last executing test programs: 33m37.536087541s ago: executing program 4 (id=2309): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, &(0x7f0000000180)) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000001580)={&(0x7f0000000180)='kmem_cache_free\x00'}, 0x10) syz_emit_ethernet(0x82, &(0x7f0000000580)=ANY=[@ANYBLOB="cf599d3baed500000000000086dd60f20000004c2c00fe8000000000000000000000000000bbfe8000000000000000000000000000aa00060008"], 0x0) syz_emit_ethernet(0x46, &(0x7f0000000000)=ANY=[@ANYBLOB="ffffffffffffffffffffffff86dd6060626000102c00fe8000000000000000000000000000bbfe8000000000000000000000000000aa880040"], 0x0) 33m37.312008098s ago: executing program 4 (id=2312): r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) fcntl$notify(0xffffffffffffffff, 0x402, 0x69) syz_open_dev$vim2m(0x0, 0x1, 0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, 0x0, 0x0) r3 = syz_open_dev$vim2m(&(0x7f0000000080), 0x7, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r3, 0xc0cc5605, 0x0) mount$fuse(0xe000000, 0x0, 0x0, 0x0, 0x0) socket$unix(0x1, 0x5, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0x1}, {0xffff, 0xffff}, {0x0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtfilter={0x84, 0x2c, 0xd27, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0xb, 0xb}, {}, {0x7, 0xfff3}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x655c, 0x3, 0xffffffffffffffff, 0x9, 0x800}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x10}, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @broadcast}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008031, 0xffffffffffffffff, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(r0, 0x0, 0x487, &(0x7f0000000000)={{0x32, @remote, 0x4e23, 0x2, 'wrr\x00', 0x2a, 0x3, 0x2d}, {@rand_addr=0x64010102, 0x4e23, 0x2000, 0x2, 0x7, 0xe0}}, 0x44) setsockopt$inet_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000440)=@gcm_128={{0x303}, "3875c1662b0bc1b9", "fa0f2b765022fb30b5888d3d43180656", "f81a4aaf", "5724c1e2c9d2e060"}, 0x28) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffffe5, 0x0, 0x0, 0x11) 33m34.042541488s ago: executing program 4 (id=2318): openat$zero(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_setup(0x83b, 0x0) r0 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = fsopen(&(0x7f0000000180)='cifs\x00', 0x0) syz_open_dev$vim2m(0x0, 0x20003, 0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$IPSET_CMD_GET_BYNAME(0xffffffffffffffff, 0x0, 0xc004004) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x0, 0x1, 0x401, 0x0, 0x92, 0x55, 0x8, 0x7, 0x8}, 0x0) fanotify_init(0xa00, 0x0) clock_gettime(0xfffffffffffffffc, &(0x7f0000003a40)) mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x3000, 0x2, &(0x7f0000ffc000/0x3000)=nil) r4 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/sys/net/ipv4/tcp_sack\x00', 0x1, 0x0) write$sysctl(r4, &(0x7f0000000000)='2\x00', 0x2) syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000200)='source', &(0x7f0000000340)='\\/\xe9\x838\x9d<\f\x91\a\xd4\xb03\xb4\x901\xf0\x8e\xd6F\x92$\xae$\x91&6n @\xf4M\xba\xf2<\xd6A\xdb\xd7\xbeY@g\xcc\xca\n@\x06\xa3\xfe%\x11\xc9\xc5\xc4\x96\xb7b\xa7\x15R.\xa3`fd\xdc\x8b\x18rBl{\x82\\/A\x17\n\f\xcd=\'\x11\x1bZ\x8e\xb1\xc3j$v\xef\x1f\xc4\xc3\xd5\xb3\xf6.\t\x86\x17\xfa\xf0(\xefw\x96\\\xff\xa2\xfc\xe3\xb8\xc7\x0f\xaaQ\x98F*T\xd5\xcd4g+\xbd\xd1\xe0R\x9d\x18\x19a:\xa2\xdf\xbe\x8b\x89\x81', 0x0) preadv(r0, &(0x7f0000000740)=[{&(0x7f0000000440)=""/113, 0x71}], 0x1, 0x401, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000008c0)=@newqdisc={0x1a8, 0x24, 0x800, 0x70bd28, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x9, 0xd}, {0x1f, 0xc}, {0xfff3, 0x5}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0x1000}, @TCA_RATE={0x6, 0x5, {0x6, 0x1}}, @TCA_STAB={0x144, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x7, 0x8, 0xfffe, 0x6, 0x0, 0x3, 0x23a26, 0x5}}, {0xe, 0x2, [0x7, 0x4, 0xf, 0xdbbe, 0x2]}}, {{0x1c, 0x1, {0x3, 0x7, 0x5, 0x4, 0x1, 0x5, 0xe2, 0x2}}, {0x8, 0x2, [0x5, 0x4]}}, {{0x1c, 0x1, {0x3, 0x0, 0x4, 0x6, 0x1, 0x3, 0x8, 0x1}}, {0x6, 0x2, [0x7]}}, {{0x1c, 0x1, {0x42, 0x1, 0x9, 0x1, 0x2, 0x7, 0x0, 0x4}}, {0xc, 0x2, [0x6, 0x8008, 0xfd, 0x9]}}, {{0x1c, 0x1, {0x3, 0x5, 0x9bb6, 0x3ac, 0x2, 0xfffffffc, 0x2, 0x6}}, {0x10, 0x2, [0x1ff, 0x1, 0xecbd, 0xa1, 0x8, 0x2]}}, {{0x1c, 0x1, {0xff, 