last executing test programs: 6m30.831613669s ago: executing program 32 (id=857): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) pipe2(&(0x7f0000000040), 0x80000) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x20, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r1 = bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000080)={r0, 0xffffffffffffffff, 0x2d, 0x0, @val=@netfilter={0x2, 0x0, 0x6, 0x1}}, 0x20) bpf$LINK_DETACH(0x22, &(0x7f00000001c0)=r1, 0x4) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907001175f37538e486dd637f4b22667f2f00db5b686158bbcfe8875a65969ff57b00000000000000000000000000ac1414aa35f086dd"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_CONST_STR(0x2, 0x0, 0x0) msync(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r3, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a300000000048000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a300000000008000540000000210c0009800800014000000005600000000c0a010300000000000000000700fffe0900020073797a31000000000900010073797a300000000034000380300000802c000180250001002130404c6bfef3a31e2587ebd76200eb3ea056f39e3ab8a93c358099bf8cf3007d00000014000000110001"], 0xf0}}, 0x0) r4 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000300)) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fed007907001175f37538e486dd6317ce2200"], 0xcfa4) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r4, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x88be, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) r5 = syz_open_dev$usbfs(&(0x7f0000000340), 0xb, 0x40000) r6 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r7 = dup(r5) mount$9p_fd(0x0, &(0x7f0000000000)='.\x00', &(0x7f0000000040), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r7, @ANYBLOB=',wfdno=', @ANYRESHEX=r6, @ANYBLOB="2c01"]) 6m25.791034445s ago: executing program 33 (id=933): add_key$user(&(0x7f0000000200), 0x0, 0x0, 0x0, 0xfffffffffffffffe) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) pipe2$watch_queue(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$IOC_WATCH_QUEUE_SET_FILTER(r0, 0x5761, &(0x7f0000000580)=ANY=[@ANYBLOB="020000000000be2f7de0fa0000ff01400000000000000000000e00000084e8323990d564b70572e11d000000000000000000000000000000000000000040000000000000000000000000000000000000000200"/113]) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x2, 0x0, 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount$overlay(0x0, 0x0, &(0x7f0000000240), 0x0, &(0x7f00000001c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) lstat(0x0, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000008c0)={'wlan0\x00'}) sendmsg$NL80211_CMD_NEW_INTERFACE(r4, &(0x7f0000000a00)={0x0, 0x0, &(0x7f0000000980)={&(0x7f0000000640)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="33fafdffffff03000080070000000c00990082ebffff09000000080005000b0000000a00e88008021100000000000800178004000600"], 0x3c}, 0x1, 0x0, 0x0, 0xc804}, 0xc2010) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000400)={{0x1, 0x1, 0x18, r1, {r2, r3}}, './file0\x00'}) mount$9p_unix(0x0, &(0x7f0000000600)='./file0\x00', 0x0, 0x1c2caa, &(0x7f0000000540)=ANY=[@ANYBLOB="7472616e733d756e69782c6657ac31d06e6f7861"]) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000780)=ANY=[@ANYBLOB="f0000000100013070000000000000000ea0d0000000000000000000000000000000000000000000000000000000000000000002000000000", @ANYRES32=0x0, @ANYRES8, @ANYRES16=r2], 0xf0}, 0x1, 0xe}, 0x404c010) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000480)={0xffffffffffffffff, 0x0, 0x25, 0x2, @val=@uprobe_multi={0x0, 0x0, 0x0, 0x6, 0x0, 0x1}}, 0x40) r5 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r5, 0xaf01, 0x0) r6 = eventfd(0xffffffff) ioctl$VHOST_SET_LOG_FD(r5, 0x4004af07, &(0x7f0000000240)=r6) ioctl$VHOST_SET_VRING_KICK(r5, 0x4008af20, &(0x7f0000000040)={0x1, r6}) ioctl$VHOST_SET_VRING_ADDR(r5, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r5, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/247, &(0x7f00000000c0)=""/87, &(0x7f0000000480)=""/74}) ioctl$VHOST_SET_MEM_TABLE(r5, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0xfffffeac, &(0x7f00000001c0)=""/115}]}) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000080)={'syz0\x00', {0x200}, 0x4c, [0x7, 0x3, 0x403, 0x100000, 0x2000006, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0xfffffffc, 0x3c8, 0x0, 0x0, 0x3, 0x4, 0x1, 0xffffffff, 0x0, 0x3, 0x0, 0x3, 0x3, 0x10000000, 0x8, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000a, 0x0, 0x0, 0x80000007, 0x0, 0x0, 0xfffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x4, 0x8001, 0xffffffff], [0x0, 0xa82, 0x0, 0xc, 0x2, 0x1, 0x2, 0xedc0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x2000000, 0x0, 0x0, 0x7ffff, 0x0, 0xfffffff8, 0x3, 0x0, 0x79, 0xfffffffd, 0x20, 0x0, 0x0, 0x2, 0x47, 0x0, 0x0, 0x800, 0x736, 0xfffffffc, 0x0, 0x7ffef, 0x4, 0x0, 0x0, 0x6, 0x0, 0x2000, 0x28220be6, 0x401, 0x0, 0x3, 0xfffffffc, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x20], [0x0, 0xfffffffc, 0x0, 0x2006, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x6, 0x0, 0x0, 0x7, 0x101, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x2, 0x0, 0x400, 0x3000, 0xffffffff, 0x89, 0x0, 0x800, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x1, 0xfffffffc, 0x200, 0x0, 0x0, 0x0, 0x80008000, 0x0, 0x1, 0xfffffffc, 0x0, 0x9, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x351e, 0x0, 0xdc50, 0x0, 0x0, 0x81, 0x8, 0x0, 0x729], [0xb, 0x0, 0xfffffffc, 0x0, 0x0, 0x4000000, 0xfffffffe, 0xd2a, 0x200000, 0x0, 0x0, 0x8, 0x0, 0x0, 0x804, 0x0, 0x0, 0x0, 0x0, 0x7f, 0xfffffffc, 0x0, 0x0, 0x6, 0x0, 0x40040, 0x40, 0xfffffffe, 0xc3, 0x4, 0x0, 0xfd32, 0x6, 0x0, 0x0, 0x0, 0x82, 0x5, 0x9, 0x3ff, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0xfffffffc, 0x0, 0x8000006, 0x0, 0x0, 0x0, 0x800000, 0x0, 0x0, 0x0, 0x3, 0x8000000, 0x4, 0x1, 0x0, 0x0, 0x100000]}, 0x45c) openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0xd01, 0x0) write$binfmt_misc(r0, &(0x7f00000006c0)="1c2c07f50603d4a3d09b4d491da4cf80ef91c49a37c3e04e3996c5cb0b3618faf8ee05587b92cf756c19141038e952523eab2de41853c317fb12363d8370c647409e0a0542f0f3349d8609e85b18e8b4f78f24fa2d22049bcbe2ab018d2f674f2ff90cfe11ed3e44c894d05b17752420d262759849c64b4a627bb81513361fdef372374c5a8ddb9ba45587db22f5e5cf11943ce74d2d6b0ec495afc5709cc8551a51e522f6e53a91374b60733d07ba02e9a77f70fd6f", 0xb6) 5m22.819271774s ago: executing program 2 (id=1152): r0 = socket$qrtr(0x2a, 0x2, 0x0) connect$qrtr(r0, &(0x7f0000000080), 0xc) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000000180)) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000040)={&(0x7f0000000000)=ANY=[@ANYBLOB="9febeaff1700"], &(0x7f0000000f40)=""/4089, 0x2b, 0xff9, 0x8, 0x0, 0x0, @void, @value}, 0x28) r1 = request_key(&(0x7f0000000080)='encrypted\x00', &(0x7f00000000c0)={'syz', 0x1}, &(0x7f0000000100)=':\xf6\x96+\x00', 0xffffffffffffffff) keyctl$read(0xb, r1, &(0x7f0000000140)=""/250, 0xfa) r2 = socket$netlink(0x10, 0x3, 0x4) r3 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0xd9, 0x72, 0xa4, 0x40, 0x20b7, 0x1540, 0xb75a, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xff}}]}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r3, 0x0, 0x0) syz_usb_control_io$printer(r3, 0x0, 0x0) syz_usb_control_io$uac1(r3, 0x0, &(0x7f0000000400)={0x44, &(0x7f0000000240)=ANY=[@ANYBLOB='@\x00=', @ANYRES32=r2, @ANYRESHEX=r3], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) poll(&(0x7f0000000a00)=[{0xffffffffffffffff, 0x302e}], 0x1, 0x4) 5m19.063355819s ago: executing program 2 (id=1160): r0 = socket(0x10, 0x3, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000001c0)=@newqdisc={0x24, 0x24, 0xd0f, 0x65580000, 0x0, {0x60, 0x0, 0x0, r2, {0x0, 0xc}, {0xffff, 0xffff}}}, 0x24}}, 0x0) 5m18.967330477s ago: executing program 2 (id=1163): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x676d4000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prlimit64(0x0, 0x2, &(0x7f0000000240)={0xfffffffffffffffe}, 0x0) r3 = syz_open_dev$dri(0x0, 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000200)={0x8000, 0x2, 0x4}) r4 = syz_open_dev$vcsa(&(0x7f00000002c0), 0x8000, 0x2101) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f0000000300)={r4, 0x0, 0xfffffffffffff000, 0x100002000}) r5 = syz_open_dev$dri(&(0x7f0000000000), 0x1ff, 0x8000) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r5, 0xc04064a0, &(0x7f0000000700)={0x0, &(0x7f0000000640)=[0x0], 0x0, 0x0, 0x0, 0x1}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001800)={0xffffffffffffffff}) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r8, 0x8933, &(0x7f0000000280)={'wg0\x00', 0x0}) sendmsg$nl_route(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="600000001a00010029bd700000000000022020050003c80000000000080002000a01010008000100ac1414aa08000300", @ANYRES32=r9], 0x60}}, 0x0) ioctl$sock_SIOCSPGRP(r8, 0x8902, &(0x7f0000000280)=r0) bind$unix(r7, &(0x7f00000000c0)=@file={0x1, './file0\x00'}, 0x2) ioctl$DRM_IOCTL_MODE_CURSOR(r3, 0xc01c64a3, &(0x7f0000000040)={0x3, r6, 0x10000000, 0x80000001, 0xb, 0x1fd, 0x1}) openat$binder_debug(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) close_range(r3, 0xffffffffffffffff, 0x0) 5m17.443660721s ago: executing program 2 (id=1166): mkdir(&(0x7f0000000200)='./file1\x00', 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000850000005000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f00000002c0)='mmap_lock_acquire_returned\x00', r0}, 0x10) move_pages(0x0, 0x1efe, &(0x7f0000000080), 0x0, &(0x7f0000000040), 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) r1 = syz_open_procfs$userns(0x0, &(0x7f0000000000)) ioctl$NS_GET_OWNER_UID(r1, 0xb704, 0xfffffffffffffffe) mount(0x0, &(0x7f0000000140)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) r2 = syz_open_dev$loop(&(0x7f0000000240), 0x1, 0x2000) ioctl$LOOP_SET_STATUS64(r2, 0x4c04, &(0x7f0000001400)={0x0, 0x0, 0x0, 0xfffffffffffff7ba, 0xe, 0x0, 0x0, 0x1d, 0x14, "b4549f68e7c9c7e8e6eb45e6465689e6175a72ececddef2b7f96ea06a4fbcb0c28a217358816583ea1cf8fe9273de057366b03e269300e402872910f3dc3a879", "65c99bab0852f55b0d2503b1d4599ee65b3326d88ea9e6845d0554ed3419a6ea16bdf81e2b7b430dc5f048079bb9ed030f4a32b3136bbbc333b1fb51cc66c6a0", "546303290ca417e1a6d46510f0b2d6271efcdb4062c1a4384f37e2146ae7c8e1", [0x100000000000000]}) chdir(&(0x7f0000000080)='./file1\x00') mkdir(&(0x7f0000000300)='./file0\x00', 0xffffffffffffff7e) mount(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000004c0)='cgroup2\x00', 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x61, 0x10, 0x69}, [@ldst={0x7, 0x3, 0x0, 0x1c10a1}]}, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) r4 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) sendfile(r4, r3, &(0x7f0000002080)=0x3a, 0x23b) write(r4, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xb, 0x4, &(0x7f0000000040)=ANY=[], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) mount$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0/file1\x00', 0x1c0) mount$tmpfs(0x0, &(0x7f0000000300)='./file0/file1\x00', &(0x7f0000000340), 0x0, 0x0) r5 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x4, 0x16, &(0x7f0000001000)=ANY=[@ANYBLOB="61125900000000006113740000000000bf20000000000000070000000f0000003d030100000000009500ffb1000000006926000000000000bf6700000000000036000b000fff52004507faff15300000d60600000ee60000bf050000000000003d63000000000000650700000200000007070000fbffffff1f75000000000000bf54000000000000070000000410f900bd430100000000009500000000000000050000000000000095000000000000001c15a3ce747c693a74b62fd0758b15f09429c09074bc4b2bd2dc480dd7a064b8673e2060162cc43bcba1060999eef9d60bb39d0af449deaa27ea949e8f9000d885deea2783835e29eba8546fc020c1966f8b5f32b095f566edf66b7751828da9dbd5b996b9e8d897e461c01c697671d100000000400036c17fb01dde179c1f26cac1c7b21bde7d1a55d6ebe700b3be005e47ef55e0dd81244b18590e000000000000356d82e43407a6d7fa94b21002f06cd247b126b6349ab62d7b07ba0a71a72145edade9941f49f300a8c8913e0e4ea9e4c77740ab3312edee62a4dc2fc85755d387d8a1bc8eb71fbe11b2216cc8d1f0160c237d929b49d828724b95555b459f4763c6222175c974be2f76fb5f330b015a68587a75c013000000000000000000000003000000000000d6ddc46e58eff8f4fbadfc6a3af8123b7f4240713a4c0cdc9d7820c4eb67cc0f8b5fe9258eeacb5776aebbab3d5c55020000006082778366dadfc36029633e0514cbcee1f3928970bde148c940434f33acd377cbad17673b2d30b6339255c98eba97efb4e9ac1f11be815dd6045592edcbee7f253ec74c7c1313505bd7ff8fd58b3a6569c91dbdef1df585aeaea7346a2a65caee5c85f9eddeeeee3c8a2e523c864ac430eb47cb4d0c8767b9d4125661b5a1a170c04b64da3a99ddb93bf14fae3ca2d1e882375b8dbac83978e136c34f90b33cc0eeb57debcfe26589efc08125d5d62a7e593c9738a50171adf051ea4f07e7e7e770c2016eeacbe8511afffffbea75759a1ea5404f5453c0b5c46c9700808c096cf8cf5223f341cbea3841b5cd224c1b381d56afebe9f99a00e3cd94dc0bb7af9e8709db487cc4d9b3b96723d69d512ddd57b0dee9b9f6ae80a502cce352098603e77f9ecced07fa25e99e9e415414c91f8bfd1c150570512f26c4ee34a64c131dce3800000000000000006c86287945bd8d258442870e000000000000000000000000f7e6a10de4bf7369b0d5b5373829b09bf5b7b34099b27ac7770fca449d4c4ca15f88b588b2429af2e1d1a4e1fa44cb80fcfae6e50d7e5b4675d7e0be706224f34e6eed553b40e2b897e73752fc7d1e4b0f4c5967eefd7448d5fde5841fa464a67267c631052bd7333769a4b8d19d4794357edce762e8136ab9d7ed34a72baffd849b90579b96b3"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) ioctl$AUTOFS_IOC_PROTOSUBVER(r5, 0x40049366, 0x0) r6 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r6, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e22, @broadcast}, 0x2, 0x9800}}, 0x2e) faccessat(r5, &(0x7f0000000100)='./file1\x00', 0x1c2) write$binfmt_aout(r3, &(0x7f0000000500)=ANY=[@ANYBLOB="0801ff05f0010000b302000005000000b203000002000000000000000000000005b9efa4ce7670917cffae5268f37952b9176a1c1a6b90bb0f2596fe6d8e092de19852b2091076ee84d3c3c1f21500f67337197f03a67c99e575a508063f953d3650149c821207b724666832e75a49b697292faad700e06bfe2e3a7b9de26c2580e8b97ce8d9f337e325296f3c5a552747c240c6aa7d5e551ae65b359af9904f7562eb4fe19d3fa442bbff74ce2710b92ae09c3d9e51a0d7dc2fc3a9bfcebde0061243f28002d5c98b7870fee31daf005e918101d11a69c75dc1d0dbddc7d56f401948b07ec04da1948a3fa2b1edfabfb3676f3c8172516a65065753d39a353ede8c5cec12e2d600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff0c81f100"/2823], 0xb07) 5m8.904581332s ago: executing program 2 (id=1196): r0 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) fchdir(r1) mknod$loop(&(0x7f0000000180)='./file0\x00', 0x6000, 0x0) r2 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r2, 0x40345410, &(0x7f00000083c0)={{0x1}}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r2, 0x40505412, &(0x7f0000000440)={0x7, 0x8, 0x0, 0x0, 0x6}) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@struct]}}, 0x0, 0x26, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f00000004c0)=0xffffffffffffffff, 0x4) 5m8.635876551s ago: executing program 2 (id=1199): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x200000, &(0x7f0000006680)) (async, rerun: 32) mbind(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x5, &(0x7f0000000240)=0xfffffffffffffffe, 0x85, 0x6) (async, rerun: 32) set_mempolicy_home_node(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x0) 5m8.260605399s ago: executing program 34 (id=1199): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x200000, &(0x7f0000006680)) (async, rerun: 32) mbind(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x5, &(0x7f0000000240)=0xfffffffffffffffe, 0x85, 0x6) (async, rerun: 32) set_mempolicy_home_node(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x0) 3m55.214298574s ago: executing program 4 (id=1477): listen(0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0xb, &(0x7f0000000380)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_CM_ID_GET(r4, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)={0x20, 0x140b, 0x1, 0x74bd23, 0x25dfdbfd, "", [@RDMA_NLDEV_ATTR_RES_CM_IDN={0x5, 0x3f, 0x4}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x20}}, 0x40000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000300)='rcu_utilization\x00', r3}, 0x10) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000480), 0xffffffffffffffff) sendmsg$TIPC_NL_MON_GET(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000880)=ANY=[@ANYRES16=r5], 0x2dc}, 0x1, 0x0, 0x0, 0x4045}, 0x80000) syz_open_dev$video(0x0, 0xc000, 0x0) syz_open_dev$I2C(0x0, 0x80, 0x14000) socket$inet6_mptcp(0xa, 0x1, 0x106) landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3, 0x1}, 0x18, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40008c1}, 0x8000) sendmsg$TIPC_CMD_SET_NODE_ADDR(r6, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000002c0)={0x24, 0x0, 0x20, 0x1, 0x25dfdbfd, {{}, {}, {0x8, 0x11, 0x16}}, ["", "", "", ""]}, 0x24}}, 0x40844) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newlink={0x40, 0x10, 0x1, 0x1, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x10b85}, [@IFLA_IFNAME={0x14, 0x3, 'macsec0\x00'}, @IFLA_ADDRESS={0xa, 0x1, @local}]}, 0x40}, 0x1, 0x0, 0x0, 0x90}, 0x0) 3m54.251832754s ago: executing program 4 (id=1479): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) prctl$PR_SET_MM(0x23, 0x6, &(0x7f0000ffc000/0x4000)=nil) prctl$PR_SET_MM(0x23, 0x7, &(0x7f0000ffc000/0x4000)=nil) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0xa000000, 0x2172, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x8010000000000084) sched_getparam(0x0, &(0x7f00000001c0)) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, 0x0, 0x0) ioctl$sock_TIOCINQ(r1, 0x541b, &(0x7f0000000200)) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e21, 0x0, @empty}, 0x1c) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e21, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000300)={0x0, @in6={{0xa, 0x0, 0x0, @empty}}, 0x0, 0x0, 0x318, 0x1, 0x24}, 0x9c) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000ac0)=@raw={'raw\x00', 0x3c1, 0x1a6cc7, 0x2a8, 0xf0, 0x5802, 0x294, 0xf0, 0x294, 0x1d8, 0x378, 0x378, 0x1d8, 0x378, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @empty}, @private0, [], [], 'macvtap0\x00', 'vlan1\x00', {}, {}, 0x0, 0x0, 0x9}, 0x0, 0xa8, 0xf0, 0x52020000}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'pptp\x00', {0x3}}}}, {{@uncond, 0x0, 0xa8, 0xe8}, @common=@inet=@TCPOPTSTRIP={0x40, 'TCPOPTSTRIP\x00', 0x0, {[0x3, 0x0, 0x6536, 0xdfc, 0x25676d1d, 0x1000, 0x1ff, 0x81]}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x308) r3 = getpid() r4 = openat$null(0xffffffffffffff9c, &(0x7f0000000180), 0x44440, 0x0) process_vm_readv(r3, &(0x7f0000008400)=[{0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000140)={0xc}) 3m53.326949721s ago: executing program 5 (id=1482): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), r1) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_IBSS(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000880)={0x3c, r2, 0x101, 0x3, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r3}, @void}}, [@chandef_params=[@NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x1}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x1}, @NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_SSID={0x5, 0x34, @random='n'}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x4800) 3m53.12367014s ago: executing program 5 (id=1483): unshare(0x64000600) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x141042, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000004b64ffec850000007d000000850000000f00000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000100)='kfree\x00', r1}, 0x10) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000009c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r2}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) fanotify_init(0x8, 0x80000) pwritev2(r0, 0x0, 0x0, 0xe7b, 0x0, 0x0) fsmount(r0, 0x0, 0x88) 3m52.963740508s ago: executing program 4 (id=1484): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000140)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x3f8, 0x0, 0x51}, 0x9c) bind$inet6(r1, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r1, &(0x7f0000847fff)='X', 0x1, 0x40880, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f00000004c0)={0x0, 0x2, 0x10}, 0xc) r2 = syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) setsockopt$sock_timeval(r2, 0x1, 0x42, &(0x7f0000001600)={0x0, 0xea60}, 0x10) r3 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000000100)={0x0, 0xdce, 0x101, 0x7}, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000280)={r4}, 0x0) getsockopt$sock_buf(r1, 0x1, 0x8a50adcc399d9d2a, &(0x7f0000000380)=""/150, &(0x7f0000000240)=0x96) getsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000180)=0x8) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r3, 0x84, 0x66, &(0x7f0000000000)={r5, 0x10}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, &(0x7f0000000040)={r5, 0xe}, 0x8) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000019680)=""/102392, 0x18ff8) keyctl$session_to_parent(0x12) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_mgmt(0x0, r8) sendmsg$NLBL_MGMT_C_ADD(r8, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4048000}, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a300000000088000000090a010400000000000000000700000308000a40000000000900020073797a30000000000900010073"], 0xd0}}, 0x20050800) readv(r2, &(0x7f0000002c80)=[{&(0x7f0000001ac0)=""/133, 0x85}], 0x1) sendto$inet6(r1, &(0x7f0000000000)='\t', 0xf4c, 0x0, 0x0, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) 3m51.015421234s ago: executing program 4 (id=1487): getpeername$packet(0xffffffffffffffff, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000300)=0xfffffcca) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x5, 0x0, &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x11, 0x0, 0x0, &(0x7f0000000340), 0x0, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x100) r2 = syz_open_dev$video4linux(&(0x7f0000000500), 0x20, 0x400) ioctl$VIDIOC_SUBDEV_S_FRAME_INTERVAL(r2, 0xc0305616, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000540)={0x11, 0x3, &(0x7f0000001d40)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000380)='udp_fail_queue_rcv_skb\x00', r4, 0x0, 0x6}, 0x18) bind$inet6(r3, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0xf93, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, 0x1c) syz_emit_ethernet(0xbe, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaac8912216c20000000800450000b0000000000011907864010101ac14142100004e20009c907801000000000000007b4b143b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b1af584cbf2649a50f2dbc43efa8698dfa871c51852e4451b57d037ad3c045942824251d7d17b5191584cdd4fbe40a27424dbcfd56f1373669caaa2f19935e6996c7096ffe4f3a4745a8f938e87ad7c7d23fc0f762b9649a3bfbc1f39cb307b3c308b9cdb042d2643fcbb2c5a57d"], 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r5, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000001d40)=ANY=[], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000380)='udp_fail_queue_rcv_skb\x00', r6, 0x0, 0x6}, 0x18) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) syz_genetlink_get_family_id$l2tp(&(0x7f00000001c0), 0xffffffffffffffff) r7 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r7, &(0x7f0000002700)=""/102392, 0x18ff8) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r8 = gettid() process_vm_writev(r8, &(0x7f0000000000)=[{&(0x7f00008f9f09)=""/247, 0xf7}], 0x1, &(0x7f0000121000)=[{&(0x7f0000217f28)=""/231, 0xffffff4e}], 0x23a, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x15) mount$tmpfs(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x21, &(0x7f0000000200)=ANY=[]) accept4$packet(0xffffffffffffffff, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14, 0x800) 3m50.749093008s ago: executing program 5 (id=1489): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) socket$nl_route(0x10, 0x3, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_MAXSEG(r1, 0x84, 0xd, 0xfffffffffffffffc, &(0x7f0000000140)=0x4) r2 = socket$inet6(0xa, 0x2, 0x0) capset(&(0x7f0000000b00)={0x19980330}, &(0x7f0000000000)) r3 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r3, &(0x7f0000000080)=[{&(0x7f0000000400)="580000001400192340834b80040d8c560a067fbc45ff620500000000070058000b480400945f640094272d7061d328b92d0000000000008000f0fffeffe809000000ffd9dd00000010000100050808004149004006040800", 0x58}], 0x1) r4 = io_uring_setup(0x669, &(0x7f00000002c0)) r5 = io_uring_register$IORING_REGISTER_PERSONALITY(r4, 0x9, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_PERSONALITY(0xffffffffffffffff, 0x1f, 0x20000002, r5) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000000780)=[{{0x0, 0x0, 0x0}, 0x3}], 0x1, 0x10020, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r6 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000440), 0x80, 0x0) pidfd_send_signal(r6, 0x3a, &(0x7f0000000480)={0x13, 0xf, 0x3}, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x44000, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x2, 0x8a2e, @loopback, 0x6}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2500000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xa, 0x5, 0x2, 0x7, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000818110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) syz_emit_ethernet(0x1fe, 0x0, 0x0) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, 0x0, 0x0) 3m49.273839044s ago: executing program 4 (id=1492): r0 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) socket$packet(0x11, 0x3, 0x300) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x6) r1 = getpid() sched_setscheduler(0x0, 0x0, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = fsopen(&(0x7f0000000100)='gadgetfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000040)='source', &(0x7f0000005fc0)='//\xf2/\x06\b/\\/o\xdc\xea\x95\x9a\x82\x10\x97W\x8f7\x98\\\\/\\\xf9\rmD\x94)U\xdb\x15X.I\n}\xf3\x9d\xe4_\x05\x9cqf4I^#b?9\xde\xafu\'\x83L\xe0\x97\xe1n_\xa4%\xb1\x97\x93\xafv\xce/\\\xb4L\xf2_\xa7\xfb\xf4\x84\x1fA\xeas^\xef\xa2\x85\xa3!