] netlink: 'syz.5.1353': attribute type 10 has an invalid length. [ 486.131557][ T5958] usb 9-1: Using ep0 maxpacket: 8 [ 486.146475][ T5958] usb 9-1: config index 0 descriptor too short (expected 301, got 45) [ 486.167330][ T5958] usb 9-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 486.186839][ T5958] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 486.199244][ T5958] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 486.214488][ T5958] usb 9-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 486.214693][T10751] bridge0: port 3(netdevsim0) entered disabled state [ 486.229748][ T5958] usb 9-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 486.234547][T10751] bridge0: port 2(bridge_slave_1) entered disabled state [ 486.234862][T10751] bridge0: port 1(bridge_slave_0) entered disabled state [ 486.274794][ T5958] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 486.281728][ T5952] usb 8-1: new full-speed USB device number 32 using dummy_hcd [ 486.495866][ T5958] usb 9-1: GET_CAPABILITIES returned 0 [ 486.511381][ T5958] usbtmc 9-1:16.0: can't read capabilities [ 486.532189][ T5952] usb 8-1: not running at top speed; connect to a high speed hub [ 486.581526][ T5952] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 486.605367][ T5952] usb 8-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 486.631350][ T5952] usb 8-1: config 1 has no interface number 1 [ 486.637529][ T5952] usb 8-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 486.741806][ T5952] usb 8-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 4 [ 486.817969][ T5952] usb 8-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 486.830269][ T5952] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 486.850120][ T5952] usb 8-1: Product: syz [ 486.861064][ T5952] usb 8-1: Manufacturer: syz [ 486.872922][ T5952] usb 8-1: SerialNumber: syz [ 486.929276][ T10] usb 9-1: USB disconnect, device number 38 [ 487.467071][T10764] virt_wifi0 speed is unknown, defaulting to 1000 [ 487.474235][T10764] virt_wifi0 speed is unknown, defaulting to 1000 [ 487.481491][T10764] virt_wifi0 speed is unknown, defaulting to 1000 [ 487.500279][T10764] infiniband @: RDMA CMA: cma_listen_on_dev, error -98 [ 487.529767][T10764] virt_wifi0 speed is unknown, defaulting to 1000 [ 487.538292][T10764] virt_wifi0 speed is unknown, defaulting to 1000 [ 487.546526][T10764] virt_wifi0 speed is unknown, defaulting to 1000 [ 487.554756][T10764] virt_wifi0 speed is unknown, defaulting to 1000 [ 487.562680][T10764] virt_wifi0 speed is unknown, defaulting to 1000 [ 488.115462][ T5949] usb 9-1: new high-speed USB device number 39 using dummy_hcd [ 488.291520][ T5949] usb 9-1: Using ep0 maxpacket: 32 [ 488.300299][ T5949] usb 9-1: config index 0 descriptor too short (expected 35577, got 27) [ 488.305466][T10780] : left promiscuous mode [ 488.317693][ T5949] usb 9-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 488.334863][ T5949] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 488.347674][ T5949] usb 9-1: config 1 has no interface number 0 [ 488.354530][ T5949] usb 9-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 488.365990][ T5949] usb 9-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 488.380085][ T5949] usb 9-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 488.389765][ T5949] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 488.433468][ T5949] snd_usb_pod 9-1:1.1: Line 6 Pocket POD found [ 488.630103][ T5949] snd_usb_pod 9-1:1.1: Line 6 Pocket POD now attached [ 488.684429][T10789] netlink: 'syz.0.1365': attribute type 2 has an invalid length. [ 489.011961][ T5952] usb 8-1: 2:1 : no or invalid class specific endpoint descriptor [ 489.141976][ T5952] usb 8-1: USB disconnect, device number 32 [ 489.157970][T10771] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 489.205262][T10771] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 489.293682][ T10] usb 9-1: USB disconnect, device number 39 [ 489.306093][ T10] snd_usb_pod 9-1:1.1: Line 6 Pocket POD now disconnected [ 489.364222][T10801] udevd[10801]: error opening ATTR{/sys/devices/platform/dummy_hcd.7/usb8/8-1/8-1:1.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 489.871351][ T10] usb 8-1: new high-speed USB device number 33 using dummy_hcd [ 490.042187][ T10] usb 8-1: Using ep0 maxpacket: 16 [ 490.083709][ T10] usb 8-1: too many configurations: 24, using maximum allowed: 8 [ 490.107863][ T10] usb 8-1: unable to read config index 0 descriptor/start: -61 [ 490.330827][ T10] usb 8-1: can't read configurations, error -61 [ 490.544159][ T10] usb 8-1: new high-speed USB device number 34 using dummy_hcd [ 490.711693][ T10] usb 8-1: Using ep0 maxpacket: 16 [ 490.727657][ T10] usb 8-1: too many configurations: 24, using maximum allowed: 8 [ 490.748412][ T10] usb 8-1: unable to read config index 0 descriptor/start: -61 [ 490.779910][ T10] usb 8-1: can't read configurations, error -61 [ 490.799697][ T10] usb usb8-port1: attempt power cycle [ 490.961564][ T5958] usb 9-1: new high-speed USB device number 40 using dummy_hcd [ 491.141491][ T5958] usb 9-1: Using ep0 maxpacket: 32 [ 491.149398][ T5958] usb 9-1: config 3 has an invalid interface number: 171 but max is 29 [ 491.151373][ T10] usb 8-1: new high-speed USB device number 35 using dummy_hcd [ 491.159048][ T5958] usb 9-1: config 3 has 1 interface, different from the descriptor's value: 30 [ 491.175535][ T5958] usb 9-1: config 3 has no interface number 0 [ 491.182145][ T5958] usb 9-1: config 3 interface 171 altsetting 108 endpoint 0x1 has invalid wMaxPacketSize 0 [ 491.192557][ T5958] usb 9-1: config 3 interface 171 has no altsetting 0 [ 491.196648][ T10] usb 8-1: Using ep0 maxpacket: 16 [ 491.206648][ T10] usb 8-1: too many configurations: 24, using maximum allowed: 8 [ 491.207701][ T5958] usb 9-1: New USB device found, idVendor=2137, idProduct=0001, bcdDevice= c.e5 [ 491.220104][ T10] usb 8-1: unable to read config index 0 descriptor/start: -61 [ 491.224032][ T5958] usb 9-1: New USB device strings: Mfr=1, Product=10, SerialNumber=3 [ 491.243527][ T10] usb 8-1: can't read configurations, error -61 [ 491.272160][ T5958] usb 9-1: Product: syz [ 491.276422][ T5958] usb 9-1: Manufacturer: syz [ 491.281014][ T5958] usb 9-1: SerialNumber: syz [ 491.372169][ T10] usb 8-1: new high-speed USB device number 36 using dummy_hcd [ 491.401519][ T10] usb 8-1: Using ep0 maxpacket: 16 [ 491.407465][ T10] usb 8-1: too many configurations: 24, using maximum allowed: 8 [ 491.420604][ T10] usb 8-1: unable to read config index 0 descriptor/start: -61 [ 491.430419][ T10] usb 8-1: can't read configurations, error -61 [ 491.440968][ T10] usb usb8-port1: unable to enumerate USB device [ 491.529280][ T5958] as10x_usb: device has been detected [ 491.539046][ T5958] dvbdev: DVB: registering new adapter (Sky IT Digital Key (green led)) [ 491.571600][ T5958] usb 9-1: DVB: registering adapter 1 frontend 0 (Sky IT Digital Key (green led))... [ 491.625217][T10855] netlink: 40 bytes leftover after parsing attributes in process `wÞ£ÿ'. [ 491.639681][ T5958] as10x_usb: error during firmware upload part1 [ 491.648066][ T5958] Registered device Sky IT Digital Key (green led) [ 491.681633][ T5958] usb 9-1: USB disconnect, device number 40 [ 491.757831][ T5958] Unregistered device Sky IT Digital Key (green led) [ 491.770608][ T5958] as10x_usb: device has been disconnected [ 491.820574][T10859] Cannot find set identified by id 0 to match [ 492.381290][ T10] usb 9-1: new high-speed USB device number 41 using dummy_hcd [ 492.542772][ T10] usb 9-1: Using ep0 maxpacket: 8 [ 492.597287][ T10] usb 9-1: New USB device found, idVendor=04a5, idProduct=3003, bcdDevice=44.b2 [ 492.617291][ T10] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 492.625600][ T10] usb 9-1: Product: syz [ 492.629885][ T10] usb 9-1: Manufacturer: syz [ 492.645721][ T10] usb 9-1: SerialNumber: syz [ 492.676374][ T10] usb 9-1: config 0 descriptor?? [ 492.860093][T10886] netlink: 16 bytes leftover after parsing attributes in process `syz.7.1397'. [ 492.904530][ T10] gspca_main: sunplus-2.14.0 probing 04a5:3003 [ 493.080031][T10888] kvm: pic: non byte write [ 493.126596][T10893] set match dimension is over the limit! [ 493.330388][T10869] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 493.407879][T10869] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 493.697917][T10904] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1403'. [ 493.699725][ T10] gspca_sunplus: reg_w_riv err -71 [ 493.931365][ T10] sunplus 9-1:0.0: probe with driver sunplus failed with error -71 [ 493.969719][ T10] usb 9-1: USB disconnect, device number 41 [ 494.273561][T10922] Cannot find set identified by id 0 to match [ 494.371604][ T10] usb 9-1: new high-speed USB device number 42 using dummy_hcd [ 494.401382][ T5841] usb 8-1: new low-speed USB device number 37 using dummy_hcd [ 494.541451][ T5841] usb 8-1: device descriptor read/64, error -71 [ 494.556831][ T10] usb 9-1: Using ep0 maxpacket: 16 [ 494.573554][ T10] usb 9-1: config 0 has an invalid interface number: 4 but max is 1 [ 494.591001][ T10] usb 9-1: config 0 has an invalid interface number: 4 but max is 1 [ 494.601342][ T10] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 494.620636][ T10] usb 9-1: config 0 has no interface number 0 [ 494.637769][ T10] usb 9-1: config 0 interface 4 altsetting 9 endpoint 0xF has an invalid bInterval 255, changing to 11 [ 494.676138][ T10] usb 9-1: config 0 interface 4 altsetting 4 endpoint 0xE has invalid wMaxPacketSize 0 [ 494.703655][ T10] usb 9-1: config 0 interface 4 altsetting 4 bulk endpoint 0xE has invalid maxpacket 0 [ 494.714347][ T10] usb 9-1: config 0 interface 4 has no altsetting 0 [ 494.721004][ T10] usb 9-1: config 0 interface 4 has no altsetting 1 [ 494.734702][ T10] usb 9-1: New USB device found, idVendor=eb1a, idProduct=2750, bcdDevice=e2.82 [ 494.740844][T10935] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1416'. [ 494.744501][ T10] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 494.772655][ T10] usb 9-1: config 0 descriptor?? [ 494.791574][ T5841] usb 8-1: new low-speed USB device number 38 using dummy_hcd [ 494.825004][T10937] netlink: 40 bytes leftover after parsing attributes in process `wÞ£ÿ'. [ 494.935468][ T5841] usb 8-1: device descriptor read/64, error -71 [ 495.000573][ T10] usb 9-1: string descriptor 0 read error: -71 [ 495.032847][ T10] usb 9-1: USB disconnect, device number 42 [ 495.066259][ T5841] usb usb8-port1: attempt power cycle [ 495.230356][T10946] ceph: Path missing in source [ 495.831397][ T5841] usb 8-1: new low-speed USB device number 39 using dummy_hcd [ 495.878741][ T5841] usb 8-1: device descriptor read/8, error -71 [ 496.141617][ T5841] usb 8-1: new low-speed USB device number 40 using dummy_hcd [ 496.173461][ T5841] usb 8-1: device descriptor read/8, error -71 [ 496.182202][ T5949] usb 9-1: new high-speed USB device number 43 using dummy_hcd [ 496.282059][ T5841] usb usb8-port1: unable to enumerate USB device [ 496.334992][ T5949] usb 9-1: New USB device found, idVendor=0eb1, idProduct=7007, bcdDevice= 2.10 [ 496.344453][ T5949] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 496.352814][ T5949] usb 9-1: Product: syz [ 496.357012][ T5949] usb 9-1: Manufacturer: syz [ 496.362002][ T5949] usb 9-1: SerialNumber: syz [ 496.378728][ T5949] usb 9-1: config 0 descriptor?? [ 496.393892][ T5949] go7007 9-1:0.0: probe with driver go7007 failed with error -12 [ 496.536639][T10971] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1428'. [ 496.771005][T10977] pimreg3: entered allmulticast mode [ 498.069599][T10998] afs: Unknown parameter 'dPÿÿÊøE¡f¡‹¼yn$' [ 498.230059][T11003] FAULT_INJECTION: forcing a failure. [ 498.230059][T11003] name failslab, interval 1, probability 0, space 0, times 0 [ 498.243277][T11003] CPU: 1 UID: 0 PID: 11003 Comm: syz.7.1439 Not tainted 6.16.0-rc5-syzkaller-00121-gbc9ff192a6c9 #0 PREEMPT(full) [ 498.243303][T11003] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 498.243314][T11003] Call Trace: [ 498.243322][T11003] [ 498.243331][T11003] dump_stack_lvl+0x189/0x250 [ 498.243358][T11003] ? __pfx____ratelimit+0x10/0x10 [ 498.243377][T11003] ? __pfx_dump_stack_lvl+0x10/0x10 [ 498.243389][T11003] ? __pfx__printk+0x10/0x10 [ 498.243407][T11003] ? __pfx___might_resched+0x10/0x10 [ 498.243423][T11003] should_fail_ex+0x414/0x560 [ 498.243443][T11003] should_failslab+0xa8/0x100 [ 498.243460][T11003] __kmalloc_noprof+0xcb/0x4f0 [ 498.243476][T11003] ? io_cache_alloc_new+0x40/0x100 [ 498.243486][T11003] ? lockdep_hardirqs_on+0x9c/0x150 [ 498.243505][T11003] io_cache_alloc_new+0x40/0x100 [ 498.243517][T11003] io_rsrc_node_alloc+0x172/0x280 [ 498.243533][T11003] io_sqe_buffer_register+0xf2/0x2280 [ 498.243560][T11003] ? __pfx_io_sqe_buffer_register+0x10/0x10 [ 498.243577][T11003] ? rcu_is_watching+0x15/0xb0 [ 498.243588][T11003] ? io_sqe_buffers_register+0x133/0x8d0 [ 498.243599][T11003] ? trace_kmalloc+0x1f/0xd0 [ 498.243612][T11003] ? __kvmalloc_node_noprof+0x331/0x5f0 [ 498.243627][T11003] ? iovec_from_user+0x1ba/0x250 [ 498.243642][T11003] io_sqe_buffers_register+0x3b4/0x8d0 [ 498.243663][T11003] ? __pfx_io_sqe_buffers_register+0x10/0x10 [ 498.243676][T11003] ? __fget_files+0x3a0/0x420 [ 498.243686][T11003] ? __fget_files+0x2a/0x420 [ 498.243698][T11003] ? io_is_uring_fops+0xd/0x50 [ 498.243713][T11003] __se_sys_io_uring_register+0xb85/0x11b0 [ 498.243729][T11003] ? __pfx___se_sys_io_uring_register+0x10/0x10 [ 498.243738][T11003] ? ksys_write+0x22a/0x250 [ 498.243754][T11003] ? __pfx_ksys_write+0x10/0x10 [ 498.243771][T11003] ? do_syscall_64+0xbe/0x3b0 [ 498.243785][T11003] do_syscall_64+0xfa/0x3b0 [ 498.243794][T11003] ? lockdep_hardirqs_on+0x9c/0x150 [ 498.243809][T11003] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 498.243821][T11003] ? clear_bhb_loop+0x60/0xb0 [ 498.243834][T11003] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 498.243845][T11003] RIP: 0033:0x7fb42378e929 [ 498.243857][T11003] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 498.243867][T11003] RSP: 002b:00007fb424527038 EFLAGS: 00000246 ORIG_RAX: 00000000000001ab [ 498.243881][T11003] RAX: ffffffffffffffda RBX: 00007fb4239b5fa0 RCX: 00007fb42378e929 [ 498.243890][T11003] RDX: 00002000000011c0 RSI: 0000000000000000 RDI: 0000000000000003 [ 498.243897][T11003] RBP: 00007fb424527090 R08: 0000000000000000 R09: 0000000000000000 [ 498.243904][T11003] R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000001 [ 498.243913][T11003] R13: 0000000000000000 R14: 00007fb4239b5fa0 R15: 00007ffd3afc9858 [ 498.243933][T11003] [ 498.521716][ C1] vkms_vblank_simulate: vblank timer overrun [ 498.697494][T11009] ptrace attach of "./syz-executor exec"[6569] was attempted by ""[11009] [ 498.985808][T11019] overlayfs: failed to clone upperpath [ 499.024924][ T5896] usb 9-1: USB disconnect, device number 43 [ 500.021350][ T5925] usb 8-1: new high-speed USB device number 41 using dummy_hcd [ 500.220095][ T5925] usb 8-1: unable to get BOS descriptor or descriptor too short [ 500.232257][ T5925] usb 8-1: config 8 has an invalid interface number: 43 but max is 0 [ 500.246802][ T5925] usb 8-1: config 8 has no interface number 0 [ 500.260433][ T5925] usb 8-1: config 8 interface 43 altsetting 255 bulk endpoint 0x4 has invalid maxpacket 64 [ 500.391012][ T5925] usb 8-1: config 8 interface 43 has no altsetting 0 [ 500.400978][ T5925] usb 8-1: New USB device found, idVendor=0582, idProduct=935b, bcdDevice=be.6c [ 500.410503][ T5925] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 500.418660][ T5925] usb 8-1: Product: syz [ 500.423163][ T5925] usb 8-1: Manufacturer: syz [ 500.427907][ T5925] usb 8-1: SerialNumber: syz [ 500.459675][T11032] raw-gadget.0 gadget.7: fail, usb_ep_enable returned -22 [ 500.881636][ T5949] usb 9-1: new high-speed USB device number 44 using dummy_hcd [ 501.141762][ T5949] usb 9-1: Using ep0 maxpacket: 16 [ 501.195268][ T5949] usb 9-1: config 254 has an invalid interface number: 235 but max is 0 [ 501.235731][ T5949] usb 9-1: config 254 has no interface number 0 [ 501.266088][ T5949] usb 9-1: config 254 interface 235 altsetting 2 bulk endpoint 0x6 has invalid maxpacket 32 [ 501.277211][ T5949] usb 9-1: config 254 interface 235 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 501.322663][ T5949] usb 9-1: config 254 interface 235 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 501.369428][ T5949] usb 9-1: config 254 interface 235 has no altsetting 0 [ 501.414460][ T5949] usb 9-1: New USB device found, idVendor=0525, idProduct=a4a0, bcdDevice=2b.f1 [ 501.441767][ T5949] usb 9-1: New USB device strings: Mfr=1, Product=251, SerialNumber=3 [ 501.479810][ T5949] usb 9-1: Product: syz [ 501.501808][ T5949] usb 9-1: Manufacturer: syz [ 501.523926][ T5949] usb 9-1: SerialNumber: syz [ 501.605340][T11041] raw-gadget.1 gadget.8: fail, usb_ep_enable returned -22 [ 501.729971][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.736700][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.846285][T11037] raw-gadget.1 gadget.8: fail, usb_ep_enable returned -22 [ 501.859038][ T5949] usbtest 9-1:254.235: Linux gadget zero [ 501.864913][ T5949] usbtest 9-1:254.235: high-speed {control in/out bulk-out int-in} tests (+alt) [ 502.283506][ T5925] usb 8-1: USB disconnect, device number 41 [ 502.337506][T10802] udevd[10802]: error opening ATTR{/sys/devices/platform/dummy_hcd.7/usb8/8-1/8-1:8.43/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 502.417069][T11059] netlink: 212376 bytes leftover after parsing attributes in process `syz.6.1458'. [ 502.974369][T11072] FAULT_INJECTION: forcing a failure. [ 502.974369][T11072] name failslab, interval 1, probability 0, space 0, times 0 [ 502.987509][T11072] CPU: 0 UID: 0 PID: 11072 Comm: syz.7.1463 Not tainted 6.16.0-rc5-syzkaller-00121-gbc9ff192a6c9 #0 PREEMPT(full) [ 502.987539][T11072] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 502.987551][T11072] Call Trace: [ 502.987560][T11072] [ 502.987569][T11072] dump_stack_lvl+0x189/0x250 [ 502.987598][T11072] ? __pfx____ratelimit+0x10/0x10 [ 502.987629][T11072] ? __pfx_dump_stack_lvl+0x10/0x10 [ 502.987651][T11072] ? __pfx__printk+0x10/0x10 [ 502.987683][T11072] ? __pfx___might_resched+0x10/0x10 [ 502.987710][T11072] should_fail_ex+0x414/0x560 [ 502.987743][T11072] should_failslab+0xa8/0x100 [ 502.987774][T11072] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 502.987803][T11072] ? __alloc_skb+0x112/0x2d0 [ 502.987829][T11072] __alloc_skb+0x112/0x2d0 [ 502.987866][T11072] netlink_sendmsg+0x5c6/0xb30 [ 502.987901][T11072] ? __pfx_netlink_sendmsg+0x10/0x10 [ 502.987934][T11072] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 502.987961][T11072] ? __pfx_netlink_sendmsg+0x10/0x10 [ 502.987986][T11072] __sock_sendmsg+0x219/0x270 [ 502.988019][T11072] ____sys_sendmsg+0x505/0x830 [ 502.988051][T11072] ? __pfx_____sys_sendmsg+0x10/0x10 [ 502.988086][T11072] ? import_iovec+0x74/0xa0 [ 502.988113][T11072] ___sys_sendmsg+0x21f/0x2a0 [ 502.988138][T11072] ? __pfx____sys_sendmsg+0x10/0x10 [ 502.988203][T11072] ? __fget_files+0x2a/0x420 [ 502.988220][T11072] ? __fget_files+0x3a0/0x420 [ 502.988252][T11072] __x64_sys_sendmsg+0x19b/0x260 [ 502.988279][T11072] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 502.988313][T11072] ? __pfx_ksys_write+0x10/0x10 [ 502.988343][T11072] ? do_syscall_64+0xbe/0x3b0 [ 502.988365][T11072] do_syscall_64+0xfa/0x3b0 [ 502.988385][T11072] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 502.988409][T11072] ? asm_sysvec_call_function_single+0x1a/0x20 [ 502.988428][T11072] ? clear_bhb_loop+0x60/0xb0 [ 502.988450][T11072] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 502.988469][T11072] RIP: 0033:0x7fb42378e929 [ 502.988486][T11072] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 502.988502][T11072] RSP: 002b:00007fb4215f6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 502.988524][T11072] RAX: ffffffffffffffda RBX: 00007fb4239b6080 RCX: 00007fb42378e929 [ 502.988538][T11072] RDX: 0000000000000000 RSI: 0000200000001540 RDI: 0000000000000004 [ 502.988550][T11072] RBP: 00007fb4215f6090 R08: 0000000000000000 R09: 0000000000000000 [ 502.988562][T11072] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 502.988574][T11072] R13: 0000000000000000 R14: 00007fb4239b6080 R15: 00007ffd3afc9858 [ 502.988608][T11072] [ 503.298702][T11072] netlink: 260 bytes leftover after parsing attributes in process `syz.7.1463'. [ 503.559417][ T5925] usb 9-1: USB disconnect, device number 44 [ 503.853352][T11076] netlink: 'syz.8.1464': attribute type 3 has an invalid length. [ 503.861658][T11076] netlink: 'syz.8.1464': attribute type 1 has an invalid length. [ 503.869511][T11076] netlink: 216 bytes leftover after parsing attributes in process `syz.8.1464'. [ 503.890236][T11076] NCSI netlink: No device for ifindex 33022 [ 504.156528][T11083] syz_tun: entered promiscuous mode [ 504.163712][T11083] batadv_slave_0: entered promiscuous mode [ 504.171295][T11083] hsr1: entered allmulticast mode [ 504.176537][T11083] syz_tun: entered allmulticast mode [ 504.182258][T11083] batadv_slave_0: entered allmulticast mode [ 504.226102][T11083] netlink: 'syz.8.1467': attribute type 1 has an invalid length. [ 504.242492][T11083] netlink: 'syz.8.1467': attribute type 2 has an invalid length. [ 504.543023][T11094] Cannot find set identified by id 0 to match [ 504.601421][ T5896] usb 9-1: new high-speed USB device number 45 using dummy_hcd [ 504.901787][ T5896] usb 9-1: Using ep0 maxpacket: 16 [ 505.612944][ T5896] usb 9-1: too many endpoints for config 0 interface 0 altsetting 61: 48, using maximum allowed: 30 [ 505.632134][ T5896] usb 9-1: config 0 interface 0 altsetting 61 has 0 endpoint descriptors, different from the interface descriptor's value: 48 [ 505.645704][ T5896] usb 9-1: config 0 interface 0 has no altsetting 0 [ 505.660982][ T5896] usb 9-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice=29.82 [ 505.671600][ T5896] usb 9-1: New USB device strings: Mfr=83, Product=5, SerialNumber=10 [ 505.679927][ T5896] usb 9-1: Product: syz [ 505.691697][ T5896] usb 9-1: Manufacturer: syz [ 505.822685][ T5896] usb 9-1: SerialNumber: syz [ 505.832728][ T5896] usb 9-1: config 0 descriptor?? [ 505.842999][ T5896] usb 9-1: selecting invalid altsetting 1 [ 506.723059][ T5896] snd-usb-audio 9-1:0.0: probe with driver snd-usb-audio failed with error -22 [ 506.739847][ T5896] usb 9-1: USB disconnect, device number 45 [ 506.767736][T11111] FAULT_INJECTION: forcing a failure. [ 506.767736][T11111] name failslab, interval 1, probability 0, space 0, times 0 [ 506.818709][T10802] udevd[10802]: error opening ATTR{/sys/devices/platform/dummy_hcd.8/usb9/9-1/9-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 506.849816][T11111] CPU: 0 UID: 0 PID: 11111 Comm: syz.7.1476 Not tainted 6.16.0-rc5-syzkaller-00121-gbc9ff192a6c9 #0 PREEMPT(full) [ 506.849848][T11111] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 506.849859][T11111] Call Trace: [ 506.849868][T11111] [ 506.849877][T11111] dump_stack_lvl+0x189/0x250 [ 506.849906][T11111] ? __pfx____ratelimit+0x10/0x10 [ 506.849935][T11111] ? __pfx_dump_stack_lvl+0x10/0x10 [ 506.849957][T11111] ? __pfx__printk+0x10/0x10 [ 506.849990][T11111] ? __pfx___might_resched+0x10/0x10 [ 506.850017][T11111] should_fail_ex+0x414/0x560 [ 506.850049][T11111] should_failslab+0xa8/0x100 [ 506.850080][T11111] __kmalloc_cache_noprof+0x70/0x3d0 [ 506.850106][T11111] ? sctp_add_bind_addr+0x8c/0x370 [ 506.850131][T11111] sctp_add_bind_addr+0x8c/0x370 [ 506.850157][T11111] sctp_bind_addr_copy+0xb3/0x3c0 [ 506.850178][T11111] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 506.850209][T11111] sctp_connect_new_asoc+0x2e0/0x690 [ 506.850239][T11111] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 506.850266][T11111] ? sctp_endpoint_lookup_assoc+0x7b/0x260 [ 506.850291][T11111] ? sctp_endpoint_lookup_assoc+0x7b/0x260 [ 506.850314][T11111] ? sctp_endpoint_lookup_assoc+0x7b/0x260 [ 506.850340][T11111] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 506.850357][T11111] ? security_sctp_bind_connect+0x7e/0x2e0 [ 506.850389][T11111] sctp_sendmsg+0x155c/0x2810 [ 506.850428][T11111] ? __pfx_sctp_sendmsg+0x10/0x10 [ 506.850452][T11111] ? __lock_acquire+0xab9/0xd20 [ 506.850491][T11111] ? sock_rps_record_flow+0x19/0x410 [ 506.850513][T11111] ? inet_sendmsg+0x2f4/0x370 [ 506.850529][T11111] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 506.850559][T11111] __sock_sendmsg+0x19c/0x270 [ 506.850594][T11111] __sys_sendto+0x3bd/0x520 [ 506.850619][T11111] ? __pfx___sys_sendto+0x10/0x10 [ 506.850638][T11111] ? __mutex_unlock_slowpath+0x1cd/0x700 [ 506.850674][T11111] ? __fget_files+0x3a0/0x420 [ 506.850706][T11111] ? ksys_write+0x22a/0x250 [ 506.850735][T11111] ? __pfx_ksys_write+0x10/0x10 [ 506.850766][T11111] ? rcu_is_watching+0x15/0xb0 [ 506.850864][T11111] __x64_sys_sendto+0xde/0x100 [ 506.850891][T11111] do_syscall_64+0xfa/0x3b0 [ 506.850909][T11111] ? lockdep_hardirqs_on+0x9c/0x150 [ 506.850934][T11111] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 506.850954][T11111] ? clear_bhb_loop+0x60/0xb0 [ 506.850977][T11111] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 506.850995][T11111] RIP: 0033:0x7fb42378e929 [ 506.851013][T11111] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 506.851030][T11111] RSP: 002b:00007fb424527038 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 506.851051][T11111] RAX: ffffffffffffffda RBX: 00007fb4239b5fa0 RCX: 00007fb42378e929 [ 506.851066][T11111] RDX: 000000000000fee4 RSI: 0000200000847fff RDI: 0000000000000003 [ 506.851079][T11111] RBP: 00007fb424527090 R08: 000020000005ffe4 R09: 000000000000001c [ 506.851092][T11111] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 506.851103][T11111] R13: 0000000000000000 R14: 00007fb4239b5fa0 R15: 00007ffd3afc9858 [ 506.851137][T11111] [ 507.188597][T11123] IPVS: fo: SCTP 172.20.20.187:0 - no destination available [ 507.225349][ T5949] IPVS: starting estimator thread 0... [ 507.311297][T11124] IPVS: using max 28 ests per chain, 67200 per kthread [ 507.393514][T11132] set match dimension is over the limit! [ 508.088756][T11138] netlink: 32 bytes leftover after parsing attributes in process `syz.6.1485'. [ 509.141566][ T5896] usb 9-1: new high-speed USB device number 46 using dummy_hcd [ 509.291329][ T5896] usb 9-1: Using ep0 maxpacket: 8 [ 509.302350][ T5896] usb 9-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 509.328444][ T5896] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 509.349543][ T5896] usb 9-1: Product: syz [ 509.363981][ T5896] usb 9-1: Manufacturer: syz [ 509.374025][ T5896] usb 9-1: SerialNumber: syz [ 509.386872][ T5896] usb 9-1: config 0 descriptor?? [ 510.285946][ T5896] usb 9-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 510.636952][T11191] ipt_ECN: cannot use operation on non-tcp rule [ 510.764321][T11197] netlink: 20 bytes leftover after parsing attributes in process `syz.5.1506'. [ 510.775104][T11197] xt_TCPMSS: Only works on TCP SYN packets [ 510.832529][T11199] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1507'. [ 510.863844][ T5958] usb 8-1: new high-speed USB device number 42 using dummy_hcd [ 510.910951][T11201] netlink: 28 bytes leftover after parsing attributes in process `syz.5.1508'. [ 511.001919][ T5958] usb 8-1: device descriptor read/64, error -71 [ 511.119753][T11208] netlink: 104 bytes leftover after parsing attributes in process `syz.6.1511'. [ 511.261819][ T5958] usb 8-1: new high-speed USB device number 43 using dummy_hcd [ 511.451315][ T5958] usb 8-1: device descriptor read/64, error -71 [ 511.562434][ T5958] usb usb8-port1: attempt power cycle [ 511.819065][T11222] delete_channel: no stack [ 511.951313][ T5958] usb 8-1: new high-speed USB device number 44 using dummy_hcd [ 511.982688][ T5958] usb 8-1: device descriptor read/8, error -71 [ 512.027560][ T5896] dvb_usb_rtl28xxu 9-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 512.061095][ T5896] usb 9-1: USB disconnect, device number 46 [ 512.150686][T11232] netlink: 60 bytes leftover after parsing attributes in process `syz.5.1519'. [ 512.228419][ T5958] usb 8-1: new high-speed USB device number 45 using dummy_hcd [ 512.256523][ T5958] usb 8-1: device descriptor read/8, error -71 [ 512.373422][ T5958] usb usb8-port1: unable to enumerate USB device [ 514.054447][T11254] ipt_ECN: cannot use operation on non-tcp rule [ 514.089177][T11254] loop6: detected capacity change from 0 to 7 [ 514.099907][T11254] Dev loop6: unable to read RDB block 7 [ 514.115963][T11254] loop6: AHDI p3 p4 [ 514.120066][T11254] loop6: partition table partially beyond EOD, truncated [ 514.140369][T11254] loop6: p3 start 1886353253 is beyond EOD, truncated [ 514.384586][T11261] ubi31: attaching mtd0 [ 514.485287][T11261] ubi31: scanning is finished [ 514.490075][T11261] ubi31: empty MTD device detected [ 514.524513][T11262] 9pnet_fd: Insufficient options for proto=fd [ 515.136233][T11261] ubi31: attached mtd0 (name "mtdram test device", size 0 MiB) [ 515.156723][T11261] ubi31: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 515.182853][T11261] ubi31: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 515.200376][T11261] ubi31: VID header offset: 64 (aligned 64), data offset: 128 [ 515.229694][T11261] ubi31: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 515.270258][T11261] ubi31: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 515.301791][T11261] ubi31: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 687396574 [ 515.344303][T11261] ubi31: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 515.378295][T11267] ubi31: background thread "ubi_bgt31d" started, PID 11267 [ 516.465382][T11282] set match dimension is over the limit! [ 517.232635][T11290] ipt_ECN: cannot use operation on non-tcp rule [ 517.743318][T11303] syzkaller1: entered promiscuous mode [ 517.809513][T11303] syzkaller1: entered allmulticast mode [ 518.622914][T11319] set match dimension is over the limit! [ 519.305353][T11325] mac80211_hwsim hwsim17 wlan0: entered promiscuous mode [ 519.416178][T11327] ipt_ECN: cannot use operation on non-tcp rule [ 519.886069][T11349] netlink: 20 bytes leftover after parsing attributes in process `syz.8.1560'. [ 520.445215][T11367] netlink: 300 bytes leftover after parsing attributes in process `syz.0.1566'. [ 520.804363][T11372] syz_tun: entered allmulticast mode [ 520.921404][T11379] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 521.368593][T11373] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 522.344268][T11393] sch_fq: defrate 4294967295 ignored. [ 522.394919][T11395] netlink: 'syz.0.1577': attribute type 49 has an invalid length. [ 523.086630][T11418] netlink: 40 bytes leftover after parsing attributes in process `syz.5.1585'. [ 523.207931][T11418] virt_wifi0 speed is unknown, defaulting to 1000 [ 523.256913][T11419] virt_wifi0 speed is unknown, defaulting to 1000 [ 523.258382][T11422] netlink: 'syz.5.1585': attribute type 3 has an invalid length. [ 523.667666][T11435] netlink: 96 bytes leftover after parsing attributes in process `syz.0.1589'. [ 