0x7, 0x8, 0x7fffffff, 0x0, 0x9, 0x6, 0x2}}, {0x8, 0x2, [0x463e, 0x7f]}}, {{0x1c, 0x1, {0x0, 0x4, 0x1000, 0x800, 0x2, 0x4, 0x0, 0x2}}, {0x8, 0x2, [0x1fe0, 0x9d]}}, {{0x1c, 0x1, {0xa, 0x16, 0x90, 0xfff, 0x0, 0xd, 0x6b82, 0x7}}, {0x12, 0x2, [0x7, 0x7, 0x4, 0x1, 0xc, 0x5, 0xbe]}}]}, @qdisc_kind_options=@q_clsact={0xb}, @qdisc_kind_options=@q_fq_codel={{0xd}, {0x14, 0x2, [@TCA_FQ_CODEL_MEMORY_LIMIT={0x8, 0x9, 0x8}, @TCA_FQ_CODEL_CE_THRESHOLD_SELECTOR={0x5, 0xa, 0x5}]}}]}, 0x1a8}, 0x1, 0x0, 0x0, 0x4000810}, 0x40) syz_open_dev$usbfs(&(0x7f0000000100), 0x77, 0x101301) r5 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r5, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r5, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r5, 0x6, 0xd, &(0x7f0000000540)='vegas\x00', 0x6) r6 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000840)="89000000120081ae08060cdc030000fe7f030000000000000001ffca1b1f0000000024c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec00150c00014003080c00bdad446b31007a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947e", 0x75}, {&(0x7f0000000140)="11d6cb557c8496a2fe7a81f38210bfa9b70ee09c", 0x14}], 0x2}, 0x0) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_RECVMSG={0xa, 0x10, 0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x12080, 0x1, {0x3}}) 33m32.08104492s ago: executing program 4 (id=2333): socket$nl_generic(0x10, 0x3, 0x10) landlock_create_ruleset(&(0x7f0000000500)={0x21c1, 0x3, 0x3}, 0x18, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x8000) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f0000006300)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000000040)={0x50, 0x0, r1, {0x7, 0x1f, 0x20000000, 0x4041}}, 0x50) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r2, 0x84, 0x24, 0x0, 0x0) syz_fuse_handle_req(r0, &(0x7f00000021c0)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003dc150f4000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d90000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x80101, 0x0) r4 = syz_open_dev$loop(&(0x7f0000000000), 0x4, 0x2080) ioctl$LOOP_SET_FD(r4, 0x4c00, r3) ioctl$LOOP_SET_FD(r4, 0x4c03, r4) 33m28.589951132s ago: executing program 4 (id=2355): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000004c0)={{{@in=@remote, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0xa}}, {{@in6=@mcast2, 0x0, 0x2b}, 0x0, @in=@empty}}, 0xe8) r1 = socket$key(0xf, 0x3, 0x2) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=ANY=[@ANYBLOB="020b000102"], 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="0212000002"], 0x10}}, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="b80000001d0001"], 0xb8}}, 0x0) 33m28.09774596s ago: executing program 4 (id=2357): r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f0000000400)={0x18, 0x0, {0x2, @empty, 'veth0_to_hsr\x00'}}, 0x1e) r1 = socket$pppoe(0x18, 0x1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) connect$pppoe(r1, &(0x7f0000000080)={0x18, 0x0, {0x15, @local, 'bond0\x00'}}, 0x1e) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f0000000400)={0x18, 0x0, {0x2, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, 'veth0_to_hsr\x00'}}, 0x1e) 33m27.219414009s ago: executing program 32 (id=2357): r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f0000000400)={0x18, 0x0, {0x2, @empty, 'veth0_to_hsr\x00'}}, 0x1e) r1 = socket$pppoe(0x18, 0x1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) connect$pppoe(r1, &(0x7f0000000080)={0x18, 0x0, {0x15, @local, 'bond0\x00'}}, 0x1e) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f0000000400)={0x18, 0x0, {0x2, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, 'veth0_to_hsr\x00'}}, 0x1e) 20m11.431937371s ago: executing program 2 (id=6069): close(0xffffffffffffffff) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = signalfd(0xffffffffffffffff, &(0x7f00000002c0)={[0x7fffffff]}, 0x8) read$FUSE(r1, &(0x7f00000008c0)={0x2020}, 0xfffffef0) io_cancel(0x0, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x6, r0, &(0x7f0000000300)="04f79c7ac5b0879e2782326c4004b0eaaae38e381dec2ae216d2dbb88825b466b0016bf1aa9a270d1f63cb856dcd4f37af713ced4a49aeefba7eeca3ebbc32a816d9479f6e59dcf768c4d8c50f2ce15150b550bb28cd00aa14394f1778c518d9977cf9912c450bf20e010b5569063e77896150cc2661c2f168d9b5f1728d31625dce2a1bd4645e9593c5bb3aba113dd6255d85dfb5cf6b2f0e636408b1f02ff9ce9b238e8932b14cf7c2aac4ea05228df143d0e11414c6270e4bc1ae862444b5de9bd75e0402c76e32f4e1d2d66a59eae48a5c", 