\xfb\x93\xd7R\xab2\x1eW\xe9h\x9b\xf7ul\xf9D\xd4\x82X5\x13\xaa\x87\xf9\xba\xa9m\x14\x14R_\x9a\\>4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\xef\x8b0xffffffffffffffff}) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x0, 0x2, 0x0) sched_setaffinity(r1, 0x0, 0x0) r4 = syz_open_dev$vim2m(&(0x7f0000000680), 0x8, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r4, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1, 0x0, 0x10}) ioctl$vim2m_VIDIOC_QBUF(r4, 0xc058560f, &(0x7f00000002c0)=@multiplanar_mmap={0x0, 0x2, 0x0, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "fafc00"}, 0x0, 0x1, {0x0}}) ioctl$vim2m_VIDIOC_STREAMOFF(r4, 0x40045612, &(0x7f0000000280)=0x2) close(r0) r5 = socket$inet(0xa, 0x801, 0x84) connect$inet(r5, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r5, 0x8) r6 = accept4(r5, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r6, 0x84, 0x84, &(0x7f0000000000)={0x0, @in={{0x2, 0x4e20, @empty}}, 0xfffd}, 0x90) ioctl$I2C_SMBUS(0xffffffffffffffff, 0x720, 0x0) bind$bt_hci(r0, &(0x7f0000000000)={0x27}, 0x74) socket$inet6_sctp(0xa, 0x1, 0x84) r7 = openat$procfs(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/vmallocinfo\x00', 0x0, 0x0) read$FUSE(r7, &(0x7f0000000480)={0x2020}, 0x2020) 3m48.948050133s ago: executing program 5 (id=1495): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x6) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0xffffffffffffff2b, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_open_dev$sg(0x0, 0x0, 0x40042) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="18010000010000000000000000030000850000007b00000095"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f00000000c0)='sched_switch\x00', r3}, 0x10) r4 = socket(0x10, 0x2, 0x0) mount$bind(&(0x7f00000001c0)='./file1\x00', &(0x7f0000000380)='./bus\x00', &(0x7f00000003c0), 0x400000, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r4, 0x89f1, &(0x7f0000000000)={'ip6gre0\x00', &(0x7f00000009c0)={'syztnl1\x00', 0x0, 0x0, 0x0, 0x1, 0x2, 0x0, @loopback, @loopback}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r4, 0x89f3, &(0x7f0000000440)={'syztnl1\x00', &(0x7f0000000640)={'ip6_vti0\x00', 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, @loopback, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x0, 0x0, 0x0, 0x6}}) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000580)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './cgroup'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000a40)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a70000000060a0b0400000000000000000200000344000480240001800b000100736f636b6574000014000280080002400000000308000140000000011c0001800a00010071756575650000000c00028008000440000000100900010073797a30000000000900020073797a3200010000000000000000000000000adba5b76e9fcd57187a507a4ad9530f6dcdfd73928e05c84bcd87d563357f2a24eedddb5df4d988c2ba4eaeb64f2a9b95463e7fb0c39df1911342c700376307f41db6dd"], 0x98}}, 0x0) socket$kcm(0x21, 0x2, 0xa) r5 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101b01) ioctl$USBDEVFS_GET_CAPABILITIES(r5, 0x8004551a, &(0x7f0000000080)) r6 = socket$inet(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r6, 0x4000000000000, 0x40, &(0x7f0000000740)=@raw={'raw\x00', 0x8, 0x3, 0x1f8, 0x0, 0x8, 0xfa04, 0xd0, 0x6c02, 0x160, 0x194, 0x194, 0x160, 0x194, 0x3, 0x0, {[{{@uncond, 0x0, 0x98, 0xd0, 0x0, {0x0, 0x74020000}, [@common=@inet=@ecn={{0x28}, {0x0, 0x22}}]}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x70, 0x90}, @unspec=@TRACE={0x20}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x258) socket$kcm(0x21, 0x2, 0xa) 3m47.974514684s ago: executing program 5 (id=1497): socket$inet_udplite(0x2, 0x2, 0x88) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000100), 0x109000, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) ioctl$USBDEVFS_REAPURBNDELAY(0xffffffffffffffff, 0x4008550d, &(0x7f0000000280)) fsetxattr(r0, &(0x7f0000000180)=@random={'trusted.', '\x00'}, 0x0, 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) read$FUSE(r1, &(0x7f0000002c80)={0x2020}, 0xfffffdb2) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x0, 0x31, 0xffffffffffffffff, 0x0) 3m47.424350757s ago: executing program 5 (id=1501): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000005"], 0x0, 0x26, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000003c0)={0x6, 0xf, &(0x7f0000000100)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083b00ec7410900000000200055090100000000009500000000000000bf91000000000000b7020000000000008500000000000000b7000000000000009500000000000000"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, r0, 0x14, 0x0, 0x700, 0x10, &(0x7f0000000300), 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000c4b20710200e01015a7a0102030109021b00010000000009040000012e6d0a000905ff276b"], 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/cpuinfo\x00', 0x0, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x6, 0xe, &(0x7f00000008c0)=ANY=[@ANYBLOB="b7020000ff0d0000bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000006f6400000000000045040400010000001704000001000a00b7040000ff0100006a0a00fe0000000085000000bd000000b70000000000000095000000000000009e17f199a68b06d83298a8cdc21ce784909b849d5550ad857d0454d8877a6db61d69f2ffcaa10350e11cb97c8adf1bc9a0c4eeceb9971e43405d621ffbc9ce000000d8ca56b50d0c010d631f6dde53a9a53608c10556e5734eb84049761451ce540c772e2d9f8004e26f7fcc059c062234d5595f6fbaa187b81d1106000000000fd60000fd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7e43c5cbd80450f859ce8122a79c3e40000b59b0fc46d6cec3c0802882add4e3179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3a32efa04137d4524847d2638da3261c8162bb7c7824be6195a66d2e17e122040e1100000000928612a29fc691e4f1f7bd053abb885f39381f1759410b1059f05684261f332d606834669b49ec99320ca7712d7e79bd5bf5ed818ecc7640917f6a559a47db608fcf9f6c131b84e41c354c66838f72b9e12d36e996f316f0812ca83efb30c7f6c6d57c4a64590401eec22523dd712c680013e87f649a1ede7142ca9d5d8a8c9f9b440fe4331ad5532c74d9a31a5d737537f7a2caa30581253d14dd3e92af7dc836686365ae01bdec561c0402b67801267a8df97d2f85426a5963d4fa3e26cc05972c162f223f000000d999e80de00fcbcc02d0aed7bb8f7ba337d59c14f39dcd4aad4139ef6425a9367f1bd1467fc6b95a4df7669839771ce9d5788029901e5a79d8b9990ace8f74087f25ad50c46088000000008000"/686], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x3a, 0x10, &(0x7f0000000340), 0xd58495bc, 0x0, 0xffffffffffffffff, 0xffffffffffffff5b, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x42) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = socket$kcm(0x29, 0x5, 0x0) sendmmsg$inet(r4, &(0x7f0000008dc0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000080)={r2, r5, 0x25, 0x0, @val=@netfilter={0x5, 0x1, 0x107, 0x1}}, 0x20) connect$packet(r1, &(0x7f00000000c0)={0x11, 0x10, r5, 0x1, 0x9, 0x6, @multicast}, 0x14) pread64(r1, &(0x7f0000000380)=""/85, 0x55, 0x81ffffffbfffffc) ioctl$IOCTL_VMCI_VERSION(r1, 0x79f, &(0x7f00000001c0)=0x80000) ioctl$EVIOCRMFF(r1, 0x40044581, &(0x7f0000000040)=0xfffffffb) 3m47.315887762s ago: executing program 4 (id=1502): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000062d14406d0470084761000000010902120001000000000904"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) r1 = memfd_secret(0x0) fchownat(r1, &(0x7f0000000040)='\x00', 0x0, 0x0, 0x1000) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000840)={0x44, &(0x7f0000000700)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 3m32.211985117s ago: executing program 35 (id=1501): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000005"], 0x0, 0x26, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000003c0)={0x6, 0xf, &(0x7f0000000100)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083b00ec7410900000000200055090100000000009500000000000000bf91000000000000b7020000000000008500000000000000b7000000000000009500000000000000"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, r0, 0x14, 0x0, 0x700, 0x10, &(0x7f0000000300), 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000c4b20710200e01015a7a0102030109021b00010000000009040000012e6d0a000905ff276b"], 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/cpuinfo\x00', 0x0, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x6, 0xe, &(0x7f00000008c0)=ANY=[@ANYBLOB="b7020000ff0d0000bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000006f6400000000000045040400010000001704000001000a00b7040000ff0100006a0a00fe0000000085000000bd000000b70000000000000095000000000000009e17f199a68b06d83298a8cdc21ce784909b849d5550ad857d0454d8877a6db61d69f2ffcaa10350e11cb97c8adf1bc9a0c4eeceb9971e43405d621ffbc9ce000000d8ca56b50d0c010d631f6dde53a9a53608c10556e5734eb84049761451ce540c772e2d9f8004e26f7fcc059c062234d5595f6fbaa187b81d1106000000000fd60000fd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7e43c5cbd80450f859ce8122a79c3e40000b59b0fc46d6cec3c0802882add4e3179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3a32efa04137d4524847d2638da3261c8162bb7c7824be6195a66d2e17e122040e1100000000928612a29fc691e4f1f7bd053abb885f39381f1759410b1059f05684261f332d606834669b49ec99320ca7712d7e79bd5bf5ed818ecc7640917f6a559a47db608fcf9f6c131b84e41c354c66838f72b9e12d36e996f316f0812ca83efb30c7f6c6d57c4a64590401eec22523dd712c680013e87f649a1ede7142ca9d5d8a8c9f9b440fe4331ad5532c74d9a31a5d737537f7a2caa30581253d14dd3e92af7dc836686365ae01bdec561c0402b67801267a8df97d2f85426a5963d4fa3e26cc05972c162f223f000000d999e80de00fcbcc02d0aed7bb8f7ba337d59c14f39dcd4aad4139ef6425a9367f1bd1467fc6b95a4df7669839771ce9d5788029901e5a79d8b9990ace8f74087f25ad50c46088000000008000"/686], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x3a, 0x10, &(0x7f0000000340), 0xd58495bc, 0x0, 0xffffffffffffffff, 0xffffffffffffff5b, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x42) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = socket$kcm(0x29, 0x5, 0x0) sendmmsg$inet(r4, &(0x7f0000008dc0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000080)={r2, r5, 0x25, 0x0, @val=@netfilter={0x5, 0x1, 0x107, 0x1}}, 0x20) connect$packet(r1, &(0x7f00000000c0)={0x11, 0x10, r5, 0x1, 0x9, 0x6, @multicast}, 0x14) pread64(r1, &(0x7f0000000380)=""/85, 0x55, 0x81ffffffbfffffc) ioctl$IOCTL_VMCI_VERSION(r1, 0x79f, &(0x7f00000001c0)=0x80000) ioctl$EVIOCRMFF(r1, 0x40044581, &(0x7f0000000040)=0xfffffffb) 3m32.129823462s ago: executing program 36 (id=1502): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000062d14406d0470084761000000010902120001000000000904"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) r1 = memfd_secret(0x0) fchownat(r1, &(0x7f0000000040)='\x00', 0x0, 0x0, 0x1000) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000840)={0x44, &(0x7f0000000700)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 1m55.378050037s ago: executing program 9 (id=1827): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = syz_io_uring_setup(0x10d, 0x0, 0x0, 0x0) socket$can_j1939(0x1d, 0x2, 0x7) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x80000005, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000002000)=""/102389, 0x18ff5) listen(r0, 0x5) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f000001d7c0)=@filter={'filter\x00', 0x42, 0x4, 0x13a0, 0xffffffff, 0x0, 0x0, 0x1238, 0xffffffff, 0xffffffff, 0x1308, 0x1308, 0x1308, 0xffffffff, 0x5, 0x0, {[{{@uncond, 0x3127, 0x10e0, 0x1120, 0x1ba, {0x46010000}, [@common=@set={{0x40}, {{0x3, [0x0, 0x1, 0x0, 0x3, 0x7, 0x4], 0x5, 0x9}}}, @common=@unspec=@cgroup1={{0x1030}, {0x1, 0x0, 0x5, 0x0, './cgroup.net/syz0\x00', 0x9, {0x8dfd}}}]}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz0\x00', 0x8, 0x3}}}, {{@uncond, 0x287, 0xf0, 0x118, 0x0, {0x0, 0x4}, [@common=@addrtype={{0x30}, {0x108, 0x0, 0x0, 0xfffffffd}}, @common=@osf={{0x50}, {'syz1\x00', 0x0, 0x4, 0x100, 0x1}}]}, @common=@inet=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0x8, 0x5, 0x7fff}}}, {{@ip={@multicast1, @multicast2, 0xffffff00, 0xffffff00, 'ip6_vti0\x00', 'netpci0\x00', {0xff}, {0xff}, 0x5e, 0x3, 0x20}, 0x0, 0x70, 0xd0}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv4=@multicast1, [0x0, 0x0, 0xff], 0x4e24, 0x4e20, 0x4e20, 0x4e22, 0x6, 0x8, 0xffff, 0x80000005, 0x7}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x535) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x801}, 0x40018) syz_emit_ethernet(0x52, &(0x7f0000000500)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb08004c000078ac14", @ANYRES32=0x41424344, @ANYRES64=r2], 0x0) r4 = syz_io_uring_setup(0x24fa, &(0x7f0000000400)={0x0, 0x81b174, 0x1, 0x8000, 0x40024e, 0x0, r1}, &(0x7f0000000540)=0x0, &(0x7f0000000640)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x110, &(0x7f0000000000)=0xff8, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f0000002c00)=@IORING_OP_NOP={0x0, 0x28}) sendmsg$RDMA_NLDEV_CMD_GET(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB="1000d702687a24ff030000"], 0x2}, 0x1, 0x0, 0x0, 0x8000}, 0xc000) io_uring_enter(r4, 0x627, 0xc1040000, 0x43, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000480), 0x200400, 0x0) r7 = add_key$user(&(0x7f00000002c0), &(0x7f0000000300)={'syz', 0x0}, &(0x7f0000000280)="d25a9850a9d77f", 0x7, 0xfffffffffffffffe) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000018c0)={&(0x7f0000000680)=ANY=[@ANYBLOB="0ac70669f88ec105004ce295ff3c230c3dfc8719c57b428998bc2cea6750ec88e3554615939096aa707ecb8d8b1c8560c0e4404db82c55b609e49983cbd236e5a9562eb63ff099f65b578989d9e4470e7420b4dc2fce6b43dab1d52633531e4c31a45a05005800c0bab6c44ee9ff6af0690bb3ec3abd1c3ba002aae62001d7b12fa3d89afcca3b930f8347a89ff56ffc7f87aaab284894cd283a640e958c1c29307c88a8699ddf2da60c7948c996efdb67279c83356ae074e2dbfa28195c4b3d460c1ccd7bb3931da6d6e0b97028ee0a0849a99b7241de2e9dbcc69b5fe03e2e323ed15a00", @ANYBLOB="ebffffffffffffff280012800b"], 0x48}}, 0x801) r8 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r7, r8, r7}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x606000, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) add_key$fscrypt_v1(&(0x7f0000000180), &(0x7f00000004c0)={'fscrypt:', @auto=[0x51, 0x39, 0x34, 0x34, 0x2d6c01a8f29871d0, 0x63, 0x31, 0x36, 0x37, 0x36, 0x32, 0x64, 0x37, 0x39, 0x36, 0x64]}, &(0x7f0000000340)={0x0, "0ed5f854e8e86a2254c1c824bd65b98d2bcb1b186b4e6d3dfcd10bdb2df476b02701a0ebcf4a4a3a80c38b2f7e544a3df04200a655d407becb3ed31c4eb5b33c", 0x1a}, 0x48, 0xfffffffffffffffc) dup(r10) ioctl$KVM_SET_USER_MEMORY_REGION(r10, 0x4020ae46, 0x0) 1m55.168021761s ago: executing program 9 (id=1829): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x400000000010, 0x80000, 0x20) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@deltclass={0x68, 0x29, 0x900, 0x70bd2d, 0x25dfdbfb, {0x0, 0x0, 0x0, r3, {0x1, 0xfff3}, {0xfff1, 0x5}, {0x7, 0xffe0}}, [@tclass_kind_options=@c_multiq={0xb}, @tclass_kind_options=@c_fq_codel={0xd}, @TCA_RATE={0x6, 0x5, {0x7, 0x4}}, @TCA_RATE={0x6, 0x5, {0x4, 0x1}}, @tclass_kind_options=@c_red={0x8}, @TCA_RATE={0x6, 0x5, {0x5, 0x4}}, @TCA_RATE={0x6, 0x5, {0xc, 0xa}}]}, 0x68}, 0x1, 0x0, 0x0, 0x10}, 0x0) r4 = open(&(0x7f0000000080)='./bus\x00', 0x4a003, 0x0) r5 = syz_open_dev$video(0x0, 0x3, 0x402) ioctl$VIDIOC_G_FMT(r5, 0xc0d05604, &(0x7f0000000500)={0xa, @pix={0x0, 0x1000, 0xf8606d00}}) ioctl$FS_IOC_FSSETXATTR(r4, 0x401c5820, &(0x7f00000003c0)={0xd8}) ioctl$IOCTL_VMCI_QUEUEPAIR_SETPF(r4, 0x7a9, &(0x7f0000000000)={{@hyper, 0x9}, 0x6, 0x6, 0xc, 0x7, 0xa0, 0xf4d, 0xd8a9, 0x81}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000c80)={'ip6gre0\x00', 0x0}) r7 = syz_open_dev$tty1(0xc, 0x4, 0x1) r8 = dup(r7) write$UHID_INPUT(r8, &(0x7f00000010c0)={0xc, {"a2e3ad21ed0d52f91b5d320887f70e06d038e7ff7fc6e5539b3272298b089b07081b4d090890e0878f0e1ac6e7049b3365959bfc9a240d2567f3988f7ef31952013fffe8d178708c523c921b1b9b39070d075d1836cd3b78130d9b61d8e809ea882f5802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb056d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498be0800000000000000f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6efcffac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ec126c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b8247068ae949ed06e288e810bac9c76600025e19c9000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c198045651cf4778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdc80c47ee4f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78ff95b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af0000807e0000000002d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c5409711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b4051db55e0510a6e4114a53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e24919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afae5136651b1b9bd522d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a6d8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f00000000000000000000b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d53588a0f9455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d664130bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7899484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ea4cd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f031755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c7e36bb2fc4c40e9cf96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb24ee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0x1000}}, 0x1006) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000016c0)=@newqdisc={0x54, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0x4000000, {0x0, 0x0, 0x0, r6, {0x0, 0x1}, {0xffff, 0xffff}, {0xc}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x4}}, @TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x9, 0x2, 0x3, 0x1, 0x0, 0xd75e, 0x3ff}}, {0x4}}]}]}, 0x54}}, 0x0) 1m53.583182967s ago: executing program 9 (id=1832): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f0000000440)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) open$dir(&(0x7f00000001c0)='./file0\x00', 0x400082, 0x40) futex(0x0, 0xc, 0x1, 0x0, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r4 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_INPUT(r4, 0xc0045627, &(0x7f0000000100)=0x3) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r4, 0xc0845657, &(0x7f0000000200)={0x0, @bt={0xa02, 0x870, 0x1, 0x2, 0xd59f80, 0x19f2, 0x3f, 0x19ef, 0x3, 0x8, 0x2800, 0x6, 0x2, 0xfffffff7, 0x8, 0x30, {0x8, 0xffffffff}, 0xd0, 0x9}}) 1m50.488736278s ago: executing program 9 (id=1841): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000240)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r0, 0x3ba0, &(0x7f0000000500)={0x48, 0x2, r3}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000400)={0x48, 0x5, r2, 0x0, 0xffffffffffffffff, 0x1}) timer_create(0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0) socket$inet6(0xa, 0x2, 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000440)='./file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2125099, 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) mount$bind(&(0x7f0000000000)='./file0/../file0\x00', &(0x7f0000000340)='./file0/file0\x00', 0x0, 0x891018, 0x0) mount$bind(&(0x7f00000000c0)='.\x00', &(0x7f0000000080)='./file0/file0/file0\x00', 0x0, 0x80700e, 0x0) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000040)={0x28, 0x2, r2, 0x0, &(0x7f0000392000/0x3000)=nil, 0x3000, 0xab1a}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000680)={0x48, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x749bc}) 1m50.295723013s ago: executing program 9 (id=1844): mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000004c0)={{{@in6=@remote, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0xa, 0x20, 0x20}, {}, {0x0, 0x9}}, {{@in6=@mcast2, 0x0, 0x2b}, 0x0, @in=@empty}}, 0xe8) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="020000000400000005000000020000000010"], 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xd, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000850000005000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000001b80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='kmem_cache_free\x00', r2}, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000007940)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x33f}, 0x1, 0x0, 0x0, 0xc0d0}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0xa, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r4, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r3, {}, 0xa}}, 0x26) sendmmsg$inet(r4, &(0x7f0000005f80)=[{{0x0, 0x0, &(0x7f0000005dc0)=[{&(0x7f00000010c0)="7d5107673289eeae3f806c5c62db497a0299399ab6101c3b", 0x1}], 0x1}}], 0x4000000000001ce, 0x8040) r5 = socket$key(0xf, 0x3, 0x2) setsockopt$sock_int(r5, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=ANY=[], 0x10}}, 0xc0) sendmsg$key(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="0212000002"], 0x10}}, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1400000015000103"], 0x14}}, 0x0) close(r0) socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[], 0xb8}}, 0x0) mount(0x0, &(0x7f0000000240)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, &(0x7f0000000300)='usrquota') chdir(&(0x7f00000000c0)='./file1\x00') syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='comm\x00') r6 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./bus\x00', 0x141842, 0x0) pipe2$9p(&(0x7f0000000080), 0x0) pipe2$9p(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80080) write$P9_RXATTRWALK(r7, &(0x7f0000000380)={0xf, 0x1f, 0x2, 0x8}, 0xf) quotactl_fd$Q_QUOTAOFF(r6, 0xffffffff80000302, 0x0, 0x0) 1m49.556040932s ago: executing program 9 (id=1846): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000ec0)={&(0x7f0000000000)=@newtfilter={0x34, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {}, {0xc}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x20044010}, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r3 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r3, &(0x7f0000002700)=""/102392, 0x18ff8) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)={{0x14}, [@NFT_MSG_NEWRULE={0x70, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x44, 0x4, 0x0, 0x1, [{0x40, 0x1, 0x0, 0x1, @match={{0xa}, @val={0x30, 0x2, 0x0, 0x1, [@NFTA_MATCH_REV={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_MATCH_INFO={0x18, 0x3, "c6a41d106c72fffffffffffffff5000007000000"}, @NFTA_MATCH_NAME={0xa, 0x1, 'recent\x00'}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x45, 0x2, 'syz2\x00'}]}], {0x14}}, 0x98}}, 0x4048010) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="2c000000680001ed020000000000008000000000000000000c000200030000000600000008"], 0x2c}, 0x1, 0x0, 0x0, 0x4}, 0x4000) write$binfmt_misc(r1, &(0x7f0000000000), 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 1m47.928734783s ago: executing program 37 (id=1846): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000ec0)={&(0x7f0000000000)=@newtfilter={0x34, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {}, {0xc}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x20044010}, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r3 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r3, &(0x7f0000002700)=""/102392, 0x18ff8) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)={{0x14}, [@NFT_MSG_NEWRULE={0x70, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x44, 0x4, 0x0, 0x1, [{0x40, 0x1, 0x0, 0x1, @match={{0xa}, @val={0x30, 0x2, 0x0, 0x1, [@NFTA_MATCH_REV={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_MATCH_INFO={0x18, 0x3, "c6a41d106c72fffffffffffffff5000007000000"}, @NFTA_MATCH_NAME={0xa, 0x1, 'recent\x00'}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x45, 0x2, 'syz2\x00'}]}], {0x14}}, 0x98}}, 0x4048010) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="2c000000680001ed020000000000008000000000000000000c000200030000000600000008"], 0x2c}, 0x1, 0x0, 0x0, 0x4}, 0x4000) write$binfmt_misc(r1, &(0x7f0000000000), 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 1m31.598851308s ago: executing program 6 (id=1901): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x3, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000000000000000000000008500000061000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffbfffb702000008000000b703000000000000850000007b00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4004af61, &(0x7f0000000300)) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x18000000000002a0, 0xe, 0x0, &(0x7f00000012c0)="b9ff03316844268cb89e14f088a8", 0x0, 0xfffffffe, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) 1m29.771774751s ago: executing program 6 (id=1906): r0 = fsopen(&(0x7f0000000000)='hugetlbfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) fsmount(r0, 0x1, 0x0) fsconfig$FSCONFIG_CMD_RECONFIGURE(r0, 0x7, 0x0, 0x0, 0x0) setrlimit(0x2, &(0x7f0000000000)={0x4000051, 0xfffffffa}) prctl$PR_SET_MM(0x23, 0xa, &(0x7f0000ffb000/0x3000)=nil) prctl$PR_SET_MM(0x23, 0xb, &(0x7f0000ffb000/0x4000)=nil) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="18000000240001030000000000000000010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000) recvmmsg(r1, &(0x7f0000000e40)=[{{0x0, 0x0, 0x0}, 0x8101}, {{0x0, 0x0, 0x0}, 0x10004}, {{0x0, 0x0, 0x0}, 0x1}, {{0x0, 0x0, &(0x7f0000000900)=[{&(0x7f0000000000)=""/203, 0xcb}, {&(0x7f00000009c0)=""/257, 0x101}, {&(0x7f0000003e00)=""/4109, 0x100d}, {&(0x7f00000006c0)=""/229, 0xe5}], 0x4}, 0x80000000}], 0x4, 0x20, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000001080)='smaps_rollup\x00') read$FUSE(r2, &(0x7f0000002e40)={0x2020}, 0x2020) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000100)='\'$\x00', &(0x7f0000000140)='[\x00', 0x0) pread64(r1, &(0x7f0000000240)=""/182, 0xb6, 0xffffffffffffff7f) 1m29.502721309s ago: executing program 6 (id=1908): r0 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETFB2(r0, 0xc06864ce, &(0x7f0000000440)) ioctl$DRM_IOCTL_MODE_GETFB2(r0, 0xc06864ce, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, [], [], [], [0x0, 0x3, 0x400000006]}) bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000340)=ANY=[@ANYBLOB="1f000000000000000000000000200000000000", @ANYRESOCT=r0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00un ;\x00\x00\x00\x00', @ANYRES32=0x0, @ANYRES32], 0x50) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000006b40)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4081}}, {{&(0x7f0000000880)=@abs={0x0, 0x0, 0x4e23}, 0x6e, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="14000000000000000100000001000100902ae2a1f1b52902b0670dea11ed66342b5e545dce1229a68b4988802d523f1f", @ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00'], 0x18}}], 0x2, 0x40d0) rseq(0xfffffffffffffffd, 0xfffffffffffffeeb, 0x0, 0x0) r3 = socket$inet6(0xa, 0x3, 0x20) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x1}, 0x1c) bind$inet6(r3, &(0x7f0000000080)={0xa, 0x0, 0x0, @mcast1}, 0x1c) connect$inet6(r3, &(0x7f0000000040)={0xa, 0x3, 0x0, @ipv4={'\x00', '\xff\xff', @remote}, 0x1}, 0x1c) r4 = socket$kcm(0x10, 0x2, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newtaction={0x48, 0x30, 0x53b, 0x0, 0x0, {0x9}, [{0x34, 0x1, [@m_sample={0x30, 0x1, 0x0, 0x0, {{0xb}, {0x4}, {0x4}, {0xc}, {0xc, 0x4, {0x3}}}}]}]}, 0x48}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=ANY=[@ANYBLOB="680000001000030500"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000400012800c0001006d6163766c616e0030000280080006"], 0x68}}, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x10b243, 0x2) pwrite64(r5, 0x0, 0x0, 0x7) ioctl$IOCTL_VMCI_INIT_CONTEXT(r5, 0x7a0, &(0x7f00000000c0)={@host, 0x1}) sendmsg$kcm(r4, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03003f000b05d25a806c8c6394f90324fc60100002000a000300053582c137153e3704020180fc0b09000c00", 0x33fe0}], 0x1}, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000014da2108ab1204000000000000010902240001b30000040904410c17ff5d810009050f1f05e13f00000905"], 0x0) syz_open_dev$evdev(&(0x7f0000000000), 0x40, 0x1e5782) 1m27.967115698s ago: executing program 6 (id=1911): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(0xffffffffffffffff, &(0x7f0000000400)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x0, 0x2, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000ac0)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000fdffffff850000002d00000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xa, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r3}, 0x10) inotify_add_watch(0xffffffffffffffff, 0x0, 0x42000773) syz_pidfd_open(r0, 0x0) getpid() sched_setaffinity(0x0, 0x0, 0x0) r4 = socket$nl_audit(0x10, 0x3, 0x9) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000700)=ANY=[@ANYBLOB="9feb0100180000000000000034000000340000000c000000040000000100008402030000"], 0x0, 0x58, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x28) sendmsg$AUDIT_USER(r4, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="10000000ed0320b43d95a4e94eaf8fe3acadd8c1026cbf0026bdbf7f0000df255f4655904d00d23dea393dd0c77ee3547e96c282e46aa26262048ba968e1c34cb86693530edace413c06a066c61061"], 0x10}, 0x1, 0x0, 0x0, 0x4}, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r5, 0x6, 0x13, &(0x7f00000001c0)=0x4, 0x4) connect$inet6(r5, &(0x7f0000000200)={0xa, 0xffff, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r5, 0x6, 0x1f, &(0x7f0000000040), 0x4) setsockopt$inet6_tcp_TLS_TX(r5, 0x11a, 0x1, &(0x7f00000000c0)=@gcm_256={{0x304}, "0002002000", "07f217bd74511e465bbbd5de01000000f9044677d4d588363d63af84db44be59", "00f8ff00", "8ce63ecbc640735f"}, 0x38) syz_open_dev$sndctrl(&(0x7f0000000580), 0x1, 0x100) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = syz_open_dev$admmidi(&(0x7f0000000140), 0x20, 0x0) io_setup(0x3, &(0x7f0000000180)=0x0) io_submit(r7, 0x1, &(0x7f0000000800)=[&(0x7f0000000040)={0x0, 0x0, 0x0, 0x6, 0x0, r6, 0x0}]) 1m26.959337159s ago: executing program 6 (id=1914): unshare(0x22020600) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="16000000000000000400000001"], 0x50) r1 = bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000240)={{r1}, &(0x7f0000000180), &(0x7f00000001c0)}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00'}, 0x10) bpf$MAP_GET_NEXT_KEY(0x15, &(0x7f0000000580)={r0, 0x0, 0x0}, 0x20) r2 = syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201000094ae94405f0520c4336a000000010902120001000000000904"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) 1m22.830786886s ago: executing program 6 (id=1922): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x6) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0xffffffffffffff2b, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_open_dev$sg(0x0, 0x0, 0x40042) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="18010000010000000000000000030000850000007b00000095"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f00000000c0)='sched_switch\x00', r3}, 0x10) r4 = socket(0x10, 0x2, 0x0) mount$bind(&(0x7f00000001c0)='./file1\x00', &(0x7f0000000380)='./bus\x00', &(0x7f00000003c0), 0x400000, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r4, 0x89f1, &(0x7f0000000000)={'ip6gre0\x00', &(0x7f00000009c0)={'syztnl1\x00', 0x0, 0x0, 0x0, 0x1, 0x2, 0x0, @loopback, @loopback}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r4, 0x89f3, &(0x7f0000000440)={'syztnl1\x00', &(0x7f0000000640)={'ip6_vti0\x00', 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, @loopback, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x0, 0x0, 0x0, 0x6}}) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000580)={[{@lowerdir={'lowerdir', 0x3d, './cgroup'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x98}}, 0x0) socket$kcm(0x21, 0x2, 0xa) r5 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101b01) ioctl$USBDEVFS_GET_CAPABILITIES(r5, 0x8004551a, &(0x7f0000000080)) r6 = socket$inet(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r6, 0x4000000000000, 0x40, 0x0, 0x0) socket$kcm(0x21, 0x2, 0xa) 1m7.108787937s ago: executing program 38 (id=1922): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x6) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0xffffffffffffff2b, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_open_dev$sg(0x0, 0x0, 0x40042) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="18010000010000000000000000030000850000007b00000095"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f00000000c0)='sched_switch\x00', r3}, 0x10) r4 = socket(0x10, 0x2, 0x0) mount$bind(&(0x7f00000001c0)='./file1\x00', &(0x7f0000000380)='./bus\x00', &(0x7f00000003c0), 0x400000, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r4, 0x89f1, &(0x7f0000000000)={'ip6gre0\x00', &(0x7f00000009c0)={'syztnl1\x00', 0x0, 0x0, 0x0, 0x1, 0x2, 0x0, @loopback, @loopback}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r4, 0x89f3, &(0x7f0000000440)={'syztnl1\x00', &(0x7f0000000640)={'ip6_vti0\x00', 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, @loopback, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x0, 0x0, 0x0, 0x6}}) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000580)={[{@lowerdir={'lowerdir', 0x3d, './cgroup'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x98}}, 0x0) socket$kcm(0x21, 0x2, 0xa) r5 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101b01) ioctl$USBDEVFS_GET_CAPABILITIES(r5, 0x8004551a, &(0x7f0000000080)) r6 = socket$inet(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r6, 0x4000000000000, 0x40, 0x0, 0x0) socket$kcm(0x21, 0x2, 0xa) 33.387432178s ago: executing program 0 (id=2098): socket$inet_tcp(0x2, 0x1, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0x8, &(0x7f0000000180)=0x200007ff, 0x4) setsockopt$packet_int(r0, 0x107, 0x9, &(0x7f0000000080)=0x2, 0x4) r1 = socket$netlink(0x10, 0x3, 0x4) write(r1, &(0x7f0000005c00)="2700000014000707030e0000120f0a0011000100f5fe0012ff000000078a151f75080039000500", 0x27) r2 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0xd, 0x0, &(0x7f0000000040)=0x700) syz_io_uring_setup(0x110, &(0x7f0000000140)={0x0, 0xfad6}, 0x0, 0x0) unshare(0x2a020400) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x1}, 0x0, &(0x7f0000000240)={0x1f}, &(0x7f0000000280)={0x0, 0x3938700}, 0x0) 32.771121273s ago: executing program 0 (id=2102): r0 = syz_io_uring_setup(0x231, &(0x7f0000000080)={0x0, 0xd811, 0x10100, 0x0, 0x2}, &(0x7f0000000000)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r1, r2, &(0x7f00000009c0)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd_index=0x3, 0xffffffffffffffff, 0x0}) io_uring_enter(r0, 0x7a98, 0x4, 0x41, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') unshare(0x6a040000) r3 = socket$netlink(0x10, 0x3, 0xb) r4 = socket$phonet_pipe(0x23, 0x5, 0x2) r5 = syz_io_uring_setup(0x83f, &(0x7f00000000c0)={0x0, 0xa9ee, 0x400, 0x3, 0x8002ae}, &(0x7f0000000140)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r8 = socket$kcm(0x2, 0x1000000000000002, 0x0) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000b80)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0ff0100000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec561750379585e5a076d839240d29c034055b67dafe6c8dc3d5d78c07fa1f7e655ced4fbd44e24eb0d34e4d5b3185fec0e07004e60c08dc8b8dbf11e6e94d75938321a3aa502cd2424a66e6d2ef831ab7ea0c34f17e3946ef3bb622003b538dfd8e012e79578e51bc53099e90f4580d760551b5b341a29f31e3a06d1ddd6152f7cbdb9cd38bdb2209c67deca8eeb9c15ab3a14817ac61e4dd11183a13477bf7e860e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cb132b8667c2147661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c581e7be6ba0dc001c4110555850915148ba532e6ea09c346dfebd38608b3280080005d9a9500000000000000334d83239dd27080851dcac3c12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3deadd7130856f756436303767d2e24f29e5dad9796efea77aeea0182babd18cac1bd4f4390af9a9ceafd0002cab154ad029a1090000002780870014f51c3c975d5aec84222fff0d7216fdb0d3a0ec4be3e563112f0b39501aafe234870072858dc06e7c337642d3e5a815232f5e16c1b30c3a6a71bc85018e5ff2c91018afc9ffc2cc788bee1b47683db01a469398685211dfbbae3e2ed0a50e7313bff5d4c391ddece00fc772dd6b4d4de2a41990f05ca3bdfc92c88c5b8dcd36e7487afa447e2edfae4f390a8337841cef386e22cc22ee17476d738952229682e24b92533ac2a9f5a699593f084419cae0b4532bcc97d3ae486aca54183fb01c73f979ca9857399537f5dc2acb72e7ead0509d380578673f8b6e74ce23877a6b24db0e067345560942fa629fbef2461c96a088a22e8b15c3e233db7ab22e30d46a9d24d37cef099ece72f2090000f44a3210223fdae7ed04935c3c90941576aebc8619d73415cda2130f5011e4845505000001000000004f50adab988dd8e12baf5cc9398fff00404d5d99f82e20ee6a8c88e18c2977aab37d9ac4cfc1c7b400000000000007ff57c39495d5e41ff868f7ca1664fe2f3ced846891180604b6dd2499d16d7d9158ffffffff00000000ef069dc42749a89f854797f29d0000002d8c38a967c1bbe09315c29877a331bcc87dc3addb08141bdee5d27874b2f663ddeef0005b3d96c7aabf4df517d90bdc01e73835d5a3e1a90800c66ee2b1ad76dff9f9000071414c99d4894ee7f8249dc1e3428d2129369ee1b85af6eb2eea0d0df414b315f651c8412392191fa83ee830548f11e1036a8debd64cbe359454a3f2239cfe35f81b7a490f167e6d5c1109000000000000000042b8ff8c21ad702ccacad5b39eef213d1ca296d2a27798c8ce2a305c040035cf4b22549a4bd92052188bd1f285f653b621491dc6aaee0200e2ff08644fb94c06006eff1be2f633c1d987591ec3db58a7bb3042ec3f771f7a1338a5c3dd35e926049fe86e09c58e273cd905deb28c13c1ed1c0d9cae846bf463261135e24d154114df1381b02a0dcbfa8cce7b893e578af7dc7d5e87d44ff828de453f34c2b18660b080efc707e676e1fb4d5825c0ca177a4c7fbb4e62b445c00f576b2b5cc7f819abd0f884cc4806f40300966fcf1e54f5a2d38708194cd6f496e5dee734fe7da3770845cf442d488afdc0e1700000000000000000000000000000000000000000000000000000520500002952a93466ae595c6a8cda690d192a070886df42b27098773b45198b4a34ac977ebd4450e121d01342703f5bf030e935878a6d169c80aa4252d4ea6b8f6216ff202b5b5a182cb5e838b307632d03a7ca6f6d0339f9a33c3093c3690d10ecb65dc5b47481edbf1f000000000000004d16d29c28eb5167e9936ed327fb237a62415f78000000005f0dec1b3ccd35364600000000000000000000000000000000000000000000000000000000000026ded4dd6fe1518cc7802043ecfe69f743f1213bf8179ecd9e5a225d67521dc728eac7d80a5656ac2cbde21d3ebfbf69ff861f4394836ddf128d6d19079e64336e7c676505c78ad67548f4b192be1827fcd95cf107753cb0a6a979d3db0c81c6281e2d8429a863903ca75f4c7df3ea8fc2018d07af1491ef060cd4403a099f32468f65bd06b40824095135861b5cc03f1a1561f0589e0d12969bc982ff5d8e9b986c0c6c747d9a1cc500bb892c3a16ff10feea20bdac00000b0000000000ca06f256c8028e0f9b65f037b21f3289f86a6826c69fa35ba5cbc3f2db1516ffc5c6e3fa618b24a6ce16d6c7010bb37b61fa0a2d8974e69115d33394e86e5dd921a5eadd4b838297ba20f96936b7e4746e92dea6c5d1d33d84d96b50fb000000ae07c65b71088dd7d5d1e1bab9000000000000000000000000b5ace293d5c833c13e3229432ad71d646218b5229dd88137fc7c59aa242af3bb4efb82055a3b61227ad40f52c9f2500579aca11033ec14bb9cc16bd83a00840e602c28ec78e116ae46c4897e2795b6ff92e9a1e24b0b855c02f257aac5af18d8c6b7add58ffb25f339297729a7a51810134d3dfbf71f6516737be55c06d9cdcfb1e29b10b50000eb4acff90756dba1ecf9f58afd3c19b5c4558ba9af6b7333c894a1fb29ade9ad75c9c022e8d03fe28bc358684492aa771dbfe8e4cd14dc5c1eb98b63198f6f830745fe89ad349ffaad76ff9dd643796caffdf67af5dd476c37e7e9a84e2e5da2696e285a59b51c34a5384f2cf51180c159ce40c14089c82759106f422582b42e3e8484ea5a6ad9aa52106eafe0e0caea1ad4cb23f3c2b8a0f455ba69ea284c268d54b43158a8b1d128d02af243b3dc1cab794c9ac57a2a7332f4d8764c302ccd5aac114482b619fc575aa0dd2777e881e29a854380ecf1e49db5a1517ec40bb3fa44f9959bad67ccaba76408da35c9f1534c8bd48bbd61627a2e0a74b5e6aefb7eee403502734137ff47257f164391c673b6079e65d7295eed164ca63e4ea26dce0fb3ce0f6591d80dfb8f386bb79f558982d57c556ca1427b5960b79990565ca2a20996fcba472213744d3a156979651596afde2b0089f023fcfccd072bd6ea8445fc787390d71ec61d5b7b0f05f6931914bf49aa0d66eff294271a93e32f54f281068514a4cd2d0700a43df59e9924e4affdbd22405e675e9d7cdc10546571131831d4dc8c8363077a908d9ae4f27ff095f5b07667f93a3573d3fabfca58ee0a6b6a691102bb3c7be4dc5b816853275e7ae8c13ec341bad15353fad794b46c4fd73e1b4cc78de2156cb158870d5b8446dae9ba5f7f244e6cf8f6791671057347208a313ebbcb72b04706005670f2b0055e440d72c7c3316982c6ebe8675458cf6bb393b007f5cedb7bc411834600000000000000000000000000a20071b07d568a8150ed646b4978d0226d9651647a5999ae7c7c85322a215fcdb1adbad63499518fe0d10145d430422c78367dfa941f74b63f3884565ac89c673da2c2b1172be5f2cd1f3f453ebddd432bd24c73fa773b739e20fcec16a821230654a383ac1868495f67d942c772ca75e09073dbe9307ff5cac7c2c411149a4d989a8a019e068da218d4bc34e4102fd2f97397331e4cd70b4915582b635f07ca87f00dc929f902540f565c20add8675b79e005cf0277d954697317b907b77fa5d6b7feaebaf676a2a37de8aa70748fee4bc198ffd3e2de11eb0eff896fd94de0805ba6b1054a7b3e300d4581e9af62a1ecaee96d2819b3d192e5b9561eb622da25450f586be14017a1cf74f89a1dd18af004decfe266134c3d036ae7996931fe6008a73ed34c35f0da4ffee1fe63bc1af6ef1b4731d50b8ceb582a1e9c6e8d97f8290cc105754f592d16ccdb1df8636d7ca5e372cea97dd0f005cc7092b126dd46758917fb0d94b8483d403bd451429cc1660f0b5a529d8134dc2702f6d8e2f943d98fbe50a3ba653f13f98a00fcbf311f9758ade8e4eb87b4b9fb2d387f5d8c4bdcab2fff9ed8c9de961fd831a070381c8020352fea7c334b2959ddd956701a7ea415e224a81c9fa1ebbabe74f7743e09b6c8b72650b51d5c2000ef3679c039b3604374fc1af7ab354204afbd24f0e701bc08a98452ce2668617e85e0d876f5a8b6d9b777f1c384d8a9883e4262defb6b9aab8d5b76bc91ca50f87966797da2499ca0ac76707c0408a7b6d8708fe7714988babdc11f"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) setsockopt$sock_attach_bpf(r8, 0x88, 0x67, &(0x7f00000002c0)=r9, 0x4) sendmsg$inet(r8, &(0x7f00000000c0)={&(0x7f0000000080)={0x2, 0x4e60, @multicast1}, 0x10, &(0x7f0000000000)=[{&(0x7f0000000740)="400f007ae1", 0x5}], 0x1, &(0x7f0000000780)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0xe}, @private=0xa010102}}}], 0x20}, 0x0) r10 = openat2(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', &(0x7f0000000200)={0x100, 0x8, 0x5}, 0x18) ioctl$SNDCTL_DSP_SETTRIGGER(r10, 0x40045010, &(0x7f0000000240)=0x1) syz_io_uring_submit(r6, r7, &(0x7f00000002c0)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r4, 0x80, &(0x7f0000000680)=@ax25={{0x3, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x6}, [@default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null]}}) io_uring_enter(r5, 0x3516, 0x0, 0x0, 0x0, 0xfffffdcf) sendmsg$IPVS_CMD_NEW_DAEMON(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)={0x14, 0x0, 0x4, 0x70bd2a, 0x25dfdbff}, 0x14}}, 0x2400c800) r11 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r11, &(0x7f0000000040)={0x2, 0x4e21, @multicast1}, 0x10) 29.411208262s ago: executing program 0 (id=2112): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) fchdir(r1) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000280)={0x1, 0x20000001, &(0x7f0000000380)=""/247, &(0x7f00000000c0)=""/85, 0x0}) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x9, 0x9, 0x8, 0x40, 0x42, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240), &(0x7f0000000000), 0x86, r2}, 0x38) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000001600)={r2, &(0x7f0000000240)='_H', &(0x7f0000000540)=""/96}, 0x20) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000680)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0x12, &(0x7f0000000580)=ANY=[@ANYBLOB="1800000005000000000000000200000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000850000006d000000bf91000000000000b7020000010000008500000084000000b70000000000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000002c0)={0x1b, 0x0, 0x0, 0x90a5, 0x0, 0x1, 0x7ff, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x5, 0x4, 0x0, @void, @value, @void, @value}, 0x50) r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000340)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x80000001, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x1, 0x1, 0x0, @void, @value, @void, @value}, 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4) r7 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000400)={0xffffffffffffffff, 0x4, 0x18}, 0xc) r8 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000440)='.pending_reads\x00', 0x200000, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x18, 0x16, &(0x7f0000000040)=@raw=[@cb_func={0x18, 0x1}, @call={0x85, 0x0, 0x0, 0x40}, @jmp={0x5, 0x1, 0xa, 0xa, 0x7, 0xfffffffffffffff4}, @initr0={0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x40}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x80000000}}, @map_idx_val={0x18, 0x4, 0x6, 0x0, 0x6, 0x0, 0x0, 0x0, 0x3}, @exit], &(0x7f0000000100)='syzkaller\x00', 0x6, 0x2d, &(0x7f0000000180)=""/45, 0x41000, 0x26, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f00000001c0)={0x4, 0x1}, 0x8, 0x10, &(0x7f0000000280)={0x1, 0xd, 0x51, 0x60000}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000480)=[r1, r2, r3, r4, r5, 0xffffffffffffffff, r6, r7, r8], 0x0, 0x10, 0xffffffff, @void, @value}, 0x94) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r9, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) socket(0x10, 0x2, 0xeb) sendmmsg$unix(r10, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r9, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r11 = socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_genetlink_get_family_id$devlink(&(0x7f0000008280), r11) sendmsg$DEVLINK_CMD_SB_POOL_GET(r11, &(0x7f00000084c0)={0x0, 0x0, &(0x7f0000008480)={&(0x7f00000082c0)={0x44, r12, 0x1, 0x70bd26, 0x25dfdbfd, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xfffffffffffffe51, 0xb, 0x8001}, {0x6, 0x11, 0x40}}]}, 0x44}, 0x1, 0x0, 0x0, 0x24000084}, 0x40080) ioctl$SIOCX25SFACILITIES(0xffffffffffffffff, 0x89e3, 0x0) 28.320967786s ago: executing program 0 (id=2117): openat$ipvs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/sys/net/ipv4/vs/sync_ports\x00', 0x2, 0x0) r0 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev, 0x9}, 0x1c) r1 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000700)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000004c0)=ANY=[@ANYBLOB="d80000", @ANYRES16, @ANYBLOB="04002dbd7000f2dbdf254f0000000c00839ced540000680000004c007a8008000400000000181c000200134ecc4d908540c3c8630b918a29360800040004005111335ced5fd94e0800040009000000080004000300000048007a801400010003d869f47d8c428eaa74b31794b4b314b5000400000000000c0003004180081ee4f88f1a080004000c0000000c0003007858754e3c504054080004000800000004007a8020007a800800040005000000140002002929"], 0xd8}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x952f, &(0x7f0000000100)=[{&(0x7f0000000000)="2c10", 0x5dc}], 0x1, 0x0, 0x0, 0x2c}, 0x44004) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) ioctl$VIDIOC_QUERYBUF(0xffffffffffffffff, 0xc0585609, &(0x7f00000000c0)=@multiplanar_mmap={0x7, 0xa, 0x4, 0x100000, 0x3, {0x0, 0x2710}, {0x1, 0xc, 0x7, 0x7, 0x80, 0x5, "2852dfcf"}, 0x8, 0x1, {0x0}, 0x5}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x16, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) syz_open_dev$I2C(&(0x7f0000004800), 0x0, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = add_key$user(&(0x7f0000000040), &(0x7f0000000180)={'syz', 0x0}, &(0x7f0000000080)='\x00', 0x1, 0xfffffffffffffffb) ioctl$IOC_WATCH_QUEUE_SET_SIZE(0xffffffffffffffff, 0x5760, 0x14) keyctl$KEYCTL_WATCH_KEY(0x20, r3, 0xffffffffffffffff, 0x100000000000f7) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f00000003c0)={'vxcan0\x00', 0x0}) sendmsg$can_bcm(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x1d, r4}, 0x10, &(0x7f00000000c0)={&(0x7f0000000580)={0x1, 0x7ab0715dca68fed7, 0x0, {}, {}, {}, 0x4, @canfd={{}, 0x0, 0x0, 0x0, 0x0, "b8ee0816756b62187804752330b2b55830d7228ef1593c0639bd084bba0bfd8db72f70e5b2e7f90e11cbc6ec61a03fc316d5d47970907af5fc4a27f6cf718909"}}, 0x20000600}}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) 26.86341285s ago: executing program 0 (id=2122): madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x3) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_SET_MSRS(r5, 0x4008ae89, &(0x7f0000000080)=ANY=[@ANYBLOB="0400000000000000ce"]) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x18, 0x4, &(0x7f00000002c0)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x208e, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r8}, 0x10) r9 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x8400, 0x0) prlimit64(r2, 0x7, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x8) r10 = syz_open_dev$MSR(0x0, 0x0, 0x0) read$msr(r10, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$vim2m_VIDIOC_EXPBUF(0xffffffffffffffff, 0xc0405668, 0x0) ioctl$FS_IOC_SETFLAGS(r9, 0x40186f40, &(0x7f0000000440)=0x1f) setns(r1, 0x24020000) 24.814211403s ago: executing program 0 (id=2131): r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000100), 0x1, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="01000000030000000200000004"], 0x48) r2 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r2, 0x400442c8, &(0x7f0000000400)={0xffffffffffffffff, 0x0, 0x4, "33616129be49257c2ec4143b82f6253e3554afc6d831a35b0b9b4fa3b46b12f53703e7fed1bbe1aab1d724698c4ad5c9cd955a85"}) unshare(0x26000400) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) dup(r1) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, r1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000008900000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000fdffffff7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b702000000000000850000007500000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000140)={0xaa, 0x298}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r6 = userfaultfd(0x1) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f0000000140)={0xaa, 0x298}) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.current\x00', 0x275a, 0x0) write$cgroup_int(r7, &(0x7f0000000100), 0x1001) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000b00)={&(0x7f0000000ac0)='mm_page_free_batched\x00', r5}, 0x10) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000140)={{0x1, 0xffffffffffffffff}, &(0x7f0000000000), &(0x7f00000000c0)='%-010d \x00'}, 0x20) bpf$MAP_CREATE(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="f0ca626faa3d1200000700", @ANYRES32=r8, @ANYBLOB="81ffffff00"/20, @ANYRES32, @ANYRES32=r7, @ANYBLOB="05000000050000000400"/28], 0x50) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.current\x00', 0x275a, 0x0) ioctl$SNAPSHOT_UNFREEZE(r0, 0x3302) syz_usb_connect(0x5, 0x3e, &(0x7f0000000040)={{0x12, 0x1, 0x141, 0xc8, 0x55, 0x3d, 0x20, 0x499, 0x500c, 0x3349, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2c, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0xa9, 0x2, 0x1, 0x46, 0x66, 0x27, 0x0, [@uac_as={[@format_type_ii_discrete={0x9, 0x24, 0x2, 0x2, 0x6, 0x4}, @format_type_i_discrete={0x8, 0x24, 0x2, 0x1, 0x7, 0x1, 0x6, 0xf}]}], [{{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) 10.851294315s ago: executing program 1 (id=2191): r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB, @ANYRES32=r1, @ANYBLOB='\x00\x00w\x00\b\x00\b'], 0x24}, 0x1, 0x0, 0x0, 0x4}, 0x0) 10.612922654s ago: executing program 1 (id=2193): ioprio_set$pid(0x1, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xc000000000000) r0 = syz_open_dev$usbfs(&(0x7f0000000480), 0x2e, 0x111401) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, &(0x7f00000004c0)) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='mountinfo\x00') r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000380)={0x1000000b}) getpeername$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000500)=0x14) bpf$MAP_CREATE(0x0, &(0x7f0000000580)=@bloom_filter={0x1e, 0x0, 0x8, 0xffff, 0x10010, r1, 0xfffffff3, '\x00', r3, 0xffffffffffffffff, 0x0, 0x4, 0x1, 0x5, @void, @value, @value=r1}, 0x50) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r4, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) mknod(&(0x7f00000048c0)='./file0\x00', 0x0, 0x0) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000140), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESDEC=r5, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r5, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r5, &(0x7f0000000280)={0x50, 0x0, r6, {0x7, 0x1f}}, 0x50) syz_fuse_handle_req(r5, &(0x7f0000008380)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008df76a250000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea21056000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000131a5d9400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b600", 0x2000, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r7 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x101001, 0x0) r8 = openat$smackfs_cipsonum(0xffffffffffffff9c, &(0x7f0000000080)='/sys/fs/smackfs/doi\x00', 0x2, 0x0) ioctl$F2FS_IOC_SET_PIN_FILE(r8, 0x4004f50d, &(0x7f00000000c0)) ioctl(r5, 0x2, &(0x7f0000000380)="6e3ddafd0f5124180bb4a2087ba30502458bd88c06b38a420f5f7e2d57ee4b4c7ebcf5f5a206f191eed66e02b899df17c494f9576fbb592b8ff1e0b97c373f058959fb75f77d2b727f185cd752bd0c791c8ca0b4eed56c3d8295cc564e717031430e3b3d26339a575684ffafa6877fc448cfb848df426ed22c368ee3003ba00a04b002e03fd89fed539e2cd343a5fcc2c15c03e4acebe97b4aac4a88449135364810559326500ce4a0568bdf167b07b0359d134ab72896476c128720fe6c8d8aa5f3a69001c878586d41341d409d488e702256f19715429b6151e1") lseek(r7, 0x7fffffffffffffff, 0x0) write$binfmt_misc(r4, &(0x7f0000000000), 0xd) 9.776907287s ago: executing program 39 (id=2131): r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000100), 0x1, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="01000000030000000200000004"], 0x48) r2 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r2, 0x400442c8, &(0x7f0000000400)={0xffffffffffffffff, 0x0, 0x4, "33616129be49257c2ec4143b82f6253e3554afc6d831a35b0b9b4fa3b46b12f53703e7fed1bbe1aab1d724698c4ad5c9cd955a85"}) unshare(0x26000400) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) dup(r1) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, r1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000008900000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000fdffffff7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b702000000000000850000007500000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000140)={0xaa, 0x298}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r6 = userfaultfd(0x1) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f0000000140)={0xaa, 0x298}) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.current\x00', 0x275a, 0x0) write$cgroup_int(r7, &(0x7f0000000100), 0x1001) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000b00)={&(0x7f0000000ac0)='mm_page_free_batched\x00', r5}, 0x10) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000140)={{0x1, 0xffffffffffffffff}, &(0x7f0000000000), &(0x7f00000000c0)='%-010d \x00'}, 0x20) bpf$MAP_CREATE(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="f0ca626faa3d1200000700", @ANYRES32=r8, @ANYBLOB="81ffffff00"/20, @ANYRES32, @ANYRES32=r7, @ANYBLOB="05000000050000000400"/28], 0x50) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.current\x00', 0x275a, 0x0) ioctl$SNAPSHOT_UNFREEZE(r0, 0x3302) syz_usb_connect(0x5, 0x3e, &(0x7f0000000040)={{0x12, 0x1, 0x141, 0xc8, 0x55, 0x3d, 0x20, 0x499, 0x500c, 0x3349, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2c, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0xa9, 0x2, 0x1, 0x46, 0x66, 0x27, 0x0, [@uac_as={[@format_type_ii_discrete={0x9, 0x24, 0x2, 0x2, 0x6, 0x4}, @format_type_i_discrete={0x8, 0x24, 0x2, 0x1, 0x7, 0x1, 0x6, 0xf}]}], [{{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) 8.013838526s ago: executing program 8 (id=2204): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) seccomp$SECCOMP_GET_ACTION_AVAIL(0x2, 0x0, 0x0) r0 = syz_io_uring_setup(0x110, &(0x7f0000000140)={0x0, 0xb783, 0x20000, 0x0, 0x1b6}, &(0x7f0000000240)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, 0x0, 0x0, 0x4) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) syz_io_uring_submit(r1, r2, &(0x7f00000001c0)=@IORING_OP_FADVISE={0x18, 0x2b, 0x0, @fd=r3, 0xd1f6, 0x0, 0x5, 0x1}) io_uring_enter(r0, 0x47f6, 0x0, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x16) r4 = userfaultfd(0x801) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x280}) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000100)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r5 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r6 = memfd_create(&(0x7f0000000140)='\vem\xda\x99[R@M\xfc\xfe\x9b#*\xff', 0x0) write(r6, &(0x7f0000000040)="0600", 0x2) write$FUSE_NOTIFY_STORE(r6, &(0x7f0000000180)=ANY=[], 0xe) sendfile(r6, r6, &(0x7f0000001000), 0xffff) mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x80000000004, 0x11, r6, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f000001a000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r7, 0x1, 0x1a, &(0x7f000002eff0)={0x135, &(0x7f0000000000)=[{}]}, 0x10) ioctl$UFFDIO_WRITEPROTECT(r4, 0xc018aa06, &(0x7f00000000c0)={{&(0x7f000040a000/0x800000)=nil, 0x800000}, 0x1}) socket(0x1e, 0x805, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) 7.785559147s ago: executing program 3 (id=2205): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r0 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x3, &(0x7f0000000000)=[{0x35, 0x0, 0x1}, {0x20}, {0x6, 0xfd, 0x0, 0x7ffffcb9}]}) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_DEL_DAEMON(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000500)=ANY=[@ANYBLOB="18000000", @ANYRES16=r0, @ANYBLOB="01002bbd7000fbdbdf250a000000040003802a6da61d334d15d8e505b80b277bfbc0996adc06f3a57ff0328018bc9193b8000000000000f9a8bc9dd45e1491dc4991c2022f85e7f5810d917bc22c938e51b9c36da39e10f5646a7cd4068cd566a010319283331202814e4277be53beb18ddc17fd09049621fbb2fa87864f7490c48a4331c8da7d902a4483246279"], 0x18}, 0x1, 0x0, 0x0, 0x4004041}, 0x40080) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x0, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(r2, 0x8, &(0x7f0000000000)=0x6) r5 = shmget$private(0x0, 0x8000, 0x10, &(0x7f0000ff5000/0x8000)=nil) r6 = shmat(r5, &(0x7f0000ffc000/0x2000)=nil, 0x4000) r7 = add_key$user(&(0x7f0000000040), &(0x7f0000000180)={'syz', 0x0}, &(0x7f0000000080)='\x00', 0x1, 0xfffffffffffffffb) pipe2$watch_queue(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$IOC_WATCH_QUEUE_SET_SIZE(r9, 0x5760, 0x1f) keyctl$KEYCTL_WATCH_KEY(0x20, r7, r8, 0x100000000000f7) read$watch_queue(r8, &(0x7f00000000c0)=""/16, 0xffffffb9) keyctl$revoke(0x3, r7) shmat(r5, &(0x7f0000ff9000/0x1000)=nil, 0x5000) mremap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000fff000/0x1000)=nil) shmdt(r6) pipe2$9p(0x0, 0x40880) r10 = shmget$private(0x0, 0x1000, 0x40, &(0x7f0000884000/0x1000)=nil) statfs(&(0x7f0000000280)='./file0\x00', &(0x7f0000000400)=""/230) shmctl$IPC_INFO(r10, 0x3, &(0x7f0000000300)=""/251) 6.582800666s ago: executing program 8 (id=2206): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000500)=ANY=[@ANYBLOB="12010000f1d566201e043c40d7cc000000010902120001000000000904"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 6.506317677s ago: executing program 1 (id=2207): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) r0 = syz_open_dev$vim2m(0x0, 0x3, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, 0x0) userfaultfd(0x1) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000a80)=@raw={'raw\x00', 0x8, 0x3, 0x2b8, 0x0, 0x11, 0x148, 0x148, 0x0, 0x248, 0x2a8, 0x2a8, 0x248, 0x2a8, 0x3, 0x0, {[{{@uncond, 0x0, 0xd8, 0x120, 0x0, {}, [@common=@unspec=@rateest={{0x68}, {'gre0\x00', 'veth0_vlan\x00', 0x0, 0x0, 0xf9e, 0x5, 0x8, 0x9, {0xb}, {0x8}}}]}, @unspec=@CT0={0x48}}, {{@ip={@multicast2, @empty, 0x0, 0x0, 'vlan0\x00', 'netdevsim0\x00', {0xff}}, 0x0, 0xd0, 0x100, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@unspec=@quota={{0x38}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x318) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) r2 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r2, &(0x7f0000002700)=""/102392, 0x18ff8) r3 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r3, 0xc0189375, &(0x7f0000000040)={{0x1, 0x1, 0x18, r3}, './file0\x00'}) getpid() ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x405c5503, &(0x7f0000000480)={{0x0, 0xefae, 0x0, 0x3}, 'syz1\x00', 0x4d}) close(0x3) setreuid(0xee01, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) 5.962284499s ago: executing program 3 (id=2208): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, &(0x7f00000005c0)='syzkaller\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r0 = syz_io_uring_setup(0x121d, &(0x7f00000002c0)={0x0, 0x407d10, 0x80, 0x3, 0x1bd}, &(0x7f0000000040)=0x0, &(0x7f0000000580)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) r3 = socket(0x2a, 0x2, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000060000003800000004000000020000000000001104000000ffffffff000000000000000200000000020000000000000802000000020000000000000e030000000000000000006100"], 0x0, 0x54, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x6, 0xe, &(0x7f00000001c0)) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x2, &(0x7f0000000200)=0x0) io_submit(r5, 0x1, &(0x7f0000000040)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, r4, 0x0, 0x0, 0x80000000}]) io_getevents(r5, 0x2, 0x2, &(0x7f0000001340)=[{}, {}], 0x0) io_submit(r5, 0x1, &(0x7f0000000140)=[&(0x7f0000000000)={0x1802, 0x0, 0x0, 0x5, 0x0, r4, 0x0}]) getsockname$packet(r3, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) r6 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r6, &(0x7f0000001d80)=[{{&(0x7f0000000280)={0x2, 0x4e22, @private=0xa010101}, 0x10, &(0x7f0000000980)=[{&(0x7f0000000200)="9c", 0x1}], 0x1}}], 0x1, 0x48000) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xc, &(0x7f0000000040)=@assoc_value={0x0}, &(0x7f0000000000)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r6, 0x84, 0x22, &(0x7f0000000240)={0xffff, 0x1, 0x1, 0x1, r7}, 0x10) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, &(0x7f0000000340)={0x0, 0x55, "5a7e47bb3598dfdf777d0d0a3f64058dd864c37f585c9b710937c847d77526e0f4af84ffcda46f008b72304f157b8efcc243416bf4385154514ed710616f7ca726162889b7710cdc75585929018503af7c0aaefc01"}, &(0x7f0000000100)=0x5d) getsockopt$inet_sctp6_SCTP_STATUS(r3, 0x84, 0xe, &(0x7f00000003c0)={r7, 0xfaa, 0xc0000000, 0x9, 0x3, 0x3, 0x9, 0x5, {r8, @in={{0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x14}}}, 0x800, 0x2, 0x615, 0x5, 0xb}}, &(0x7f0000000480)=0xb0) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=ANY=[@ANYBLOB="380000001800010000df25020020000001fe0900000000060015000400000014001680100008800c00038005a3695d3300010003000000"], 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x14) r10 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r10, &(0x7f0000002600)=[{{&(0x7f0000000000)={0x2, 0x0, @remote}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000000180)="e1", 0x1}], 0x1}}], 0x1, 0x50) r11 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r11, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r10, 0x84, 0xa, &(0x7f0000000240)={0x5, 0x800, 0x206, 0x2, 0x6, 0x14000000, 0xb, 0x4f, r12}, 0x20) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_REMOVE={0x7, 0x50, 0x0, 0x0, 0x0, 0x23457}) io_uring_enter(r0, 0x47bc, 0x0, 0x0, 0x0, 0x0) 5.469662788s ago: executing program 3 (id=2210): r0 = openat$yama_ptrace_scope(0xffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$F2FS_IOC_RESIZE_FS(r0, 0x4008f510, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), 0x0, 0x0, 0xfffffffffffffffd) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$netlink(r4, 0x10e, 0x5, &(0x7f0000000040)=""/162, &(0x7f0000000100)=0xa2) gettid() r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r5, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_DEL_NAN_FUNCTION(r7, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f0000000300)={0x5c, r8, 0x200, 0x70bd25, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_COOKIE={0xc, 0x58, 0x24}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x18}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x49}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0xc}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x54}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x2f}]}, 0x5c}, 0x1, 0x0, 0x0, 0xc001}, 0x1) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r5, 0x3ba0, &(0x7f00000003c0)={0x48, 0xc, r6, 0x0, 0x0, 0x200000000}) ioctl$IOMMU_IOAS_MAP$PAGES(r5, 0x3b85, &(0x7f0000000000)={0x28, 0x6, r6, 0x0, &(0x7f0000ffb000/0x4000)=nil, 0x4000}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000080)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x10, 0x10, 0x2, [@var={0x4, 0x0, 0x0, 0xe, 0x3}]}}, 0x0, 0x2a, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x28) timer_create(0x5, 0x0, 0x0) timer_settime(0x0, 0x0, 0x0, 0x0) 4.528825019s ago: executing program 3 (id=2211): r0 = socket(0x10, 0x3, 0x0) r1 = syz_init_net_socket$ax25(0x3, 0x2, 0x7) getsockopt$ax25_int(r1, 0x101, 0x3, &(0x7f0000000100), &(0x7f0000000740)=0x4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)) socket$nl_xfrm(0x10, 0x3, 0x6) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r2, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000000c0)={'syz_tun\x00', 0x0}) sendfile(0xffffffffffffffff, r2, &(0x7f00000001c0)=0x1, 