523.699692][T11432] macsec1: entered promiscuous mode [ 523.705311][T11432] mac80211_hwsim hwsim18 wlan0: entered promiscuous mode [ 523.713746][T11432] macsec1: entered allmulticast mode [ 523.719824][T11432] mac80211_hwsim hwsim18 wlan0: entered allmulticast mode [ 525.004011][T11456] set match dimension is over the limit! [ 525.014078][T11456] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1597'. [ 525.096139][T11461] netlink: 96 bytes leftover after parsing attributes in process `syz.0.1598'. [ 527.354721][ T5896] usb 9-1: new high-speed USB device number 47 using dummy_hcd [ 527.791840][ T5896] usb 9-1: config 0 has an invalid interface number: 153 but max is 0 [ 527.820651][ T5896] usb 9-1: config 0 has no interface number 0 [ 527.860064][ T5896] usb 9-1: too many endpoints for config 0 interface 153 altsetting 255: 255, using maximum allowed: 30 [ 527.908276][ T5896] usb 9-1: config 0 interface 153 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 527.968156][ T5896] usb 9-1: config 0 interface 153 has no altsetting 0 [ 527.978240][ T5896] usb 9-1: New USB device found, idVendor=1199, idProduct=6852, bcdDevice=57.34 [ 527.998500][ T5896] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 528.018335][ T5896] usb 9-1: Product: syz [ 528.030148][ T5896] usb 9-1: Manufacturer: syz [ 528.046256][ T5896] usb 9-1: SerialNumber: syz [ 528.065389][ T5896] usb 9-1: config 0 descriptor?? [ 528.080864][ T5896] hub 9-1:0.153: bad descriptor, ignoring hub [ 528.087231][ T5896] hub 9-1:0.153: probe with driver hub failed with error -5 [ 528.103137][ T5896] sierra 9-1:0.153: Sierra USB modem converter detected [ 528.300463][T11483] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 528.315466][T11509] Dead loop on virtual device ip6_vti0, fix it urgently! [ 528.323711][T11509] Dead loop on virtual device ip6_vti0, fix it urgently! [ 528.333139][T11483] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 528.347789][T11509] Dead loop on virtual device ip6_vti0, fix it urgently! [ 528.382353][T11509] Dead loop on virtual device ip6_vti0, fix it urgently! [ 528.509203][T11509] Dead loop on virtual device ip6_vti0, fix it urgently! [ 528.534730][T11509] Dead loop on virtual device ip6_vti0, fix it urgently! [ 528.622591][ T5896] usb 9-1: USB disconnect, device number 47 [ 528.646334][ T5896] sierra 9-1:0.153: device disconnected [ 528.878089][T11515] overlayfs: failed to resolve './file1': -2 [ 529.073372][T11519] overlayfs: workdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 529.447054][T11523] netlink: 92 bytes leftover after parsing attributes in process `syz.7.1616'. [ 530.362416][T11537] 9pnet_fd: Insufficient options for proto=fd [ 530.381902][T11537] lo speed is unknown, defaulting to 1000 [ 530.388193][T11537] lo speed is unknown, defaulting to 1000 [ 530.400159][T11537] lo speed is unknown, defaulting to 1000 [ 530.505662][T11537] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 530.683559][T11537] lo speed is unknown, defaulting to 1000 [ 530.703071][T11537] lo speed is unknown, defaulting to 1000 [ 530.724978][T11537] lo speed is unknown, defaulting to 1000 [ 530.746023][T11537] lo speed is unknown, defaulting to 1000 [ 530.768105][T11537] lo speed is unknown, defaulting to 1000 [ 532.036236][T11553] netlink: 44 bytes leftover after parsing attributes in process `syz.5.1626'. [ 532.048297][T11553] new mount options do not match the existing superblock, will be ignored [ 533.297155][T11562] netlink: 4 bytes leftover after parsing attributes in process `syz.8.1628'. [ 533.541298][ T5841] usb 8-1: new high-speed USB device number 46 using dummy_hcd [ 533.842187][ T5841] usb 8-1: Using ep0 maxpacket: 8 [ 533.859826][ T5841] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 533.892433][ T5841] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 533.907766][T11587] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 533.917016][T11587] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 533.925881][T11587] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 533.935550][T11587] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 533.941221][ T5841] usb 8-1: New USB device found, idVendor=046d, idProduct=c24f, bcdDevice= 0.00 [ 533.989262][ T5841] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 534.027018][ T5841] usb 8-1: config 0 descriptor?? [ 534.543647][ T5841] logitech 0003:046D:C24F.0008: unbalanced collection at end of report description [ 534.560996][ T5841] logitech 0003:046D:C24F.0008: parse failed [ 534.600384][ T5841] logitech 0003:046D:C24F.0008: probe with driver logitech failed with error -22 [ 534.896473][T11610] netlink: 28 bytes leftover after parsing attributes in process `syz.8.1645'. [ 534.923772][T11610] netlink: 28 bytes leftover after parsing attributes in process `syz.8.1645'. [ 535.291490][T11622] netlink: 260 bytes leftover after parsing attributes in process `syz.0.1648'. [ 535.414313][ T5958] usb 8-1: USB disconnect, device number 46 [ 537.861685][ T30] kauditd_printk_skb: 305 callbacks suppressed [ 537.861706][ T30] audit: type=1326 audit(1752253891.382:476): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11642 comm="syz.0.1657" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fedbfb8e929 code=0x0 [ 537.889298][ C1] vkms_vblank_simulate: vblank timer overrun [ 537.892738][T11650] set match dimension is over the limit! [ 537.995023][T11650] netlink: 4 bytes leftover after parsing attributes in process `syz.7.1658'. [ 539.457475][T11662] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1662'. [ 541.456156][T11706] netlink: 260 bytes leftover after parsing attributes in process `syz.0.1678'. [ 541.730871][ T30] audit: type=1800 audit(1752253895.932:477): pid=11710 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.7.1680" name="SYSV00000000" dev="tmpfs" ino=2 res=0 errno=0 [ 542.017039][T11720] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1684'. [ 543.250279][T11731] netlink: 'syz.0.1688': attribute type 19 has an invalid length. [ 543.302983][T11731] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1688'. [ 543.364883][T11734] netlink: 40 bytes leftover after parsing attributes in process `syz.6.1689'. [ 544.057457][T11728] trusted_key: encrypted_key: insufficient parameters specified [ 544.476932][T11753] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1695'. [ 545.990574][ T30] audit: type=1326 audit(1752253900.182:478): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11772 comm="syz.0.1703" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fedbfb8e929 code=0x7ffc0000 [ 546.044733][ T30] audit: type=1326 audit(1752253900.182:479): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11772 comm="syz.0.1703" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fedbfb8e929 code=0x7ffc0000 [ 546.317936][ T30] audit: type=1326 audit(1752253900.182:480): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11772 comm="syz.0.1703" exe="/root/syz-executor" sig=0 arch=c000003e syscall=254 compat=0 ip=0x7fedbfb8e929 code=0x7ffc0000 [ 546.339706][ C1] vkms_vblank_simulate: vblank timer overrun [ 546.840960][ T30] audit: type=1326 audit(1752253900.182:481): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11772 comm="syz.0.1703" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fedbfb8e929 code=0x7ffc0000 [ 546.871383][ T30] audit: type=1326 audit(1752253900.182:482): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11772 comm="syz.0.1703" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fedbfb8e929 code=0x7ffc0000 [ 546.941381][ T30] audit: type=1326 audit(1752253900.182:483): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11772 comm="syz.0.1703" exe="/root/syz-executor" sig=0 arch=c000003e syscall=255 compat=0 ip=0x7fedbfb8e929 code=0x7ffc0000 [ 546.997875][ T30] audit: type=1326 audit(1752253900.182:484): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11772 comm="syz.0.1703" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fedbfb8e929 code=0x7ffc0000 [ 547.030361][ T30] audit: type=1326 audit(1752253900.182:485): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11772 comm="syz.0.1703" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fedbfb8e52b code=0x7ffc0000 [ 547.073344][ T30] audit: type=1326 audit(1752253900.182:486): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11772 comm="syz.0.1703" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fedbfb8e929 code=0x7ffc0000 [ 547.099036][ T30] audit: type=1326 audit(1752253900.182:487): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11772 comm="syz.0.1703" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fedbfb8e52b code=0x7ffc0000 [ 548.730447][T11795] netlink: 260 bytes leftover after parsing attributes in process `syz.7.1711'. [ 548.996596][T11802] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1712'. [ 549.239808][T11817] netlink: 20 bytes leftover after parsing attributes in process `syz.7.1715'. [ 549.818045][T11816] netlink: 4 bytes leftover after parsing attributes in process `syz.7.1715'. [ 550.737934][T11829] random: crng reseeded on system resumption [ 551.597545][T11831] bridge: RTM_NEWNEIGH with invalid ether address [ 553.555602][ T5957] usb 9-1: new full-speed USB device number 48 using dummy_hcd [ 553.793452][ T5957] usb 9-1: config 5 has an invalid interface number: 123 but max is 0 [ 553.957365][ T5957] usb 9-1: config 5 has no interface number 0 [ 553.981782][ T5958] usb 8-1: new full-speed USB device number 47 using dummy_hcd [ 553.991231][ T5957] usb 9-1: config 5 interface 123 altsetting 7 endpoint 0x4 has invalid maxpacket 65535, setting to 64 [ 554.021213][ T5957] usb 9-1: config 5 interface 123 has no altsetting 0 [ 554.052876][ T5957] usb 9-1: New USB device found, idVendor=3923, idProduct=718a, bcdDevice=d8.d7 [ 554.080898][ T5957] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 554.114920][ T5957] usb 9-1: Product: syz [ 554.119242][ T5957] usb 9-1: Manufacturer: syz [ 554.138167][ T5957] usb 9-1: SerialNumber: syz [ 554.164000][ T5958] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 554.196655][ T5958] usb 8-1: config 0 has no interfaces? [ 554.466266][T11866] --map-set only usable from mangle table [ 554.502496][T11847] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 554.541447][ T5958] usb 8-1: New USB device found, idVendor=0b48, idProduct=1005, bcdDevice=8c.1e [ 554.552525][ T5958] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 554.588567][ T5958] usb 8-1: config 0 descriptor?? [ 554.807041][ T5957] ni6501 9-1:5.123: driver 'ni6501' failed to auto-configure device. [ 554.853365][ T5958] usb 8-1: USB disconnect, device number 47 [ 554.896714][ T5957] usb 9-1: USB disconnect, device number 48 [ 555.638411][T11884] netlink: 'syz.8.1735': attribute type 1 has an invalid length. [ 556.688724][T11897] tty tty2: ldisc open failed (-12), clearing slot 1 [ 556.844323][ T30] kauditd_printk_skb: 32 callbacks suppressed [ 556.844343][ T30] audit: type=1326 audit(1752253911.052:520): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11899 comm="syz.5.1739" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f95e638e929 code=0x0 [ 556.871714][ C1] vkms_vblank_simulate: vblank timer overrun [ 557.311236][ T5958] usb 8-1: new high-speed USB device number 48 using dummy_hcd [ 557.663281][ T5958] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x6 has invalid wMaxPacketSize 0 [ 557.838557][ T5958] usb 8-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 0 [ 557.859540][ T5958] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 557.871062][ T5958] usb 8-1: config 0 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 557.889193][ T5958] usb 8-1: New USB device found, idVendor=1199, idProduct=b000, bcdDevice=e5.38 [ 557.898598][ T5958] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 557.909721][ T5958] usb 8-1: Product: syz [ 557.915124][ T5958] usb 8-1: Manufacturer: syz [ 558.057381][ T5958] usb 8-1: SerialNumber: syz [ 558.069972][ T5958] usb 8-1: config 0 descriptor?? [ 558.832419][T11904] netlink: 24 bytes leftover after parsing attributes in process `syz.7.1740'. [ 560.036179][ T5958] usb 9-1: new high-speed USB device number 49 using dummy_hcd [ 560.211035][ T5926] usb 8-1: USB disconnect, device number 48 [ 560.348244][ T5958] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 560.413684][ T5958] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 560.503233][ T5958] usb 9-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 560.559673][ T5958] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 560.568671][ T5958] usb 9-1: SerialNumber: syz [ 561.119460][ T5958] usb 9-1: 0:2 : does not exist [ 561.129473][ T5958] usb 9-1: unit 255 not found! [ 561.179574][ T5958] usb 9-1: USB disconnect, device number 49 [ 561.229375][T11851] udevd[11851]: error opening ATTR{/sys/devices/platform/dummy_hcd.8/usb9/9-1/9-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 561.576621][T11962] wireguard: wg1: Could not create IPv4 socket [ 561.841364][ T5958] usb 8-1: new high-speed USB device number 49 using dummy_hcd [ 562.791375][ T5958] usb 8-1: Using ep0 maxpacket: 8 [ 562.801810][ T5958] usb 8-1: unable to get BOS descriptor or descriptor too short [ 562.963033][ T5958] usb 8-1: config 4 interface 0 has no altsetting 0 [ 563.817430][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.829909][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.832089][ T5958] usb 8-1: string descriptor 0 read error: -22 [ 563.843342][ T5958] usb 8-1: New USB device found, idVendor=058f, idProduct=6610, bcdDevice=48.05 [ 563.852662][ T5958] usb 8-1: New USB device strings: Mfr=2, Product=0, SerialNumber=3 [ 563.914374][ T5958] usb 8-1: dvb_usb_v2: found a 'Sigmatek DVB-110' in warm state [ 563.987390][ T5958] usb 8-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 564.021611][ T5958] dvbdev: DVB: registering new adapter (Sigmatek DVB-110) [ 564.047186][ T5958] usb 8-1: media controller created [ 564.155146][ T5958] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 565.403118][ T5958] zl10353_read_register: readreg error (reg=127, ret==0) [ 567.621367][ T10] usb 9-1: new low-speed USB device number 50 using dummy_hcd [ 567.781410][ T10] usb 9-1: device descriptor read/64, error -71 [ 568.051858][ T10] usb 9-1: new low-speed USB device number 51 using dummy_hcd [ 568.221759][ T10] usb 9-1: device descriptor read/64, error -71 [ 568.385985][ T10] usb usb9-port1: attempt power cycle [ 568.668082][T12076] netlink: 88 bytes leftover after parsing attributes in process `syz.6.1797'. [ 568.896282][ T10] usb 9-1: new low-speed USB device number 52 using dummy_hcd [ 569.050603][T12096] netlink: 84 bytes leftover after parsing attributes in process `syz.6.1797'. [ 569.288034][ T10] usb 9-1: device descriptor read/8, error -71 [ 569.879334][T12094] wireguard: wg1: Could not create IPv4 socket [ 569.924115][ T10] usb 9-1: new low-speed USB device number 53 using dummy_hcd [ 569.966966][ T10] usb 9-1: device descriptor read/8, error -71 [ 570.138406][T12107] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1799'. [ 570.281812][ T10] usb usb9-port1: unable to enumerate USB device [ 570.669126][T12111] netlink: 4 bytes leftover after parsing attributes in process `syz.8.1802'. [ 570.765355][T12112] set match dimension is over the limit! [ 571.138462][T12118] set match dimension is over the limit! [ 572.221545][T12131] netlink: 20 bytes leftover after parsing attributes in process `syz.5.1805'. [ 572.272612][T12131] netdevsim