0xd3, 0xffffffffffffff80, 0x0, 0x0, r1}, &(0x7f00000001c0)) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000400)='dctcp\x00', 0x6) r2 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x18, &(0x7f0000000480)=0x1, 0x4) r3 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) copy_file_range(r2, 0x0, r3, 0x0, 0x5, 0x0) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr\x00', 0x4) setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0xb, 0x0, 0x0) syz_emit_ethernet(0x83, 0x0, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="60000000020601080000000000000000000000001400078008001140000000000500150002000000050005000a000000050001008700000005000400020000000900020073797a310000000011000300686173683a6970"], 0x60}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x1, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x40938, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x40801}, 0x4000000) r6 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000240), 0x80200, 0x0) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r6, 0x81785501, &(0x7f0000000440)=""/27) r7 = syz_open_dev$vim2m(&(0x7f0000000040), 0x40000000e, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r7, 0xc0405602, &(0x7f0000000000)={0x11, 0x2, 0x457f1c9146f8f874, "464905e100000000000000007f00", 0xb5315241}) r8 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0006}]}) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$OSF_MSG_REMOVE(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)=ANY=[@ANYBLOB="14000005010800bd000000"], 0x14}}, 0x0) close_range(r8, r8, 0x0) 20m10.284315904s ago: executing program 2 (id=6072): syz_open_procfs(0x0, &(0x7f0000000300)='net\x00') socket$inet6_udp(0xa, 0x2, 0x0) landlock_restrict_self(0xffffffffffffffff, 0x4) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x2, 0x8, 0x0, 0x3}, 0x0) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x7a, 0x4) bind$inet(r3, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f0000000140)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0xe4}]}, 0x10) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, &(0x7f0000000180)=@framed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$FS_IOC_GETVERSION(0xffffffffffffffff, 0xc040ff0b, &(0x7f0000000180)) sendto$inet(r3, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg$inet(r3, &(0x7f0000000cc0)=[{{0x0, 0x0, &(0x7f0000000b40)=[{0x0}], 0x1}}], 0x1, 0xc0) sendto$inet(r3, &(0x7f0000000300)="09268a9234f8b358387f1f6588b94b481241ded8974895abfab7511e6e9532120200000000000086b7c4fff5575470f7385a78182eeaea563a905780232726ffbcb5e8d06ec5161ab4b4317995652dc20915e12a020fe3e2bf05b39e5c14312c2f7efc25b5575a7697a9240b578ac6971c54aec0b1ee3d84056a80e7878b37568b295a57f59a9f599bd5ccf5a12920e47c2d37f9140a41ed0ec9392f997cf6", 0xffffffffffffff7f, 0x4000080, 0x0, 0xfffffffffffffff7) 20m8.594767847s ago: executing program 2 (id=6077): r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) fcntl$addseals(r0, 0x409, 0x3f) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$FS_IOC_RESVSP(r2, 0x40305828, &(0x7f0000000000)={0x0, 0x1, 0x1, 0x1000}) r3 = socket$pppl2tp(0x18, 0x1, 0x1) accept4$alg(r3, 0x0, 0x0, 0x800) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) r5 = openat$sw_sync_info(0xffffffffffffff9c, &(0x7f0000000040), 0x1150c0, 0x0) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDGKBDIACR(r6, 0x80085610, &(0x7f0000004100)=""/42) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001180)=@ipv6_newrule={0x30, 0x1a, 0x1, 0x0, 0x0, {0x81}, [@FRA_SRC={0x14, 0x2, @mcast2}]}, 0x30}}, 0x0) r8 = memfd_secret(0x80000) pipe2(&(0x7f0000000040)={0xffffffffffffffff}, 0x0) splice(r9, 0x0, r8, &(0x7f0000000180), 0x800002000000008, 0x4) sendmsg$NL80211_CMD_NEW_KEY(r5, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000000c0)=ANY=[@ANYBLOB='H\x00\x00\x00', @ANYRES16=r1, @ANYRES64=r4, @ANYRES32=r4, @ANYBLOB="0a000600080211000001000020005080090001007f6f495ff200000005000200040000000800070000000000"], 0x48}}, 0x40c0) 20m5.775113242s ago: executing program 2 (id=6081): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYBLOB="020d00000c0000002bbd70000000000005000a004e200000000000000000000000000000000000000000000000000000000005000600000069d0ed2000000a0000000000000000000000000000000100ffffe000000100000000000000000000da0e4cda29c42125112a1e85979346cc60a6b9b49395152d44e943282fba37820ebb56bb80a73fda149c7ec9918918eccd16a519d2fc36c1a98808f3d2d15202fe213eba1da383c30a7278d4f661c880d89e3e4b5beb691b5456060514d499642cce492a89edf56c3f57116a32d04ebe2bff28c75a50cc3e17cd2c694e167dcd6f0fbb8697b37b3638412491007fb52a8118ff30fe1b98f39ecb1ee0f15650a7ddb639e09ee4f3e299ebf29d84e81bfeecb85e3490c21f80513bbcb186c73e3342de545a6efb30e036e85aa30ab565dbdda5083d3da254f061f04746f5ba599622e829eb638320102ca44b6d62f272e73589bd84416c50ec5aa198901e0903f8"], 0x60}}, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000006600000008000300", @ANYRES32=0x0, @ANYBLOB="00081bb70099000000"], 0x2c}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000003c0)={'wlan0\x00'}) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)=ANY=[@ANYBLOB="300000001800010000000000000000000a821000000300080000000014000100"], 0x30}}, 0x0) r5 = bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x108) r6 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x89901) move_mount(r6, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) chroot(&(0x7f0000000300)='./file0/../file0/../file0/../file0\x00') syz_clone(0x0, 0x0, 0xfffffe11, 0x0, 0x0, 0x0) r7 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r7, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) r8 = socket$inet_tcp(0x2, 0x1, 0x0) syz_usb_connect(0x3, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b362f"], 0x0) syz_open_dev$midi(&(0x7f0000000000), 0x3, 0x88c02) close_range(r8, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='./file0/../file0/../file0/../file0\x00') getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, 0x0, &(0x7f0000000100)) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000600)={0x0, r5}, 0x18) getitimer(0x1, &(0x7f00000005c0)) 20m4.472517015s ago: executing program 2 (id=6087): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000340)='./binderfs/binder0\x00', 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r6 = socket$inet6(0xa, 0x3, 0xff) syz_open_dev$sndctrl(&(0x7f0000000000), 0x2, 0xe8e80) connect$inet6(r6, &(0x7f0000000480)={0xa, 0xfffc, 0x3, @empty, 0x5}, 0x1c) r7 = dup2(r6, r6) sendmmsg$unix(r7, &(0x7f0000008380), 0x400000000000174, 0x4008890) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) ioctl$KVM_CAP_EXIT_HYPERCALL(r3, 0x4068aea3, &(0x7f0000000040)={0x79, 0x0, 0xc}) r8 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r3, r8, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_SET_MSRS(r8, 0x4008ae89, &(0x7f00000002c0)=ANY=[]) ioctl$KVM_RUN(r8, 0xae80, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x20, 0x0, &(0x7f00000004c0)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@fd={0x66642a85, 0x0, r1}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xc}, @flat=@handle={0x73682a85, 0x101}}, &(0x7f0000000080)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) sendto$packet(0xffffffffffffffff, 0x0, 0x0, 0x4000814, &(0x7f0000000540)={0xc9, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) close_range(r0, 0xffffffffffffffff, 0x0) 20m3.213500085s ago: executing program 2 (id=6088): r0 = socket$nl_generic(0x10, 0x3, 0x10) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x6080, 0x0) r1 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r1, 0x7a7, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x21, &(0x7f0000000180)=0x2, 0x4) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r1, 0x4010640d, &(0x7f0000000000)={0x2, 0x2}) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/key-users\x00', 0x0, 0x0) pread64(r3, &(0x7f0000000280)=""/211, 0xd3, 0xea6) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r2, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GETPLANE(r2, 0xc02064b6, &(0x7f0000000380)={r4, 0x0, 0x0, 0x0, 0x0, 0x6, &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_GETPLANE(r2, 0xc02064b6, &(0x7f00000001c0)={r4, r5, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r2, 0xc02064b9, &(0x7f00000002c0)={0x0, 0x0, 0x0, r6}) ioctl$DRM_IOCTL_MODE_ATOMIC(r2, 0xc03864bc, 0x0) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x1c, 0x2d, 0x9, 0x70bd27, 0x0, {0x4}, [@typed={0x8, 0x18, 0x0, 0x0, @binary="04ac0f00"}]}, 0x1c}, 0x1, 0x0, 0x0, 