0x6) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="0a00000008000000020000000400000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000000001000"/28], 0x50) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000003c0)={0xffffffffffffffff, 0xe0, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x8, 0xa, &(0x7f00000001c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000280)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xe5, &(0x7f00000002c0)=[{}, {}, {}, {}], 0x20, 0x10, &(0x7f0000000300), &(0x7f0000000340), 0x8, 0xdd, 0x8, 0x8, &(0x7f0000000580)}}, 0x10) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000540)=r6, 0x4) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x14, &(0x7f0000000200)=ANY=[@ANYBLOB="1802000000000000000000000000000018010000786c6c3a00000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000080000850000002d00000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r7, 0x0, 0x48, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x50) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'veth0_to_batadv\x00'}) sendto$packet(r2, &(0x7f0000000180)="0b03f6ffe0ff64000200475400f6a13bb1000000080086dd4803", 0x100a6, 0x0, &(0x7f0000000140)={0x11, 0x8100, r4}, 0x14) landlock_create_ruleset(&(0x7f0000000400)={0xef51, 0x2}, 0x18, 0x0) r8 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00I}', @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000000)={{r8, 0xffffffffffffffff}, &(0x7f0000000200), &(0x7f00000003c0)='%-010d \x00'}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={r9, 0xffffffffffffffff}, 0x4) r11 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x16, 0x10, &(0x7f0000000100)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000ffff0b867b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r10, @ANYBLOB="0000000000000000b70500000800000085000000a500000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000340)={@cgroup, 0xffffffffffffffff, 0x26, 0x6, 0xffffffffffffffff, @void, @value}, 0x20) sendto$isdn(r0, &(0x7f00000008c0)=ANY=[@ANYBLOB="0800000080a54565063d2eb8ea91a988a66f6ea007675894f0202058030e33057fefea466497fd4419606a4d4b4d4cc100261dc42041884a789a9a0e1a3f83cea15a339fd9b1b09d84bef7aaaf317fc5e6a7edc811be82794c83c81503ed7038f7f524512262afdfbca24bb4bf8eae90f714b09bd030951d8d26e5d4aaa259fa6bf69d7fadc7e8cfe3862a0904b1f316ef24975f91477f7b081cd135d4085a11a21debe17fc1d7d5885b653d77595185251532dc4d50cce502e11b22b956e532095609569eeab5016afe9abff3665d66503c983a8d2d97fbc8c5ad026e1be8206b6e93141b075b53fe39cd6331cecfd813b79f33e6e9082d2731d8ebedf7f81e1ec7da447886cd1f2fab53a09343117c833e0349d61ea536ca8ec6e014fa9758bf5c731f1cdf9e7b7b0a08007a32d8f10d509ecb4f02cc97b1284db86d66663ef66fd0064124270ee1e480cd5b974badf679784c59425555d857b0d1f42a8b19615c2b63fce71b22cf3f17ddb6b3bf5aadbe00f7649553153e05c814891d90732105400db7734d6c3fda71f76f0e6816840edf5ebd15bb7d34a5215279d54a1324"], 0x86, 0x801, &(0x7f0000000280)={0x22, 0x6, 0x4, 0x7, 0x1}, 0x6) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r11, 0x0, 0xe, 0x48000000, &(0x7f0000000300)="40f0538ef047b21fb60068305500", 0x0, 0xf00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) newfstatat(0xffffffffffffff9c, &(0x7f0000002480)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x100) setreuid(0x0, r12) r13 = socket$nl_audit(0x10, 0x3, 0x9) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r13, 0x10e, 0x1, 0x0, 0x0) bind$netlink(r13, &(0x7f0000001500)={0x10, 0x0, 0x25dfdbfe}, 0xc) 4.168982904s ago: executing program 3 (id=2212): sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0xffffffffffffffb4, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x809d) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="000002f0d31209000000bc2e79e995"], 0x0) write$binfmt_script(r2, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x3e, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000180)="66b9800000c00f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f320f300f20e06635800000000f22e02b6aa6c8", 0x4a}], 0x1, 0x0, 0x0, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20004000}, 0x14) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f00000004c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$TCSETSF2(0xffffffffffffffff, 0x402c542d, &(0x7f0000000000)={0x1, 0xfffffffd, 0x8bd0, 0xffff, 0x0, "4a073b267df2e98c69ba36c5095c911abad88f", 0x4, 0x7}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0x0, 0x400}, 0x18) ioctl$KVM_RUN(r3, 0xae80, 0x0) 3.779299941s ago: executing program 7 (id=2214): r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB, @ANYRES32=r1, @ANYBLOB='\x00\x00w\x00\b\x00\b'], 0x24}, 0x1, 0x0, 0x0, 0x4}, 0x0) 3.644918916s ago: executing program 7 (id=2215): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000b40)={0x11, 0x8, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) write(0xffffffffffffffff, &(0x7f00000000c0)="240000001e005f0214fffffffffffff881ff00001d00000000000000080009000d0000", 0x23) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x102}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x11, 0xf, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000"], &(0x7f0000001dc0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TCSETS(r4, 0x40045431, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, "810000cc2b000000000000fa25ffff00ffffff"}) r5 = syz_open_pts(r4, 0x141601) fcntl$setstatus(r5, 0x4, 0x42000) 3.469667639s ago: executing program 3 (id=2216): modify_ldt$write2(0x11, 0x0, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000440)=ANY=[@ANYRES32=r1, @ANYRES32=r1, @ANYBLOB='7'], 0x20) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2) r5 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000500)={0x0, 0xfffffffffffffd83, 0xfa00, {0x0, 0x0}}, 0xfdbc) ioctl$SNDCTL_DSP_GETODELAY(r5, 0x80045017, &(0x7f0000000000)) mmap$dsp(&(0x7f0000063000/0xe000)=nil, 0xe000, 0x1000009, 0x732f05018d148c36, r5, 0x0) ioctl$vim2m_VIDIOC_ENUM_FMT(r4, 0xc0405602, &(0x7f0000000180)={0x22, 0x1, 0x0, "27425ba25f17386bcec1d8665c0084fe038be6b8a800f35a46e9a7796caf19e3", 0x494e4f4b}) r6 = gettid() r7 = syz_open_procfs(r6, 0x0) pread64(r7, 0x0, 0x0, 0x2000000000) execve(0x0, 0x0, 0x0) mount(0x0, 0x0, 0x0, 0x23010, 0x0) r8 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x127081) close(r8) 3.419780364s ago: executing program 8 (id=2217): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x141042, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000009c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) fanotify_init(0x8, 0x80000) pwritev2(r0, 0x0, 0x0, 0xe7b, 0x0, 0x0) fsmount(r0, 0x0, 0x88) 2.662140821s ago: executing program 7 (id=2218): r0 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}, 0x20000}}, {{0xa, 0x0, 0x40000, @dev={0xfe, 0x80, '\x00', 0x26}}}}, 0x108) r1 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r1, 0x29, 0x2a, &(0x7f0000000080)={0x20, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}, 0x9}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) setsockopt$inet6_group_source_req(r1, 0x29, 0x2e, &(0x7f0000000200)={0xffffffa4, {{0xa, 0x0, 0x5, @mcast1={0xff, 0x7}, 0x9a6}}, {{0xa, 0x0, 0x0, @mcast1}}}, 0x108) 2.008873831s ago: executing program 7 (id=2219): sendmmsg$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r2, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r3, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x1, 0x803, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001ac0)=@newlink={0x3c, 0x10, 0x609, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x88a8ffa7, 0x10008}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r6}]}, 0x3c}}, 0x0) r7 = socket(0x10, 0x803, 0x8) pread64(r5, 0x0, 0x0, 0x3) sendmsg$IPVS_CMD_SET_INFO(r7, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r9 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r10, 0xc00caee0, &(0x7f0000000140)={0x4, 0xffffffffffffffff}) ioctl$KVM_HAS_DEVICE_ATTR(r11, 0x4018aee3, &(0x7f0000000180)=@attr_other={0x0, 0x9, 0x800, 0x0}) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x60, &(0x7f0000000300)={&(0x7f0000000900)=ANY=[@ANYBLOB="5c00000010001ffffcffffff0000000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000340012800b0001006772657461700000240002800800070064010100060003001008000008001500700f0d0008000700ac1414bb08000a00", @ANYRES32=r8], 0x5c}}, 0x40) 1.965900927s ago: executing program 8 (id=2220): prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x8b}, 0x0) getrlimit(0xe, &(0x7f00000000c0)) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x6) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) getpid() mremap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) r3 = socket(0x40000000015, 0x5, 0x0) connect$inet(r3, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) bind$inet(r3, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) sendmsg$NL80211_CMD_JOIN_MESH(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[], 0x1a000}}, 0x0) close(0xffffffffffffffff) 1.931945003s ago: executing program 1 (id=2221): r0 = socket(0x80000000000000a, 0x2, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x328000, 0x1000}, 0x1c) setsockopt$XDP_UMEM_COMPLETION_RING(r1, 0x11b, 0x6, &(0x7f0000000080)=0x1, 0x4) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$XDP_RX_RING(r1, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f0000000580)={'batadv_slave_1\x00', 0x0}) setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, &(0x7f0000000300)=0x1, 0x4) bind$xdp(r1, &(0x7f0000000100)={0x2c, 0x0, r3}, 0x10) getsockopt$XDP_STATISTICS(r1, 0x11b, 0x7, &(0x7f0000000180), &(0x7f00000001c0)=0x30) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}, 0x20000}}, {{0xa, 0x0, 0x40000, @dev={0xfe, 0x80, '\x00', 0x26}}}}, 0x108) r4 = socket(0x80000000000000a, 0x2, 0x0) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) ioctl$TIOCSSOFTCAR(r5, 0x5453, 0x0) ioctl$TIOCMGET(r5, 0x5415, 0x0) setsockopt$inet6_group_source_req(r4, 0x29, 0x2a, &(0x7f0000000080)={0x20, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}, 0x9}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) setsockopt$inet6_group_source_req(r4, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x5, @mcast1={0xff, 0x7}, 0x9a6}}, {{0xa, 0x0, 0x0, @mcast1}}}, 0x108) 1.008766268s ago: executing program 7 (id=2222): bpf$BPF_RAW_TRACEPOINT_OPEN_UNNAMED(0x11, &(0x7f0000000000), 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x18, 0x4, &(0x7f0000000040)=ANY=[], &(0x7f0000001640)='GPL\x00', 0x1, 0x0, 0x0, 0x40f00, 0x23, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000180)='/sys/power/freeze_filesystems', 0x149882, 0x8) write$sysctl(r0, &(0x7f0000000040)='1\x00', 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f00000003c0), 0xa8202, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) r2 = syz_open_dev$vim2m(&(0x7f0000000040), 0x2, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r2, 0xc0405602, &(0x7f00000000c0)={0x3, 0x1, 0x1, "3f0000eef2000220080000ddee00000000800000000000cc0057e31e9400", 0x76640f09}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) socket(0x2a, 0x2, 0x0) socket(0x1e, 0x1, 0x0) openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r6 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000080), 0x88000, 0x0) writev(r6, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0x4, 0x8, 0x2, 0xb}, 0x0, &(0x7f0000000280)={0x3ff, 0x0, 0x0, 0x400d, 0x0, 0x9, 0x466}, 0x0, 0x0) close_range(r5, 0xffffffffffffffff, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x24000000) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 1.005603139s ago: executing program 8 (id=2223): pipe2(&(0x7f0000000000)={0x0, 0x0}, 0x0) r1 = syz_init_net_socket$ax25(0x3, 0x5, 0x9) bind$ax25(r1, &(0x7f0000000000)={{0x3, @default, 0x2}, [@null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}, 0x48) tee(0xffffffffffffffff, r0, 0xff, 0x0) request_key(&(0x7f00000013c0)='big_key\x00', &(0x7f0000001400)={'syz', 0x1}, &(0x7f0000001440)='/\x00', 0xfffffffffffffffe) add_key(&(0x7f00000018c0)='big_key\x00', &(0x7f0000001900)={'syz', 0x1}, &(0x7f0000001940)='\f', 0x1, 0xfffffffffffffffe) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x10) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='cpuacct.usage_sys\x00', 0x275a, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000340), 0x0, &(0x7f0000000080)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000900)={0x0, 0x2, 0x1, [0xffff, 0x13a0000000000, 0x1, 0x88, 0x5], [0xffffffffffffff63, 0x8, 0xffffffffffffff4a, 0x80000001, 0x10000, 0x2, 0x2d9, 0x4, 0x40000003, 0xc5, 0x8001, 0x9, 0x4, 0x7e, 0x7d, 0x3ae7, 0x8, 0x101, 0x80, 0xffffffffffff8000, 0x3, 0x9, 0x7f, 0x6, 0x1, 0xc, 0x5, 0xff800000000000, 0x401, 0x7fffffff, 0xc333, 0x9, 0x6, 0x8001, 0x1, 0xd5d, 0x8, 0x1, 0x7, 0x5, 0x6cf2, 0x2, 0x9, 0xa, 0x0, 0xffffffff00000001, 0x7fffffffffffffff, 0x2, 0x5, 0x4cc2, 0xfffffffffffffff7, 0x6, 0x0, 0x3a67, 0x7f, 0x0, 0xfff, 0xffffffffffffffff, 0x8, 0x3, 0x706, 0x4002, 0x5b4, 0x8, 0xfffffffffffffffb, 0xb, 0xb88a, 0x6, 0x3, 0x6, 0x2, 0x77, 0x8, 0x346, 0x0, 0xfffffffffffffff9, 0x8, 0xffff800000000000, 0x7, 0x800, 0x7, 0xffffffffffffff92, 0x7, 0x5, 0xe39, 0x3, 0x9, 0x5, 0x8, 0x6, 0x40000000000000, 0x6, 0x684, 0x2, 0x401, 0x5, 0x6fc, 0xc90, 0xfff, 0xfffffffffffffeff, 0x72, 0x3, 0x6, 0x28, 0x3, 0x1, 0x8d45, 0x100000000, 0x3ff, 0xf2, 0x800, 0x8, 0x8, 0x8001, 0x5, 0x9, 0xa, 0x1ff, 0x2, 0x6b, 0x334]}) chdir(&(0x7f0000000140)='./bus\x00') r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000280), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x28011, r2, 0x0) r3 = socket(0x1, 0x2, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setresuid(0x0, r4, 0x0) sendmsg$key(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x40408c1) ioctl$FS_IOC_SETFLAGS(r2, 0xc0189436, &(0x7f0000000140)) 955.63073ms ago: executing program 1 (id=2224): r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB="240000001d00070f0002", @ANYRES32=r1, @ANYBLOB='\x00\x00w\x00\b\x00\b'], 0x24}, 0x1, 0x0, 0x0, 0x4}, 0x0) 747.532275ms ago: executing program 1 (id=2225): r0 = syz_open_dev$sndctrl(&(0x7f0000000080), 0x8000000000000000, 0x4000) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000140)={0x7, 0x4, 0x101, 0x2, 'syz0\x00', 0x5}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x101040, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x7) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000600)=[@text64={0x40, &(0x7f0000000480)="2ef2dd050080000048b844410000000000000f23d00f21f8350000000126f2ad36362e6726af440f20c0350e000000b9800000c00f3235000800000f30b805000000b9009800000f01d90f01c965470f01c4410f79d226450f01cb660f013b", 0x5f}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_INITMSG(r5, 0x84, 0x2, &(0x7f00000000c0)={0xfffc}, 0x8) sendto$inet6(r5, &(0x7f00000004c0)='W', 0x1, 0x0, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback, 0x8}, 0x1c) setsockopt$inet6_mreq(r5, 0x29, 0x1c, 0x0, 0x0) r6 = socket(0x2, 0x5, 0x0) sendmmsg$inet_sctp(r6, &(0x7f00000032c0)=[{&(0x7f0000002e40)=@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f00000004c0)=[{&(0x7f0000000100)="03", 0x1}], 0x1}], 0x1, 0x0) sendmmsg$inet_sctp(r6, &(0x7f0000000bc0)=[{&(0x7f00000000c0)=@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="300000000000000084000000010000000000ffff070200"/44, @ANYRES32=0x0, @ANYBLOB="180000000000000084"], 0x48}], 0x1, 0x0) clock_gettime(0x0, &(0x7f00000000c0)={0x0, 0x0}) setsockopt$sock_timeval(r1, 0x1, 0x14, &(0x7f0000000000)={r7, r8/1000+10000}, 0x10) recvmmsg(r1, &(0x7f0000007900)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r9 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000140)={0x0, 0xfeffffff, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="3c0000001800ef0100000000000000000a00000000000000000000000c00090008000000", @ANYRES32=0x0, @ANYBLOB="140005000000001e000000008000000000000002e6ef"], 0x3c}, 0x1, 0x11}, 0x0) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r5, 0x84, 0x1, &(0x7f00000001c0)={0x0, 0x10, 0x5, 0x3, 0x8, 0xa000}, &(0x7f0000000200)=0x14) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r6, 0x84, 0x76, &(0x7f0000000240)={r10, 0x6}, 0x8) 6.961541ms ago: executing program 7 (id=2226): sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0xffffffffffffffb4, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x809d) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="000002f0d31209000000bc2e79e995"], 0x0) write$binfmt_script(r2, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x3e, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000180)="66b9800000c00f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f320f300f20e06635800000000f22e02b6aa6c8", 0x4a}], 0x1, 0x0, 0x0, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20004000}, 0x14) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f00000004c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$TCSETSF2(0xffffffffffffffff, 0x402c542d, &(0x7f0000000000)={0x1, 0xfffffffd, 0x8bd0, 0xffff, 0x0, "4a073b267df2e98c69ba36c5095c911abad88f", 0x4, 0x7}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0x0, 0x400}, 0x18) ioctl$KVM_RUN(r3, 0xae80, 0x0) 0s ago: executing program 8 (id=2227): socketpair$unix(0x1, 0x2, 0x0, 0x0) r0 = socket(0x10, 0x3, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(0xffffffffffffffff, 0x541c, &(0x7f00000005c0)) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r1, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f0000000080)=[@in6={0xa, 0x4e23, 0x4, @private0={0xfc, 0x0, '\x00', 0x1}, 0x4}]}, &(0x7f0000000440)=0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff}) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_NEW_STATION(r6, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000000500)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="f1e600000000000000001300000008000300", @ANYRES32=r5, @ANYBLOB="04001300060012004a02000006001000fd0000000600be0010c100000a000600021100000200000600bd00cb000000005705e7a1c82ec3263f4b10d49dc09fd9f688edf2d0c164956b8ba4473e2a0dbce22fc7dc27f64482e2ed9367697cbe0609402713dfdc8306620f"], 0x4c}, 0x1, 0x0, 0x0, 0xc0}, 0x44) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f00000000c0)={r2, 0x9}, &(0x7f0000000200)=0x8) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x18, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x1, 0x0, 0x0, 0x40f00, 0x23, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r7}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x6}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r8 = getpid() sched_setscheduler(r8, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r9, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r10, &(0x7f0000000000), 0x651, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$NL80211_CMD_JOIN_MESH(0xffffffffffffffff, 0x0, 0x4000) sendmsg$NL80211_CMD_SET_BSS(r0, 0x0, 0x800) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000080)={'syz0\x00', {}, 0x10, [0x3, 0x1, 0x3f7, 0x8, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0xffffffff, 0x0, 0x9, 0x0, 0x8, 0x0, 0x0, 0x0, 0x9, 0x0, 0x10000000, 0x2, 0x0, 0x0, 0x0, 0x0, 0x4, 0xfffffffc, 0x0, 0x0, 0x4, 0x0, 0x0, 0x787, 0x10000000, 0x5, 0x0, 0x0, 0xf3b0, 0x4, 0x0, 0x7, 0x1, 0x1, 0xfffffffe, 0x5, 0x0, 0x0, 0x0, 0x4, 0x4, 0x0, 0x4, 0x0, 0x8, 0x0, 0x3, 0x0, 0x6, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x6d, 0xffffffff, 0xedc0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0xa0000000, 0x3, 0x1, 0x0, 0x0, 0x0, 0x0, 0x74e, 0x6, 0x0, 0x0, 0x0, 0x0, 0xa, 0x2, 0x1, 0x2000079, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x8, 0xc0000000, 0x0, 0x0, 0x0, 0xfffffffd, 0x8, 0x0, 0xfffffff8, 0x8, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x7d7, 0x4, 0x0, 0x0, 0x0, 0x0, 0xffffffe6], [0xffffffff, 0x83, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x5, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x4000, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x401, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbc, 0xfffffffc, 0x44, 0x4000400, 0xfffffffc, 0x3, 0xfffffffd], [0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x4, 0x0, 0x0, 0x0, 0x3, 0x2, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000004, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000010, 0x5, 0x0, 0x0, 0x0, 0x0, 0x4, 0xd, 0x0, 0x0, 0x0, 0x0, 0x46, 0x8, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x3, 0x2, 0x0, 0x0, 0xfffffe01, 0x80000000]}, 0x45c) socket$inet(0x2, 0x2, 0x1) kernel console output (not intermixed with test programs): 1610][T11493] [ 556.091626][T11493] Mem-Info: [ 556.377918][T11493] active_anon:38 inactive_anon:3987 isolated_anon:0 [ 556.377918][T11493] active_file:11633 inactive_file:3836 isolated_file:0 [ 556.377918][T11493] unevictable:768 dirty:42 writeback:0 [ 556.377918][T11493] slab_reclaimable:11288 slab_unreclaimable:102495 [ 556.377918][T11493] mapped:34536 shmem:1362 pagetables:1033 [ 556.377918][T11493] sec_pagetables:0 bounce:0 [ 556.377918][T11493] kernel_misc_reclaimable:0 [ 556.377918][T11493] free:1330916 free_pcp:23197 free_cma:0 [ 556.423487][T11493] Node 0 active_anon:152kB inactive_anon:15948kB active_file:46528kB inactive_file:15212kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:138140kB dirty:168kB writeback:0kB shmem:3912kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:12052kB pagetables:4008kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 556.457136][T11493] Node 1 active_anon:0kB inactive_anon:0kB active_file:4kB inactive_file:132kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:4kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:48kB pagetables:124kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 556.488543][T11493] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 556.517349][T11493] lowmem_reserve[]: 0 2501 2503 2503 2503 [ 556.523482][T11493] Node 0 DMA32 free:1428984kB boost:0kB min:34264kB low:42828kB high:51392kB reserved_highatomic:0KB free_highatomic:0KB active_anon:144kB inactive_anon:15844kB active_file:45008kB inactive_file:15012kB unevictable:1536kB writepending:168kB present:3129332kB managed:2561488kB mlocked:0kB bounce:0kB free_pcp:51556kB local_pcp:28568kB free_cma:0kB [ 556.555938][T11493] lowmem_reserve[]: 0 0 1 1 1 [ 556.560630][T11493] Node 0 Normal free:24kB boost:0kB min:24kB low:28kB high:32kB reserved_highatomic:0KB free_highatomic:0KB active_anon:8kB inactive_anon:104kB active_file:1520kB inactive_file:200kB unevictable:0kB writepending:0kB present:1048580kB managed:1904kB mlocked:0kB bounce:0kB free_pcp:48kB local_pcp:36kB free_cma:0kB [ 556.590038][T11493] lowmem_reserve[]: 0 0 0 0 0 [ 556.594751][T11493] Node 1 Normal free:3879296kB boost:0kB min:55612kB low:69512kB high:83412kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:4kB inactive_file:132kB unevictable:1536kB writepending:0kB present:4194300kB managed:4111164kB mlocked:0kB bounce:0kB free_pcp:41184kB local_pcp:17568kB free_cma:0kB [ 556.626296][T11493] lowmem_reserve[]: 0 0 0 0 0 [ 556.630989][T11493] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 556.643609][T11493] Node 0 DMA32: 668*4kB (UME) 599*8kB (UME) 407*16kB (UM) 326*32kB (UME) 328*64kB (UM) 80*128kB (UM) 128*256kB (UME) 78*512kB (UM) 44*1024kB (UME) 11*2048kB (UM) 301*4096kB (UM) = 1428824kB [ 556.662427][T11493] Node 0 Normal: 0*4kB 3*8kB (M) 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 24kB [ 556.674338][T11493] Node 1 Normal: 176*4kB (UME) 68*8kB (UME) 32*16kB (UME) 115*32kB (UME) 35*64kB (UME) 7*128kB (UME) 4*256kB (UME) 2*512kB (UM) 2*1024kB (UE) 2*2048kB (UE) 943*4096kB (M) = 3879296kB [ 556.698192][T11493] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 556.707799][T11493] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 556.717086][T11493] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 556.726643][T11493] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 556.738323][T11493] 16828 total pagecache pages [ 556.743016][T11493] 0 pages in swap cache [ 556.747281][T11493] Free swap = 124996kB [ 556.751420][T11493] Total swap = 124996kB [ 556.755592][T11493] 2097051 pages RAM [ 556.759376][T11493] 0 pages HighMem/MovableOnly [ 556.764055][T11493] 424572 pages reserved [ 556.768189][T11493] 0 pages cma reserved [ 556.910953][T11497] netlink: 36 bytes leftover after parsing attributes in process `syz.9.1592'. [ 557.563019][T10843] usb 9-1: new full-speed USB device number 3 using dummy_hcd [ 557.642895][ T30] kauditd_printk_skb: 64 callbacks suppressed [ 557.642915][ T30] audit: type=1800 audit(2000000073.986:206): pid=11499 uid=0 auid=4294967295 ses=4294967295 subj=_ op=set_data cause=unavailable-hash-algorithm comm="syz.3.1590" name="/" dev="sockfs" ino=40833 res=0 errno=0 [ 557.869425][T10843] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 558.466128][T10843] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 558.568610][T10843] usb 9-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 558.582462][T10843] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 558.631984][T10843] usb 9-1: config 0 descriptor?? [ 558.656076][T10843] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 558.701300][T10843] dvb-usb: bulk message failed: -22 (3/0) [ 558.740768][T10843] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 558.775034][T10843] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 558.782890][T10843] usb 9-1: media controller created [ 558.811184][T10843] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 558.845297][T10843] dvb-usb: bulk message failed: -22 (6/0) [ 558.865368][T11502] netlink: 248 bytes leftover after parsing attributes in process `syz.8.1594'. [ 558.866354][T10843] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 558.888699][T10843] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.8/usb9/9-1/input/input27 [ 558.972638][T10843] dvb-usb: schedule remote query interval to 150 msecs. [ 559.011654][T10843] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 559.078082][T10843] usb 9-1: USB disconnect, device number 3 [ 559.202231][T10843] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 559.234184][ T2151] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 559.407962][ T2151] usb 7-1: config index 0 descriptor too short (expected 38, got 36) [ 559.492188][ T2151] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 559.524481][ T2151] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 559.539463][ T2151] usb 7-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 559.563800][ T2151] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 559.590251][ T2151] usb 7-1: config 0 descriptor?? [ 560.238859][T11542] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1605'. [ 560.313381][ T5840] usb 8-1: new full-speed USB device number 7 using dummy_hcd [ 560.496269][ T5840] usb 8-1: New USB device found, idVendor=09c0, idProduct=0203, bcdDevice=d3.43 [ 560.587286][ T2151] usb 7-1: string descriptor 0 read error: -71 [ 560.655407][ T2151] uclogic 0003:256C:006D.0008: failed retrieving string descriptor #200: -71 [ 560.661447][ T5840] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 560.664602][ T2151] uclogic 0003:256C:006D.0008: failed retrieving pen parameters: -71 [ 560.693573][ T2151] uclogic 0003:256C:006D.0008: failed probing pen v2 parameters: -71 [ 560.770827][ T5840] usb 8-1: config 0 descriptor?? [ 560.774766][ T2151] uclogic 0003:256C:006D.0008: failed probing parameters: -71 [ 560.781013][ T5840] dvb-usb: found a 'Genpix SkyWalker-1 DVB-S receiver' in warm state. [ 560.924597][ T2151] uclogic 0003:256C:006D.0008: probe with driver uclogic failed with error -71 [ 560.968399][ T2151] usb 7-1: USB disconnect, device number 6 [ 561.879088][ T5840] gp8psk: usb in 128 operation failed. [ 562.247936][ T5840] gp8psk: FW Version = 107.255.166 (0x6bffa6) Build 2064/41/152 [ 562.961065][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 562.967584][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.153291][T11568] (unnamed net_device) (uninitialized): option tlb_dynamic_lb: invalid value (20) [ 563.290479][T11557] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 563.340843][T11557] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 563.770239][T11587] FAULT_INJECTION: forcing a failure. [ 563.770239][T11587] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 563.784102][T11587] CPU: 1 UID: 0 PID: 11587 Comm: syz.6.1615 Not tainted 6.16.0-rc3-syzkaller #0 PREEMPT(full) [ 563.784137][T11587] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 563.784148][T11587] Call Trace: [ 563.784155][T11587] [ 563.784163][T11587] dump_stack_lvl+0x189/0x250 [ 563.784191][T11587] ? __pfx____ratelimit+0x10/0x10 [ 563.784214][T11587] ? __pfx_dump_stack_lvl+0x10/0x10 [ 563.784237][T11587] ? __pfx__printk+0x10/0x10 [ 563.784257][T11587] ? fs_reclaim_acquire+0x7d/0x100 [ 563.784289][T11587] should_fail_ex+0x414/0x560 [ 563.784315][T11587] prepare_alloc_pages+0x213/0x610 [ 563.784346][T11587] __alloc_frozen_pages_noprof+0x123/0x370 [ 563.784372][T11587] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 563.784414][T11587] alloc_pages_mpol+0x232/0x4a0 [ 563.784441][T11587] alloc_pages_noprof+0xa9/0x190 [ 563.784464][T11587] folio_alloc_noprof+0x1e/0x30 [ 563.784484][T11587] filemap_alloc_folio_noprof+0xdf/0x470 [ 563.784500][T11587] ? filemap_get_entry+0xad/0x2f0 [ 563.784516][T11587] ? filemap_get_entry+0xad/0x2f0 [ 563.784534][T11587] ? filemap_get_entry+0x28f/0x2f0 [ 563.784551][T11587] ? __pfx_filemap_alloc_folio_noprof+0x10/0x10 [ 563.784574][T11587] ? folio_add_lru+0x106/0x220 [ 563.784596][T11587] ? filemap_add_folio+0x1af/0x270 [ 563.784617][T11587] __filemap_get_folio+0x3f2/0xaf0 [ 563.784644][T11587] aio_setup_ring+0x3bc/0xd80 [ 563.784680][T11587] ? __pfx_aio_setup_ring+0x10/0x10 [ 563.784713][T11587] ioctx_alloc+0x32f/0x7a0 [ 563.784742][T11587] __se_sys_io_setup+0x7b/0x1a0 [ 563.784763][T11587] do_syscall_64+0xfa/0x3b0 [ 563.784787][T11587] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 563.784803][T11587] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 563.784818][T11587] ? clear_bhb_loop+0x60/0xb0 [ 563.784839][T11587] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 