netdevsim5 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 572.281532][T12131] netdevsim netdevsim5 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 572.290249][T12131] netdevsim netdevsim5 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 572.299236][T12131] netdevsim netdevsim5 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 572.728323][T12130] vivid-002: disconnect [ 573.268653][T12135] netlink: 'syz.8.1806': attribute type 10 has an invalid length. [ 573.285584][T12135] bridge0: port 2(bridge_slave_1) entered disabled state [ 573.294773][T12135] bridge_slave_1: left allmulticast mode [ 573.301050][T12135] bridge_slave_1: left promiscuous mode [ 573.307817][T12135] bridge0: port 2(bridge_slave_1) entered disabled state [ 573.749047][T12129] vivid-002: reconnect [ 573.765953][T12135] bridge_slave_1: entered allmulticast mode [ 573.773334][T12135] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 574.470112][T12153] FAULT_INJECTION: forcing a failure. [ 574.470112][T12153] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 574.484686][T12153] CPU: 1 UID: 0 PID: 12153 Comm: syz.8.1812 Not tainted 6.16.0-rc5-syzkaller-00121-gbc9ff192a6c9 #0 PREEMPT(full) [ 574.484714][T12153] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 574.484725][T12153] Call Trace: [ 574.484733][T12153] [ 574.484741][T12153] dump_stack_lvl+0x189/0x250 [ 574.484768][T12153] ? __pfx____ratelimit+0x10/0x10 [ 574.484803][T12153] ? __pfx_dump_stack_lvl+0x10/0x10 [ 574.484827][T12153] ? __pfx__printk+0x10/0x10 [ 574.484854][T12153] ? __might_fault+0xb0/0x130 [ 574.484901][T12153] should_fail_ex+0x414/0x560 [ 574.484949][T12153] _copy_from_iter+0x1db/0x16f0 [ 574.484977][T12153] ? rcu_is_watching+0x15/0xb0 [ 574.485012][T12153] ? __kmalloc_node_track_caller_noprof+0x28e/0x4e0 [ 574.485043][T12153] ? __pfx__copy_from_iter+0x10/0x10 [ 574.485068][T12153] ? __build_skb_around+0x257/0x3e0 [ 574.485112][T12153] ? tipc_msg_build+0x400/0xcf0 [ 574.485159][T12153] tipc_msg_build+0x458/0xcf0 [ 574.485203][T12153] ? __pfx_tipc_msg_build+0x10/0x10 [ 574.485241][T12153] ? tipc_sk_filtering+0x13c/0x510 [ 574.485283][T12153] __tipc_sendstream+0x8ac/0x1290 [ 574.485359][T12153] ? __pfx___tipc_sendstream+0x10/0x10 [ 574.485382][T12153] ? __pfx_woken_wake_function+0x10/0x10 [ 574.485407][T12153] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 574.485434][T12153] tipc_sendstream+0x55/0x70 [ 574.485465][T12153] ? __pfx_tipc_sendstream+0x10/0x10 [ 574.485484][T12153] __sock_sendmsg+0x219/0x270 [ 574.485513][T12153] sock_write_iter+0x258/0x330 [ 574.485538][T12153] ? __pfx_sock_write_iter+0x10/0x10 [ 574.485572][T12153] ? bpf_lsm_file_permission+0x9/0x20 [ 574.485587][T12153] ? security_file_permission+0x75/0x290 [ 574.485624][T12153] vfs_write+0x548/0xa90 [ 574.485656][T12153] ? __pfx_sock_write_iter+0x10/0x10 [ 574.485683][T12153] ? __pfx_vfs_write+0x10/0x10 [ 574.485720][T12153] ? __fget_files+0x2a/0x420 [ 574.485749][T12153] ksys_write+0x145/0x250 [ 574.485777][T12153] ? __pfx_ksys_write+0x10/0x10 [ 574.485798][T12153] ? rcu_is_watching+0x15/0xb0 [ 574.485822][T12153] ? do_syscall_64+0xbe/0x3b0 [ 574.485845][T12153] do_syscall_64+0xfa/0x3b0 [ 574.485861][T12153] ? lockdep_hardirqs_on+0x9c/0x150 [ 574.485887][T12153] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 574.485905][T12153] ? clear_bhb_loop+0x60/0xb0 [ 574.485927][T12153] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 574.485946][T12153] RIP: 0033:0x7f861bd8e929 [ 574.485964][T12153] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 574.485981][T12153] RSP: 002b:00007f8619bd5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 574.486003][T12153] RAX: ffffffffffffffda RBX: 00007f861bfb6080 RCX: 00007f861bd8e929 [ 574.486017][T12153] RDX: 000000002000011a RSI: 0000200000000400 RDI: 0000000000000003 [ 574.486029][T12153] RBP: 00007f8619bd5090 R08: 0000000000000000 R09: 0000000000000000 [ 574.486041][T12153] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 574.486052][T12153] R13: 0000000000000000 R14: 00007f861bfb6080 R15: 00007ffdcb9ca638 [ 574.486087][T12153] [ 574.787677][ C1] vkms_vblank_simulate: vblank timer overrun [ 575.346206][T12163] set match dimension is over the limit! [ 575.360926][T12165] xt_hashlimit: size too large, truncated to 1048576 [ 576.021260][ T10] usb 9-1: new full-speed USB device number 54 using dummy_hcd [ 576.194994][ T10] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 576.217957][ T10] usb 9-1: config 0 has no interfaces? [ 576.226110][T12180] overlayfs: failed to resolve 'cgroup': -2 [ 576.231490][ T10] usb 9-1: New USB device found, idVendor=0b48, idProduct=1005, bcdDevice=8c.1e [ 576.264027][ T10] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 576.287633][ T10] usb 9-1: config 0 descriptor?? [ 576.385439][T12186] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1825'. [ 576.528347][ T10] usb 9-1: USB disconnect, device number 54 [ 577.098772][T12196] overlayfs: failed to clone upperpath [ 577.262134][ T5855] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 577.273026][ T5855] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 577.283497][ T5855] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 577.554522][ T5855] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 577.569705][ T5855] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 578.550985][T12199] virt_wifi0 speed is unknown, defaulting to 1000 [ 578.574241][T12199] lo speed is unknown, defaulting to 1000 [ 579.643166][ T5847] Bluetooth: hci5: command tx timeout [ 579.670248][T12223] kernel read not supported for file /blkio.throttle.io_service_bytes_recursive (pid: 12223 comm: syz.8.1835) [ 579.693525][ T30] audit: type=1800 audit(1752253933.892:521): pid=12223 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.8.1835" name="blkio.throttle.io_service_bytes_recursive" dev="mqueue" ino=31796 res=0 errno=0 [ 580.248299][T12199] chnl_net:caif_netlink_parms(): no params data found [ 580.393317][T12225] overlayfs: failed to resolve 'cgroup': -2 [ 580.562665][T12199] bridge0: port 1(bridge_slave_0) entered blocking state [ 580.569793][T12199] bridge0: port 1(bridge_slave_0) entered disabled state [ 580.585864][T12199] bridge_slave_0: entered allmulticast mode [ 580.616597][T12199] bridge_slave_0: entered promiscuous mode [ 580.704011][T12199] bridge0: port 2(bridge_slave_1) entered blocking state [ 580.715511][T12199] bridge0: port 2(bridge_slave_1) entered disabled state [ 580.724067][T12199] bridge_slave_1: entered allmulticast mode [ 580.734601][T12199] bridge_slave_1: entered promiscuous mode [ 580.850119][T12199] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 580.940839][T12199] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 581.247504][T12199] team0: Port device team_slave_0 added [ 581.257058][T12199] team0: Port device team_slave_1 added [ 581.386846][T12199] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 581.404972][T12199] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 581.434596][T12199] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 581.472505][T12199] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 581.497910][T12199] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 581.659442][T12199] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 581.721418][ T5847] Bluetooth: hci5: command tx timeout [ 581.800597][T12199] hsr_slave_0: entered promiscuous mode [ 581.835604][T12199] hsr_slave_1: entered promiscuous mode [ 581.843509][T12243] netlink: 132 bytes leftover after parsing attributes in process `syz.5.1842'. [ 582.181102][T12247] netlink: 48 bytes leftover after parsing attributes in process `syz.5.1844'. [ 584.072106][ T5847] Bluetooth: hci5: command tx timeout [ 584.903550][T12199] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 584.934197][T12199] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 584.956796][T12199] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 584.986315][T12199] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 585.390257][T12199] 8021q: adding VLAN 0 to HW filter on device bond0 [ 585.476127][T12199] 8021q: adding VLAN 0 to HW filter on device team0 [ 585.519790][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 585.527066][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 585.623123][ T9956] bridge0: port 2(bridge_slave_1) entered blocking state [ 585.630441][ T9956] bridge0: port 2(bridge_slave_1) entered forwarding state [ 585.744776][T12299] FAULT_INJECTION: forcing a failure. [ 585.744776][T12299] name failslab, interval 1, probability 0, space 0, times 0 [ 585.788136][T12299] CPU: 1 UID: 0 PID: 12299 Comm: syz.8.1856 Not tainted 6.16.0-rc5-syzkaller-00121-gbc9ff192a6c9 #0 PREEMPT(full) [ 585.788167][T12299] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 585.788178][T12299] Call Trace: [ 585.788186][T12299] [ 585.788194][T12299] dump_stack_lvl+0x189/0x250 [ 585.788223][T12299] ? __pfx____ratelimit+0x10/0x10 [ 585.788255][T12299] ? __pfx_dump_stack_lvl+0x10/0x10 [ 585.788276][T12299] ? __pfx__printk+0x10/0x10 [ 585.788308][T12299] ? __pfx___might_resched+0x10/0x10 [ 585.788327][T12299] ? fs_reclaim_acquire+0x7d/0x100 [ 585.788363][T12299] should_fail_ex+0x414/0x560 [ 585.788396][T12299] should_failslab+0xa8/0x100 [ 585.788425][T12299] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 585.788453][T12299] ? __alloc_skb+0x112/0x2d0 [ 585.788481][T12299] __alloc_skb+0x112/0x2d0 [ 585.788507][T12299] sock_omalloc+0xd8/0x1e0 [ 585.788538][T12299] msg_zerocopy_realloc+0x9c/0x850 [ 585.788575][T12299] tcp_sendmsg_locked+0x451b/0x5710 [ 585.788611][T12299] ? __pfx_process_measurement+0x10/0x10 [ 585.788628][T12299] ? tomoyo_check_open_permission+0x16a/0x3b0 [ 585.788653][T12299] ? __pfx_tomoyo_check_open_permission+0x10/0x10 [ 585.788702][T12299] ? __lock_acquire+0xab9/0xd20 [ 585.788735][T12299] ? __pfx_tcp_sendmsg_locked+0x10/0x10 [ 585.788751][T12299] ? __local_bh_enable_ip+0x12d/0x1c0 [ 585.788777][T12299] ? __local_bh_enable_ip+0x12d/0x1c0 [ 585.788814][T12299] tcp_sendmsg+0x2f/0x50 [ 585.788834][T12299] __sock_sendmsg+0x19c/0x270 [ 585.788866][T12299] ____sys_sendmsg+0x52d/0x830 [ 585.788898][T12299] ? __pfx_____sys_sendmsg+0x10/0x10 [ 585.788935][T12299] ? import_iovec+0x74/0xa0 [ 585.788962][T12299] ___sys_sendmsg+0x21f/0x2a0 [ 585.788990][T12299] ? __pfx____sys_sendmsg+0x10/0x10 [ 585.789056][T12299] ? __fget_files+0x2a/0x420 [ 585.789072][T12299] ? __fget_files+0x3a0/0x420 [ 585.789102][T12299] __sys_sendmmsg+0x227/0x430 [ 585.789132][T12299] ? __pfx___sys_sendmmsg+0x10/0x10 [ 585.789152][T12299] ? __mutex_unlock_slowpath+0x1cd/0x700 [ 585.789202][T12299] ? ksys_write+0x22a/0x250 [ 585.789230][T12299] ? __pfx_ksys_write+0x10/0x10 [ 585.789264][T12299] __x64_sys_sendmmsg+0xa0/0xc0 [ 585.789289][T12299] do_syscall_64+0xfa/0x3b0 [ 585.789305][T12299] ? lockdep_hardirqs_on+0x9c/0x150 [ 585.789332][T12299] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 585.789358][T12299] ? clear_bhb_loop+0x60/0xb0 [ 585.789381][T12299] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 585.789399][T12299] RIP: 0033:0x7f861bd8e929 [ 585.789417][T12299] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 585.789432][T12299] RSP: 002b:00007f8619bf6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 585.789454][T12299] RAX: ffffffffffffffda RBX: 00007f861bfb5fa0 RCX: 00007f861bd8e929 [ 585.789468][T12299] RDX: 0000000000000004 RSI: 0000200000000d00 RDI: 0000000000000003 [ 585.789479][T12299] RBP: 00007f8619bf6090 R08: 0000000000000000 R09: 0000000000000000 [ 585.789492][T12299] R10: 0000000004000000 R11: 0000000000000246 R12: 0000000000000001 [ 585.789503][T12299] R13: 0000000000000000 R14: 00007f861bfb5fa0 R15: 00007ffdcb9ca638 [ 585.789536][T12299] [ 586.102789][ C1] vkms_vblank_simulate: vblank timer overrun [ 586.123963][ T5847] Bluetooth: hci5: command tx timeout [ 586.195231][T12199] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 586.205851][T12199] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 586.209149][T12303] 9pnet_fd: Insufficient options for proto=fd [ 586.700985][T12199] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 587.649371][T12343] overlayfs: failed to clone upperpath [ 587.881931][ T5896] usb 9-1: new high-speed USB device number 55 using dummy_hcd [ 588.417823][ T5896] usb 9-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 588.522079][ T5896] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 588.595813][ T5896] usb 9-1: Product: syz [ 588.663217][ T5896] usb 9-1: Manufacturer: syz [ 588.757835][ T5896] usb 9-1: SerialNumber: syz [ 589.005793][ T5896] usb 9-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 589.201338][ T5925] usb 9-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 589.289169][T12199] veth0_vlan: entered promiscuous mode [ 589.308358][T12199] veth1_vlan: entered promiscuous mode [ 589.425432][T12199] veth0_macvtap: entered promiscuous mode [ 589.458668][T12199] veth1_macvtap: entered promiscuous mode [ 589.525481][T12199] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 589.570267][T12199] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 589.599223][T12199] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 589.619407][T12199] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 589.650227][T12199] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 589.671297][T12199] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 589.976130][ T9956] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 590.000933][ T9956] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 590.070634][ T9944] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 590.082064][ T9944] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 590.283023][ T5925] ath9k_htc 9-1:1.0: ath9k_htc: Target is unresponsive [ 590.306585][ T5925] ath9k_htc: Failed to initialize the device [ 590.390963][ T5925] usb 9-1: ath9k_htc: USB layer deinitialized [ 590.771365][ T5952] usb 9-1: USB disconnect, device number 55 [ 591.118718][T12384] bond_slave_0: entered promiscuous mode [ 591.124891][T12384] bond_slave_1: entered promiscuous mode [ 591.132404][T12384] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 591.140869][T12384] bond_slave_0: left promiscuous mode [ 591.146410][T12384] bond_slave_1: left promiscuous mode [ 592.363273][T12409] pimreg3: entered allmulticast mode [ 593.293625][T12408] virt_wifi0 speed is unknown, defaulting to 1000 [ 594.342796][T12408] lo speed is unknown, defaulting to 1000 [ 596.204964][T12445] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1900'. [ 596.298979][T12445] bridge_slave_1: left allmulticast mode [ 596.324418][T12445] bridge_slave_1: left promiscuous mode [ 596.330339][T12445] bridge0: port 2(bridge_slave_1) entered disabled state [ 596.383335][T12445] bridge_slave_0: left allmulticast mode [ 596.389062][T12445] bridge_slave_0: left promiscuous mode [ 596.431501][T12445] bridge0: port 1(bridge_slave_0) entered disabled state [ 597.531446][ T5925] usb 10-1: new high-speed USB device number 2 using dummy_hcd [ 597.702486][ T5925] usb 10-1: Using ep0 maxpacket: 16 [ 597.728062][ T5925] usb 10-1: config 0 has an invalid interface number: 41 but max is 0 [ 597.747601][ T5925] usb 10-1: config 0 has no interface number 0 [ 597.783446][ T5925] usb 10-1: New USB device found, idVendor=0c52, idProduct=2872, bcdDevice=b5.85 [ 597.821459][ T5925] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 597.851673][ T5925] usb 10-1: Product: syz [ 597.985901][ T5925] usb 