0x42804}, 0x84) 20m2.208883684s ago: executing program 33 (id=6088): r0 = socket$nl_generic(0x10, 0x3, 0x10) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x6080, 0x0) r1 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r1, 0x7a7, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x21, &(0x7f0000000180)=0x2, 0x4) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r1, 0x4010640d, &(0x7f0000000000)={0x2, 0x2}) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/key-users\x00', 0x0, 0x0) pread64(r3, &(0x7f0000000280)=""/211, 0xd3, 0xea6) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r2, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GETPLANE(r2, 0xc02064b6, &(0x7f0000000380)={r4, 0x0, 0x0, 0x0, 0x0, 0x6, &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_GETPLANE(r2, 0xc02064b6, &(0x7f00000001c0)={r4, r5, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r2, 0xc02064b9, &(0x7f00000002c0)={0x0, 0x0, 0x0, r6}) ioctl$DRM_IOCTL_MODE_ATOMIC(r2, 0xc03864bc, 0x0) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x1c, 0x2d, 0x9, 0x70bd27, 0x0, {0x4}, [@typed={0x8, 0x18, 0x0, 0x0, @binary="04ac0f00"}]}, 0x1c}, 0x1, 0x0, 0x0, 0x42804}, 0x84) 2m38.363807091s ago: executing program 6 (id=9399): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r1, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6, 0x0, 0x0, 0x81}, 0x1c) mmap(&(0x7f0000000000/0x2000)=nil, 0x30000, 0x2, 0x11, r1, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps\x00') preadv(r2, &(0x7f0000000040)=[{&(0x7f00000034c0)=""/4087, 0xff7}], 0x10000000000002b0, 0xffff, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) syz_clone(0x1a200600, &(0x7f0000000100)="0785471dedf112971de69097846e98dc7e26b0c10772140f0f36c59cdcb8681225d8dca1d053c80dd8689679b30533537fc377fdf1c2e894d562028898b0c0289efbbb366c72", 0x46, &(0x7f0000000180), &(0x7f00000001c0), &(0x7f0000000240)="a208e15cdd673436d751dedf1d119cf7a2fea421e7fee30e737e2a51b026a1fdefd371561c41e4be1c1cc119d705c004821160eac77e865e2bc00d97e06cab848fe63ee9f091aae760bba79eabbdf34ffd79698634d1b16d6b7c50ca30fb8112e09b77e16d6553d1239d08d33416555834d472a9cfee8d7f6dc5bca609167a2ee6748c27f6186f1a538e0708ef8d454a0f83c0ac8c9f5811e1c906d3ba6ed1e1132e1f6d23c66f3b0ac5620363e7f4f760f9673b57e0f35c919291458bd81acc46ecb37905cabf83ed7370ecdb8277") r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0) r5 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000080), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$WG_CMD_SET_DEVICE(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000480)=ANY=[@ANYBLOB="1c020000", @ANYRES16=r5, @ANYBLOB="01000000000000000000010000001400020077673100000000000000000000000000f4010880700000804800098028a25880060001000a00000014000200fe8000000000000000000000000000aa05000300000000001c000080060001000200000008000200e0000001050003000000000024000100000000000000000000000000000000000000000000000000000000000000000080010080200004000a004e2000000005200100000000000000000000000000000800000006000500b01f00000800030006000000060005000500000008000a000100000024000100dbffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff200004000a004e200000040100000000000000000000ffffac14142a06000000240001000000000000000000000000000000000000000000000000000000000000000000d400", @ANYRES16=r4], 0x21c}}, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r3, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r7, 0x0) ioctl$PPPIOCGL2TPSTATS(r0, 0x80487436, 0x0) 2m38.052617272s ago: executing program 6 (id=9433): writev(0xffffffffffffffff, &(0x7f00000000c0), 0x0) r0 = syz_open_dev$video4linux(&(0x7f0000000040), 0x7ffffffbffffffff, 0x0) ioctl$F2FS_IOC_RELEASE_COMPRESS_BLOCKS(r0, 0x8008f512, &(0x7f0000000080)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f0000000700)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x1000}}, './file0\x00'}) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3c0200001900010000000000fddbdf25e0000001000000000000000000000000ac1414bb0000000000000000000000000000000bffff00000a00802000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000000086ff000000000000000000000000000000000000000001000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000084010500e0000002000000000000000000000000000000003c00000000000000ffffffff000000000000000000000000fe34000000020000000000000000000000000000ac1414aa000000000000000000000000000000003c0000000a000000fc01000000000000000000000000000102000000000000000008000000080000fcffffff000000000000000000000000000000000000000032000000000000007f0000010000000000000000000000000335000003000000000000000002000000000000fe80000000000000000000000000002f0000000033000000000000000a010101000000000000000000000000043500000000010000000000bf0a00000000000100000000000000000000000000000001000004d43c00000000000000e00000010000000000000000000000000300000000010800000000000000000000040000fc000000000000000000000000000001000000000f00000002000000fe80000000000000000000000000000f000000000102000001000000000000000f000000"], 