563.784855][T11587] RIP: 0033:0x7f2e3c38e929 [ 563.784871][T11587] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 563.784885][T11587] RSP: 002b:00007f2e3d1ab038 EFLAGS: 00000246 ORIG_RAX: 00000000000000ce [ 563.784903][T11587] RAX: ffffffffffffffda RBX: 00007f2e3c5b6160 RCX: 00007f2e3c38e929 [ 563.784915][T11587] RDX: 0000000000000000 RSI: 0000200000000680 RDI: 0000000000002004 [ 563.784926][T11587] RBP: 00007f2e3d1ab090 R08: 0000000000000000 R09: 0000000000000000 [ 563.784936][T11587] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 563.784946][T11587] R13: 0000000000000000 R14: 00007f2e3c5b6160 R15: 00007ffe26c7ae38 [ 563.784976][T11587] [ 564.339612][ T5840] gp8psk: usb in 149 operation failed. [ 564.345142][ T5840] gp8psk: failed to get FPGA version [ 564.432710][ T5840] gp8psk: usb in 138 operation failed. [ 564.492438][ T5840] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 564.543182][ T5840] dvb-usb: Genpix SkyWalker-1 DVB-S receiver error while loading driver (-19) [ 565.954894][ T2151] usb 8-1: USB disconnect, device number 7 [ 566.592529][T11217] Bluetooth: hci2: unexpected event for opcode 0x2023 [ 567.325873][ T2151] usb 9-1: new high-speed USB device number 4 using dummy_hcd [ 567.624710][T11632] tipc: Started in network mode [ 567.638068][T11632] tipc: Node identity 8af0fa87d9e4, cluster identity 4711 [ 567.655674][T11632] tipc: Enabled bearer , priority 10 [ 567.830033][ T2151] usb 9-1: unable to get BOS descriptor or descriptor too short [ 567.852423][T11632] tipc: Resetting bearer [ 567.860838][ T2151] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 567.875796][ T2151] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 567.886927][T11629] tipc: Resetting bearer [ 567.896938][ T2151] usb 9-1: config 0 interface 0 altsetting 0 bulk endpoint 0x88 has invalid maxpacket 0 [ 567.910356][ T2151] usb 9-1: New USB device found, idVendor=04e6, idProduct=5591, bcdDevice=b5.39 [ 567.928650][ T2151] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 567.936985][ T2151] usb 9-1: Product: syz [ 567.941584][ T2151] usb 9-1: Manufacturer: syz [ 567.946300][ T2151] usb 9-1: SerialNumber: syz [ 567.960080][ T2151] usb 9-1: config 0 descriptor?? [ 567.968105][ T2151] pn533_usb 9-1:0.0: NFC: Could not find bulk-in or bulk-out endpoint [ 567.998808][T11643] sctp: [Deprecated]: syz.6.1632 (pid 11643) Use of int in maxseg socket option. [ 567.998808][T11643] Use struct sctp_assoc_value instead [ 568.761913][T10244] tipc: Node number set to 1393883783 [ 569.190846][T10244] usb 4-1: new full-speed USB device number 40 using dummy_hcd [ 569.723550][ T5946] usb 9-1: USB disconnect, device number 4 [ 569.866636][T10244] usb 4-1: New USB device found, idVendor=09c0, idProduct=0203, bcdDevice=d3.43 [ 569.886347][T10244] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 569.897459][T10244] usb 4-1: config 0 descriptor?? [ 569.905695][T10244] dvb-usb: found a 'Genpix SkyWalker-1 DVB-S receiver' in warm state. [ 570.140455][ T5840] hid-generic 0000:0000:0000.0009: unknown main item tag 0x0 [ 570.160214][T10244] gp8psk: usb in 128 operation failed. [ 570.193162][ T5840] hid-generic 0000:0000:0000.0009: hidraw0: HID v0.00 Device [syz1] on syz0 [ 570.430610][T10244] gp8psk: FW Version = 107.255.166 (0x6bffa6) Build 2064/41/152 [ 570.594352][T11665] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 570.603463][T11665] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 571.161013][T11649] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 571.171115][T11649] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 571.229615][T10244] gp8psk: usb in 149 operation failed. [ 571.261788][T10244] gp8psk: failed to get FPGA version [ 571.283770][T10244] gp8psk: usb in 138 operation failed. [ 571.324898][T10244] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 571.361193][T10244] dvb-usb: Genpix SkyWalker-1 DVB-S receiver error while loading driver (-19) [ 571.393191][T10244] usb 4-1: USB disconnect, device number 40 [ 573.125984][T11676] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1640'. [ 573.138985][T11676] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1640'. [ 574.740749][T11678] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1641'. [ 575.000141][T11629] tipc: Disabling bearer [ 575.373013][T11686] FAULT_INJECTION: forcing a failure. [ 575.373013][T11686] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 575.386219][T11686] CPU: 0 UID: 0 PID: 11686 Comm: syz.3.1644 Not tainted 6.16.0-rc3-syzkaller #0 PREEMPT(full) [ 575.386235][T11686] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 575.386241][T11686] Call Trace: [ 575.386245][T11686] [ 575.386250][T11686] dump_stack_lvl+0x189/0x250 [ 575.386269][T11686] ? __pfx____ratelimit+0x10/0x10 [ 575.386284][T11686] ? __pfx_dump_stack_lvl+0x10/0x10 [ 575.386298][T11686] ? __pfx__printk+0x10/0x10 [ 575.386308][T11686] ? __might_fault+0xb0/0x130 [ 575.386325][T11686] should_fail_ex+0x414/0x560 [ 575.386340][T11686] _copy_from_user+0x2d/0xb0 [ 575.386350][T11686] ___sys_sendmsg+0x158/0x2a0 [ 575.386364][T11686] ? __pfx____sys_sendmsg+0x10/0x10 [ 575.386379][T11686] ? rcu_read_lock_any_held+0xb3/0x120 [ 575.386401][T11686] ? sb_end_write+0xe9/0x1c0 [ 575.386422][T11686] ? __pfx_vfs_write+0x10/0x10 [ 575.386437][T11686] __x64_sys_sendmsg+0x19b/0x260 [ 575.386450][T11686] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 575.386466][T11686] ? __pfx_ksys_write+0x10/0x10 [ 575.386486][T11686] ? do_syscall_64+0xbe/0x3b0 [ 575.386503][T11686] do_syscall_64+0xfa/0x3b0 [ 575.386516][T11686] ? lockdep_hardirqs_on+0x9c/0x150 [ 575.386530][T11686] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 575.386539][T11686] ? clear_bhb_loop+0x60/0xb0 [ 575.386550][T11686] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 575.386559][T11686] RIP: 0033:0x7fa41638e929 [ 575.386569][T11686] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 575.386578][T11686] RSP: 002b:00007fa4172cb038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 575.386589][T11686] RAX: ffffffffffffffda RBX: 00007fa4165b5fa0 RCX: 00007fa41638e929 [ 575.386595][T11686] RDX: 0000000000000000 RSI: 0000200000000300 RDI: 0000000000000005 [ 575.386601][T11686] RBP: 00007fa4172cb090 R08: 0000000000000000 R09: 0000000000000000 [ 575.386607][T11686] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 575.386613][T11686] R13: 0000000000000000 R14: 00007fa4165b5fa0 R15: 00007ffde91886e8 [ 575.386628][T11686] [ 575.922564][T11696] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 576.500506][T11702] random: crng reseeded on system resumption [ 576.813587][T10843] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 576.889104][ T5840] usb 8-1: new high-speed USB device number 8 using dummy_hcd [ 577.008289][T10843] usb 7-1: Using ep0 maxpacket: 16 [ 577.046231][T10843] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 577.063622][T10843] usb 7-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 577.142007][T10843] usb 7-1: New USB device found, idVendor=054c, idProduct=06c1, bcdDevice=c2.87 [ 577.187903][ T5840] usb 8-1: device descriptor read/64, error -71 [ 577.191548][T10843] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 577.337514][T10843] usb 7-1: Product: syz [ 577.341821][T10843] usb 7-1: Manufacturer: syz [ 577.346642][T10843] usb 7-1: SerialNumber: syz [ 577.383773][T10843] usb 7-1: config 0 descriptor?? [ 577.453016][ T5840] usb 8-1: new high-speed USB device number 9 using dummy_hcd [ 577.527781][T11713] netlink: 304 bytes leftover after parsing attributes in process `syz.8.1653'. [ 577.827670][ T5840] usb 8-1: device descriptor read/64, error -71 [ 577.935612][T10843] usb 7-1: USB disconnect, device number 7 [ 578.053210][ T5840] usb usb8-port1: attempt power cycle [ 578.108801][T11724] netlink: 24 bytes leftover after parsing attributes in process `syz.9.1657'. [ 578.196162][T11728] fuse: Bad value for 'fd' [ 578.392835][ T5921] usb 9-1: new high-speed USB device number 5 using dummy_hcd [ 578.402743][ T5840] usb 8-1: new high-speed USB device number 10 using dummy_hcd [ 578.443972][ T5840] usb 8-1: device descriptor read/8, error -71 [ 578.564100][ T5921] usb 9-1: config 0 has no interfaces? [ 578.581443][ T5921] usb 9-1: New USB device found, idVendor=0f11, idProduct=1000, bcdDevice= 0.02 [ 578.605856][ T5921] usb 9-1: New USB device strings: Mfr=0, Product=232, SerialNumber=255 [ 578.632989][ T5921] usb 9-1: Product: syz [ 578.656625][ T5921] usb 9-1: SerialNumber: syz [ 578.684941][ T5840] usb 8-1: new high-speed USB device number 11 using dummy_hcd [ 578.700461][ T5921] usb 9-1: config 0 descriptor?? [ 578.725555][ T5840] usb 8-1: device descriptor read/8, error -71 [ 578.853057][ T5840] usb usb8-port1: unable to enumerate USB device [ 579.084465][ T5946] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 579.232319][ T5921] usb 10-1: new high-speed USB device number 2 using dummy_hcd [ 579.254805][ T5946] usb 7-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 579.266912][ T5946] usb 7-1: config 2 interface 0 altsetting 178 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 579.310508][ T5946] usb 7-1: config 2 interface 0 has no altsetting 0 [ 579.319410][ T5946] usb 7-1: New USB device found, idVendor=04d8, idProduct=0083, bcdDevice=da.47 [ 579.328646][ T5946] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 579.336815][ T5946] usb 7-1: Product: syz [ 579.341005][ T5946] usb 7-1: Manufacturer: syz [ 579.345663][ T5946] usb 7-1: SerialNumber: syz [ 580.110565][ T5921] usb 10-1: Using ep0 maxpacket: 16 [ 580.152026][ T5921] usb 10-1: config 1 interface 0 altsetting 255 endpoint 0x1 has invalid wMaxPacketSize 0 [ 580.169420][ T5946] usb 7-1: USB disconnect, device number 8 [ 580.185060][ T5921] usb 10-1: config 1 interface 0 altsetting 255 bulk endpoint 0x1 has invalid maxpacket 0 [ 580.214815][ T5921] usb 10-1: config 1 interface 0 altsetting 255 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 580.230508][ T5921] usb 10-1: config 1 interface 0 has no altsetting 0 [ 580.265351][ T5921] usb 10-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 580.291732][ T5921] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 580.299870][ T5921] usb 10-1: Product: syz [ 580.308786][ T5921] usb 10-1: Manufacturer: syz [ 580.314071][ T5921] usb 10-1: SerialNumber: syz [ 580.415269][T11756] netlink: 304 bytes leftover after parsing attributes in process `syz.7.1666'. [ 580.546488][T11739] fuse: Unknown parameter 'g3(0)͖K ' [ 581.537379][ T5921] usblp 10-1:1.0: usblp0: USB Unidirectional printer dev 2 if 0 alt 255 proto 1 vid 0x0525 pid 0xA4A8 [ 581.616086][ T5921] usb 10-1: USB disconnect, device number 2 [ 581.643897][ T5921] usblp0: removed [ 581.671361][ T24] usb 9-1: USB disconnect, device number 5 [ 581.799818][T11766] fuse: Bad value for 'fd' [ 582.184552][T11775] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1673'. [ 582.290404][T11779] random: crng reseeded on system resumption [ 582.297262][T11782] netlink: 'syz.7.1676': attribute type 15 has an invalid length. [ 582.386018][T11786] FAULT_INJECTION: forcing a failure. [ 582.386018][T11786] name failslab, interval 1, probability 0, space 0, times 0 [ 582.410553][T11786] CPU: 1 UID: 0 PID: 11786 Comm: syz.9.1674 Not tainted 6.16.0-rc3-syzkaller #0 PREEMPT(full) [ 582.410581][T11786] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 582.410591][T11786] Call Trace: [ 582.410599][T11786] [ 582.410607][T11786] dump_stack_lvl+0x189/0x250 [ 582.410635][T11786] ? __pfx____ratelimit+0x10/0x10 [ 582.410659][T11786] ? __pfx_dump_stack_lvl+0x10/0x10 [ 582.410682][T11786] ? __pfx__printk+0x10/0x10 [ 582.410701][T11786] ? __pfx___might_resched+0x10/0x10 [ 582.410732][T11786] ? fs_reclaim_acquire+0x7d/0x100 [ 582.410758][T11786] should_fail_ex+0x414/0x560 [ 582.410783][T11786] should_failslab+0xa8/0x100 [ 582.410805][T11786] __kmalloc_cache_noprof+0x70/0x3d0 [ 582.410824][T11786] ? resv_map_alloc+0x51/0x2c0 [ 582.410844][T11786] resv_map_alloc+0x51/0x2c0 [ 582.410863][T11786] hugetlbfs_get_inode+0x68/0x660 [ 582.410887][T11786] ? fput+0xa0/0xd0 [ 582.410914][T11786] hugetlb_file_setup+0x21d/0x630 [ 582.410941][T11786] ksys_mmap_pgoff+0x22f/0x760 [ 582.410967][T11786] do_syscall_64+0xfa/0x3b0 [ 582.410988][T11786] ? lockdep_hardirqs_on+0x9c/0x150 [ 582.411009][T11786] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 582.411026][T11786] ? clear_bhb_loop+0x60/0xb0 [ 582.411045][T11786] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 582.411061][T11786] RIP: 0033:0x7f48a2f8e929 [ 582.411077][T11786] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 582.411091][T11786] RSP: 002b:00007f48a3de4038 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 582.411108][T11786] RAX: ffffffffffffffda RBX: 00007f48a31b6080 RCX: 00007f48a2f8e929 [ 582.411120][T11786] RDX: 0000000001000005 RSI: 0000000000ff5000 RDI: 0000200000000000 [ 582.411131][T11786] RBP: 00007f48a3de4090 R08: ffffffffffffffff R09: 0000000000000000 [ 582.411142][T11786] R10: 00020000000ec071 R11: 0000000000000246 R12: 0000000000000001 [ 582.411153][T11786] R13: 0000000000000000 R14: 00007f48a31b6080 R15: 00007ffe9def73f8 [ 582.411179][T11786] [ 582.620995][ C1] vkms_vblank_simulate: vblank timer overrun [ 582.723156][ T5921] usb 9-1: new high-speed USB device number 6 using dummy_hcd [ 582.860526][ T5921] usb 9-1: device descriptor read/64, error -71 [ 582.957567][T11795] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1679'. [ 583.619957][ T5921] usb 9-1: new high-speed USB device number 7 using dummy_hcd [ 583.802384][ T5921] usb 9-1: device descriptor read/64, error -71 [ 583.852647][T11799] could not allocate digest TFM handle sha512-ce [ 583.950401][ T5921] usb usb9-port1: attempt power cycle [ 584.610910][T11818] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1687'. [ 584.639469][ T5921] usb 9-1: new high-speed USB device number 8 using dummy_hcd [ 584.889522][T11822] syz_tun: entered promiscuous mode [ 584.907695][T11822] syz_tun: left promiscuous mode [ 585.159884][ T5921] usb 9-1: device descriptor read/8, error -71 [ 585.469173][ T24] usb 4-1: new high-speed USB device number 41 using dummy_hcd [ 585.619051][ T24] usb 4-1: Using ep0 maxpacket: 32 [ 585.664029][ T24] usb 4-1: config 0 has an invalid interface number: 159 but max is 0 [ 585.758763][ T24] usb 4-1: config 0 has no interface number 0 [ 585.831792][T11837] netlink: 'syz.8.1692': attribute type 4 has an invalid length. [ 586.035782][ T24] usb 4-1: config 0 interface 159 altsetting 36 has 0 endpoint descriptors, different from the interface descriptor's value: 22 [ 586.161499][ T24] usb 4-1: config 0 interface 159 has no altsetting 0 [ 586.188470][ T24] usb 4-1: New USB device found, idVendor=055f, idProduct=2b7d, bcdDevice=88.92 [ 586.488461][ T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 586.539420][ T24] usb 4-1: config 0 descriptor?? [ 586.906568][ T24] usb 4-1: string descriptor 0 read error: -71 [ 587.164286][ T24] usb 4-1: USB disconnect, device number 41 [ 587.713634][ T48] usb 10-1: new full-speed USB device number 3 using dummy_hcd [ 587.827642][T11864] netlink: 44 bytes leftover after parsing attributes in process `syz.6.1699'. [ 588.138575][T11869] random: crng reseeded on system resumption [ 588.283000][ T48] usb 10-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 588.283032][ T48] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 78, changing to 4 [ 588.283057][ T48] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 60057, setting to 1023 [ 588.283098][ T48] usb 10-1: New USB device found, idVendor=0e20, idProduct=0101, bcdDevice= 0.5a [ 588.283119][ T48] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 588.285788][ T48] usb 10-1: config 0 descriptor?? [ 588.289955][ T48] pegasus_notetaker 10-1:0.0: probe with driver pegasus_notetaker failed with error -22 [ 588.427653][ T5946] usb 4-1: new high-speed USB device number 42 using dummy_hcd [ 588.492602][ T48] usb 10-1: USB disconnect, device number 3 [ 588.627421][ T5946] usb 4-1: device descriptor read/64, error -71 [ 588.832580][T11879] input: syz1 as /devices/virtual/input/input29 [ 588.867447][ T5946] usb 4-1: new high-speed USB device number 43 using dummy_hcd [ 588.968425][ T5921] usb 8-1: new full-speed USB device number 12 using dummy_hcd [ 589.067203][ T5946] usb 4-1: device descriptor read/64, error -71 [ 589.126111][ T5921] usb 8-1: device descriptor read/64, error -71 [ 589.187562][ T5946] usb usb4-port1: attempt power cycle [ 589.217418][T11886] netlink: 20 bytes leftover after parsing attributes in process `syz.9.1707'. [ 589.439350][ T5921] usb 8-1: new full-speed USB device number 13 using dummy_hcd [ 589.716945][ T5946] usb 4-1: new high-speed USB device number 44 using dummy_hcd [ 589.738125][ T5946] usb 4-1: device descriptor read/8, error -71 [ 589.796931][ T5921] usb 8-1: device descriptor read/64, error -71 [ 589.928761][ T5921] usb usb8-port1: attempt power cycle [ 589.977900][T11893] IPVS: sync thread started: state = MASTER, mcast_ifn = bridge_slave_0, syncid = 0, id = 0 [ 590.016735][ T5946] usb 4-1: new high-speed USB device number 45 using dummy_hcd [ 590.037682][ T5946] usb 4-1: device descriptor read/8, error -71 [ 590.146993][ T5946] usb usb4-port1: unable to enumerate USB device [ 590.216871][T10244] usb 10-1: new high-speed USB device number 4 using dummy_hcd [ 590.296612][ T5921] usb 8-1: new full-speed USB device number 14 using dummy_hcd [ 590.332328][ T5921] usb 8-1: device descriptor read/8, error -71 [ 590.369269][T10244] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 590.381931][T10244] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 590.403515][T10244] usb 10-1: New USB device found, idVendor=06cb, idProduct=73f6, bcdDevice= 0.00 [ 590.413054][T10244] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 590.430112][T10244] usb 10-1: config 0 descriptor?? [ 590.576553][ T5921] usb 8-1: new full-speed USB device number 15 using dummy_hcd [ 590.597215][ T5921] usb 8-1: device descriptor read/8, error -71 [ 590.707871][ T5921] usb usb8-port1: unable to enumerate USB device [ 590.910757][T10244] itetech 0003:06CB:73F6.000A: unknown main item tag 0x0 [ 590.918475][T10244] itetech 0003:06CB:73F6.000A: unbalanced collection at end of report description [ 590.928850][T10244] itetech 0003:06CB:73F6.000A: probe with driver itetech failed with error -22 [ 590.986302][T11906] netlink: 12 bytes leftover after parsing attributes in process `syz.6.1713'. [ 592.558133][T11915] block device autoloading is deprecated and will be removed. [ 593.035638][ T48] usb 10-1: USB disconnect, device number 4 [ 593.346091][T11936] netlink: 'syz.6.1721': attribute type 1 has an invalid length. [ 593.367871][T11936] netlink: 184 bytes leftover after parsing attributes in process `syz.6.1721'. [ 593.465284][T11943] netlink: 12 bytes leftover after parsing attributes in process `syz.8.1725'. [ 593.502074][T11936] netlink: 20 bytes leftover after parsing attributes in process `syz.6.1721'. [ 593.583345][T11948] netlink: 8 bytes leftover after parsing attributes in process `syz.8.1726'. [ 593.802007][T11953] netlink: 16 bytes leftover after parsing attributes in process `syz.7.1727'. [ 593.935477][T11956] random: crng reseeded on system resumption [ 594.317783][ T5921] usb 9-1: new high-speed USB device number 10 using dummy_hcd [ 594.464644][ T5921] usb 9-1: device descriptor read/64, error -71 [ 594.714697][ T5921] usb 9-1: new high-speed USB device number 11 using dummy_hcd [ 594.854405][ T5921] usb 9-1: device descriptor read/64, error -71 [ 594.881353][T11969] (unnamed net_device) (uninitialized): option packets_per_slave: invalid value (18446744073709551615) [ 594.896968][T11969] (unnamed net_device) (uninitialized): option packets_per_slave: allowed values 0 - 65535 [ 594.964658][ T5921] usb usb9-port1: attempt power cycle [ 595.314116][ T5921] usb 9-1: new high-speed USB device number 12 using dummy_hcd [ 595.369771][ T5921] usb 9-1: device descriptor read/8, error -71 [ 595.490032][ T30] audit: type=1326 audit(2000000111.885:207): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11977 comm="syz.9.1735" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f48a2f8e929 code=0x7ffc0000 [ 595.515891][ T30] audit: type=1326 audit(2000000111.885:208): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11977 comm="syz.9.1735" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f48a2f8e929 code=0x7ffc0000 [ 595.566921][T11978] netlink: 'syz.9.1735': attribute type 1 has an invalid length. [ 595.569906][ T30] audit: type=1326 audit(2000000111.915:209): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11977 comm="syz.9.1735" exe="/root/syz-executor" sig=0 arch=c000003e syscall=36 compat=0 ip=0x7f48a2f8e929 code=0x7ffc0000 [ 595.597951][ T30] audit: type=1326 audit(2000000111.915:210): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11977 comm="syz.9.1735" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f48a2f8e929 code=0x7ffc0000 [ 595.626615][ T30] audit: type=1326 audit(2000000111.915:211): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11977 comm="syz.9.1735" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f48a2f8e929 code=0x7ffc0000 [ 595.648915][ T30] audit: type=1326 audit(2000000111.915:212): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11977 comm="syz.9.1735" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f48a2f8e929 code=0x7ffc0000 [ 595.670857][ T5921] usb 9-1: new high-speed USB device number 13 using dummy_hcd [ 595.724127][ T5921] usb 9-1: device descriptor read/8, error -71 [ 595.731365][ T30] audit: type=1326 audit(2000000111.915:213): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11977 comm="syz.9.1735" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f48a2f8e929 code=0x7ffc0000 [ 595.753664][ T30] audit: type=1326 audit(2000000111.915:214): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11977 comm="syz.9.1735" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f48a2f8e929 code=0x7ffc0000 [ 595.778675][ T30] audit: type=1326 audit(2000000111.915:215): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11977 comm="syz.9.1735" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f48a2f8e929 code=0x7ffc0000 [ 595.800892][ T30] audit: type=1326 audit(2000000111.915:216): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11977 comm="syz.9.1735" exe="/root/syz-executor" sig=0 arch=c000003e syscall=259 compat=0 ip=0x7f48a2f8e929 code=0x7ffc0000 [ 595.835173][ T5921] usb usb9-port1: unable to enumerate USB device [ 595.986055][T11980] netlink: 32 bytes leftover after parsing attributes in process `syz.7.1736'. [ 595.997452][T11980] netlink: 32 bytes leftover after parsing attributes in process `syz.7.1736'. [ 596.100187][T11980] netlink: 32 bytes leftover after parsing attributes in process `syz.7.1736'. [ 596.110292][T11980] netlink: 32 bytes leftover after parsing attributes in process `syz.7.1736'. [ 598.284624][ T48] usb 4-1: new high-speed USB device number 46 using dummy_hcd [ 598.307282][T12027] random: crng reseeded on system resumption [ 598.465304][ T48] usb 4-1: config index 0 descriptor too short (expected 38, got 36) [ 598.484315][ T48] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 598.505342][ T48] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 598.516118][ T48] usb 4-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 598.525688][ T48] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 598.561240][ T48] usb 4-1: config 0 descriptor?? [ 598.712939][ T5946] usb 8-1: new high-speed USB device number 16 using dummy_hcd [ 598.862338][ T5946] usb 8-1: device descriptor read/64, error -71 [ 599.113081][ T5946] usb 8-1: new high-speed USB device number 17 using dummy_hcd [ 599.188642][T12036] binder: 12032:12036 ioctl c0046209 0 returned -22 [ 599.220295][T12035] tmpfs: Unknown parameter ' V13' [ 599.262920][ T5946] usb 8-1: device descriptor read/64, error -71 [ 599.295749][ T48] usb 4-1: string descriptor 0 read error: -71 [ 599.332886][ T48] uclogic 0003:256C:006D.000B: failed retrieving string descriptor #200: -71 [ 599.342507][ T48] uclogic 0003:256C:006D.000B: failed retrieving pen parameters: -71 [ 599.352679][ T48] uclogic 0003:256C:006D.000B: failed probing pen v2 parameters: -71 [ 599.362580][ T48] uclogic 0003:256C:006D.000B: failed probing parameters: -71 [ 599.373850][ T5946] usb usb8-port1: attempt power cycle [ 599.386339][ T48] uclogic 0003:256C:006D.000B: probe with driver uclogic failed with error -71 [ 599.824380][ T48] usb 4-1: USB disconnect, device number 46 [ 600.176403][ T5946] usb 8-1: new high-speed USB device number 18 using dummy_hcd [ 600.230371][ T5946] usb 8-1: device descriptor read/8, error -71 [ 600.571442][ T5946] usb 8-1: new high-speed USB device number 19 using dummy_hcd [ 600.657660][T12036] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 600.659228][ T5946] usb 8-1: device descriptor read/8, error -71 [ 601.212055][T12036] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 601.214021][ T5946] usb usb8-port1: unable to enumerate USB device [ 601.234700][T12036] bond0 (unregistering): Released all slaves [ 601.255292][T12046] 0: renamed from bond_slave_1 (while UP) [ 601.834284][T12072] FAULT_INJECTION: forcing a failure. [ 601.834284][T12072] name failslab, interval 1, probability 0, space 0, times 0 [ 601.888724][T12072] CPU: 0 UID: 0 PID: 12072 Comm: syz.9.1760 Not tainted 6.16.0-rc3-syzkaller #0 PREEMPT(full) [ 601.888753][T12072] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 601.888764][T12072] Call Trace: [ 601.888772][T12072] [ 601.888781][T12072] dump_stack_lvl+0x189/0x250 [ 601.888809][T12072] ? __pfx____ratelimit+0x10/0x10 [ 601.888833][T12072] ? __pfx_dump_stack_lvl+0x10/0x10 [ 601.888855][T12072] ? __pfx__printk+0x10/0x10 [ 601.888875][T12072] ? __pfx___might_resched+0x10/0x10 [ 601.888899][T12072] ? fs_reclaim_acquire+0x7d/0x100 [ 601.888927][T12072] should_fail_ex+0x414/0x560 [ 601.888953][T12072] should_failslab+0xa8/0x100 [ 601.888977][T12072] kmem_cache_alloc_noprof+0x73/0x3c0 [ 601.888996][T12072] ? getname_flags+0xb8/0x540 [ 601.889022][T12072] getname_flags+0xb8/0x540 [ 601.889049][T12072] __x64_sys_mkdir+0x5d/0x80 [ 601.889069][T12072] do_syscall_64+0xfa/0x3b0 [ 601.889091][T12072] ? lockdep_hardirqs_on+0x9c/0x150 [ 601.889114][T12072] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 601.889131][T12072] ? clear_bhb_loop+0x60/0xb0 [ 601.889153][T12072] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 601.889169][T12072] RIP: 0033:0x7f48a2f8e929 [ 601.889191][T12072] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 601.889206][T12072] RSP: 002b:00007f48a3dc3038 EFLAGS: 00000246 ORIG_RAX: 0000000000000053 [ 601.889226][T12072] RAX: ffffffffffffffda RBX: 00007f48a31b6160 RCX: 00007f48a2f8e929 [ 601.889239][T12072] RDX: 0000000000000000 RSI: 0000000000000120 RDI: 00002000000000c0 [ 601.889251][T12072] RBP: 00007f48a3dc3090 R08: 0000000000000000 R09: 0000000000000000 [ 601.889262][T12072] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 601.889273][T12072] R13: 0000000000000000 R14: 00007f48a31b6160 R15: 00007ffe9def73f8 [ 601.889303][T12072] [ 602.077449][ C0] vkms_vblank_simulate: vblank timer overrun [ 603.189103][T12082] kvm: kvm [12078]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x11e) = 0xbe702111 [ 603.228425][T12089] netlink: 24 bytes leftover after parsing attributes in process `syz.6.1768'. [ 603.462728][ T5921] usb 8-1: new high-speed USB device number 20 using dummy_hcd [ 603.587594][T12099] kvm: pic: non byte write [ 603.653507][ T5921] usb 8-1: config index 0 descriptor too short (expected 38, got 36) [ 603.681508][ T5921] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 603.730256][ T5921] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 603.794208][ T5921] usb 8-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 603.840563][ T5921] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 603.962363][ T5921] usb 8-1: config 0 descriptor?? [ 604.196386][T12107] random: crng reseeded on system resumption [ 604.549576][T11158] Bluetooth: hci5: command 0x0405 tx timeout [ 604.559139][ T5946] usb 4-1: new high-speed USB device number 47 using dummy_hcd [ 604.681307][ T5921] usb 8-1: string descriptor 0 read error: -71 [ 604.692556][ T5921] uclogic 0003:256C:006D.000C: failed retrieving string descriptor #200: -71 [ 604.710261][ T5921] uclogic 0003:256C:006D.000C: failed retrieving pen parameters: -71 [ 604.718402][ T5921] uclogic 0003:256C:006D.000C: failed probing pen v2 parameters: -71 [ 604.747078][ T5921] uclogic 0003:256C:006D.000C: failed probing parameters: -71 [ 604.762607][ T5946] usb 4-1: device descriptor read/64, error -71 [ 604.769344][ T5921] uclogic 0003:256C:006D.000C: probe with driver uclogic failed with error -71 [ 604.783042][ T5921] usb 8-1: USB disconnect, device number 20 [ 604.999596][ T5946] usb 4-1: new high-speed USB device number 48 using dummy_hcd [ 605.159267][ T5946] usb 4-1: device descriptor read/64, error -71 [ 605.245327][T12139] netlink: 'syz.6.1780': attribute type 5 has an invalid length. [ 605.254414][T12139] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1780'. [ 605.269637][ T5946] usb usb4-port1: attempt power cycle [ 605.399061][ T48] usb 10-1: new full-speed USB device number 5 using dummy_hcd [ 605.413480][T12143] netlink: 16 bytes leftover after parsing attributes in process `syz.6.1782'. [ 606.218597][ T5946] usb 4-1: new high-speed USB device number 49 using dummy_hcd [ 606.259563][ T5946] usb 4-1: device descriptor read/8, error -71 [ 606.729090][ T48] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 606.743648][ T48] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 606.758375][ T48] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 606.778602][ T5946] usb 4-1: new high-speed USB device number 50 using dummy_hcd [ 606.974207][ T5946] usb 4-1: device descriptor read/8, error -71 [ 607.203687][ T5946] usb usb4-port1: unable to enumerate USB device [ 607.260573][ T48] usb 10-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 607.279286][ T48] usb 10-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 607.289605][ T48] usb 10-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 607.297728][ T48] usb 10-1: Manufacturer: syz [ 607.334369][ T48] usb 10-1: config 0 descriptor?? [ 607.538905][T12172] fuse: Unknown parameter '\3ȇ%4AؗgJd*8NnQZ?