10-1: Manufacturer: syz [ 597.990763][ T5925] usb 10-1: SerialNumber: syz [ 598.034893][ T5925] usb 10-1: config 0 descriptor?? [ 598.066362][ T5925] ftdi_sio 10-1:0.41: FTDI USB Serial Device converter detected [ 598.096303][ T5925] ftdi_sio ttyUSB0: unknown device type: 0xb585 [ 598.352193][ T5949] usb 10-1: USB disconnect, device number 2 [ 598.359054][ T5949] ftdi_sio 10-1:0.41: device disconnected [ 599.363375][ T10] usb 10-1: new high-speed USB device number 3 using dummy_hcd [ 599.527693][ T10] usb 10-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac [ 599.563369][ T10] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 599.591294][ T10] usb 10-1: Product: syz [ 599.607106][ T10] usb 10-1: Manufacturer: syz [ 599.618945][ T10] usb 10-1: SerialNumber: syz [ 599.636344][ T10] usb 10-1: config 0 descriptor?? [ 599.658334][ T10] gspca_main: sunplus-2.14.0 probing 055f:c230 [ 600.062510][ T10] gspca_sunplus: reg_r err -71 [ 600.088443][ T10] sunplus 10-1:0.0: probe with driver sunplus failed with error -71 [ 600.138038][ T10] usb 10-1: USB disconnect, device number 3 [ 601.161775][T12503] bridge0: port 3(netdevsim0) entered blocking state [ 601.169256][T12503] bridge0: port 3(netdevsim0) entered disabled state [ 601.177539][T12503] netdevsim netdevsim9 netdevsim0: entered allmulticast mode [ 601.201209][T12503] netdevsim netdevsim9 netdevsim0: entered promiscuous mode [ 601.211217][T12503] bridge0: port 3(netdevsim0) entered blocking state [ 601.218062][T12503] bridge0: port 3(netdevsim0) entered forwarding state [ 603.048091][T12526] ipt_ECN: cannot use operation on non-tcp rule [ 603.198393][T12531] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1927'. [ 605.078199][T12535] Process accounting resumed [ 605.268083][T12556] xt_hashlimit: size too large, truncated to 1048576 [ 606.648677][T12569] ipt_ECN: cannot use operation on non-tcp rule [ 606.892313][T12576] netlink: 199868 bytes leftover after parsing attributes in process `syz.5.1942'. [ 608.427573][ T30] audit: type=1326 audit(1752253962.632:522): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12587 comm="syz.5.1947" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f95e638e929 code=0x0 [ 609.669584][ T30] audit: type=1326 audit(1752253962.762:523): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12585 comm="syz.8.1948" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f861bd8e929 code=0x7ffc0000 [ 611.274000][ T30] audit: type=1326 audit(1752253962.762:524): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12585 comm="syz.8.1948" exe="/root/syz-executor" sig=0 arch=c000003e syscall=222 compat=0 ip=0x7f861bd8e929 code=0x7ffc0000 [ 611.311249][ T30] audit: type=1326 audit(1752253962.762:525): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12585 comm="syz.8.1948" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f861bd8e929 code=0x7ffc0000 [ 611.333509][ T30] audit: type=1326 audit(1752253962.762:526): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12585 comm="syz.8.1948" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f861bd8e929 code=0x7ffc0000 [ 611.355156][ C1] vkms_vblank_simulate: vblank timer overrun [ 611.513709][ T30] audit: type=1326 audit(1752253962.772:527): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12585 comm="syz.8.1948" exe="/root/syz-executor" sig=0 arch=c000003e syscall=224 compat=0 ip=0x7f861bd8e929 code=0x7ffc0000 [ 611.541314][ T30] audit: type=1326 audit(1752253962.772:528): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12585 comm="syz.8.1948" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f861bd8e929 code=0x7ffc0000 [ 611.611564][ T30] audit: type=1326 audit(1752253962.772:529): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12585 comm="syz.8.1948" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f861bd8e929 code=0x7ffc0000 [ 611.703879][ T30] audit: type=1326 audit(1752253962.772:530): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12585 comm="syz.8.1948" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f861bd8e929 code=0x7ffc0000 [ 611.770538][ T30] audit: type=1326 audit(1752253962.772:531): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12585 comm="syz.8.1948" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f861bd8e929 code=0x7ffc0000 [ 611.971513][ T5925] usb 9-1: new high-speed USB device number 56 using dummy_hcd [ 612.143504][ T5925] usb 9-1: config 1 interface 0 altsetting 5 bulk endpoint 0x1 has invalid maxpacket 1007 [ 612.159154][T12614] netlink: 52 bytes leftover after parsing attributes in process `syz.0.1959'. [ 612.170427][ T5925] usb 9-1: config 1 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 612.186284][ T5925] usb 9-1: config 1 interface 0 has no altsetting 0 [ 612.197081][ T5925] usb 9-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 612.208570][ T5925] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 612.218552][ T5925] usb 9-1: Product: syz [ 612.223733][ T5925] usb 9-1: Manufacturer: syz [ 612.228451][ T5925] usb 9-1: SerialNumber: syz [ 612.246233][T12595] raw-gadget.1 gadget.8: fail, usb_ep_enable returned -22 [ 612.475690][T12595] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 612.489575][T12595] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 612.549684][ T5925] usb 9-1: USB disconnect, device number 56 [ 613.925703][T12631] xt_hashlimit: size too large, truncated to 1048576 [ 614.651478][ T5925] usb 9-1: new high-speed USB device number 57 using dummy_hcd [ 614.847174][ T5925] usb 9-1: New USB device found, idVendor=249c, idProduct=9002, bcdDevice=5e.ad [ 614.996245][ T5925] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 615.026153][ T5925] usb 9-1: config 0 descriptor?? [ 615.184091][T12662] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1976'. [ 615.330650][T12663] _ÐZ`Ô€@ÿÃ: entered promiscuous mode [ 615.458594][T12647] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 615.478059][T12647] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 615.499635][ T5925] snd-usb-hiface 9-1:0.0: probe with driver snd-usb-hiface failed with error -22 [ 615.542741][ T5925] usb 9-1: USB disconnect, device number 57 [ 615.584885][T12662] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1976'. [ 615.611539][T12662] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1976'. [ 615.820708][T12669] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1979'. [ 615.859079][T12671] xt_hashlimit: size too large, truncated to 1048576 [ 615.905807][T12675] netlink: 'syz.5.1979': attribute type 13 has an invalid length. [ 615.934737][T12675] gretap0: refused to change device tx_queue_len [ 615.942142][T12675] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 618.426284][T12720] futex_wake_op: syz.5.1994 tries to shift op by -1; fix this program [ 619.541579][T12728] xt_bpf: check failed: parse error [ 619.962222][ T5925] usb 9-1: new high-speed USB device number 58 using dummy_hcd [ 620.951212][ T5855] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 620.969105][ T5855] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 620.978733][ T5855] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 620.994388][ T5855] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 621.004975][ T5855] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 621.058634][T12765] veth0_to_team: entered promiscuous mode [ 621.064905][T12765] veth0_to_team: entered allmulticast mode [ 621.152622][T12760] virt_wifi0 speed is unknown, defaulting to 1000 [ 621.365231][T12760] lo speed is unknown, defaulting to 1000 [ 622.370097][T12776] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2010'. [ 622.464586][T12760] chnl_net:caif_netlink_parms(): no params data found [ 622.702436][T12760] bridge0: port 1(bridge_slave_0) entered blocking state [ 622.709896][T12760] bridge0: port 1(bridge_slave_0) entered disabled state [ 622.717626][T12760] bridge_slave_0: entered allmulticast mode [ 622.728296][T12760] bridge_slave_0: entered promiscuous mode [ 622.737870][T12760] bridge0: port 2(bridge_slave_1) entered blocking state [ 622.745362][T12760] bridge0: port 2(bridge_slave_1) entered disabled state [ 622.753041][T12760] bridge_slave_1: entered allmulticast mode [ 622.763339][T12760] bridge_slave_1: entered promiscuous mode [ 622.812720][T12760] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 622.826384][T12760] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 622.893863][T12760] team0: Port device team_slave_0 added [ 622.912360][T12760] team0: Port device team_slave_1 added [ 622.989301][T12760] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 622.997796][T12760] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 623.023741][ C1] vkms_vblank_simulate: vblank timer overrun [ 623.121426][ T5847] Bluetooth: hci6: command tx timeout [ 623.182604][T12760] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 623.210021][T12760] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 623.222870][T12760] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 623.279215][T12760] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 623.388473][T12760] hsr_slave_0: entered promiscuous mode [ 623.396171][T12760] hsr_slave_1: entered promiscuous mode [ 623.403721][T12760] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 623.412324][T12760] Cannot create hsr debugfs directory [ 623.812668][T12786] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2012'. [ 624.992364][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.998749][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 625.161951][ T5847] Bluetooth: hci6: command tx timeout [ 627.251454][ T5847] Bluetooth: hci6: command tx timeout [ 627.924480][ T5847] Bluetooth: hci1: SCO packet for unknown connection handle 200 [ 628.519522][ T30] kauditd_printk_skb: 17 callbacks suppressed [ 628.519544][ T30] audit: type=1326 audit(1752253982.722:549): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12855 comm="syz.0.2035" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fedbfb8e929 code=0x0 [ 628.731890][T12760] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 628.761648][T12760] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 628.780477][T12760] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 628.804559][T12760] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 628.908407][T12760] 8021q: adding VLAN 0 to HW filter on device bond0 [ 628.938564][T12760] 8021q: adding VLAN 0 to HW filter on device team0 [ 628.954893][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 628.962165][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 628.982350][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 628.989516][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 629.258839][T12760] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 629.322190][ T5847] Bluetooth: hci6: command tx timeout [ 629.422866][T12874] netlink: 40 bytes leftover after parsing attributes in process `syz.8.2038'. [ 629.431042][T12760] veth0_vlan: entered promiscuous mode [ 629.543666][T12876] netlink: 'syz.8.2038': attribute type 5 has an invalid length. [ 629.711503][T12760] veth1_vlan: entered promiscuous mode [ 630.097622][T12760] veth0_macvtap: entered promiscuous mode [ 630.119323][T12760] veth1_macvtap: entered promiscuous mode [ 630.168663][T12760] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 631.092452][T12760] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 631.136346][T12760] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 631.162388][T12760] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 631.200279][T12760] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 631.227440][T12760] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 631.833325][T12899] bridge0: port 2(netdevsim0) entered blocking state [ 631.840388][T12899] bridge0: port 2(netdevsim0) entered disabled state [ 631.853722][T12899] bridge0: port 2(netdevsim0) entered blocking state [ 631.860593][T12899] bridge0: port 2(netdevsim0) entered forwarding state [ 631.978220][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 632.204712][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 632.380631][ T9932] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 632.410821][ T9932] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 632.578029][T12908] xt_hashlimit: size too large, truncated to 1048576 [ 633.741941][T12928] tipc: Enabling of bearer rejected, failed to enable media [ 634.088296][T12927] virt_wifi0 speed is unknown, defaulting to 1000 [ 634.394207][T12927] lo speed is unknown, defaulting to 1000 [ 636.352779][ T5952] usb 9-1: new full-speed USB device number 59 using dummy_hcd [ 637.418952][ T5952] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 637.479893][ T5952] usb 9-1: config 0 has no interfaces? [ 638.162043][T12975] netlink: zone id is out of range [ 638.167341][T12975] netlink: zone id is out of range [ 638.172632][T12975] netlink: zone id is out of range [ 638.177875][T12975] netlink: zone id is out of range [ 638.183171][T12975] netlink: zone id is out of range [ 638.188397][T12975] netlink: zone id is out of range [ 638.193831][T12975] netlink: zone id is out of range [ 638.199060][T12975] netlink: zone id is out of range [ 638.205168][T12975] netlink: zone id is out of range [ 638.210349][T12975] netlink: zone id is out of range [ 638.333107][ T5952] usb 9-1: New USB device found, idVendor=0b48, idProduct=1005, bcdDevice=8c.1e [ 638.376333][ T5952] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 638.438401][ T5952] usb 9-1: config 0 descriptor?? [ 638.701970][ T5949] usb 9-1: USB disconnect, device number 59 [ 639.908602][T12991] xt_hashlimit: size too large, truncated to 1048576 [ 640.346616][T12994] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2071'. [ 644.231076][ T5925] usb 4-1: new full-speed USB device number 6 using dummy_hcd [ 644.436990][ T5925] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 644.452148][ T5925] usb 4-1: config 0 has no interfaces? [ 644.458687][ T5925] usb 4-1: New USB device found, idVendor=0b48, idProduct=1005, bcdDevice=8c.1e [ 644.468391][ T5925] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 644.502035][ T5925] usb 4-1: config 0 descriptor?? [ 644.728092][ T5925] usb 4-1: USB disconnect, device number 6 [ 645.538399][T13048] erofs (device nullb0): cannot find valid erofs superblock [ 648.283246][T13063] netlink: 260 bytes leftover after parsing attributes in process `syz.8.2089'. [ 650.376717][T13079] bridge_slave_0: left allmulticast mode [ 650.404156][T13079] bridge_slave_0: left promiscuous mode [ 650.410067][T13079] bridge0: port 1(bridge_slave_0) entered disabled state [ 650.463313][T13089] netlink: 'syz.8.2095': attribute type 10 has an invalid length. [ 650.598560][T13079] bond0: (slave bridge_slave_1): Releasing backup interface [ 650.664213][T13079] bridge_slave_1: left allmulticast mode [ 650.700867][T13079] bond0: (slave bond_slave_0): Releasing backup interface [ 650.722243][T13079] bond_slave_0: left allmulticast mode [ 650.810008][T13079] bond0: (slave bond_slave_1): Releasing backup interface [ 650.872532][T13079] bond_slave_1: left allmulticast mode [ 651.040159][T13079] team0: Port device team_slave_0 removed [ 651.090541][T13079] team0: Port device team_slave_1 removed [ 651.141204][T13079] bridge0: port 2(netdevsim0) entered disabled state [ 651.218397][ T5957] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 651.279449][T13089] 8021q: adding VLAN 0 to HW filter on device bond0 [ 