0x23c}, 0x1, 0x0, 0x0, 0x20000040}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000001c0)='f2fs_reserve_new_blocks\x00', r3, 0x0, 0x100}, 0x18) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x1) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r5, @ANYBLOB=',rootmode=000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r5, &(0x7f0000006300)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r5, &(0x7f0000000040)={0x50, 0x0, r6, {0x7, 0x1f, 0x0, 0x1000040c, 0xffff}}, 0x50) syz_fuse_handle_req(r5, &(0x7f00000021c0)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003dc150f4000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d90000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x80f81, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x0, r7, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) setgid(0x0) r8 = syz_clone(0x5948000, 0x0, 0x0, 0x0, 0x0, 0x0) process_vm_writev(r8, &(0x7f0000000840), 0x0, &(0x7f00000001c0), 0x0, 0x0) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(r0, 0xc040564a, &(0x7f0000000200)={0x0, 0x0, 0x300f}) r9 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000000)={'macsec0\x00', 0x0}) sendmsg$nl_route(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2c009b011000012010050000ffdbdf2500000000", @ANYRES32=r11, @ANYBLOB="dc020000110004000a000100ffffffffffff0000"], 0x2c}}, 0x800) r12 = bpf$ITER_CREATE(0x21, &(0x7f0000000100), 0x8) io_uring_register$IORING_REGISTER_FILES2(r12, 0xd, &(0x7f0000000680)={0x0, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000180)=[0x9, 0x9, 0x401, 0x6]}, 0x20) 2m35.720859796s ago: executing program 6 (id=9439): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000380)=@req3={0x10000, 0x100000001, 0x10003, 0x1}, 0x1c) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder-control\x00', 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) unlink(&(0x7f0000000140)='./file2\x00') ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'veth0_macvtap\x00', 0x0}) bind$packet(r0, &(0x7f0000000140)={0x11, 0x0, r1, 0x1, 0x4, 0x6, @remote}, 0x14) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/bus/input/handlers\x00', 0x0, 0x0) pread64(r2, &(0x7f0000000280)=""/211, 0xd3, 0xea6) sendmmsg$sock(r0, &(0x7f0000000a40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x20004874) 2m35.52796883s ago: executing program 6 (id=9440): r0 = syz_open_dev$dri(&(0x7f0000000140), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_ADDFB2(r0, 0xc06864b8, &(0x7f0000000580)={0x0, 0x2000, 0x80, 0x3231564e, 0x3, [0x2], [0x2161, 0xfffffffc], [], [0x400000000000001, 0x2000000000]}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2902, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CLEAR_DIRTY_LOG(0xffffffffffffffff, 0xc018aec0, &(0x7f0000000140)={0x0, 0x240, 0x380, &(0x7f0000000180)=[0x6bd1a312, 0xec66, 0xff, 0x8, 0x98bd, 0x800000000000009, 0x0, 0x4, 0x10000, 0x7, 0x9004, 0x9, 0x8, 0x9, 0x5, 0x49, 0x3ff, 0x5, 0x2, 0x1, 0x8, 0x7, 0xc1, 0x1, 0x7ff, 0x2, 0x6, 0x9, 0x96, 0xffffffff, 0xffffffff00000000, 0x0, 0x5, 0x7, 0x4, 0x3, 0x9, 0x888f, 0x1, 0x8, 0x46, 0x6, 0x3, 0xa3de, 0x20000000006, 0x8, 0x7, 0x400, 0x3, 0xfffffffffffffff7, 0xfffffffffffffffa, 0x2, 0xe, 0x6, 0x4, 0xe6, 0x200000000000101, 0x5, 0x9, 0x66, 0x6, 0x7, 0x40000005, 0xfffffffeffffffff, 0x9, 0xd, 0x10001, 0xbbd9, 0x80000000, 0xfffffffffffffc00, 0x2, 0x7, 0x2, 0xcdc, 0x4000000007, 0x2, 0x3, 0x2, 0x2, 0xfff, 0x6, 0x4, 0x1, 0xab6, 0x0, 0x8, 0x0, 0xffffffffffffff81, 0x9, 0xff, 0x6, 0x28000000, 0x5, 0x8061d, 0x3, 0x7, 0xf6, 0x4, 0x6, 0x200, 0x7, 0xe53e, 0x4, 0x8, 0x2293332f, 0x6, 0x5, 0x1e, 0xd, 0x2, 0x4, 0xfffffffffffffffb, 0x2, 0x7, 0xdfd4, 0xfffd, 0x10, 0x5, 0x8, 