ʔ_' [ 607.778000][ T24] usb 8-1: new high-speed USB device number 21 using dummy_hcd [ 607.817774][ T48] rc_core: IR keymap rc-hauppauge not found [ 607.824778][ T48] Registered IR keymap rc-empty [ 607.828462][T12161] syzkaller0: entered promiscuous mode [ 607.834097][ T48] mceusb 10-1:0.0: Error: mce write submit urb error = -90 [ 607.835382][T12161] syzkaller0: entered allmulticast mode [ 607.856688][T12135] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 607.886709][ T48] mceusb 10-1:0.0: Error: mce write submit urb error = -90 [ 607.887576][T12135] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 607.916600][ T48] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.9/usb10/10-1/10-1:0.0/rc/rc0 [ 607.977376][ T24] usb 8-1: config index 0 descriptor too short (expected 38, got 36) [ 607.991891][ T48] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.9/usb10/10-1/10-1:0.0/rc/rc0/input30 [ 608.005584][ T24] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 608.048611][ T24] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 608.080964][ T48] mceusb 10-1:0.0: Error: mce write submit urb error = -90 [ 608.120398][ T24] usb 8-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 608.149642][ T48] mceusb 10-1:0.0: Error: mce write submit urb error = -90 [ 608.175667][ T24] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 608.184786][ T48] mceusb 10-1:0.0: Error: mce write submit urb error = -90 [ 608.219704][ T48] mceusb 10-1:0.0: Error: mce write submit urb error = -90 [ 608.229839][ T24] usb 8-1: config 0 descriptor?? [ 608.248531][ T48] mceusb 10-1:0.0: Error: mce write submit urb error = -90 [ 608.267922][ T48] mceusb 10-1:0.0: Error: mce write submit urb error = -90 [ 608.288176][ T48] mceusb 10-1:0.0: Error: mce write submit urb error = -90 [ 608.308437][ T48] mceusb 10-1:0.0: Error: mce write submit urb error = -90 [ 608.354515][ T30] kauditd_printk_skb: 33 callbacks suppressed [ 608.354532][ T30] audit: type=1326 audit(2000000124.752:250): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12182 comm="syz.6.1794" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2e3c38e929 code=0x7ffc0000 [ 608.355487][ T48] mceusb 10-1:0.0: Error: mce write submit urb error = -90 [ 608.394496][ T30] audit: type=1326 audit(2000000124.752:251): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12182 comm="syz.6.1794" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2e3c38e929 code=0x7ffc0000 [ 608.423844][ T48] mceusb 10-1:0.0: Error: mce write submit urb error = -90 [ 608.453915][ T48] mceusb 10-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 608.473330][ T48] mceusb 10-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 608.502363][ T48] usb 10-1: USB disconnect, device number 5 [ 608.513789][ T30] audit: type=1326 audit(2000000124.772:252): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12182 comm="syz.6.1794" exe="/root/syz-executor" sig=0 arch=c000003e syscall=13 compat=0 ip=0x7f2e3c38e929 code=0x7ffc0000 [ 608.590175][ T30] audit: type=1326 audit(2000000124.772:253): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12182 comm="syz.6.1794" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2e3c38e929 code=0x7ffc0000 [ 608.939251][ T30] audit: type=1326 audit(2000000124.772:254): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12182 comm="syz.6.1794" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2e3c38e929 code=0x7ffc0000 [ 608.944979][T12170] overlayfs: failed to resolve './file1': -2 [ 608.965235][ T30] audit: type=1326 audit(2000000124.772:255): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12182 comm="syz.6.1794" exe="/root/syz-executor" sig=0 arch=c000003e syscall=319 compat=0 ip=0x7f2e3c38e929 code=0x7ffc0000 [ 608.988599][ C0] vkms_vblank_simulate: vblank timer overrun [ 608.997393][ T30] audit: type=1326 audit(2000000124.772:256): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12182 comm="syz.6.1794" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2e3c38e929 code=0x7ffc0000 [ 609.018969][ C0] vkms_vblank_simulate: vblank timer overrun [ 609.027840][ T30] audit: type=1326 audit(2000000124.772:257): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12182 comm="syz.6.1794" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2e3c38e929 code=0x7ffc0000 [ 609.062034][ T30] audit: type=1326 audit(2000000124.772:258): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12182 comm="syz.6.1794" exe="/root/syz-executor" sig=0 arch=c000003e syscall=285 compat=0 ip=0x7f2e3c38e929 code=0x7ffc0000 [ 609.083935][ T30] audit: type=1326 audit(2000000124.772:259): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12182 comm="syz.6.1794" exe="/root/syz-executor" sig=0 arch=c000003e syscall=96 compat=0 ip=0xffffffffff600000 code=0x7ffc0000 [ 609.105746][ C0] vkms_vblank_simulate: vblank timer overrun [ 609.263306][ T24] usb 8-1: string descriptor 0 read error: -71 [ 609.270360][ T24] uclogic 0003:256C:006D.000D: failed retrieving string descriptor #200: -71 [ 609.282787][ T24] uclogic 0003:256C:006D.000D: failed retrieving pen parameters: -71 [ 609.301309][ T24] uclogic 0003:256C:006D.000D: failed probing pen v2 parameters: -71 [ 609.325868][ T24] uclogic 0003:256C:006D.000D: failed probing parameters: -71 [ 609.351767][ T24] uclogic 0003:256C:006D.000D: probe with driver uclogic failed with error -71 [ 609.390621][ T24] usb 8-1: USB disconnect, device number 21 [ 610.299491][ T48] usb 10-1: new high-speed USB device number 6 using dummy_hcd [ 610.456752][ T48] usb 10-1: Using ep0 maxpacket: 16 [ 610.536907][T12205] random: crng reseeded on system resumption [ 610.551669][ T48] usb 10-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 255, changing to 7 [ 610.583410][ T48] usb 10-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 610.601863][ T48] usb 10-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 610.611201][ T48] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 610.622920][ T48] usb 10-1: Product: syz [ 610.633000][ T48] usb 10-1: Manufacturer: syz [ 610.637946][ T48] usb 10-1: SerialNumber: syz [ 611.796132][ T24] usb 8-1: new high-speed USB device number 22 using dummy_hcd [ 611.936130][ T24] usb 8-1: device descriptor read/64, error -71 [ 612.370022][ T48] usb 10-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 612.451693][ T48] usb 10-1: USB disconnect, device number 6 [ 612.458002][ T24] usb 8-1: new high-speed USB device number 23 using dummy_hcd [ 612.615371][ T24] usb 8-1: device descriptor read/64, error -71 [ 612.737940][ T24] usb usb8-port1: attempt power cycle [ 613.085710][ T24] usb 8-1: new high-speed USB device number 24 using dummy_hcd [ 613.106191][ T24] usb 8-1: device descriptor read/8, error -71 [ 613.424531][ T24] usb 8-1: new high-speed USB device number 25 using dummy_hcd [ 613.495956][ T24] usb 8-1: device descriptor read/8, error -71 [ 613.628119][ T24] usb usb8-port1: unable to enumerate USB device [ 613.689255][T12251] FAULT_INJECTION: forcing a failure. [ 613.689255][T12251] name failslab, interval 1, probability 0, space 0, times 0 [ 613.713498][T12251] CPU: 1 UID: 0 PID: 12251 Comm: syz.3.1813 Not tainted 6.16.0-rc3-syzkaller #0 PREEMPT(full) [ 613.713526][T12251] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 613.713537][T12251] Call Trace: [ 613.713545][T12251] [ 613.713555][T12251] dump_stack_lvl+0x189/0x250 [ 613.713586][T12251] ? __pfx____ratelimit+0x10/0x10 [ 613.713610][T12251] ? __pfx_dump_stack_lvl+0x10/0x10 [ 613.713632][T12251] ? __pfx__printk+0x10/0x10 [ 613.713657][T12251] ? __pfx___might_resched+0x10/0x10 [ 613.713679][T12251] ? fs_reclaim_acquire+0x7d/0x100 [ 613.713707][T12251] should_fail_ex+0x414/0x560 [ 613.713733][T12251] ? file_tty_write+0x2a8/0x990 [ 613.713754][T12251] should_failslab+0xa8/0x100 [ 613.713778][T12251] __kvmalloc_node_noprof+0x161/0x5f0 [ 613.713799][T12251] ? file_tty_write+0x2a8/0x990 [ 613.713828][T12251] file_tty_write+0x2a8/0x990 [ 613.713861][T12251] do_iter_readv_writev+0x56b/0x7f0 [ 613.713886][T12251] ? __pfx_do_iter_readv_writev+0x10/0x10 [ 613.713912][T12251] ? bpf_lsm_file_permission+0x9/0x20 [ 613.713933][T12251] ? security_file_permission+0x75/0x290 [ 613.713957][T12251] ? rw_verify_area+0x258/0x650 [ 613.713979][T12251] vfs_writev+0x31a/0x960 [ 613.714007][T12251] ? __lock_acquire+0xab9/0xd20 [ 613.714031][T12251] ? __pfx_vfs_writev+0x10/0x10 [ 613.714070][T12251] ? __fget_files+0x2a/0x420 [ 613.714096][T12251] ? __fget_files+0x3a0/0x420 [ 613.714115][T12251] ? __fget_files+0x2a/0x420 [ 613.714147][T12251] do_writev+0x14d/0x2d0 [ 613.714172][T12251] ? __pfx_do_writev+0x10/0x10 [ 613.714192][T12251] ? rcu_is_watching+0x15/0xb0 [ 613.714221][T12251] ? do_syscall_64+0xbe/0x3b0 [ 613.714255][T12251] do_syscall_64+0xfa/0x3b0 [ 613.714277][T12251] ? lockdep_hardirqs_on+0x9c/0x150 [ 613.714300][T12251] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 613.714317][T12251] ? clear_bhb_loop+0x60/0xb0 [ 613.714338][T12251] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 613.714354][T12251] RIP: 0033:0x7fa41638e929 [ 613.714371][T12251] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 613.714385][T12251] RSP: 002b:00007fa4172aa038 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 613.714404][T12251] RAX: ffffffffffffffda RBX: 00007fa4165b6080 RCX: 00007fa41638e929 [ 613.714417][T12251] RDX: 0000000000000001 RSI: 0000200000000c80 RDI: 0000000000000004 [ 613.714428][T12251] RBP: 00007fa4172aa090 R08: 0000000000000000 R09: 0000000000000000 [ 613.714439][T12251] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 613.714449][T12251] R13: 0000000000000000 R14: 00007fa4165b6080 R15: 00007ffde91886e8 [ 613.714484][T12251] [ 614.055660][ T5921] usb 9-1: new high-speed USB device number 14 using dummy_hcd [ 614.220257][ T5921] usb 9-1: config index 0 descriptor too short (expected 38, got 36) [ 614.220535][ T5921] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 614.220604][ T5921] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 614.220768][ T5921] usb 9-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 614.220833][ T5921] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 614.327747][ T5921] usb 9-1: config 0 descriptor?? [ 614.793060][T12264] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 614.802210][T12264] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 616.003277][T12270] overlayfs: failed to resolve './file1': -2 [ 616.653821][ T5921] usb 9-1: string descriptor 0 read error: -71 [ 616.660546][ T5921] uclogic 0003:256C:006D.000E: failed retrieving string descriptor #200: -71 [ 616.673082][T12277] RDS: rds_bind could not find a transport for fc00::1, load rds_tcp or rds_rdma? [ 616.694330][ T5921] uclogic 0003:256C:006D.000E: failed retrieving pen parameters: -71 [ 616.702468][ T5921] uclogic 0003:256C:006D.000E: failed probing pen v2 parameters: -71 [ 616.711643][ T5921] uclogic 0003:256C:006D.000E: failed probing parameters: -71 [ 616.719323][ T5921] uclogic 0003:256C:006D.000E: probe with driver uclogic failed with error -71 [ 616.733144][ T5921] usb 9-1: USB disconnect, device number 14 [ 617.700958][T12288] random: crng reseeded on system resumption [ 617.826240][T12290] FAULT_INJECTION: forcing a failure. [ 617.826240][T12290] name failslab, interval 1, probability 0, space 0, times 0 [ 617.841679][T12290] CPU: 0 UID: 0 PID: 12290 Comm: syz.6.1825 Not tainted 6.16.0-rc3-syzkaller #0 PREEMPT(full) [ 617.841708][T12290] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 617.841716][T12290] Call Trace: [ 617.841722][T12290] [ 617.841728][T12290] dump_stack_lvl+0x189/0x250 [ 617.841749][T12290] ? __pfx____ratelimit+0x10/0x10 [ 617.841765][T12290] ? __pfx_dump_stack_lvl+0x10/0x10 [ 617.841779][T12290] ? __pfx__printk+0x10/0x10 [ 617.841794][T12290] ? __pfx___might_resched+0x10/0x10 [ 617.841815][T12290] ? fs_reclaim_acquire+0x7d/0x100 [ 617.841833][T12290] should_fail_ex+0x414/0x560 [ 617.841849][T12290] should_failslab+0xa8/0x100 [ 617.841863][T12290] __kmalloc_noprof+0xcb/0x4f0 [ 617.841875][T12290] ? kfree+0x4d/0x440 [ 617.841884][T12290] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 617.841902][T12290] tomoyo_realpath_from_path+0xe3/0x5d0 [ 617.841918][T12290] ? tomoyo_domain+0xda/0x130 [ 617.841936][T12290] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 617.841948][T12290] tomoyo_path_number_perm+0x1e8/0x5a0 [ 617.841962][T12290] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 617.841984][T12290] ? __lock_acquire+0xab9/0xd20 [ 617.842009][T12290] ? __fget_files+0x2a/0x420 [ 617.842024][T12290] ? __fget_files+0x2a/0x420 [ 617.842037][T12290] ? __fget_files+0x3a0/0x420 [ 617.842049][T12290] ? __fget_files+0x2a/0x420 [ 617.842078][T12290] security_file_ioctl+0xcb/0x2d0 [ 617.842093][T12290] __se_sys_ioctl+0x47/0x170 [ 617.842105][T12290] do_syscall_64+0xfa/0x3b0 [ 617.842119][T12290] ? lockdep_hardirqs_on+0x9c/0x150 [ 617.842134][T12290] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 617.842143][T12290] ? clear_bhb_loop+0x60/0xb0 [ 617.842156][T12290] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 617.842165][T12290] RIP: 0033:0x7f2e3c38e929 [ 617.842175][T12290] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 617.842184][T12290] RSP: 002b:00007f2e3d1ed038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 617.842195][T12290] RAX: ffffffffffffffda RBX: 00007f2e3c5b5fa0 RCX: 00007f2e3c38e929 [ 617.842202][T12290] RDX: 0000200000000380 RSI: 00000000c03864bc RDI: 0000000000000003 [ 617.842209][T12290] RBP: 00007f2e3d1ed090 R08: 0000000000000000 R09: 0000000000000000 [ 617.842215][T12290] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 617.842221][T12290] R13: 0000000000000000 R14: 00007f2e3c5b5fa0 R15: 00007ffe26c7ae38 [ 617.842237][T12290] [ 617.842242][T12290] ERROR: Out of memory at tomoyo_realpath_from_path. [ 618.002803][ T48] usb 4-1: new high-speed USB device number 51 using dummy_hcd [ 618.292670][ T48] usb 4-1: device descriptor read/64, error -71 [ 618.532467][ T48] usb 4-1: new high-speed USB device number 52 using dummy_hcd [ 619.212175][ T48] usb 4-1: device descriptor read/64, error -71 [ 619.322477][ T48] usb usb4-port1: attempt power cycle [ 619.672379][ T48] usb 4-1: new high-speed USB device number 53 using dummy_hcd [ 619.740639][ T48] usb 4-1: device descriptor read/8, error -71 [ 620.032206][ T48] usb 4-1: new high-speed USB device number 54 using dummy_hcd [ 620.382295][ T48] usb 4-1: device descriptor read/8, error -71 [ 620.422779][T12318] RDS: rds_bind could not find a transport for fc00::1, load rds_tcp or rds_rdma? [ 620.608004][ T48] usb usb4-port1: unable to enumerate USB device [ 623.078127][T12342] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 623.303803][T12347] netlink: 8 bytes leftover after parsing attributes in process `syz.8.1842'. [ 623.393598][T12347] overlay: ./file0 is not a directory [ 624.095037][T12358] RDS: rds_bind could not find a transport for fc00::1, load rds_tcp or rds_rdma? [ 625.100931][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 625.110429][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 625.484348][ T49] netdevsim netdevsim9 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 625.665440][T12367] random: crng reseeded on system resumption [ 625.699592][T12366] netlink: 4 bytes leftover after parsing attributes in process `syz.8.1849'. [ 625.828065][ T49] netdevsim netdevsim9 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 625.882961][T12366] team_slave_0: entered promiscuous mode [ 625.888810][T12366] team_slave_1: entered promiscuous mode [ 625.899248][T12366] macvtap1: entered promiscuous mode [ 625.904756][T12366] team0: entered promiscuous mode [ 625.924839][T12366] macvtap1: entered allmulticast mode [ 625.930601][T12366] team0: entered allmulticast mode [ 625.936040][T12366] team_slave_0: entered allmulticast mode [ 625.944338][T12366] team_slave_1: entered allmulticast mode [ 625.951490][T12366] 8021q: adding VLAN 0 to HW filter on device macvtap1 [ 625.971846][T12370] team0: left allmulticast mode [ 625.977078][T12370] team_slave_0: left allmulticast mode [ 626.031045][T12370] team_slave_1: left allmulticast mode [ 626.213056][T12370] team0: left promiscuous mode [ 626.484063][T12370] team_slave_0: left promiscuous mode [ 626.485160][ T2151] usb 8-1: new high-speed USB device number 26 using dummy_hcd [ 626.490185][T12370] team_slave_1: left promiscuous mode [ 626.525189][T12372] netdevsim netdevsim6 netdevsim0: entered allmulticast mode [ 626.650375][ T2151] usb 8-1: device descriptor read/64, error -71 [ 626.685382][ T49] netdevsim netdevsim9 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 626.798948][T11217] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 626.810676][T11217] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 626.847162][T11217] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 626.857885][ T49] netdevsim netdevsim9 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 626.872639][T11217] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 626.883060][T11217] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 626.898830][ T2151] usb 8-1: new high-speed USB device number 27 using dummy_hcd [ 627.078290][ T2151] usb 8-1: device descriptor read/64, error -71 [ 627.188546][ T2151] usb usb8-port1: attempt power cycle [ 627.277681][T12396] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1856'. [ 627.384176][ T49] bridge_slave_1: left allmulticast mode [ 627.396002][ T49] bridge_slave_1: left promiscuous mode [ 627.406080][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 627.506827][T12401] Can't find a SQUASHFS superblock on nullb0 [ 627.890174][ T2151] usb 8-1: new high-speed USB device number 28 using dummy_hcd [ 627.904414][T12400] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1856'. [ 627.977683][ T2151] usb 8-1: device descriptor read/8, error -71 [ 628.435576][ T49] bridge_slave_0: left allmulticast mode [ 628.452817][ T49] bridge_slave_0: left promiscuous mode [ 628.458789][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 628.507845][T12408] RDS: rds_bind could not find a transport for fc00::1, load rds_tcp or rds_rdma? [ 628.559408][T12410] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1860'. [ 628.586425][T12410] overlay: ./file0 is not a directory [ 628.676084][ T2151] usb 8-1: new high-speed USB device number 29 using dummy_hcd [ 628.741267][ T2151] usb 8-1: device descriptor read/8, error -71 [ 628.939327][T11158] Bluetooth: hci1: command tx timeout [ 629.279902][ T2151] usb usb8-port1: unable to enumerate USB device [ 629.956903][ T5840] usb 8-1: new high-speed USB device number 30 using dummy_hcd [ 630.158627][ T5840] usb 8-1: config index 0 descriptor too short (expected 14116, got 36) [ 630.172076][ T5840] usb 8-1: invalid descriptor for config index 0: type = 0x2, length = 235 [ 630.181128][ T5840] usb 8-1: can't read configurations, error -22 [ 630.246041][ T49] IPVS: stopping master sync thread 11893 ... [ 630.327311][ T5840] usb 8-1: new high-speed USB device number 31 using dummy_hcd [ 630.506050][ T5840] usb 8-1: config index 0 descriptor too short (expected 14116, got 36) [ 630.531947][ T5840] usb 8-1: invalid descriptor for config index 0: type = 0x2, length = 235 [ 630.715463][ T5840] usb 8-1: can't read configurations, error -22 [ 630.722449][ T5840] usb usb8-port1: attempt power cycle [ 631.214167][T11158] Bluetooth: hci1: command tx timeout [ 631.276424][ T5840] usb 8-1: new high-speed USB device number 32 using dummy_hcd [ 631.313426][T12381] chnl_net:caif_netlink_parms(): no params data found [ 631.477432][ T5840] usb 8-1: config index 0 descriptor too short (expected 14116, got 36) [ 631.485901][ T5840] usb 8-1: invalid descriptor for config index 0: type = 0x2, length = 235 [ 631.500075][ T5840] usb 8-1: can't read configurations, error -22 [ 631.625407][T12444] random: crng reseeded on system resumption [ 631.656457][ T5840] usb 8-1: new high-speed USB device number 33 using dummy_hcd [ 631.689039][ T49] hsr_slave_0: left promiscuous mode [ 631.695071][ T49] hsr_slave_1: left promiscuous mode [ 631.704105][ T49] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 631.711650][ T5840] usb 8-1: config index 0 descriptor too short (expected 14116, got 36) [ 631.720506][ T49] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 631.727746][ T5840] usb 8-1: invalid descriptor for config index 0: type = 0x2, length = 235 [ 631.744015][ T5840] usb 8-1: can't read configurations, error -22 [ 631.751337][ T49] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 631.759421][ T5840] usb usb8-port1: unable to enumerate USB device [ 631.765945][ T49] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 631.785321][T12448] RDS: rds_bind could not find a transport for fc00::1, load rds_tcp or rds_rdma? [ 631.798312][ T49] veth1_macvtap: left promiscuous mode [ 631.805991][ T49] veth0_macvtap: left promiscuous mode [ 631.811866][ T49] veth1_vlan: left promiscuous mode [ 631.822950][ T49] veth0_vlan: left promiscuous mode [ 632.035778][T10244] usb 4-1: new high-speed USB device number 55 using dummy_hcd [ 632.266227][T10244] usb 4-1: device descriptor read/64, error -71 [ 632.734913][T12452] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1872'. [ 632.748125][T12452] overlay: ./file0 is not a directory [ 632.751375][T10244] usb 4-1: new high-speed USB device number 56 using dummy_hcd [ 632.895269][T10244] usb 4-1: device descriptor read/64, error -71 [ 633.005897][T10244] usb usb4-port1: attempt power cycle [ 633.220802][ T49] team0 (unregistering): Port device team_slave_1 removed [ 633.260053][T11158] Bluetooth: hci1: command tx timeout [ 633.279771][ T49] team0 (unregistering): Port device team_slave_0 removed [ 633.376389][T10244] usb 4-1: new high-speed USB device number 57 using dummy_hcd [ 633.420406][T10244] usb 4-1: device descriptor read/8, error -71 [ 633.687179][T10244] usb 4-1: new high-speed USB device number 58 using dummy_hcd [ 633.732348][T10244] usb 4-1: device descriptor read/8, error -71 [ 633.847080][T10244] usb usb4-port1: unable to enumerate USB device [ 634.031467][T12381] bridge0: port 1(bridge_slave_0) entered blocking state [ 634.039488][T12381] bridge0: port 1(bridge_slave_0) entered disabled state [ 634.047544][T12381] bridge_slave_0: entered allmulticast mode [ 634.110263][T12381] bridge_slave_0: entered promiscuous mode [ 634.262520][T12381] bridge0: port 2(bridge_slave_1) entered blocking state [ 634.339051][T12381] bridge0: port 2(bridge_slave_1) entered disabled state [ 634.388268][T12381] bridge_slave_1: entered allmulticast mode [ 634.414905][T12381] bridge_slave_1: entered promiscuous mode [ 635.160066][T12381] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 635.200914][T12381] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 635.384631][T11158] Bluetooth: hci1: command tx timeout [ 635.837903][T12381] team0: Port device team_slave_0 added [ 635.923836][T12381] team0: Port device team_slave_1 added [ 636.356617][T12485] RDS: rds_bind could not find a transport for fc00::1, load rds_tcp or rds_rdma? [ 636.389422][T12381] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 636.400064][T12381] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 636.517034][T12381] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 637.116775][T12381] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 637.133151][T12381] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 637.173283][T12381] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 637.305554][T12381] hsr_slave_0: entered promiscuous mode [ 637.444584][T12381] hsr_slave_1: entered promiscuous mode [ 637.693391][ T5834] usb 4-1: new high-speed USB device number 59 using dummy_hcd [ 637.813765][T12500] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1886'. [ 637.826662][T12500] overlay: ./file0 is not a directory [ 637.919374][ T5834] usb 4-1: New USB device found, idVendor=05d1, idProduct=2021, bcdDevice=31.00 [ 637.936326][ T5834] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 637.954988][ T5834] usb 4-1: Product: syz [ 637.962988][ T5834] usb 4-1: Manufacturer: syz [ 637.972711][ T5834] usb 4-1: SerialNumber: syz [ 637.986511][ T5834] usb 4-1: config 0 descriptor?? [ 638.095459][ T5834] ftdi_sio 4-1:0.0: FTDI USB Serial Device converter detected [ 638.114171][ T5834] usb 4-1: Detected FT4232HP [ 638.128729][T12507] random: crng reseeded on system resumption [ 638.843772][ T5834] ftdi_sio ttyUSB0: Unable to read latency timer: -71 [ 638.859600][ T5834] ftdi_sio ttyUSB0: Unable to write latency timer: -71 [ 638.868089][ T5834] usb 4-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 638.876515][T12381] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 638.896202][ T5834] usb 4-1: USB disconnect, device number 59 [ 638.917538][ T5834] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 638.928550][ T5834] ftdi_sio 4-1:0.0: device disconnected [ 639.038714][T12381] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 639.181756][T10843] usb 7-1: new high-speed USB device number 9 using dummy_hcd [ 639.712079][T10843] usb 7-1: device descriptor read/64, error -71 [ 639.892959][T12381] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 640.139181][T10843] usb 7-1: new high-speed USB device number 10 using dummy_hcd [ 640.281543][T10843] usb 7-1: device descriptor read/64, error -71 [ 640.342864][T12381] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 640.412041][T10843] usb usb7-port1: attempt power cycle [ 640.635475][T12381] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 640.664454][T12381] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 640.681666][T12527] RDS: rds_bind could not find a transport for fc00::1, load rds_tcp or rds_rdma? [ 640.682739][T12381] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 640.716191][T12381] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 640.751647][T10843] usb 7-1: new high-speed USB device number 11 using dummy_hcd [ 640.774340][T10843] usb 7-1: device descriptor read/8, error -71 [ 641.681104][T10843] usb 7-1: new high-speed USB device number 12 using dummy_hcd [ 641.726416][T10843] usb 7-1: device descriptor read/8, error -71 [ 641.824744][T12544] netlink: 8 bytes leftover after parsing attributes in process `syz.8.1899'. [ 641.864588][T12381] 8021q: adding VLAN 0 to HW filter on device bond0 [ 641.871763][T10843] usb usb7-port1: unable to enumerate USB device [ 641.893410][T12544] overlay: ./file0 is not a directory [ 641.962005][T12381] 8021q: adding VLAN 0 to HW filter on device team0 [ 642.045032][ T9218] bridge0: port 1(bridge_slave_0) entered blocking state [ 642.052308][ T9218] bridge0: port 1(bridge_slave_0) entered forwarding state [ 642.111629][ T9218] bridge0: port 2(bridge_slave_1) entered blocking state [ 642.118810][ T9218] bridge0: port 2(bridge_slave_1) entered forwarding state [ 642.302203][T10843] usb 8-1: new high-speed USB device number 34 using dummy_hcd [ 642.500703][T10843] usb 8-1: Using ep0 maxpacket: 32 [ 642.514731][T10843] usb 8-1: config 0 has an invalid interface number: 85 but max is 0 [ 642.550399][T10843] usb 8-1: config 0 has no interface number 0 [ 642.556580][T10843] usb 8-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 642.585836][T12381] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 642.600491][T10843] usb 8-1: config 0 interface 85 has no altsetting 0 [ 642.624841][T10843] usb 8-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 642.655031][T10843] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 642.688121][T10843] usb 8-1: Product: syz [ 642.723458][T10843] usb 8-1: Manufacturer: syz [ 642.743156][T10843] usb 8-1: SerialNumber: syz [ 642.777031][T12381] veth0_vlan: entered promiscuous mode [ 642.796055][T12381] veth1_vlan: entered promiscuous mode [ 642.797962][T10843] usb 8-1: config 0 descriptor?? [ 643.281257][T12381] veth0_macvtap: entered promiscuous mode [ 643.590819][T10843] appletouch 8-1:0.85: Geyser mode initialized. [ 643.595445][T12381] veth1_macvtap: entered promiscuous mode [ 643.607509][T10843] input: appletouch as /devices/platform/dummy_hcd.7/usb8/8-1/8-1:0.85/input/input31 [ 643.712263][T12381] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 643.798741][T10843] usb 8-1: USB disconnect, device number 34 [ 643.804975][ C1] appletouch 8-1:0.85: atp_complete: usb_submit_urb failed with result -19 [ 643.874037][T12381] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 643.912155][T10843] appletouch 8-1:0.85: input: appletouch disconnected [ 643.926359][T12381] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 643.942652][T12381] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 643.955489][T12381] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 643.973615][T12381] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 644.079788][ T2151] usb 9-1: new high-speed USB device number 15 using dummy_hcd [ 644.090291][T12578] netlink: 212376 bytes leftover after parsing attributes in process `syz.6.1908'. [ 644.113877][ T9218] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 644.125123][ T9218] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 644.166605][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 644.175912][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 644.236392][ T2151] usb 9-1: device descriptor read/64, error -71 [ 644.349668][T12405] usb 7-1: new high-speed USB device number 13 using dummy_hcd [ 644.489648][ T2151] usb 9-1: new high-speed USB device number 16 using dummy_hcd [ 644.519661][T12405] usb 7-1: Using ep0 maxpacket: 