651.323974][T13089] team0: Port device bond0 added [ 651.417185][ T5957] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 651.433934][ T5957] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 0 [ 651.446119][ T5957] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 651.457403][ T5957] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x89 has invalid maxpacket 0 [ 651.467560][ T5957] usb 4-1: New USB device found, idVendor=2040, idProduct=4900, bcdDevice=4d.8b [ 651.468999][T13100] ipt_ECN: cannot use operation on non-tcp rule [ 651.479836][ T5957] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 651.498253][ T5957] usb 4-1: config 0 descriptor?? [ 651.646234][T13105] ipt_ECN: cannot use operation on non-tcp rule [ 651.722199][ T5957] hdpvr 4-1:0.0: firmware version 0x12 dated [ 651.788422][T13107] netlink: 'syz.5.2103': attribute type 4 has an invalid length. [ 651.847763][T13107] netlink: 'syz.5.2103': attribute type 4 has an invalid length. [ 651.927908][T13097] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 651.955212][T13097] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 652.027642][ T5957] hdpvr 4-1:0.0: device init failed [ 652.045612][ T5957] hdpvr 4-1:0.0: probe with driver hdpvr failed with error -12 [ 652.568052][ T5957] usb 4-1: USB disconnect, device number 7 [ 652.704726][T13115] netlink: 260 bytes leftover after parsing attributes in process `syz.5.2106'. [ 652.815962][T13117] (unnamed net_device) (uninitialized): option arp_interval: mode dependency failed, not supported in mode balance-alb(6) [ 653.004519][T13129] cgroup: subsys name conflicts with all [ 653.028939][T13129] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2111'. [ 653.038335][ T5896] usb 9-1: new high-speed USB device number 60 using dummy_hcd [ 653.191626][ T5896] usb 9-1: Using ep0 maxpacket: 16 [ 653.210639][ T5896] usb 9-1: New USB device found, idVendor=0d49, idProduct=7010, bcdDevice= c.90 [ 653.230805][ T5896] usb 9-1: New USB device strings: Mfr=1, Product=3, SerialNumber=3 [ 653.251283][ T5896] usb 9-1: Product: syz [ 653.261200][ T5896] usb 9-1: Manufacturer: syz [ 653.271674][ T5896] usb 9-1: SerialNumber: syz [ 653.292790][ T5896] usb 9-1: config 0 descriptor?? [ 653.329419][ T5896] ums-onetouch 9-1:0.0: USB Mass Storage device detected [ 654.215947][ T5957] usb 9-1: USB disconnect, device number 60 [ 654.322181][T13149] bridge0: port 3(netdevsim0) entered blocking state [ 654.329590][T13149] bridge0: port 3(netdevsim0) entered disabled state [ 654.337708][T13149] netdevsim netdevsim3 netdevsim0: entered allmulticast mode [ 654.359148][T13149] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 654.371199][T13149] bridge0: port 3(netdevsim0) entered blocking state [ 654.378031][T13149] bridge0: port 3(netdevsim0) entered forwarding state [ 655.162715][T13155] vlan4: entered promiscuous mode [ 655.167828][T13155] netdevsim netdevsim6 netdevsim0: entered promiscuous mode [ 655.175293][T13155] vlan4: entered allmulticast mode [ 655.180422][T13155] netdevsim netdevsim6 netdevsim0: entered allmulticast mode [ 655.204019][T13155] netlink: 260 bytes leftover after parsing attributes in process `syz.6.2120'. [ 655.361280][ T30] audit: type=1326 audit(1752254009.562:550): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13160 comm="syz.6.2121" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fba0498e929 code=0x7ff00000 [ 655.447919][ T30] audit: type=1326 audit(1752254009.602:551): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13160 comm="syz.6.2121" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fba0498e929 code=0x7ff00000 [ 655.492178][ T30] audit: type=1326 audit(1752254009.602:552): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13160 comm="syz.6.2121" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fba0498e929 code=0x7ff00000 [ 655.654149][ T30] audit: type=1326 audit(1752254009.602:553): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13160 comm="syz.6.2121" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fba0498e929 code=0x7ff00000 [ 655.693055][T13166] IPVS: sync thread started: state = MASTER, mcast_ifn = geneve0, syncid = 10802, id = 0 [ 655.784898][ T30] audit: type=1326 audit(1752254009.602:554): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13160 comm="syz.6.2121" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fba0498e929 code=0x7ff00000 [ 657.045935][ T30] audit: type=1326 audit(1752254009.602:555): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13160 comm="syz.6.2121" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fba0498e929 code=0x7ff00000 [ 657.067586][ C1] vkms_vblank_simulate: vblank timer overrun [ 657.077172][ T30] audit: type=1326 audit(1752254009.602:556): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13160 comm="syz.6.2121" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fba0498e929 code=0x7ff00000 [ 657.098799][ C1] vkms_vblank_simulate: vblank timer overrun [ 657.106894][ T30] audit: type=1326 audit(1752254009.602:557): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13160 comm="syz.6.2121" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fba0498e929 code=0x7ff00000 [ 657.129112][ T30] audit: type=1326 audit(1752254009.602:558): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13160 comm="syz.6.2121" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fba0498e929 code=0x7ff00000 [ 657.150766][ C1] vkms_vblank_simulate: vblank timer overrun [ 657.177983][ T30] audit: type=1326 audit(1752254009.602:559): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13160 comm="syz.6.2121" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fba0498e929 code=0x7ff00000 [ 659.215551][T13189] set match dimension is over the limit! [ 659.784947][T13190] ipvlan2: entered promiscuous mode [ 659.804694][T13190] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 659.882085][T13190] bond0: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 660.151588][T13195] netlink: 260 bytes leftover after parsing attributes in process `syz.6.2131'. [ 661.070720][T13202] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2127'. [ 662.999099][T13215] vlan2: left allmulticast mode [ 663.005183][T13215] netdevsim netdevsim8 netdevsim0: left allmulticast mode [ 663.020297][T13215] hsr1: left allmulticast mode [ 663.025595][T13215] syz_tun: left allmulticast mode [ 663.030761][T13215] batadv_slave_0: left allmulticast mode [ 663.663149][T13220] xt_hashlimit: size too large, truncated to 1048576 [ 664.886763][T13245] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2145'. [ 665.955306][T13261] netlink: 'syz.0.2150': attribute type 10 has an invalid length. [ 665.971569][T13262] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2149'. [ 666.410551][T13267] netlink: 36 bytes leftover after parsing attributes in process `syz.6.2151'. [ 666.685726][T13271] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2153'. [ 667.861221][ T5926] usb 9-1: new high-speed USB device number 61 using dummy_hcd [ 668.475545][T13294] ip6gre1: entered promiscuous mode [ 669.102066][ T5926] usb 9-1: too many configurations: 151, using maximum allowed: 8 [ 669.151480][ T5926] usb 9-1: New USB device found, idVendor=04d8, idProduct=0082, bcdDevice=ce.b7 [ 669.167786][ T5926] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=130 [ 669.176815][ T5926] usb 9-1: Product: syz [ 669.181946][ T5926] usb 9-1: Manufacturer: syz [ 669.186613][ T5926] usb 9-1: SerialNumber: syz [ 669.195802][ T5926] usb 9-1: config 0 descriptor?? [ 669.267263][T13298] net_ratelimit: 7 callbacks suppressed [ 669.267282][T13298] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 670.614005][T13325] netlink: 'syz.0.2173': attribute type 1 has an invalid length. [ 670.623741][T13325] netlink: 'syz.0.2173': attribute type 1 has an invalid length. [ 670.855179][ T5926] usb 9-1: USB disconnect, device number 61 [ 671.432060][ T5952] usb 9-1: new high-speed USB device number 62 using dummy_hcd [ 671.927502][ T5952] usb 9-1: Using ep0 maxpacket: 16 [ 671.959133][ T5952] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 672.020062][ T5952] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 672.060431][ T5952] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 672.112456][ T5952] usb 9-1: New USB device found, idVendor=0457, idProduct=07da, bcdDevice= 0.00 [ 672.130168][ T5952] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 672.145259][T13344] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2179'. [ 672.154658][T13344] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2179'. [ 672.198096][ T5952] usb 9-1: config 0 descriptor?? [ 672.485179][T13351] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2183'. [ 672.498067][T13351] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 673.278585][ T5952] hid-multitouch 0003:0457:07DA.0009: unknown main item tag 0x0 [ 673.523726][ T5952] hid-multitouch 0003:0457:07DA.0009: unknown main item tag 0x0 [ 673.556454][ T5952] hid-multitouch 0003:0457:07DA.0009: unknown main item tag 0x0 [ 673.580825][ T5952] hid-multitouch 0003:0457:07DA.0009: unknown main item tag 0x0 [ 673.604810][ T5952] hid-multitouch 0003:0457:07DA.0009: unknown main item tag 0x0 [ 673.618401][T13362] xt_TPROXY: Can be used only with -p tcp or -p udp [ 673.633858][ T5952] hid-multitouch 0003:0457:07DA.0009: unknown main item tag 0x0 [ 673.661236][ T5952] hid-multitouch 0003:0457:07DA.0009: unknown main item tag 0x0 [ 673.687168][ T5952] hid-multitouch 0003:0457:07DA.0009: unknown main item tag 0x0 [ 673.715689][ T5952] hid-multitouch 0003:0457:07DA.0009: unknown main item tag 0x0 [ 673.741505][ T5952] hid-multitouch 0003:0457:07DA.0009: unknown main item tag 0x0 [ 673.786407][ T5952] hid-multitouch 0003:0457:07DA.0009: unknown main item tag 0x0 [ 673.832831][ T5952] hid-multitouch 0003:0457:07DA.0009: hidraw0: USB HID v0.00 Device [HID 0457:07da] on usb-dummy_hcd.8-1/input0 [ 673.904082][ T5952] usb 9-1: USB disconnect, device number 62 [ 674.082258][T13369] fido_id[13369]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.8/usb9/report_descriptor': No such file or directory [ 674.122560][T13375] binder_alloc: 13374: binder_alloc_buf, no vma [ 674.695705][T13387] tipc: Started in network mode [ 674.700651][T13387] tipc: Node identity ac141425, cluster identity 4711 [ 674.708383][T13387] tipc: New replicast peer: 0.0.0.224 [ 674.714009][T13387] tipc: Enabled bearer , priority 10 [ 675.269441][T13400] netlink: 40 bytes leftover after parsing attributes in process `syz.6.2197'. [ 675.909419][ T5926] tipc: Node number set to 2886997029 [ 676.220368][T13402] overlayfs: failed to clone upperpath [ 678.261675][ T30] kauditd_printk_skb: 1014 callbacks suppressed [ 678.261698][ T30] audit: type=1800 audit(1752254032.462:1574): pid=13428 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.8.2209" name="/" dev="fuse" ino=0 res=0 errno=0 [ 678.930393][T13448] bridge1: entered promiscuous mode [ 678.938472][T13451] ipt_ECN: cannot use operation on non-tcp rule [ 678.950315][T13448] bridge1: entered allmulticast mode [ 679.246727][T13460] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2221'. [ 679.248660][T13461] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2221'. [ 679.473588][T13460] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2221'. [ 679.481475][T13461] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2221'. [ 679.483946][T13460] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2221'. [ 679.491586][T13461] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2221'. [ 681.173625][T13487] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2230'. [ 681.583254][T13492] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 681.962939][T13500] netlink: 36 bytes leftover after parsing attributes in process `syz.8.2236'. [ 681.979174][T13500] netlink: 16 bytes leftover after parsing attributes in process `syz.8.2236'. [ 681.989020][T13500] netlink: 36 bytes leftover after parsing attributes in process `syz.8.2236'. [ 682.632181][T13515] pci 0000:00:05.0: vgaarb: VGA decodes changed: olddecodes=none,decodes=none:owns=io+mem [ 683.094765][T13517] sch_tbf: burst 1 is lower than device lo mtu (11337746) ! [ 684.790286][T13554] __nla_validate_parse: 2 callbacks suppressed [ 684.790332][T13554] netlink: 12 bytes leftover after parsing attributes in process `syz.8.2251'. [ 685.063573][T13557] netlink: 'syz.6.2253': attribute type 10 has an invalid length. [ 685.917243][T13563] fuse: Bad value for 'rootmode' [ 686.063149][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 686.079267][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 686.146004][T13567] fuse: Bad value for 'fd' [ 686.807021][T13576] pimreg3: entered allmulticast mode [ 687.539722][T13588] No control pipe specified [ 690.221543][T13610] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 690.451401][T13616] netlink: 'syz.8.2273': attribute type 21 has an invalid length. [ 690.707560][T13624] netlink: 212376 bytes leftover after parsing attributes in process `syz.5.2275'. [ 690.805532][ T5855] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 690.818039][ T5855] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 690.827459][ T5855] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 690.847460][ T5855] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 690.855323][ T5855] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 690.924733][T13625] virt_wifi0 speed is unknown, defaulting to 1000 [ 690.933608][T13625] lo speed is unknown, defaulting to 1000 [ 691.803646][T13625] chnl_net:caif_netlink_parms(): no params data found [ 691.879760][T13648] block device autoloading is deprecated and will be removed. [ 692.156854][T13625] bridge0: port 1(bridge_slave_0) entered blocking state [ 692.166526][T13625] bridge0: port 1(bridge_slave_0) entered disabled state [ 692.178781][T13625] bridge_slave_0: entered allmulticast mode [ 692.207353][T13625] bridge_slave_0: entered promiscuous mode [ 692.227541][T13625] bridge0: port 2(bridge_slave_1) entered blocking state [ 692.246608][T13625] bridge0: port 2(bridge_slave_1) entered disabled state [ 692.255847][T13625] bridge_slave_1: entered allmulticast mode [ 692.270002][T13625] bridge_slave_1: entered promiscuous mode [ 692.354190][T13625] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 692.379906][T13625] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 692.438668][T13625] team0: Port device team_slave_0 added [ 692.927874][ T5847] Bluetooth: hci7: command tx timeout [ 692.973200][T13625] team0: Port device team_slave_1 added [ 693.221955][T13625] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 693.269692][T13625] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 693.306268][T13625] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 693.479569][T13625] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 693.507657][T13625] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 693.538546][T13625] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 693.582178][T13671] netlink: 260 bytes leftover after parsing attributes in process `syz.5.2288'. [ 693.738348][T13667] infiniband syz1: set down [ 693.743183][T13667] infiniband syz1: added bond0 [ 693.809948][T13667] RDS/IB: syz1: added [ 693.814856][T13667] smc: adding ib device syz1 with port count 1 [ 693.821399][T13667] smc: ib device syz1 port 1 has pnetid [ 695.091322][ T5847] Bluetooth: hci7: command tx timeout [ 695.204429][T13625] hsr_slave_0: entered promiscuous mode [ 