0x1, 0x53e0f0fe, 0xeb4, 0x0, 0xfffffffffffffffe, 0xa692, 0xcc, 0x8, 0x1000003]}) memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f00000002c0)=ANY=[]) 2m35.19601641s ago: executing program 6 (id=9443): r0 = syz_open_dev$sndctrl(&(0x7f0000001ac0), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0xc1105511, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$TIPC_NL_PEER_REMOVE(r2, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000340)={0x78, r3, 0x1, 0x70bd68, 0x25dfdbfe, {}, [@TIPC_NLA_SOCK={0x64, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x64000000}, @TIPC_NLA_SOCK_CON={0x2c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x4}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x4}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x1}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x9}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x80000000}]}, @TIPC_NLA_SOCK_CON={0x2c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x3ff}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x4}, @TIPC_NLA_CON_NODE={0x8}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x6}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x5}]}]}]}, 0x78}, 0x1, 0x0, 0x0, 0x48404}, 0x8040) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x1}) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r7 = openat$cgroup_type(r6, &(0x7f0000000100), 0x2, 0x0) write$cgroup_type(r7, &(0x7f0000000200), 0x2) write$tun(r4, &(0x7f0000000300)=ANY=[@ANYBLOB="000086dd03000a000000140000006c07010033d43afffe800000000000000000000000000010ff02000000000000000000000000000189"], 0x340a) syz_open_dev$sndctrl(&(0x7f0000001ac0), 0x0, 0x0) (async) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0xc1105511, 0x0) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$tipc2(&(0x7f00000003c0), 0xffffffffffffffff) (async) sendmsg$TIPC_NL_PEER_REMOVE(r2, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000340)={0x78, r3, 0x1, 0x70bd68, 0x25dfdbfe, {}, [@TIPC_NLA_SOCK={0x64, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x64000000}, @TIPC_NLA_SOCK_CON={0x2c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x4}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x4}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x1}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x9}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x80000000}]}, @TIPC_NLA_SOCK_CON={0x2c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x3ff}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x4}, @TIPC_NLA_CON_NODE={0x8}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x6}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x5}]}]}]}, 0x78}, 0x1, 0x0, 0x0, 0x48404}, 0x8040) (async) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) (async) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) (async) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x40241, 0x0) (async) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x1}) (async) socket$kcm(0x2, 0xa, 0x2) (async) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) (async) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) (async) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) (async) openat$cgroup_type(r6, &(0x7f0000000100), 0x2, 0x0) (async) write$cgroup_type(r7, &(0x7f0000000200), 0x2) (async) write$tun(r4, &(0x7f0000000300)=ANY=[@ANYBLOB="000086dd03000a000000140000006c07010033d43afffe800000000000000000000000000010ff02000000000000000000000000000189"], 0x340a) (async) 2m34.680069583s ago: executing program 6 (id=9446): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_open_dev$vbi(&(0x7f00000001c0), 0x1, 0x2) r3 = fcntl$dupfd(r2, 0x0, r2) write$binfmt_script(r3, &(0x7f0000000100), 0xfffffd9d) ioctl$UFFDIO_CONTINUE(r3, 0xc020aa07, &(0x7f0000000340)={{&(0x7f0000007000/0x3000)=nil, 0x3000}}) r4 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) ioctl$USBDEVFS_SUBMITURB(r4, 0x8038550a, &(0x7f0000000140)=@urb_type_control={0x2, {}, 0x80000000, 0x0, &(0x7f0000000240)={0x2, 0xf, 0xfffc, 0x7}, 0x8, 0x101, 0x80, 0x0, 0x100, 0x101, 0x0}) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000080)={r3, 0x20, &(0x7f0000000000)={&(0x7f00000001c0)=""/111, 0x6f, 0x0, &(0x7f0000000240)=""/216, 0xd8}}, 0x10) r5 = socket(0xe67dbfa350a56a60, 0x6, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) socketpair$unix(0x1, 