8 [ 644.526784][T12405] usb 7-1: config 179 has an invalid interface number: 65 but max is 0 [ 644.536582][T12405] usb 7-1: config 179 has no interface number 0 [ 644.549453][T12405] usb 7-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9 [ 644.568895][T12405] usb 7-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024 [ 644.582436][T12405] usb 7-1: config 179 interface 65 altsetting 12 has an invalid descriptor for endpoint zero, skipping [ 644.596198][T12405] usb 7-1: config 179 interface 65 altsetting 12 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 644.615186][T12405] usb 7-1: config 179 interface 65 has no altsetting 0 [ 644.623207][ T5946] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 644.624566][T12405] usb 7-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 644.640369][T10843] usb 8-1: new high-speed USB device number 35 using dummy_hcd [ 644.648819][ T2151] usb 9-1: device descriptor read/64, error -71 [ 644.674804][T12405] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 644.779890][ T2151] usb usb9-port1: attempt power cycle [ 644.789318][ T5946] usb 2-1: Using ep0 maxpacket: 32 [ 644.796172][ T5946] usb 2-1: config 0 has an invalid interface number: 12 but max is 0 [ 644.809240][ T5946] usb 2-1: config 0 has no interface number 0 [ 644.815370][ T5946] usb 2-1: config 0 interface 12 has no altsetting 0 [ 644.819328][T10843] usb 8-1: Using ep0 maxpacket: 16 [ 644.831884][T10843] usb 8-1: config 3 has an invalid interface number: 190 but max is 2 [ 644.831899][ T5946] usb 2-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 644.843723][T10843] usb 8-1: config 3 has an invalid interface number: 193 but max is 2 [ 644.864957][T10843] usb 8-1: config 3 has an invalid interface number: 28 but max is 2 [ 644.869201][ T5946] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 644.873792][T10843] usb 8-1: config 3 contains an unexpected descriptor of type 0x2, skipping [ 644.883060][ T5946] usb 2-1: Product: syz [ 644.894353][ T5946] usb 2-1: Manufacturer: syz [ 644.898986][ T5946] usb 2-1: SerialNumber: syz [ 644.906493][T10843] usb 8-1: config 3 has an invalid interface number: 208 but max is 2 [ 644.915141][T10843] usb 8-1: config 3 contains an unexpected descriptor of type 0x2, skipping [ 644.928183][T10843] usb 8-1: config 3 has 4 interfaces, different from the descriptor's value: 3 [ 644.930261][ T5946] usb 2-1: config 0 descriptor?? [ 644.938879][T10843] usb 8-1: config 3 has no interface number 0 [ 644.951670][ T5840] usb 7-1: USB disconnect, device number 13 [ 644.953150][T10843] usb 8-1: config 3 has no interface number 1 [ 644.964330][T10843] usb 8-1: config 3 has no interface number 2 [ 644.970909][T10843] usb 8-1: config 3 has no interface number 3 [ 644.977433][T10843] usb 8-1: config 3 interface 190 altsetting 16 endpoint 0x9 has invalid maxpacket 512, setting to 64 [ 644.988975][T10843] usb 8-1: config 3 interface 190 altsetting 16 endpoint 0xB has invalid maxpacket 1023, setting to 64 [ 645.000602][T10843] usb 8-1: config 3 interface 190 altsetting 16 has a duplicate endpoint with address 0x4, skipping [ 645.014212][T10843] usb 8-1: config 3 interface 190 altsetting 16 has a duplicate endpoint with address 0xB, skipping [ 645.036042][T10843] usb 8-1: config 3 interface 190 altsetting 16 has 7 endpoint descriptors, different from the interface descriptor's value: 16 [ 645.057777][T10843] usb 8-1: too many endpoints for config 3 interface 193 altsetting 20: 146, using maximum allowed: 30 [ 645.073802][T10843] usb 8-1: config 3 interface 193 altsetting 20 endpoint 0x6 has invalid maxpacket 1024, setting to 64 [ 645.085730][T10843] usb 8-1: config 3 interface 193 altsetting 20 bulk endpoint 0x3 has invalid maxpacket 64 [ 645.099872][T10843] usb 8-1: config 3 interface 193 altsetting 20 has an invalid descriptor for endpoint zero, skipping [ 645.114278][T10843] usb 8-1: config 3 interface 193 altsetting 20 has an invalid descriptor for endpoint zero, skipping [ 645.126337][T10843] usb 8-1: config 3 interface 193 altsetting 20 has a duplicate endpoint with address 0x4, skipping [ 645.137727][ T2151] usb 9-1: new high-speed USB device number 17 using dummy_hcd [ 645.154132][T10843] usb 8-1: config 3 interface 193 altsetting 20 endpoint 0x5 has invalid maxpacket 1024, setting to 64 [ 645.167524][T10843] usb 8-1: config 3 interface 193 altsetting 20 has an invalid descriptor for endpoint zero, skipping [ 645.188406][T10843] usb 8-1: config 3 interface 193 altsetting 20 has a duplicate endpoint with address 0x9, skipping [ 645.200142][ T2151] usb 9-1: device descriptor read/8, error -71 [ 645.210735][T10843] usb 8-1: config 3 interface 193 altsetting 20 has 9 endpoint descriptors, different from the interface descriptor's value: 146 [ 645.226905][T10843] usb 8-1: config 3 interface 28 altsetting 68 has an invalid descriptor for endpoint zero, skipping [ 645.243595][T10843] usb 8-1: config 3 interface 208 altsetting 7 has an invalid descriptor for endpoint zero, skipping [ 645.258010][T10843] usb 8-1: config 3 interface 208 altsetting 7 endpoint 0xD has an invalid bInterval 247, changing to 7 [ 645.275864][T10843] usb 8-1: config 3 interface 208 altsetting 7 has an invalid descriptor for endpoint zero, skipping [ 645.287419][T10843] usb 8-1: config 3 interface 208 altsetting 7 has a duplicate endpoint with address 0x3, skipping [ 645.302570][T10843] usb 8-1: config 3 interface 208 altsetting 7 endpoint 0xF has invalid maxpacket 512, setting to 64 [ 645.314843][T10843] usb 8-1: config 3 interface 208 altsetting 7 has a duplicate endpoint with address 0xC, skipping [ 645.330755][T10843] usb 8-1: config 3 interface 208 altsetting 7 has a duplicate endpoint with address 0x3, skipping [ 645.344180][T10843] usb 8-1: config 3 interface 208 altsetting 7 has an invalid descriptor for endpoint zero, skipping [ 645.356888][T10843] usb 8-1: config 3 interface 208 altsetting 7 has a duplicate endpoint with address 0x2, skipping [ 645.375568][T10843] usb 8-1: config 3 interface 208 altsetting 7 has a duplicate endpoint with address 0x9, skipping [ 645.393832][T10843] usb 8-1: config 3 interface 208 altsetting 7 has a duplicate endpoint with address 0xD, skipping [ 645.407191][T10843] usb 8-1: config 3 interface 190 has no altsetting 0 [ 645.418507][T10843] usb 8-1: config 3 interface 193 has no altsetting 0 [ 645.425466][T10843] usb 8-1: config 3 interface 28 has no altsetting 0 [ 645.436266][T10843] usb 8-1: config 3 interface 208 has no altsetting 0 [ 645.445688][T10843] usb 8-1: New USB device found, idVendor=3034, idProduct=7500, bcdDevice=9d.a8 [ 645.455271][ T2151] usb 9-1: new high-speed USB device number 18 using dummy_hcd [ 645.467890][T10843] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 645.476035][T10843] usb 8-1: Product: Ⰹ [ 645.487476][T10843] usb 8-1: Manufacturer: 㝜꟰䎂慿섷垁鮔堄☁엗琏彷곳☩㢋럗縻〉븲嵠㥈븀跏㱵Ꮥ糹ꂫ风欆쬞㶲䂪䗨昚튋➃讜홲䝓덴膺哻䷚൹쀺흍鹁倒ἱ匸ᴆᱎ噈莸 [ 645.508438][ T2151] usb 9-1: device descriptor read/8, error -71 [ 645.516333][T10843] usb 8-1: SerialNumber: ј [ 645.794347][ T2151] usb usb9-port1: unable to enumerate USB device [ 645.823977][T10843] dvb-usb: found a 'Prof 7500 USB DVB-S2' in cold state, will try to load a firmware [ 645.835791][T10843] usb 8-1: Direct firmware load for dvb-usb-p7500.fw failed with error -2 [ 645.844546][T10843] usb 8-1: Falling back to sysfs fallback for: dvb-usb-p7500.fw [ 645.906265][T12591] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1912'. [ 645.920705][T12591] overlay: ./file0 is not a directory [ 646.714572][T12600] netlink: 'syz.7.1915': attribute type 12 has an invalid length. [ 646.725198][T12600] netlink: 9472 bytes leftover after parsing attributes in process `syz.7.1915'. [ 647.296339][ T5840] usb 7-1: new high-speed USB device number 14 using dummy_hcd [ 649.411344][ T5946] f81534 2-1:0.12: f81534_get_register: reg: 1003 failed: -32 [ 649.807519][ T2151] usb 9-1: new high-speed USB device number 19 using dummy_hcd [ 650.166743][ T2151] usb 9-1: Using ep0 maxpacket: 32 [ 650.238313][ T2151] usb 9-1: New USB device found, idVendor=256c, idProduct=006e, bcdDevice= 0.00 [ 650.287992][ T2151] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 650.441491][ T2151] usb 9-1: config 0 descriptor?? [ 651.319596][ T5946] f81534 2-1:0.12: f81534_find_config_idx: read failed: -32 [ 651.327338][ T5946] f81534 2-1:0.12: f81534_calc_num_ports: find idx failed: -32 [ 651.334989][ T5946] f81534 2-1:0.12: probe with driver f81534 failed with error -32 [ 651.348762][ T5946] usb 2-1: USB disconnect, device number 12 [ 651.739589][T12633] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 651.748427][T12633] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 651.885907][T11217] Bluetooth: hci6: command 0x0406 tx timeout [ 652.299208][T12635] RDS: rds_bind could not find a transport for fc00::1, load rds_tcp or rds_rdma? [ 652.480484][ T2151] usb 9-1: string descriptor 0 read error: -71 [ 652.487829][ T2151] uclogic 0003:256C:006E.000F: failed retrieving string descriptor #200: -71 [ 653.218613][ T2151] uclogic 0003:256C:006E.000F: failed retrieving pen parameters: -71 [ 653.625275][ T2151] uclogic 0003:256C:006E.000F: failed probing pen v2 parameters: -71 [ 653.633460][ T2151] uclogic 0003:256C:006E.000F: failed probing parameters: -71 [ 653.685014][ T2151] uclogic 0003:256C:006E.000F: probe with driver uclogic failed with error -71 [ 653.738554][ T2151] usb 9-1: USB disconnect, device number 19 [ 653.853980][T12605] syz.3.1916 (12605): drop_caches: 2 [ 654.243779][T12655] netlink: 828 bytes leftover after parsing attributes in process `syz.1.1928'. [ 654.264990][T12667] netlink: 24 bytes leftover after parsing attributes in process `syz.7.1930'. [ 655.044294][T12672] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1933'. [ 655.077435][ T5921] usb 2-1: new full-speed USB device number 13 using dummy_hcd [ 655.230529][T12675] netlink: 'syz.8.1934': attribute type 10 has an invalid length. [ 655.236035][ T5921] usb 2-1: config index 0 descriptor too short (expected 1060, got 36) [ 655.262205][ T5921] usb 2-1: config 0 has an invalid interface number: 138 but max is -1 [ 655.278415][T12678] RDS: rds_bind could not find a transport for fc00::1, load rds_tcp or rds_rdma? [ 655.283476][T12675] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 655.466430][ T5921] usb 2-1: config 0 has an invalid descriptor of length 237, skipping remainder of the config [ 655.475406][T12681] xt_TPROXY: Can be used only with -p tcp or -p udp [ 655.477749][ T5921] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 655.493315][ T5921] usb 2-1: config 0 has no interface number 0 [ 655.500370][ T5921] usb 2-1: config 0 interface 138 altsetting 0 has an endpoint descriptor with address 0x61, changing to 0x1 [ 655.512823][ T5921] usb 2-1: config 0 interface 138 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 655.526581][ T5921] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a0, bcdDevice=c8.66 [ 655.535765][ T5921] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 656.072784][ T5921] usb 2-1: config 0 descriptor?? [ 656.097725][ T5921] usbtest 2-1:0.138: couldn't get endpoints, -22 [ 656.214169][ T5921] usbtest 2-1:0.138: probe with driver usbtest failed with error -22 [ 656.486235][T12689] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1938'. [ 656.495701][T12689] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1938'. [ 657.081947][T12699] netlink: 8 bytes leftover after parsing attributes in process `syz.8.1941'. [ 657.115783][T12699] netlink: 8 bytes leftover after parsing attributes in process `syz.8.1941'. [ 657.739188][ T5946] usb 2-1: USB disconnect, device number 13 [ 657.943247][T12715] RDS: rds_bind could not find a transport for fc00::1, load rds_tcp or rds_rdma? [ 660.607217][T12739] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1953'. [ 661.041422][ T2151] usb 9-1: new high-speed USB device number 20 using dummy_hcd [ 661.111187][T12405] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 661.216575][ T2151] usb 9-1: config index 0 descriptor too short (expected 38, got 36) [ 661.226935][ T2151] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 661.243264][ T2151] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 661.257602][ T2151] usb 9-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 661.269042][ T2151] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 661.277239][T12405] usb 2-1: Using ep0 maxpacket: 8 [ 661.288662][T12405] usb 2-1: config 0 has an invalid interface number: 55 but max is 0 [ 661.299331][ T2151] usb 9-1: config 0 descriptor?? [ 661.304527][T12405] usb 2-1: config 0 has no interface number 0 [ 661.310974][T12405] usb 2-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 661.325920][T12405] usb 2-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 661.337765][T12405] usb 2-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 661.351164][T12405] usb 2-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 661.360247][T12405] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 661.371171][T12405] usb 2-1: config 0 descriptor?? [ 661.378353][T12405] ldusb 2-1:0.55: Interrupt in endpoint not found [ 661.586485][T12750] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 661.598134][T12750] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 661.767621][ T5946] usb 2-1: USB disconnect, device number 14 [ 662.187775][T12742] overlayfs: failed to resolve './file0': -2 [ 662.722847][T12763] binder: BINDER_SET_CONTEXT_MGR already set [ 662.770581][T12763] binder: 12759:12763 ioctl 4018620d 200000000040 returned -16 [ 662.825735][ T2151] usb 9-1: string descriptor 0 read error: -71 [ 662.850321][ T2151] uclogic 0003:256C:006D.0010: failed retrieving string descriptor #200: -71 [ 662.883445][ T2151] uclogic 0003:256C:006D.0010: failed retrieving pen parameters: -71 [ 662.911048][ T2151] uclogic 0003:256C:006D.0010: failed probing pen v2 parameters: -71 [ 662.930901][T12767] RDS: rds_bind could not find a transport for fc00::1, load rds_tcp or rds_rdma? [ 662.953569][ T2151] uclogic 0003:256C:006D.0010: failed probing parameters: -71 [ 663.087923][ T2151] uclogic 0003:256C:006D.0010: probe with driver uclogic failed with error -71 [ 663.109735][ T2151] usb 9-1: USB disconnect, device number 20 [ 663.408366][T12771] ufs: You didn't specify the type of your ufs filesystem [ 663.408366][T12771] [ 663.408366][T12771] mount -t ufs -o ufstype=sun|sunx86|44bsd|ufs2|5xbsd|old|hp|nextstep|nextstep-cd|openstep ... [ 663.408366][T12771] [ 663.408366][T12771] >>>WARNING<<< Wrong ufstype may corrupt your filesystem, default is ufstype=old [ 663.452347][T12771] ufs: ufstype=old is supported read-only [ 663.724600][T12771] ufs: ufs_fill_super(): bad magic number [ 664.485728][T12792] CIFS: iocharset name too long [ 665.408827][T12805] RDS: rds_bind could not find a transport for fc00::1, load rds_tcp or rds_rdma? [ 666.398507][T12405] usb 9-1: new high-speed USB device number 21 using dummy_hcd [ 666.700835][T12405] usb 9-1: config index 0 descriptor too short (expected 38, got 36) [ 666.729028][T12405] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 666.862091][T12405] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 666.871999][T12405] usb 9-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 666.881664][T12405] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 666.893193][T12405] usb 9-1: config 0 descriptor?? [ 667.073691][T12827] ttyS ttyS3: ldisc open failed (-12), clearing slot 3 [ 667.164340][T11217] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 667.177284][T11217] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 667.745412][T11217] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 667.868503][T12405] usb 9-1: string descriptor 0 read error: -71 [ 667.876680][T12405] uclogic 0003:256C:006D.0011: failed retrieving string descriptor #200: -71 [ 667.887391][T12405] uclogic 0003:256C:006D.0011: failed retrieving pen parameters: -71 [ 667.889456][T11217] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 667.895532][T12405] uclogic 0003:256C:006D.0011: failed probing pen v2 parameters: -71 [ 667.907990][T11217] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 667.910908][T12405] uclogic 0003:256C:006D.0011: failed probing parameters: -71 [ 667.911026][T12405] uclogic 0003:256C:006D.0011: probe with driver uclogic failed with error -71 [ 667.914482][T12405] usb 9-1: USB disconnect, device number 21 [ 668.171814][T12850] binder_alloc: 12843: binder_alloc_buf, no vma [ 668.191670][T12850] binder: 12843:12850 ioctl c0306201 200000000700 returned -14 [ 668.226248][T12831] chnl_net:caif_netlink_parms(): no params data found [ 668.499007][T12831] bridge0: port 1(bridge_slave_0) entered blocking state [ 668.521212][T12831] bridge0: port 1(bridge_slave_0) entered disabled state [ 668.669929][T12831] bridge_slave_0: entered allmulticast mode [ 668.681388][T12831] bridge_slave_0: entered promiscuous mode [ 668.739349][T12831] bridge0: port 2(bridge_slave_1) entered blocking state [ 668.758394][T12831] bridge0: port 2(bridge_slave_1) entered disabled state [ 668.781788][T12831] bridge_slave_1: entered allmulticast mode [ 668.881124][T12831] bridge_slave_1: entered promiscuous mode [ 668.905029][T12865] wg2: entered promiscuous mode [ 668.917196][T12865] wg2: entered allmulticast mode [ 669.194957][T12878] netlink: zone id is out of range [ 669.500146][T12878] netlink: zone id is out of range [ 669.515937][T12878] netlink: zone id is out of range [ 669.566726][T12831] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 669.610144][T12831] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 669.652204][T12878] netlink: set zone limit has 4 unknown bytes [ 669.708427][T12831] team0: Port device team_slave_0 added [ 669.730193][T12831] team0: Port device team_slave_1 added [ 669.871774][T12831] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 669.882648][T12831] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 669.908552][ C1] vkms_vblank_simulate: vblank timer overrun [ 669.958234][T11217] Bluetooth: hci5: command tx timeout [ 670.090726][T12831] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 670.106358][T12831] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 670.113395][T12831] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 670.139282][ C1] vkms_vblank_simulate: vblank timer overrun [ 670.146432][T12831] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 671.166239][ T5886] usb 4-1: new high-speed USB device number 60 using dummy_hcd [ 671.183519][T12831] hsr_slave_0: entered promiscuous mode [ 671.267215][T12831] hsr_slave_1: entered promiscuous mode [ 671.287711][T12831] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 671.315689][T12831] Cannot create hsr debugfs directory [ 671.341136][ T5886] usb 4-1: config index 0 descriptor too short (expected 38, got 36) [ 671.352399][ T5886] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 671.410571][ T5886] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 671.437300][ T5886] usb 4-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 671.521584][ T5886] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 671.588242][ T5886] usb 4-1: config 0 descriptor?? [ 671.660015][T12921] netlink: 'syz.7.2002': attribute type 8 has an invalid length. [ 672.045038][T11217] Bluetooth: hci5: command tx timeout [ 672.889691][ T5886] usb 4-1: string descriptor 0 read error: -71 [ 672.898310][ T5886] uclogic 0003:256C:006D.0012: failed retrieving string descriptor #200: -71 [ 672.938178][ T5886] uclogic 0003:256C:006D.0012: failed retrieving pen parameters: -71 [ 673.000774][ T5886] uclogic 0003:256C:006D.0012: failed probing pen v2 parameters: -71 [ 673.031584][ T5886] uclogic 0003:256C:006D.0012: failed probing parameters: -71 [ 673.063724][ T5886] uclogic 0003:256C:006D.0012: probe with driver uclogic failed with error -71 [ 673.123312][ T5886] usb 4-1: USB disconnect, device number 60 [ 673.217114][T12936] netlink: 'syz.8.2006': attribute type 8 has an invalid length. [ 673.940822][T12831] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 674.037609][T12831] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 674.105857][T12831] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 674.125507][T11217] Bluetooth: hci5: command tx timeout [ 674.128739][T12831] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 674.507788][T12951] kvm: MWAIT instruction emulated as NOP! [ 674.581692][T12831] 8021q: adding VLAN 0 to HW filter on device bond0 [ 674.864914][T12831] 8021q: adding VLAN 0 to HW filter on device team0 [ 674.904671][ T5961] bridge0: port 1(bridge_slave_0) entered blocking state [ 674.911918][ T5961] bridge0: port 1(bridge_slave_0) entered forwarding state [ 674.955325][T12967] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2012'. [ 674.979156][ T5961] bridge0: port 2(bridge_slave_1) entered blocking state [ 674.986363][ T5961] bridge0: port 2(bridge_slave_1) entered forwarding state [ 675.318435][T12974] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2014'. [ 676.126152][T12831] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 676.196121][T11217] Bluetooth: hci5: command tx timeout [ 676.220905][T12831] veth0_vlan: entered promiscuous mode [ 676.235840][T12831] veth1_vlan: entered promiscuous mode [ 676.295155][T12831] veth0_macvtap: entered promiscuous mode [ 676.308524][T12831] veth1_macvtap: entered promiscuous mode [ 676.336258][T12831] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 676.374284][ T5886] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 676.384719][T12831] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 676.395707][ T5834] usb 9-1: new high-speed USB device number 22 using dummy_hcd [ 676.440134][T12831] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 676.463442][T12831] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 676.473099][T12831] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 676.486615][T12831] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 676.573762][ T5834] usb 9-1: Using ep0 maxpacket: 32 [ 676.583807][ T5886] usb 2-1: config index 0 descriptor too short (expected 38, got 36) [ 676.618245][ T5886] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 676.653796][ T5834] usb 9-1: config 0 has an invalid interface number: 12 but max is 0 [ 676.662511][ T5834] usb 9-1: config 0 has no interface number 0 [ 676.671793][ T5834] usb 9-1: config 0 interface 12 has no altsetting 0 [ 676.681720][ T5886] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 676.705421][ T5834] usb 9-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 676.720269][ T5886] usb 2-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 676.732576][ T5834] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 676.740370][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 676.746211][ T5834] usb 9-1: Product: syz [ 676.753007][ T5886] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 676.762886][ T5834] usb 9-1: Manufacturer: syz [ 676.768187][ T5834] usb 9-1: SerialNumber: syz [ 676.782595][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 676.785822][ T5886] usb 2-1: config 0 descriptor?? [ 676.889057][ T5834] usb 9-1: config 0 descriptor?? [ 677.379631][ T5961] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 677.402993][ T5961] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 677.645563][ T5886] usb 2-1: string descriptor 0 read error: -71 [ 677.676550][ T5886] uclogic 0003:256C:006D.0013: failed retrieving string descriptor #200: -71 [ 677.696048][ T5886] uclogic 0003:256C:006D.0013: failed retrieving pen parameters: -71 [ 677.747805][ T5886] uclogic 0003:256C:006D.0013: failed probing pen v2 parameters: -71 [ 677.763367][ T5886] uclogic 0003:256C:006D.0013: failed probing parameters: -71 [ 677.771076][ T5886] uclogic 0003:256C:006D.0013: probe with driver uclogic failed with error -71 [ 677.812338][ T5886] usb 2-1: USB disconnect, device number 15 [ 678.795029][ T5834] f81534 9-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 678.862478][ T5834] f81534 9-1:0.12: f81534_find_config_idx: read failed: -71 [ 678.877930][ T5834] f81534 9-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 678.886808][ T5834] f81534 9-1:0.12: probe with driver f81534 failed with error -71 [ 678.917075][ T5834] usb 9-1: USB disconnect, device number 22 [ 680.922573][ T5834] usb 9-1: new high-speed USB device number 23 using dummy_hcd [ 681.221052][ T5834] usb 9-1: Using ep0 maxpacket: 32 [ 681.246187][ T5834] usb 9-1: unable to read config index 0 descriptor/start: -61 [ 681.256998][ T5834] usb 9-1: can't read configurations, error -61 [ 681.429214][T13057] No such timeout policy "syz0" [ 681.569463][ T5834] usb 9-1: new high-speed USB device number 24 using dummy_hcd [ 681.791476][ T5834] usb 9-1: Using ep0 maxpacket: 32 [ 681.836169][ T5834] usb 9-1: unable to read config index 0 descriptor/start: -61 [ 681.843849][ T5834] usb 9-1: can't read configurations, error -61 [ 681.850812][ T5834] usb usb9-port1: attempt power cycle [ 682.460720][ T5834] usb 9-1: new high-speed USB device number 25 using dummy_hcd [ 682.490995][ T5834] usb 9-1: Using ep0 maxpacket: 32 [ 682.498062][ T5834] usb 9-1: unable to read config index 0 descriptor/start: -61 [ 682.516515][ T5834] usb 9-1: can't read configurations, error -61 [ 682.701567][ T5834] usb 9-1: new high-speed USB device number 26 using dummy_hcd [ 683.083440][ T5834] usb 9-1: device descriptor read/8, error -71 [ 683.203375][ T5834] usb usb9-port1: unable to enumerate USB device [ 683.407273][T13082] netlink: 332 bytes leftover after parsing attributes in process `syz.7.2041'. [ 683.420065][T13082] netlink: 'syz.7.2041': attribute type 9 has an invalid length. [ 683.427854][T13082] netlink: 108 bytes leftover after parsing attributes in process `syz.7.2041'. [ 683.470743][T13082] netlink: 32 bytes leftover after parsing attributes in process `syz.7.2041'. [ 685.582149][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 685.588898][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 688.502818][T13142] mkiss: ax0: crc mode is auto. [ 688.516701][T13146] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2062'. [ 688.533155][T13142] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2061'. [ 688.576646][T13147] netlink: 12 bytes leftover after parsing attributes in process `syz.8.2063'. [ 689.315090][T11217] Bluetooth: hci5: command tx timeout [ 689.517077][T13146] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2062'. [ 689.526022][T13146] netlink: 'syz.0.2062': attribute type 14 has an invalid length. [ 689.556489][T13146] netlink: 'syz.0.2062': attribute type 12 has an invalid length. [ 689.723688][T13136] syz.3.2060 (13136): drop_caches: 1 [ 690.330155][T13134] syz.3.2060 (13134): drop_caches: 1 [ 691.901995][ T5946] hid-generic 0005:16BF:5505.0014: unknown main item tag 0x0 [ 691.926099][ T5946] hid-generic 0005:16BF:5505.0014: hidraw0: BLUETOOTH HID vc3.b8 Device [syz0] on aa:aa:aa:aa:aa:aa [ 692.115740][ T2151] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 692.715487][T13192] netlink: 12 bytes leftover after parsing attributes in process `syz.7.2074'. [ 692.748770][ T2151] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 693.086792][ T2151] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 693.100684][ T2151] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 693.209570][ T2151] usb 2-1: config 0 descriptor?? [ 693.758876][T13206] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2077'. [ 694.440743][ T2151] ath6kl: Failed to submit usb control message: -110 [ 694.468278][ T2151] ath6kl: unable to send the bmi data to the device: -110 [ 694.484292][ T2151] ath6kl: Unable to send get target info: -110 [ 694.497649][ T2151] ath6kl: Failed to init ath6kl core: -110 [ 694.531147][ T2151] ath6kl_usb 2-1:0.0: probe with driver ath6kl_usb failed with error -110 [ 694.710186][T13227] netlink: 104 bytes leftover after parsing attributes in process `syz.8.2081'. [ 695.055082][T13226] netlink: 8 bytes leftover after parsing attributes in process `syz.7.2082'. [ 695.483311][ T2151] usb 2-1: USB disconnect, device number 16 [ 695.548062][T13232] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 696.557635][T13234] netlink: 12 bytes leftover after parsing attributes in process `syz.8.2085'. [ 698.712331][ T5834] usb 2-1: new full-speed USB device number 17 using dummy_hcd [ 698.878733][ T5834] usb 2-1: unable to get BOS descriptor or descriptor too short [ 698.895183][ T5834] usb 2-1: not running at top speed; connect to a high speed hub [ 698.935951][ T5834] usb 2-1: config 1 interface 0 altsetting 249 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 698.976120][ T5834] usb 2-1: config 1 interface 0 has no altsetting 0 [ 698.995031][ T5834] usb 2-1: New USB device found, idVendor=05ac, idProduct=0236, bcdDevice= 0.40 [ 699.014689][ T5834] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 699.030683][ T5834] usb 2-1: Product: syz [ 699.034945][ T5834] usb 2-1: Manufacturer: syz [ 699.039556][ T5834] usb 2-1: SerialNumber: syz [ 699.296656][T13270] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2096'. [ 701.581611][ T5834] input: bcm5974 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/input/input33 [ 701.645736][ T5174] bcm5974 2-1:1.0: could not read from device [ 701.789222][ T5834] usb 2-1: USB disconnect, device number 17 [ 701.797552][ T5174] bcm5974 2-1:1.0: could not read from device [ 703.331524][T13315] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 704.522368][T13335] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2112'. [ 705.144724][T13334] xt_TCPMSS: Only works on TCP SYN packets [ 705.316290][T13341] cgroup: name respecified [ 705.513349][T13343] cgroup: name respecified [ 706.436981][T10843] dvb-usb: did not find the firmware file 'dvb-usb-p7500.fw' (status -110). You can use /scripts/get_dvb_firmware to get the firmware [ 706.468914][T10843] dvb-usb: found a 'Prof 7500 USB