695.210755][T13625] hsr_slave_1: entered promiscuous mode [ 695.241785][T13625] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 695.249723][T13625] Cannot create hsr debugfs directory [ 695.535292][T13684] set match dimension is over the limit! [ 696.112014][T13687] (unnamed net_device) (uninitialized): (slave bond_slave_1): Device is not our slave [ 696.130363][T13687] (unnamed net_device) (uninitialized): option active_slave: invalid value (bond_slave_1) [ 696.625644][T13705] netlink: 260 bytes leftover after parsing attributes in process `syz.5.2298'. [ 697.161450][ T5847] Bluetooth: hci7: command tx timeout [ 698.154820][T13728] binder: 13726:13728 ioctl c0306201 200000000640 returned -22 [ 698.476382][T13729] netlink: 212376 bytes leftover after parsing attributes in process `syz.0.2301'. [ 699.241596][ T5847] Bluetooth: hci7: command tx timeout [ 699.375476][T13625] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 699.548852][T13625] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 699.967536][T13625] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 700.029411][T13625] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 700.250597][T13749] bond0: entered promiscuous mode [ 700.263409][T13747] netlink: 168 bytes leftover after parsing attributes in process `syz.8.2315'. [ 700.268399][T13749] bond_slave_0: entered promiscuous mode [ 700.291704][T13749] bond_slave_1: entered promiscuous mode [ 700.298073][T13749] bridge0: entered promiscuous mode [ 700.304761][T13749] bond0: entered allmulticast mode [ 700.310623][T13749] bond_slave_0: entered allmulticast mode [ 700.316935][T13749] bond_slave_1: entered allmulticast mode [ 700.323239][T13749] bridge0: entered allmulticast mode [ 700.650022][T13625] 8021q: adding VLAN 0 to HW filter on device bond0 [ 700.728849][T13625] 8021q: adding VLAN 0 to HW filter on device team0 [ 700.801023][ T5981] bridge0: port 1(bridge_slave_0) entered blocking state [ 700.808410][ T5981] bridge0: port 1(bridge_slave_0) entered forwarding state [ 700.908003][ T5981] bridge0: port 2(bridge_slave_1) entered blocking state [ 700.915335][ T5981] bridge0: port 2(bridge_slave_1) entered forwarding state [ 702.838344][T13789] netlink: 260 bytes leftover after parsing attributes in process `syz.5.2327'. [ 703.030110][T13795] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2329'. [ 703.055562][T13625] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 703.126622][T13799] netlink: 96 bytes leftover after parsing attributes in process `syz.0.2329'. [ 703.212881][ T5841] usb 9-1: new high-speed USB device number 63 using dummy_hcd [ 703.247189][T13625] veth0_vlan: entered promiscuous mode [ 703.280103][T13625] veth1_vlan: entered promiscuous mode [ 703.370694][T13625] veth0_macvtap: entered promiscuous mode [ 703.385796][ T5841] usb 9-1: unable to get BOS descriptor or descriptor too short [ 703.409823][T13625] veth1_macvtap: entered promiscuous mode [ 703.419420][ T5841] usb 9-1: unable to read config index 0 descriptor/start: -71 [ 703.430738][ T5841] usb 9-1: can't read configurations, error -71 [ 703.478691][T13625] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 703.487142][ T5855] Bluetooth: hci5: command 0x0406 tx timeout [ 703.519196][T13625] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 703.559926][T13625] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 703.573794][T13625] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 703.601653][T13625] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 703.628252][T13625] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 703.782649][T13808] sctp: [Deprecated]: syz.5.2333 (pid 13808) Use of int in maxseg socket option. [ 703.782649][T13808] Use struct sctp_assoc_value instead [ 704.632361][ T9932] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 704.677403][ T9932] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 704.835195][ T9936] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 704.884744][ T9936] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 705.074234][T13817] 9pnet_fd: Insufficient options for proto=fd [ 705.095186][T13821] netlink: 32 bytes leftover after parsing attributes in process `syz.8.2335'. [ 705.151854][ T5925] IPVS: starting estimator thread 0... [ 705.453049][T13823] IPVS: using max 22 ests per chain, 52800 per kthread [ 705.670113][T13829] fuse: Unknown parameter '0x0000000000000009' [ 706.422120][T13831] netlink: 260 bytes leftover after parsing attributes in process `syz.5.2338'. [ 706.849055][T13840] pimreg3: entered allmulticast mode [ 708.641404][ T5957] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 708.840585][ T5957] usb 2-1: device descriptor read/64, error -71 [ 709.164051][ T5841] usb 9-1: new high-speed USB device number 65 using dummy_hcd [ 710.111282][ T5957] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 710.322306][ T5841] usb 9-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 710.362058][ T5841] usb 9-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 710.397991][ T5841] usb 9-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 710.412071][ T5957] usb 2-1: device descriptor read/64, error -71 [ 710.421334][ T5841] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 710.458450][T13877] raw-gadget.2 gadget.8: fail, usb_ep_enable returned -22 [ 710.482376][ T5841] usb 9-1: Quirk or no altset; falling back to MIDI 1.0 [ 710.531877][ T5957] usb usb2-port1: attempt power cycle [ 710.675577][T13907] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2365'. [ 710.913013][ T5957] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 710.962775][ T5957] usb 2-1: device descriptor read/8, error -71 [ 710.980594][T13810] usb 9-1: USB disconnect, device number 65 [ 711.221476][ T5957] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 711.272541][ T5957] usb 2-1: device descriptor read/8, error -71 [ 711.392764][ T5957] usb usb2-port1: unable to enumerate USB device [ 712.311662][T12208] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 712.651415][T12208] usb 2-1: device descriptor read/64, error -71 [ 712.681626][T13945] set match dimension is over the limit! [ 712.904096][T13953] netlink: 132 bytes leftover after parsing attributes in process `syz.6.2379'. [ 712.941418][T12208] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 713.161444][T12208] usb 2-1: device descriptor read/64, error -71 [ 713.272838][T12208] usb usb2-port1: attempt power cycle [ 714.221510][T12208] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 714.305049][T12208] usb 2-1: device descriptor read/8, error -71 [ 714.603972][T12208] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 714.833748][T12208] usb 2-1: device not accepting address 13, error -71 [ 714.843917][T13972] vlan2: entered promiscuous mode [ 714.843947][T13972] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 714.844157][T13972] vlan2: entered allmulticast mode [ 714.844176][T13972] netdevsim netdevsim1 netdevsim0: entered allmulticast mode [ 714.869995][T12208] usb usb2-port1: unable to enumerate USB device [ 714.966581][T13972] netlink: 260 bytes leftover after parsing attributes in process `syz.1.2382'. [ 715.466251][T13976] netlink: 96 bytes leftover after parsing attributes in process `syz.0.2383'. [ 715.847307][T13988] netlink: 76 bytes leftover after parsing attributes in process `syz.0.2386'. [ 716.613992][ T30] audit: type=1326 audit(1752254070.802:1575): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13987 comm="syz.0.2386" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fedbfb8e929 code=0x40000 [ 717.016868][T13998] set match dimension is over the limit! [ 717.854252][ T30] audit: type=1800 audit(1752254072.052:1576): pid=14004 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.8.2390" name="/" dev="9p" ino=4611686018427387906 res=0 errno=0 [ 717.889878][T14004] netfs: Couldn't get user pages (rc=-14) [ 718.384001][T14010] 9pnet_fd: Insufficient options for proto=fd [ 719.345854][T14015] netlink: 260 bytes leftover after parsing attributes in process `syz.1.2394'. [ 720.389897][T14026] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 721.265763][ T31] INFO: task kworker/1:8:5958 blocked for more than 143 seconds. [ 721.301213][ T31] Not tainted 6.16.0-rc5-syzkaller-00121-gbc9ff192a6c9 #0 [ 721.308954][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 721.333438][ T31] task:kworker/1:8 state:D stack:15928 pid:5958 tgid:5958 ppid:2 task_flags:0x4208060 flags:0x00004000 [ 721.395345][ T31] Workqueue: usb_hub_wq hub_event [ 721.416192][ T31] Call Trace: [ 721.428496][ T31] [ 721.436334][ T31] __schedule+0x16a2/0x4cb0 [ 721.454981][ T31] ? schedule+0x165/0x360 [ 721.469099][ T31] ? __pfx___schedule+0x10/0x10 [ 721.483130][ T31] ? schedule+0x91/0x360 [ 721.494325][ T31] schedule+0x165/0x360 [ 721.508032][ T31] schedule_timeout+0x9a/0x270 [ 721.513256][T13809] usb 2-1: new full-speed USB device number 14 using dummy_hcd [ 721.540050][ T31] ? __pfx_schedule_timeout+0x10/0x10 [ 721.549660][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 721.565410][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 721.570874][ T31] ? wait_for_completion+0x267/0x5d0 [ 721.581519][ T5926] usb 9-1: new high-speed USB device number 66 using dummy_hcd [ 721.594770][ T31] wait_for_completion+0x2bf/0x5d0 [ 721.600155][ T31] ? __pfx_wait_for_completion+0x10/0x10 [ 721.614164][ T31] i2c_del_adapter+0x581/0x6e0 [ 721.619172][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 721.627242][ T31] ? __pfx_i2c_del_adapter+0x10/0x10 [ 721.638186][ T31] ? dvb_usbv2_exit+0x85a/0x9e0 [ 721.647599][ T31] dvb_usbv2_probe+0x4ae/0x41a0 [ 721.657732][ T31] ? __pfx_dvb_usbv2_probe+0x10/0x10 [ 721.666193][ T31] ? __pm_runtime_set_status+0x785/0xa50 [ 721.675843][ T31] usb_probe_interface+0x641/0xbc0 [ 721.688372][T13809] usb 2-1: config 0 has an invalid interface number: 20 but max is 0 [ 721.706377][ T31] ? __pfx_usb_probe_interface+0x10/0x10 [ 721.716598][T13809] usb 2-1: config 0 has no interface number 0 [ 721.730043][ T31] really_probe+0x26a/0x9a0 [ 721.740968][T13809] usb 2-1: config 0 interface 20 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 721.752079][ T31] __driver_probe_device+0x18c/0x2f0 [ 721.761263][ T31] driver_probe_device+0x4f/0x430 [ 721.766350][ T31] __device_attach_driver+0x2ce/0x530 [ 721.767379][ T5926] usb 9-1: Using ep0 maxpacket: 8 [ 721.772094][ T31] bus_for_each_drv+0x251/0x2e0 [ 721.779432][ T5926] usb 9-1: config 179 has an invalid interface number: 65 but max is 0 [ 721.782121][ T31] ? __pfx___device_attach_driver+0x10/0x10 [ 721.799353][ T31] ? __pfx_bus_for_each_drv+0x10/0x10 [ 721.806011][T13809] usb 2-1: New USB device found, idVendor=05e3, idProduct=572c, bcdDevice= 2.78 [ 721.811650][ T5926] usb 9-1: config 179 has no interface number 0 [ 721.815613][T13809] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 721.856674][ T31] __device_attach+0x2b8/0x400 [ 721.861694][T13809] usb 2-1: Product: syz [ 721.865562][ T5926] usb 9-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 721.868210][ T31] ? __pfx___device_attach+0x10/0x10 [ 721.884274][T13809] usb 2-1: Manufacturer: syz [ 721.889307][T13809] usb 2-1: SerialNumber: syz [ 721.890937][ T5926] usb 9-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 721.897610][T13809] usb 2-1: config 0 descriptor?? [ 721.897879][ T31] ? do_raw_spin_unlock+0x122/0x240 [ 721.897932][ T31] bus_probe_device+0x185/0x260 [ 721.898486][T14032] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 721.901887][T13809] hub 2-1:0.20: bad descriptor, ignoring hub [ 721.944918][ T31] device_add+0x7b6/0xb50 [ 721.949418][ T31] usb_set_configuration+0x1a87/0x20e0 [ 721.955664][ T31] usb_generic_driver_probe+0x8d/0x150 [ 721.961346][ T31] usb_probe_device+0x1c4/0x390 [ 721.966336][ T31] ? __pfx_usb_probe_device+0x10/0x10 [ 721.972095][T13809] hub 2-1:0.20: probe with driver hub failed with error -5 [ 721.976398][ T5926] usb 9-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 721.979631][ T31] really_probe+0x26a/0x9a0 [ 722.020770][ T31] __driver_probe_device+0x18c/0x2f0 [ 722.036636][ T31] driver_probe_device+0x4f/0x430 [ 722.040520][ T5926] usb 9-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 722.041984][ T31] __device_attach_driver+0x2ce/0x530 [ 722.042026][ T31] bus_for_each_drv+0x251/0x2e0 [ 722.064736][ T31] ? __pfx___device_attach_driver+0x10/0x10 [ 722.070688][ T31] ? __pfx_bus_for_each_drv+0x10/0x10 [ 722.076348][ T31] __device_attach+0x2b8/0x400 [ 722.079897][ T5926] usb 9-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 722.081490][ T31] ? __pfx___device_attach+0x10/0x10 [ 722.081536][ T31] ? do_raw_spin_unlock+0x122/0x240 [ 722.081570][ T31] bus_probe_device+0x185/0x260 [ 722.081605][ T31] device_add+0x7b6/0xb50 [ 722.081637][ T31] usb_new_device+0xa39/0x16c0 [ 722.081684][ T31] ? __pfx_usb_new_device+0x10/0x10 [ 722.081716][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 722.115498][ T5926] usb 9-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 722.150225][ T5926] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 722.161036][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 722.182466][ T31] hub_event+0x2941/0x4a00 [ 722.187527][T14034] raw-gadget.2 gadget.8: fail, usb_ep_enable returned -22 [ 722.225027][ T31] ? __pfx_hub_event+0x10/0x10 [ 722.230624][ T31] ? process_scheduled_works+0x9ef/0x17b0 [ 722.259069][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 722.273548][ T31] ? process_scheduled_works+0x9ef/0x17b0 [ 722.280121][ T31] ? process_scheduled_works+0x9ef/0x17b0 [ 722.302666][ T31] process_scheduled_works+0xade/0x17b0 [ 722.308630][ T31] ? __pfx_process_scheduled_works+0x10/0x10 [ 722.316509][ T31] worker_thread+0x8a0/0xda0 [ 722.321364][ T31] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 722.328542][ T31] ? __kthread_parkme+0x7b/0x200 [ 722.333719][ T31] kthread+0x711/0x8a0 [ 722.338081][ T31] ? __pfx_worker_thread+0x10/0x10 [ 722.343575][ T31] ? __pfx_kthread+0x10/0x10 [ 722.348345][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 722.354057][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 722.359426][ T31] ? __pfx_kthread+0x10/0x10 [ 722.364431][ T31] ret_from_fork+0x3fc/0x770 [ 722.369214][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 722.374703][ T31] ? __switch_to_asm+0x39/0x70 [ 722.379654][ T31] ? __switch_to_asm+0x33/0x70 [ 722.384821][ T31] ? __pfx_kthread+0x10/0x10 [ 722.389588][ T31] ret_from_fork_asm+0x1a/0x30 [ 722.392653][T13809] usb 2-1: USB disconnect, device number 14 [ 722.395003][ T31] [ 722.448921][ T31] INFO: task syz.7.1757:11956 blocked for more than 144 seconds. [ 722.485860][ T31] Not tainted 6.16.0-rc5-syzkaller-00121-gbc9ff192a6c9 #0 [ 722.488066][ T5926] input: Generic X-Box pad as /devices/platform/dummy_hcd.8/usb9/9-1/9-1:179.65/input/input10 [ 722.501359][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 722.531159][ T31] task:syz.7.1757 state:D stack:23304 pid:11956 tgid:11955 ppid:6585 task_flags:0x400140 flags:0x00004004 [ 722.575423][ T31] Call Trace: [ 722.578796][ T31] [ 722.592422][ T31] __schedule+0x16a2/0x4cb0 [ 722.613996][ T31] ? __lock_acquire+0xa01/0xd20 [ 722.635665][ T31] ? schedule+0x165/0x360 [ 722.667648][ T31] ? __pfx___schedule+0x10/0x10 [ 722.681588][ T31] ? schedule+0x91/0x360 [ 722.696052][ T31] schedule+0x165/0x360 [ 722.710465][ T31] schedule_preempt_disabled+0x13/0x30 [ 722.725490][ T31] __mutex_lock+0x724/0xe80 [ 722.732084][ T31] ? __mutex_lock+0x51b/0xe80 [ 722.737073][ T31] ? usbdev_open+0x16e/0x760 [ 722.742134][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 722.747347][ T31] ? bus_find_device+0x273/0x2b0 [ 722.752556][ T31] ? __pfx_bus_find_device+0x10/0x10 [ 722.758114][ T31] ? __kasan_kmalloc+0x93/0xb0 [ 722.763192][ T31] ? usbdev_open+0xa7/0x760 [ 722.767971][ T31] usbdev_open+0x16e/0x760 [ 722.775483][ T31] ? __pfx_usbdev_open+0x10/0x10 [ 722.780628][ T31] ? do_raw_spin_unlock+0x122/0x240 [ 722.786279][ T31] chrdev_open+0x4c9/0x5e0 [ 722.790915][ T31] ? __pfx_chrdev_open+0x10/0x10 [ 722.796403][ T31] ? __pfx_chrdev_open+0x10/0x10 [ 722.801741][ T31] do_dentry_open+0xdf0/0x1970 [ 722.806875][ T31] vfs_open+0x3b/0x340 [ 722.811590][ T31] ? path_openat+0x2ecd/0x3830 [ 722.816551][ T31] path_openat+0x2ee5/0x3830 [ 722.821623][ T31] ? arch_stack_walk+0xfc/0x150 [ 722.826711][ T31] ? __pfx_path_openat+0x10/0x10 [ 722.832759][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 722.839108][ T31] do_filp_open+0x1fa/0x410 [ 722.847068][ T31] ? __lock_acquire+0xab9/0xd20 [ 722.852327][ T31] ? __pfx_do_filp_open+0x10/0x10 [ 722.857911][ T31] ? _raw_spin_unlock+0x28/0x50 [ 722.863081][ T31] ? alloc_fd+0x64c/0x6c0 [ 722.867622][ T31] do_sys_openat2+0x121/0x1c0 [ 722.914016][ T31] ? __se_sys_futex+0x36f/0x400 [ 722.940063][ T31] ? __pfx_do_sys_openat2+0x10/0x10 [ 722.960436][ T31] ? rcu_is_watching+0x15/0xb0 [ 722.977312][ T31] __x64_sys_openat+0x138/0x170 [ 723.000628][ T31] do_syscall_64+0xfa/0x3b0 [ 723.005916][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 723.035242][ T31] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 723.050564][ T31] ? clear_bhb_loop+0x60/0xb0 [ 723.056126][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 723.062589][ T31] RIP: 0033:0x7fb42378d290 [ 723.067248][ T31] RSP: 002b:00007fb424526b70 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 [ 723.075961][ T31] RAX: ffffffffffffffda RBX: 0000000000103381 RCX: 00007fb42378d290 [ 723.085573][ T31] RDX: 0000000000103381 RSI: 00007fb424526c10 RDI: 00000000ffffff9c [ 723.094251][ T31] RBP: 00007fb424526c10 R08: 0000000000000000 R09: 0000000000000000 [ 723.114781][ T31] R10: 0000000000000000 R11: 0000000000000293 R12: cccccccccccccccd [ 723.127119][ T31] R13: 0000000000000000 R14: 00007fb4239b5fa0 R15: 00007ffd3afc9858 [ 723.135721][ T31] [ 723.142850][ T31] [ 723.142850][ T31] Showing all locks held in the system: [ 723.153121][ T31] 2 locks held by kworker/u8:1/13: [ 723.158765][ T31] #0: ffff888141359948 ((wq_completion)iou_exit){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 723.170937][ T31] #1: ffffc90000127bc0 ((work_completion)(&ctx->exit_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 723.291456][ T31] 1 lock held by khungtaskd/31: [ 723.322325][ T31] #0: ffffffff8e13f160 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 723.392644][ T31] 3 locks held by kworker/u8:2/36: [ 723.438570][ T31] 3 locks held by acpid/5190: [ 723.469441][ T31] #0: ffff888033eac160 (&joydev->mutex){+.+.}-{4:4}, at: joydev_release+0x16b/0x210 [ 723.543126][ T31] #1: ffff8880787d42c0 (&dev->mutex#2){+.+.}-{4:4}, at: input_close_device+0x4c/0x230 [ 723.553263][ T31] #2: ffffffff8e144c78 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2f6/0x730 [ 723.565100][ T31] 2 locks held by getty/5599: [ 723.569873][ T31] #0: ffff8880336700a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 723.579824][ T31] #1: ffffc9000333b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 [ 723.590303][ T31] 5 locks held by kworker/1:8/5958: [ 723.597622][ T31] #0: ffff888020ec8d48 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 723.609807][ T31] #1: ffffc900047dfbc0 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 723.624615][ T31] #2: ffff8880283d7198 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4a00 [ 723.640385][ T31] #3: ffff888020abd198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x400 [ 723.650050][ T31] #4: ffff8880216d0160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x400 [ 723.659540][ T31] 5 locks held by kworker/u8:33/9926: [ 723.665191][ T31] 1 lock held by syz.7.1757/11956: [ 723.670471][ T31] #0: ffff8880283d7198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x16e/0x760 [ 723.679674][ T31] 1 lock held by syz.9.1931/12540: [ 723.685000][ T31] #0: ffff8880283d7198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x16e/0x760 [ 723.694302][ T31] 1 lock held by syz.3.2191/13378: [ 723.699466][ T31] #0: ffff8880283d7198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x16e/0x760 [ 723.708646][ T31] 1 lock held by syz.8.2400/14033: [ 723.714102][ T31] #0: ffffffff8e144b40 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x570 [ 723.771584][ T31] [ 723.774270][ T31] ============================================= [ 723.774270][ T31] [ 723.779100][ T5925] usb 9-1: USB disconnect, device number 66 [ 723.779157][ C1] xpad 9-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 723.788768][ T31] NMI backtrace for cpu 0 [ 723.788786][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.16.0-rc5-syzkaller-00121-gbc9ff192a6c9 #0 PREEMPT(full) [ 723.788806][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 723.788816][ T31] Call Trace: [ 723.788824][ T31] [ 723.788832][ T31] dump_stack_lvl+0x189/0x250 [ 723.788855][ T31] ? __wake_up_klogd+0xd9/0x110 [ 723.788880][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 723.788899][ T31] ? __pfx__printk+0x10/0x10 [ 723.788932][ T31] nmi_cpu_backtrace+0x39e/0x3d0 [ 723.788958][ T31] ? __pfx_nmi_cpu_backtrace+0x10/0x10 [ 723.788976][ T31] ? _printk+0xcf/0x120 [ 723.789001][ T31] ? __pfx__printk+0x10/0x10 [ 723.789024][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 723.789051][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 723.789074][ T31] watchdog+0xfee/0x1030 [ 723.789101][ T31] ? watchdog+0x1de/0x1030 [ 723.789132][ T31] kthread+0x711/0x8a0 [ 723.789157][ T31] ? __pfx_watchdog+0x10/0x10 [ 723.789186][ T31] ? __pfx_kthread+0x10/0x10 [ 723.789209][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 723.789232][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 723.789254][ T31] ? __pfx_kthread+0x10/0x10 [ 723.789276][ T31] ret_from_fork+0x3fc/0x770 [ 723.789296][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 723.789318][ T31] ? __switch_to_asm+0x39/0x70 [ 723.789337][ T31] ? __switch_to_asm+0x33/0x70 [ 723.789354][ T31] ? __pfx_kthread+0x10/0x10 [ 723.789377][ T31] ret_from_fork_asm+0x1a/0x30 [ 723.789411][ T31] [ 723.789418][ T31] Sending NMI from CPU 0 to CPUs 1: [ 723.797235][ C1] xpad 9-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 723.802092][ C1] NMI backtrace for cpu 1 [ 723.802109][ C1] CPU: 1 UID: 0 PID: 5925 Comm: kworker/1:5 Not tainted 6.16.0-rc5-syzkaller-00121-gbc9ff192a6c9 #0 PREEMPT(full) [ 723.802129][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 723.802139][ C1] Workqueue: usb_hub_wq hub_event [ 723.802160][ C1] RIP: 0010:preempt_count_sub+0x2e/0x170 [ 723.802180][ C1] Code: 55 53 48 bb 00 00 00 00 00 fc ff df 48 c7 c0 e0 52 a8 99 48 c1 e8 03 0f b6 04 18 84 c0 0f 85 d1 00 00 00 83 3d 52 70 17 18 00 <75> 25 65 8b 05 99 2d 0c 11 89 c1 81 e1 ff ff ff 7f 39 cf 7f 2a 81 [ 723.802193][ C1] RSP: 0018:ffffc90000a07f78 EFLAGS: 00000046 [ 723.802205][ C1] RAX: 0000000000000004 RBX: dffffc0000000000 RCX: ffffffff99a85203 [ 723.802215][ C1] RDX: 0000000000000175 RSI: ffffffff8be1ca20 RDI: 0000000000000001 [ 723.802226][ C1] RBP: 0000000000000001 R08: ffff8880245e8237 R09: 1ffff110048bd046 [ 723.802235][ C1] R10: dffffc0000000000 R11: ffffffff8b66f530 R12: 1ffffffff33b94e6 [ 723.802246][ C1] R13: 00000000ffffffff R14: 0000017565bc76a1 R15: 00000000000007f7 [ 723.802256][ C1] FS: 0000000000000000(0000) GS:ffff888125d4f000(0000) knlGS:0000000000000000 [ 723.802268][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 723.802278][ C1] CR2: 000055fcf1813920 CR3: 00000000398d2000 CR4: 00000000003526f0 [ 723.802293][ C1] Call Trace: [ 723.802300][ C1] [ 723.802307][ C1] delay_tsc+0x4e/0xc0 [ 723.802326][ C1] wait_for_lsr+0x160/0x2f0 [ 723.802349][ C1] serial8250_console_write+0x134c/0x1ba0 [ 723.802372][ C1] ? __lock_acquire+0xab9/0xd20 [ 723.802387][ C1] ? __pfx_serial8250_console_write+0x10/0x10 [ 723.802405][ C1] ? console_flush_all+0x13a/0xc40 [ 723.802424][ C1] ? console_flush_all+0x13a/0xc40 [ 723.802445][ C1] ? do_raw_spin_unlock+0x122/0x240 [ 723.802462][ C1] ? console_flush_all+0x13a/0xc40 [ 723.802479][ C1] ? console_flush_all+0x13a/0xc40 [ 723.802497][ C1] console_flush_all+0x728/0xc40 [ 723.802516][ C1] ? console_flush_all+0x13a/0xc40 [ 723.802536][ C1] ? __pfx_console_flush_all+0x10/0x10 [ 723.802558][ C1] ? is_printk_cpu_sync_owner+0x32/0x40 [ 723.802580][ C1] console_unlock+0xc4/0x270 [ 723.802597][ C1] ? __pfx_console_unlock+0x10/0x10 [ 723.802614][ C1] ? vprintk_emit+0x444/0x7a0 [ 723.802630][ C1] ? vprintk_emit+0x444/0x7a0 [ 723.802644][ C1] ? vprintk_emit+0x444/0x7a0 [ 723.802660][ C1] vprintk_emit+0x5b7/0x7a0 [ 723.802675][ C1] ? vprintk_emit+0x444/0x7a0 [ 723.802691][ C1] ? __pfx_vprintk_emit+0x10/0x10 [ 723.802706][ C1] ? unwind_next_frame+0xa5/0x2390 [ 723.802722][ C1] ? __pfx_snprintf+0x10/0x10 [ 723.802746][ C1] dev_vprintk_emit+0x337/0x3f0 [ 723.802763][ C1] ? unwind_next_frame+0xa5/0x2390 [ 723.802778][ C1] ? __pfx_dev_vprintk_emit+0x10/0x10 [ 723.802796][ C1] ? arch_stack_walk+0x11c/0x150 [ 723.802816][ C1] dev_printk_emit+0xe0/0x130 [ 723.802836][ C1] ? __pfx_dev_printk_emit+0x10/0x10 [ 723.802853][ C1] ? do_raw_spin_lock+0x121/0x290 [ 723.802874][ C1] ? __dev_printk+0x131/0x190 [ 723.802892][ C1] _dev_err+0x10a/0x160 [ 723.802919][ C1] ? __pfx__dev_err+0x10/0x10 [ 723.802936][ C1] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 723.802961][ C1] xpad_irq_out+0x1d2/0x2e0 [ 723.802978][ C1] __usb_hcd_giveback_urb+0x417/0x690 [ 723.802996][ C1] ? usb_hcd_unlink_urb_from_ep+0x2c/0x110 [ 723.803015][ C1] ? __pfx___usb_hcd_giveback_urb+0x10/0x10 [ 723.803036][ C1] ? usb_hcd_giveback_urb+0x10e/0x420 [ 723.803054][ C1] dummy_timer+0x862/0x4550 [ 723.803085][ C1] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 723.803115][ C1] ? __pfx_dummy_timer+0x10/0x10 [ 723.803134][ C1] ? __pfx_dummy_timer+0x10/0x10 [ 723.803150][ C1] ? __pfx_dummy_timer+0x10/0x10 [ 723.803167][ C1] __hrtimer_run_queues+0x52c/0xc60 [ 723.803192][ C1] ? __pfx___hrtimer_run_queues+0x10/0x10 [ 723.803206][ C1] ? read_tsc+0x9/0x20 [ 723.803226][ C1] ? __pfx___local_bh_disable_ip+0x10/0x10 [ 723.803244][ C1] hrtimer_run_softirq+0x187/0x2b0 [ 723.803263][ C1] handle_softirqs+0x283/0x870 [ 723.803280][ C1] ? __irq_exit_rcu+0xca/0x1f0 [ 723.803297][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 723.803317][ C1] __irq_exit_rcu+0xca/0x1f0 [ 723.803332][ C1] ? __pfx___irq_exit_rcu+0x10/0x10 [ 723.803351][ C1] irq_exit_rcu+0x9/0x30 [ 723.803364][ C1] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 723.803384][ C1] [ 723.803389][ C1] [ 723.803396][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 723.803410][ C1] RIP: 0010:vprintk_store+0xabc/0xd00 [ 723.803426][ C1] Code: e8 29 46 1f 00 48 bb 00 00 00 00 00 fc ff df 4d 85 f6 75 07 e8 15 46 1f 00 eb 06 e8 0e 46 1f 00 fb 48 c7 44 24 60 0e 36 e0 45 <49> c7 04 1c 00 00 00 00 49 c7 44 1c 09 00 00 00 00 49 c7 44 1c 14 [ 723.803438][ C1] RSP: 0018:ffffc9000473f0a0 EFLAGS: 00000283 [ 723.803450][ C1] RAX: ffffffff81a0ef42 RBX: dffffc0000000000 RCX: 0000000000100000 [ 723.803460][ C1] RDX: ffffc9001a2ce000 RSI: 00000000000011fd RDI: 00000000000011fe [ 723.803471][ C1] RBP: ffffc9000473f2b0 R08: ffffffff8fa0c9f7 R09: 1ffffffff1f4193e [ 723.803482][ C1] R10: dffffc0000000000 R11: fffffbfff1f4193f R12: 1ffff920008e7e20 [ 723.803493][ C1] R13: 0000000000000029 R14: 0000000000000200 R15: ffff8880b8724281 [ 723.803507][ C1] ? vprintk_store+0xab2/0xd00 [ 723.803531][ C1] ? __pfx_vprintk_store+0x10/0x10 [ 723.803546][ C1] ? number+0xd18/0xf60 [ 723.803563][ C1] ? number+0xb1/0xf60 [ 723.803585][ C1] ? format_decode+0x5a3/0xe30 [ 723.803606][ C1] ? is_printk_cpu_sync_owner+0x32/0x40 [ 723.803627][ C1] vprintk_emit+0x21e/0x7a0 [ 723.803645][ C1] ? __pfx_vprintk_emit+0x10/0x10 [ 723.803662][ C1] ? __pfx_snprintf+0x10/0x10 [ 723.803680][ C1] ? __lock_acquire+0xab9/0xd20 [ 723.803698][ C1] dev_vprintk_emit+0x337/0x3f0 [ 723.803716][ C1] ? __pfx_dev_vprintk_emit+0x10/0x10 [ 723.803740][ C1] dev_printk_emit+0xe0/0x130 [ 723.803760][ C1] ? __pfx_dev_printk_emit+0x10/0x10 [ 723.803777][ C1] ? __queue_work+0x103/0xfe0 [ 723.803795][ C1] ? __dev_printk+0x131/0x190 [ 723.803814][ C1] _dev_info+0x10a/0x160 [ 723.803833][ C1] ? __pfx__dev_info+0x10/0x10 [ 723.803849][ C1] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 723.803872][ C1] ? kernfs_notify+0x2ee/0x370 [ 723.803891][ C1] usb_disconnect+0xdd/0x950 [ 723.803922][ C1] hub_event+0x1cdb/0x4a00 [ 723.803948][ C1] ? do_raw_spin_lock+0x121/0x290 [ 723.803968][ C1] ? register_lock_class+0x51/0x320 [ 723.803988][ C1] ? __pfx_hub_event+0x10/0x10 [ 723.804003][ C1] ? process_scheduled_works+0x9ef/0x17b0 [ 723.804021][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 723.804039][ C1] ? process_scheduled_works+0x9ef/0x17b0 [ 723.804054][ C1] ? process_scheduled_works+0x9ef/0x17b0 [ 723.804070][ C1] process_scheduled_works+0xade/0x17b0 [ 723.804097][ C1] ? __pfx_process_scheduled_works+0x10/0x10 [ 723.804120][ C1] worker_thread+0x8a0/0xda0 [ 723.804147][ C1] kthread+0x711/0x8a0 [ 723.804166][ C1] ? __pfx_worker_thread+0x10/0x10 [ 723.804182][ C1] ? __pfx_kthread+0x10/0x10 [ 723.804200][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 723.804219][ C1] ? lockdep_hardirqs_on+0x9c/0x150 [ 723.804237][ C1] ? __pfx_kthread+0x10/0x10 [ 723.804255][ C1] ret_from_fork+0x3fc/0x770 [ 723.804271][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 723.804288][ C1] ? __switch_to_asm+0x39/0x70 [ 723.804304][ C1] ? __switch_to_asm+0x33/0x70 [ 723.804321][ C1] ? __pfx_kthread+0x10/0x10 [ 723.804339][ C1] ret_from_fork_asm+0x1a/0x30 [ 723.804362][ C1] [ 723.813525][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 723.813544][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.16.0-rc5-syzkaller-00121-gbc9ff192a6c9 #0 PREEMPT(full) [ 723.813567][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 723.813578][ T31] Call Trace: [ 723.813586][ T31] [ 723.813595][ T31] dump_stack_lvl+0x99/0x250 [ 723.813619][ T31] ? __asan_memcpy+0x40/0x70 [ 723.813640][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 723.813660][ T31] ? __pfx__printk+0x10/0x10 [ 723.813695][ T31] panic+0x2db/0x790 [ 723.813718][ T31] ? __pfx_panic+0x10/0x10 [ 723.813737][ T31] ? nmi_backtrace_stall_check+0x433/0x440 [ 723.813761][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 723.813786][ T31] ? nmi_trigger_cpumask_backtrace+0x2b6/0x300 [ 723.813816][ T31] watchdog+0x102d/0x1030 [ 723.813843][ T31] ? watchdog+0x1de/0x1030 [ 723.813874][ T31] kthread+0x711/0x8a0 [ 723.813900][ T31] ? __pfx_watchdog+0x10/0x10 [ 723.813923][ T31] ? __pfx_kthread+0x10/0x10 [ 723.813947][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 723.813969][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 723.813992][ T31] ? __pfx_kthread+0x10/0x10 [ 723.814015][ T31] ret_from_fork+0x3fc/0x770 [ 723.814036][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 723.814059][ T31] ? __switch_to_asm+0x39/0x70 [ 723.814079][ T31] ? __switch_to_asm+0x33/0x70 [ 723.814098][ T31] ? __pfx_kthread+0x10/0x10 [ 723.814121][ T31] ret_from_fork_asm+0x1a/0x30 [ 723.814170][ T31] [ 724.836207][ T31] Kernel Offset: disabled [ 724.840533][ T31] Rebooting in 86400 seconds..