DVB-S2' in cold state, will try to load a firmware [ 706.637267][T10843] usb 8-1: Direct firmware load for dvb-usb-p7500.fw failed with error -2 [ 706.728427][T10843] usb 8-1: Falling back to sysfs fallback for: dvb-usb-p7500.fw [ 707.833952][T13381] netlink: 12 bytes leftover after parsing attributes in process `syz.8.2127'. [ 707.952321][T13368] ubi31: attaching mtd0 [ 707.973670][T13368] ubi31: scanning is finished [ 707.978669][T13368] ubi31: empty MTD device detected [ 708.523589][T13368] ubi31: attached mtd0 (name "mtdram test device", size 0 MiB) [ 708.531378][T13368] ubi31: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 708.538867][T13368] ubi31: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 708.545928][T13368] ubi31: VID header offset: 64 (aligned 64), data offset: 128 [ 708.553532][T13368] ubi31: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 708.553576][T13368] ubi31: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 708.553590][T13368] ubi31: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 2088084498 [ 708.579939][T13368] ubi31: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 708.595362][T13384] ubi31: background thread "ubi_bgt31d" started, PID 13384 [ 708.762979][T13396] random: crng reseeded on system resumption [ 708.857592][T10244] usb 9-1: new high-speed USB device number 27 using dummy_hcd [ 709.041093][T10244] usb 9-1: Using ep0 maxpacket: 8 [ 709.089264][T10244] usb 9-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 709.103920][T10244] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 709.112413][T10244] usb 9-1: Product: syz [ 709.116838][T10244] usb 9-1: Manufacturer: syz [ 709.123926][T10244] usb 9-1: SerialNumber: syz [ 709.663747][T10244] usb 9-1: config 0 descriptor?? [ 709.688977][T10244] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 709.705453][T10244] usb 9-1: setting power ON [ 709.715874][T10244] dvb-usb: bulk message failed: -22 (2/0) [ 709.730180][T10244] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 709.742499][T10244] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 709.751529][T10244] usb 9-1: media controller created [ 709.784286][T10244] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 709.833950][T10244] usb 9-1: selecting invalid altsetting 6 [ 709.843134][T10244] usb 9-1: digital interface selection failed (-22) [ 709.854859][T10244] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 709.876846][T10244] usb 9-1: setting power OFF [ 709.932838][T13389] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 709.946846][T10244] dvb-usb: bulk message failed: -22 (2/0) [ 709.959175][T10244] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 709.969860][T13389] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 709.979984][T10244] (NULL device *): no alternate interface [ 710.055863][T10244] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 710.074906][T10244] usb 9-1: USB disconnect, device number 27 [ 710.799351][T13419] netlink: 112 bytes leftover after parsing attributes in process `syz.8.2138'. [ 710.818397][T13419] netlink: 5 bytes leftover after parsing attributes in process `syz.8.2138'. [ 710.864634][T13419] netlink: 16 bytes leftover after parsing attributes in process `syz.8.2138'. [ 711.050840][T13424] netlink: 'syz.3.2140': attribute type 3 has an invalid length. [ 711.062988][T13424] netlink: 3 bytes leftover after parsing attributes in process `syz.3.2140'. [ 711.256081][T13000] usb 9-1: new high-speed USB device number 28 using dummy_hcd [ 711.346060][ T2151] usb 4-1: new high-speed USB device number 61 using dummy_hcd [ 711.433806][T13000] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 711.450733][T13000] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 711.461440][T13000] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 711.477842][T13000] usb 9-1: New USB device found, idVendor=0458, idProduct=5011, bcdDevice= 0.00 [ 711.488212][T13000] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 711.504129][T13000] usb 9-1: config 0 descriptor?? [ 711.526297][ T2151] usb 4-1: Using ep0 maxpacket: 32 [ 711.533565][ T2151] usb 4-1: config 0 has an invalid interface number: 202 but max is 0 [ 711.542241][ T2151] usb 4-1: config 0 has no interface number 0 [ 711.556336][ T2151] usb 4-1: config 0 interface 202 altsetting 0 endpoint 0x2 has invalid maxpacket 1023, setting to 64 [ 711.575832][ T2151] usb 4-1: config 0 interface 202 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 711.599436][ T2151] usb 4-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=58.16 [ 711.615835][ T2151] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 711.631372][ T2151] usb 4-1: Product: syz [ 711.638784][ T2151] usb 4-1: Manufacturer: syz [ 711.646766][ T2151] usb 4-1: SerialNumber: syz [ 711.656368][ T2151] usb 4-1: config 0 descriptor?? [ 711.744565][ T2151] usb 4-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 712.039613][T13000] kye 0003:0458:5011.0015: tablet report size too small, or kye_tablet_rdesc unexpectedly large [ 712.053997][T13000] kye 0003:0458:5011.0015: unbalanced collection at end of report description [ 712.063817][T13000] kye 0003:0458:5011.0015: parse failed [ 712.070237][T13000] kye 0003:0458:5011.0015: probe with driver kye failed with error -22 [ 712.139112][T13422] sctp: [Deprecated]: syz.8.2139 (pid 13422) Use of struct sctp_assoc_value in delayed_ack socket option. [ 712.139112][T13422] Use struct sctp_sack_info instead [ 712.163024][T13422] overlayfs: option "workdir=./file0" is useless in a non-upper mount, ignore [ 712.172489][T13422] overlayfs: missing 'lowerdir' [ 712.181417][T10244] usb 9-1: USB disconnect, device number 28 [ 712.188238][ T2151] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 712.326424][ T2151] usb 2-1: device descriptor read/64, error -71 [ 712.695810][ T2151] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 712.827350][ T9218] usb 4-1: Failed to submit usb control message: -110 [ 712.901454][ T9218] usb 4-1: unable to send the bmi data to the device: -110 [ 712.939229][ T2151] usb 2-1: device descriptor read/64, error -71 [ 712.981895][ T9218] usb 4-1: unable to get target info from device [ 713.037079][ T9218] usb 4-1: could not get target info (-110) [ 713.104241][ T9218] usb 4-1: could not probe fw (-110) [ 713.116185][ T2151] usb usb2-port1: attempt power cycle [ 713.341815][T13456] netlink: 56 bytes leftover after parsing attributes in process `syz.7.2149'. [ 713.355887][T13456] netlink: 8 bytes leftover after parsing attributes in process `syz.7.2149'. [ 713.664911][ T2151] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 714.374875][T10244] usb 4-1: USB disconnect, device number 61 [ 714.412404][ T2151] usb 2-1: device descriptor read/8, error -71 [ 714.676790][ T2151] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 714.705050][ T2151] usb 2-1: device descriptor read/8, error -71 [ 714.869151][ T2151] usb usb2-port1: unable to enumerate USB device [ 714.875166][T13478] sctp: [Deprecated]: syz.8.2156 (pid 13478) Use of int in maxseg socket option. [ 714.875166][T13478] Use struct sctp_assoc_value instead [ 715.472388][T13482] FAULT_INJECTION: forcing a failure. [ 715.472388][T13482] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 715.485848][T13482] CPU: 0 UID: 0 PID: 13482 Comm: syz.1.2157 Not tainted 6.16.0-rc3-syzkaller #0 PREEMPT(full) [ 715.485863][T13482] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 715.485871][T13482] Call Trace: [ 715.485876][T13482] [ 715.485881][T13482] dump_stack_lvl+0x189/0x250 [ 715.485901][T13482] ? __pfx____ratelimit+0x10/0x10 [ 715.485916][T13482] ? __pfx_dump_stack_lvl+0x10/0x10 [ 715.485930][T13482] ? __pfx__printk+0x10/0x10 [ 715.485941][T13482] ? fs_reclaim_acquire+0x7d/0x100 [ 715.485960][T13482] should_fail_ex+0x414/0x560 [ 715.485975][T13482] prepare_alloc_pages+0x213/0x610 [ 715.485992][T13482] __alloc_frozen_pages_noprof+0x123/0x370 [ 715.486008][T13482] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 715.486032][T13482] alloc_pages_bulk_noprof+0x560/0x710 [ 715.486049][T13482] ? alloc_pages_noprof+0xbe/0x190 [ 715.486065][T13482] kasan_populate_vmalloc+0xba/0x1a0 [ 715.486078][T13482] alloc_vmap_area+0xd51/0x1490 [ 715.486098][T13482] ? __pfx_alloc_vmap_area+0x10/0x10 [ 715.486109][T13482] ? __kasan_kmalloc+0x93/0xb0 [ 715.486121][T13482] ? __kmalloc_cache_node_noprof+0x234/0x3d0 [ 715.486133][T13482] ? __get_vm_area_node+0x13f/0x300 [ 715.486144][T13482] ? reuseport_array_alloc+0x98/0x130 [ 715.486157][T13482] __get_vm_area_node+0x1f8/0x300 [ 715.486172][T13482] __vmalloc_node_range_noprof+0x301/0x12f0 [ 715.486185][T13482] ? reuseport_array_alloc+0x98/0x130 [ 715.486203][T13482] ? get_pid_task+0x20/0x1f0 [ 715.486219][T13482] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 715.486231][T13482] ? rcu_is_watching+0x15/0xb0 [ 715.486248][T13482] ? safesetid_security_capable+0xa9/0x1a0 [ 715.486262][T13482] bpf_map_area_alloc+0x12d/0x180 [ 715.486276][T13482] ? reuseport_array_alloc+0x98/0x130 [ 715.486288][T13482] reuseport_array_alloc+0x98/0x130 [ 715.486300][T13482] map_create+0x900/0x1150 [ 715.486323][T13482] ? security_bpf+0x7e/0x300 [ 715.486338][T13482] __sys_bpf+0x67e/0x860 [ 715.486350][T13482] ? __pfx___sys_bpf+0x10/0x10 [ 715.486369][T13482] ? ksys_write+0x22a/0x250 [ 715.486381][T13482] ? __pfx_ksys_write+0x10/0x10 [ 715.486391][T13482] ? rcu_is_watching+0x15/0xb0 [ 715.486408][T13482] __x64_sys_bpf+0x7c/0x90 [ 715.486419][T13482] do_syscall_64+0xfa/0x3b0 [ 715.486432][T13482] ? lockdep_hardirqs_on+0x9c/0x150 [ 715.486446][T13482] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 715.486456][T13482] ? clear_bhb_loop+0x60/0xb0 [ 715.486468][T13482] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 715.486477][T13482] RIP: 0033:0x7f30d0d8e929 [ 715.486487][T13482] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 715.486496][T13482] RSP: 002b:00007f30d1bef038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 715.486507][T13482] RAX: ffffffffffffffda RBX: 00007f30d0fb5fa0 RCX: 00007f30d0d8e929 [ 715.486515][T13482] RDX: 0000000000000050 RSI: 0000200000000200 RDI: 0000000000000000 [ 715.486521][T13482] RBP: 00007f30d1bef090 R08: 0000000000000000 R09: 0000000000000000 [ 715.486527][T13482] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 715.486533][T13482] R13: 0000000000000000 R14: 00007f30d0fb5fa0 R15: 00007fff599ad938 [ 715.486549][T13482] [ 716.642006][T13489] netlink: 184 bytes leftover after parsing attributes in process `syz.3.2160'. [ 716.660608][ T30] kauditd_printk_skb: 2 callbacks suppressed [ 716.660621][ T30] audit: type=1326 audit(2000000233.116:262): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13488 comm="syz.3.2160" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7fa4163858e7 code=0x7ffc0000 [ 716.724739][ T30] audit: type=1326 audit(2000000233.116:263): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13488 comm="syz.3.2160" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fa41632ab19 code=0x7ffc0000 [ 716.756358][ T30] audit: type=1326 audit(2000000233.146:264): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13488 comm="syz.3.2160" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa41638e929 code=0x7ffc0000 [ 716.882842][ T30] audit: type=1326 audit(2000000233.156:265): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13488 comm="syz.3.2160" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7fa4163858e7 code=0x7ffc0000 [ 716.996090][ T30] audit: type=1326 audit(2000000233.156:266): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13488 comm="syz.3.2160" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fa41632ab19 code=0x7ffc0000 [ 717.112360][ T30] audit: type=1326 audit(2000000233.156:267): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13488 comm="syz.3.2160" exe="/root/syz-executor" sig=0 arch=c000003e syscall=307 compat=0 ip=0x7fa41638e929 code=0x7ffc0000 [ 717.204727][ T30] audit: type=1326 audit(2000000233.156:268): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13488 comm="syz.3.2160" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7fa4163858e7 code=0x7ffc0000 [ 717.227092][T10244] usb 2-1: new full-speed USB device number 22 using dummy_hcd [ 717.235076][ T30] audit: type=1326 audit(2000000233.156:269): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13488 comm="syz.3.2160" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fa41632ab19 code=0x7ffc0000 [ 717.298064][ T30] audit: type=1326 audit(2000000233.156:270): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13488 comm="syz.3.2160" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa41638e929 code=0x7ffc0000 [ 717.404635][T10244] usb 2-1: New USB device found, idVendor=09c0, idProduct=0203, bcdDevice=d3.43 [ 717.524755][T10244] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 717.624790][T13507] new mount options do not match the existing superblock, will be ignored [ 717.647584][T13507] option changes via remount are deprecated (pid=13503 comm=syz.7.2164) [ 718.081799][T10244] usb 2-1: config 0 descriptor?? [ 718.090321][T10244] dvb-usb: found a 'Genpix SkyWalker-1 DVB-S receiver' in warm state. [ 718.343599][ T5840] usb 4-1: new high-speed USB device number 62 using dummy_hcd [ 718.403462][T10244] gp8psk: usb in 128 operation failed. [ 718.408139][T13497] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 718.515738][T13497] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 718.652613][T11217] Bluetooth: hci0: command 0x0406 tx timeout [ 718.658940][T11158] Bluetooth: hci0: Opcode 0x0401 failed: -110 [ 718.711908][ T5840] usb 4-1: device descriptor read/64, error -71 [ 718.784899][T10244] gp8psk: usb in 137 operation failed. [ 718.790436][T10244] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 718.801663][T10244] dvb-usb: Genpix SkyWalker-1 DVB-S receiver error while loading driver (-19) [ 718.814058][T10244] usb 2-1: USB disconnect, device number 22 [ 718.822358][T13516] syz.7.2168(13516): Attempt to set a LOCK_MAND lock via flock(2). This support has been removed and the request ignored. [ 718.957654][T13521] sctp: [Deprecated]: syz.7.2169 (pid 13521) Use of int in maxseg socket option. [ 718.957654][T13521] Use struct sctp_assoc_value instead [ 719.108549][ T5840] usb 4-1: new high-speed USB device number 63 using dummy_hcd [ 719.280761][ T5840] usb 4-1: device descriptor read/64, error -71 [ 719.412505][ T5840] usb usb4-port1: attempt power cycle [ 719.762170][ T5840] usb 4-1: new high-speed USB device number 64 using dummy_hcd [ 719.859391][ T5840] usb 4-1: device descriptor read/8, error -71 [ 720.211612][ T5840] usb 4-1: new high-speed USB device number 65 using dummy_hcd [ 720.342708][ T5840] usb 4-1: device descriptor read/8, error -71 [ 720.476054][ T5840] usb usb4-port1: unable to enumerate USB device [ 720.482794][T13544] netlink: 104 bytes leftover after parsing attributes in process `syz.8.2177'. [ 721.131333][ T5834] usb 2-1: new full-speed USB device number 23 using dummy_hcd [ 721.147225][T13558] dummy0: entered promiscuous mode [ 721.347858][T13562] sctp: [Deprecated]: syz.3.2183 (pid 13562) Use of int in maxseg socket option. [ 721.347858][T13562] Use struct sctp_assoc_value instead [ 721.349141][ T5834] usb 2-1: New USB device found, idVendor=09c0, idProduct=0203, bcdDevice=d3.43 [ 721.442605][ T5834] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 721.481792][ T5834] usb 2-1: config 0 descriptor?? [ 721.757733][ T5834] dvb-usb: found a 'Genpix SkyWalker-1 DVB-S receiver' in warm state. [ 721.955303][ T5834] gp8psk: usb in 128 operation failed. [ 721.958516][T13556] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 721.969538][T13556] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 721.996679][ T5834] gp8psk: usb in 137 operation failed. [ 722.003246][ T5834] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 722.015685][ T5834] dvb-usb: Genpix SkyWalker-1 DVB-S receiver error while loading driver (-19) [ 722.048230][ T5834] usb 2-1: USB disconnect, device number 23 [ 722.338862][T13575] netlink: 104 bytes leftover after parsing attributes in process `syz.3.2188'. [ 725.390505][T11217] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 725.402083][T11217] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 725.412385][T11217] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 725.424983][T11217] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 725.438618][T11217] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 726.959743][T13616] chnl_net:caif_netlink_parms(): no params data found [ 727.141092][T13616] bridge0: port 1(bridge_slave_0) entered blocking state [ 727.148650][T13616] bridge0: port 1(bridge_slave_0) entered disabled state [ 727.156098][T13616] bridge_slave_0: entered allmulticast mode [ 727.165244][T13616] bridge_slave_0: entered promiscuous mode [ 727.204418][T13616] bridge0: port 2(bridge_slave_1) entered blocking state [ 727.216832][T13616] bridge0: port 2(bridge_slave_1) entered disabled state [ 727.226321][T13616] bridge_slave_1: entered allmulticast mode [ 727.240711][T13616] bridge_slave_1: entered promiscuous mode [ 727.282011][T13616] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 727.303200][T13616] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 727.405690][T13616] team0: Port device team_slave_0 added [ 727.435448][T13616] team0: Port device team_slave_1 added [ 727.553407][T11158] Bluetooth: hci7: command tx timeout [ 727.572914][T13616] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 727.581750][T13616] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 727.608473][T13616] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 727.623247][T13616] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 727.634791][T13616] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 727.661913][T13616] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 727.970988][T13616] hsr_slave_0: entered promiscuous mode [ 728.076847][T13616] hsr_slave_1: entered promiscuous mode [ 728.250413][T13616] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 728.329356][T13655] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 728.793200][T13616] Cannot create hsr debugfs directory [ 729.610125][T11158] Bluetooth: hci7: command tx timeout [ 731.591146][T13686] netlink: 'syz.7.2219': attribute type 1 has an invalid length. [ 731.656110][T13686] 8021q: adding VLAN 0 to HW filter on device bond1 [ 731.706015][T11158] Bluetooth: hci7: command tx timeout [ 732.329066][T13686] bond1: (slave gretap1): making interface the new active one [ 732.342888][T13686] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 732.457249][T13616] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 732.535884][T13616] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 732.563620][T13616] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 732.603548][T13616] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 733.552227][T13616] 8021q: adding VLAN 0 to HW filter on device bond0 [ 733.583568][T13616] 8021q: adding VLAN 0 to HW filter on device team0 [ 733.619486][ T5961] bridge0: port 1(bridge_slave_0) entered blocking state [ 733.626746][ T5961] bridge0: port 1(bridge_slave_0) entered forwarding state [ 733.660340][T13717] netlink: 8 bytes leftover after parsing attributes in process `syz.8.2227'. [ 733.691085][T13717] ------------[ cut here ]------------ [ 733.697905][T13717] WARNING: CPU: 1 PID: 13717 at net/mac80211/rate.c:53 rate_control_rate_init+0x64a/0x6e0 [ 733.708262][T13717] Modules linked in: [ 733.712830][T13717] CPU: 1 UID: 0 PID: 13717 Comm: syz.8.2227 Not tainted 6.16.0-rc3-syzkaller #0 PREEMPT(full) [ 733.723801][T13717] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 733.734321][T13717] RIP: 0010:rate_control_rate_init+0x64a/0x6e0 [ 733.741113][T13717] Code: 82 01 00 00 20 48 83 c4 20 5b 41 5c 41 5d 41 5e 41 5f 5d e9 58 e8 8b 00 cc e8 52 22 ea f6 90 0f 0b 90 eb e1 e8 47 22 ea f6 90 <0f> 0b 90 48 83 c4 20 5b 41 5c 41 5d 41 5e 41 5f 5d e9 90 00 00 00 [ 733.761244][T13717] RSP: 0018:ffffc9000b416ff0 EFLAGS: 00010283 [ 733.768316][T13717] RAX: ffffffff8ad629d9 RBX: ffff8880735cc000 RCX: 0000000000080000 [ 733.776713][T13717] RDX: ffffc90012f90000 RSI: 00000000000032f1 RDI: 00000000000032f2 [ 733.785210][T13717] RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff8ad624f3 [ 733.794062][T13717] R10: dffffc0000000000 R11: ffffed100e6b9831 R12: 1ffff1100e6b980a [ 733.802777][T13717] R13: ffff88804ca20e40 R14: 0000000000000001 R15: ffffffff8ad624f3 [ 733.811364][T13717] FS: 00007fbb391f16c0(0000) GS:ffff888125d85000(0000) knlGS:0000000000000000 [ 733.820822][T13717] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 733.827779][T13717] CR2: 00005555642fe5c8 CR3: 000000007a420000 CR4: 00000000003526f0 [ 733.833703][T13616] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 733.836176][T13717] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000004144 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 733.855122][T13717] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 733.863128][T13717] Call Trace: [ 733.866831][T13717] [ 733.869803][T13717] rate_control_rate_init_all_links+0x109/0x1a0 [ 733.875052][T11158] Bluetooth: hci7: command tx timeout [ 733.876461][T13717] sta_apply_auth_flags+0x1c2/0x400 [ 733.887046][T13717] sta_apply_parameters+0xe4b/0x15b0 [ 733.892693][T13717] ieee80211_add_station+0x424/0x6a0 [ 733.898793][T13717] rdev_add_station+0x108/0x290 [ 733.904651][T13717] nl80211_new_station+0x1723/0x1b40 [ 733.910028][T13717] ? __pfx_nl80211_new_station+0x10/0x10 [ 733.916439][T13717] ? netdev_run_todo+0xe1d/0xea0 [ 733.921449][T13717] ? nl80211_pre_doit+0x4f1/0x930 [ 733.927201][T13717] genl_family_rcv_msg_doit+0x215/0x300 [ 733.932766][T13616] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 733.943178][T13717] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 733.949538][T13717] ? bpf_lsm_capable+0x9/0x20 [ 733.954263][T13717] ? security_capable+0x7e/0x2e0 [ 733.959332][T13717] genl_rcv_msg+0x60e/0x790 [ 733.963885][T13717] ? __pfx_genl_rcv_msg+0x10/0x10 [ 733.969053][T13717] ? ref_tracker_free+0x63a/0x7d0 [ 733.974122][T13717] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 733.979610][T13717] ? __pfx_nl80211_new_station+0x10/0x10 [ 733.985336][T13717] ? __pfx_nl80211_post_doit+0x10/0x10 [ 733.990844][T13717] ? __pfx_ref_tracker_free+0x10/0x10 [ 733.996812][T13717] netlink_rcv_skb+0x208/0x470 [ 734.001642][T13717] ? __pfx_genl_rcv_msg+0x10/0x10 [ 734.008181][T13717] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 734.013541][T13717] ? down_read+0x1ad/0x2e0 [ 734.018610][T13717] genl_rcv+0x28/0x40 [ 734.022640][T13717] netlink_unicast+0x75b/0x8d0 [ 734.027962][T13717] netlink_sendmsg+0x805/0xb30 [ 734.032789][T13717] ? __pfx_netlink_sendmsg+0x10/0x10 [ 734.038200][T13717] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 734.043535][T13717] ? __pfx_netlink_sendmsg+0x10/0x10 [ 734.048908][T13717] __sock_sendmsg+0x21c/0x270 [ 734.053646][T13717] ____sys_sendmsg+0x505/0x830 [ 734.058682][T13717] ? __pfx_____sys_sendmsg+0x10/0x10 [ 734.064030][T13717] ? import_iovec+0x74/0xa0 [ 734.068633][T13717] ___sys_sendmsg+0x21f/0x2a0 [ 734.073342][T13717] ? __pfx____sys_sendmsg+0x10/0x10 [ 734.078693][T13717] ? __fget_files+0x2a/0x420 [ 734.083446][T13717] ? __fget_files+0x3a0/0x420 [ 734.088399][T13717] __x64_sys_sendmsg+0x19b/0x260 [ 734.093389][T13717] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 734.099467][T13717] ? rcu_is_watching+0x15/0xb0 [ 734.104286][T13717] ? do_syscall_64+0xbe/0x3b0 [ 734.109516][T13717] do_syscall_64+0xfa/0x3b0 [ 734.114063][T13717] ? lockdep_hardirqs_on+0x9c/0x150 [ 734.119557][T13717] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 734.126188][T13717] ? clear_bhb_loop+0x60/0xb0 [ 734.130914][T13717] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 734.136986][T13717] RIP: 0033:0x7fbb3838e929 [ 734.141424][T13717] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 734.161170][T13717] RSP: 002b:00007fbb391f1038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 734.169818][T13717] RAX: ffffffffffffffda RBX: 00007fbb385b5fa0 RCX: 00007fbb3838e929 [ 734.177932][T13717] RDX: 0000000000000044 RSI: 0000200000001080 RDI: 0000000000000007 [ 734.185981][T13717] RBP: 00007fbb38410b39 R08: 0000000000000000 R09: 0000000000000000 [ 734.193975][T13717] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 734.202486][T13717] R13: 0000000000000000 R14: 00007fbb385b5fa0 R15: 00007ffd426ee318 [ 734.211076][T13717] [ 734.214169][T13717] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 734.221484][T13717] CPU: 1 UID: 0 PID: 13717 Comm: syz.8.2227 Not tainted 6.16.0-rc3-syzkaller #0 PREEMPT(full) [ 734.231844][T13717] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 734.241946][T13717] Call Trace: [ 734.245260][T13717] [ 734.248210][T13717] dump_stack_lvl+0x99/0x250 [ 734.252857][T13717] ? __asan_memcpy+0x40/0x70 [ 734.257492][T13717] ? __pfx_dump_stack_lvl+0x10/0x10 [ 734.262744][T13717] ? __pfx__printk+0x10/0x10 [ 734.267386][T13717] panic+0x2db/0x790 [ 734.271329][T13717] ? __pfx_panic+0x10/0x10 [ 734.275962][T13717] __warn+0x31b/0x4b0 [ 734.279983][T13717] ? rate_control_rate_init+0x64a/0x6e0 [ 734.285599][T13717] ? rate_control_rate_init+0x64a/0x6e0 [ 734.291185][T13717] report_bug+0x2be/0x4f0 [ 734.295568][T13717] ? rate_control_rate_init+0x64a/0x6e0 [ 734.301145][T13717] ? rate_control_rate_init+0x64a/0x6e0 [ 734.306717][T13717] ? rate_control_rate_init+0x64c/0x6e0 [ 734.312282][T13717] handle_bug+0x84/0x160 [ 734.316547][T13717] exc_invalid_op+0x1a/0x50 [ 734.321083][T13717] asm_exc_invalid_op+0x1a/0x20 [ 734.325970][T13717] RIP: 0010:rate_control_rate_init+0x64a/0x6e0 [ 734.332152][T13717] Code: 82 01 00 00 20 48 83 c4 20 5b 41 5c 41 5d 41 5e 41 5f 5d e9 58 e8 8b 00 cc e8 52 22 ea f6 90 0f 0b 90 eb e1 e8 47 22 ea f6 90 <0f> 0b 90 48 83 c4 20 5b 41 5c 41 5d 41 5e 41 5f 5d e9 90 00 00 00 [ 734.351790][T13717] RSP: 0018:ffffc9000b416ff0 EFLAGS: 00010283 [ 734.357869][T13717] RAX: ffffffff8ad629d9 RBX: ffff8880735cc000 RCX: 0000000000080000 [ 734.365842][T13717] RDX: ffffc90012f90000 RSI: 00000000000032f1 RDI: 00000000000032f2 [ 734.373843][T13717] RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff8ad624f3 [ 734.381825][T13717] R10: dffffc0000000000 R11: ffffed100e6b9831 R12: 1ffff1100e6b980a [ 734.389839][T13717] R13: ffff88804ca20e40 R14: 0000000000000001 R15: ffffffff8ad624f3 [ 734.397819][T13717] ? rate_control_rate_init+0x163/0x6e0 [ 734.403406][T13717] ? rate_control_rate_init+0x163/0x6e0 [ 734.408952][T13717] ? rate_control_rate_init+0x649/0x6e0 [ 734.414530][T13717] rate_control_rate_init_all_links+0x109/0x1a0 [ 734.420795][T13717] sta_apply_auth_flags+0x1c2/0x400 [ 734.426014][T13717] sta_apply_parameters+0xe4b/0x15b0 [ 734.431313][T13717] ieee80211_add_station+0x424/0x6a0 [ 734.436609][T13717] rdev_add_station+0x108/0x290 [ 734.441463][T13717] nl80211_new_station+0x1723/0x1b40 [ 734.446772][T13717] ? __pfx_nl80211_new_station+0x10/0x10 [ 734.452413][T13717] ? netdev_run_todo+0xe1d/0xea0 [ 734.457396][T13717] ? nl80211_pre_doit+0x4f1/0x930 [ 734.462435][T13717] genl_family_rcv_msg_doit+0x215/0x300 [ 734.467994][T13717] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 734.474076][T13717] ? bpf_lsm_capable+0x9/0x20 [ 734.478761][T13717] ? security_capable+0x7e/0x2e0 [ 734.483710][T13717] genl_rcv_msg+0x60e/0x790 [ 734.488227][T13717] ? __pfx_genl_rcv_msg+0x10/0x10 [ 734.493261][T13717] ? ref_tracker_free+0x63a/0x7d0 [ 734.498308][T13717] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 734.503716][T13717] ? __pfx_nl80211_new_station+0x10/0x10 [ 734.509355][T13717] ? __pfx_nl80211_post_doit+0x10/0x10 [ 734.514827][T13717] ? __pfx_ref_tracker_free+0x10/0x10 [ 734.520275][T13717] netlink_rcv_skb+0x208/0x470 [ 734.525087][T13717] ? __pfx_genl_rcv_msg+0x10/0x10 [ 734.530138][T13717] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 734.535444][T13717] ? down_read+0x1ad/0x2e0 [ 734.539864][T13717] genl_rcv+0x28/0x40 [ 734.543853][T13717] netlink_unicast+0x75b/0x8d0 [ 734.548631][T13717] netlink_sendmsg+0x805/0xb30 [ 734.553409][T13717] ? __pfx_netlink_sendmsg+0x10/0x10 [ 734.558709][T13717] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 734.564000][T13717] ? __pfx_netlink_sendmsg+0x10/0x10 [ 734.569293][T13717] __sock_sendmsg+0x21c/0x270 [ 734.573980][T13717] ____sys_sendmsg+0x505/0x830 [ 734.578754][T13717] ? __pfx_____sys_sendmsg+0x10/0x10 [ 734.584065][T13717] ? import_iovec+0x74/0xa0 [ 734.588590][T13717] ___sys_sendmsg+0x21f/0x2a0 [ 734.593286][T13717] ? __pfx____sys_sendmsg+0x10/0x10 [ 734.598518][T13717] ? __fget_files+0x2a/0x420 [ 734.603114][T13717] ? __fget_files+0x3a0/0x420 [ 734.607797][T13717] __x64_sys_sendmsg+0x19b/0x260 [ 734.612741][T13717] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 734.618561][T13717] ? rcu_is_watching+0x15/0xb0 [ 734.623350][T13717] ? do_syscall_64+0xbe/0x3b0 [ 734.628036][T13717] do_syscall_64+0xfa/0x3b0 [ 734.632546][T13717] ? lockdep_hardirqs_on+0x9c/0x150 [ 734.637756][T13717] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 734.643835][T13717] ? clear_bhb_loop+0x60/0xb0 [ 734.648521][T13717] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 734.654412][T13717] RIP: 0033:0x7fbb3838e929 [ 734.658831][T13717] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 734.678445][T13717] RSP: 002b:00007fbb391f1038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 734.686866][T13717] RAX: ffffffffffffffda RBX: 00007fbb385b5fa0 RCX: 00007fbb3838e929 [ 734.694841][T13717] RDX: 0000000000000044 RSI: 0000200000001080 RDI: 0000000000000007 [ 734.702822][T13717] RBP: 00007fbb38410b39 R08: 0000000000000000 R09: 0000000000000000 [ 734.710796][T13717] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 734.718781][T13717] R13: 0000000000000000 R14: 00007fbb385b5fa0 R15: 00007ffd426ee318 [ 734.726778][T13717] [ 734.730083][T13717] Kernel Offset: disabled [ 734.734414][T13717] Rebooting in 86400 seconds..