0x5, 0x0, 0x0) syz_usb_connect(0x5, 0x24, &(0x7f0000001280)=ANY=[@ANYBLOB="12010003001f66088f0510660548020003010902120001049570810904008100ffffff02"], &(0x7f0000001700)={0xffffffa0, 0x0, 0x0, 0x0, 0x23}) r6 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) read(r6, 0x0, 0x0) setsockopt$inet6_group_source_req(r5, 0x29, 0x2e, 0x0, 0x0) setsockopt$inet6_MCAST_MSFILTER(r5, 0x29, 0x30, 0x0, 0x90) dup(0xffffffffffffffff) setsockopt$inet6_MCAST_MSFILTER(r5, 0x29, 0x30, &(0x7f0000000680)={0x4, {{0xa, 0x4e22, 0x10, @mcast1, 0x1}}, 0x1, 0x4, [{{0xa, 0x4e22, 0xbfa, @dev={0xfe, 0x80, '\x00', 0x35}, 0x3}}, {{0xa, 0x4e20, 0x40, @private1, 0x4}}, {{0xa, 0x4e23, 0x1c, @empty, 0x101}}, {{0xa, 0x4e24, 0x7, @remote, 0xc}}]}, 0x290) pipe2$9p(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) write$P9_RLERROR(r7, &(0x7f0000000080)=ANY=[@ANYBLOB="0e0500000761000000000000000000"], 0xe) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x1ff, 0x0, 0x10000, 0x2000, &(0x7f0000ffb000/0x2000)=nil}) r8 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x7) ioctl$KVM_SET_GUEST_DEBUG(r8, 0x4048ae9b, &(0x7f0000000140)={0x110003, 0x0, [0x7, 0x1, 0x7, 0x2d5, 0x9, 0x3, 0x7, 0x4000000002279]}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000600)=[@text64={0x40, &(0x7f00000000c0)="2ef2dd050080000048b844410000000000000f23d00f21f835000000010f23f836362e6726af440f20c0350e000000440f22c0b805000000b9009800000f01d90f01c965470f01c4410f79d226450f01cb660f013b", 0x55}], 0x1, 0x0, 0x0, 0x0) r9 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r9, 0x10e, 0x1, &(0x7f0000000080)=0x1e, 0x4) ioctl$KVM_RUN(r8, 0xae80, 0x0) 2m19.510002199s ago: executing program 34 (id=9446): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_open_dev$vbi(&(0x7f00000001c0), 0x1, 0x2) r3 = fcntl$dupfd(r2, 0x0, r2) write$binfmt_script(r3, &(0x7f0000000100), 0xfffffd9d) ioctl$UFFDIO_CONTINUE(r3, 0xc020aa07, &(0x7f0000000340)={{&(0x7f0000007000/0x3000)=nil, 0x3000}}) r4 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) ioctl$USBDEVFS_SUBMITURB(r4, 0x8038550a, &(0x7f0000000140)=@urb_type_control={0x2, {}, 0x80000000, 0x0, &(0x7f0000000240)={0x2, 0xf, 0xfffc, 0x7}, 0x8, 0x101, 0x80, 0x0, 0x100, 0x101, 0x0}) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000080)={r3, 0x20, &(0x7f0000000000)={&(0x7f00000001c0)=""/111, 0x6f, 0x0, &(0x7f0000000240)=""/216, 0xd8}}, 0x10) r5 = socket(0xe67dbfa350a56a60, 0x6, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) socketpair$unix(0x1, 0x5, 0x0, 0x0) syz_usb_connect(0x5, 0x24, &(0x7f0000001280)=ANY=[@ANYBLOB="12010003001f66088f0510660548020003010902120001049570810904008100ffffff02"], &(0x7f0000001700)={0xffffffa0, 0x0, 0x0, 0x0, 0x23}) r6 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) read(r6, 0x0, 0x0) setsockopt$inet6_group_source_req(r5, 0x29, 0x2e, 0x0, 0x0) setsockopt$inet6_MCAST_MSFILTER(r5, 0x29, 0x30, 0x0, 0x90) dup(0xffffffffffffffff) setsockopt$inet6_MCAST_MSFILTER(r5, 0x29, 0x30, &(0x7f0000000680)={0x4, {{0xa, 0x4e22, 0x10, @mcast1, 0x1}}, 0x1, 0x4, [{{0xa, 0x4e22, 0xbfa, @dev={0xfe, 0x80, '\x00', 0x35}, 0x3}}, {{0xa, 0x4e20, 0x40, @private1, 0x4}}, {{0xa, 0x4e23, 0x1c, @empty, 0x101}}, {{0xa, 0x4e24, 0x7, @remote, 0xc}}]}, 0x290) pipe2$9p(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) write$P9_RLERROR(r7, &(0x7f0000000080)=ANY=[@ANYBLOB="0e0500000761000000000000000000"], 0xe) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x1ff, 0x0, 0x10000, 0x2000, &(0x7f0000ffb000/0x2000)=nil}) r8 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x7) ioctl$KVM_SET_GUEST_DEBUG(r8, 0x4048ae9b, &(0x7f0000000140)={0x110003, 0x0, [0x7, 0x1, 0x7, 0x2d5, 0x9, 0x3, 0x7, 0x4000000002279]}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000600)=[@text64={0x40, &(0x7f00000000c0)="2ef2dd050080000048b844410000000000000f23d00f21f835000000010f23f836362e6726af440f20c0350e000000440f22c0b805000000b9009800000f01d90f01c965470f01c4410f79d226450f01cb660f013b", 0x55}], 0x1, 0x0, 0x0, 0x0) r9 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r9, 0x10e, 0x1, &(0x7f0000000080)=0x1e, 0x4) ioctl$KVM_RUN(r8, 0xae80, 0x0) 11.244190589s ago: executing program 0 (id=9941): r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x8005, 0x2) ioctl$vim2m_VIDIOC_ENUM_FRAMESIZES(r0, 0xc02c564a, &(0x7f0000000040)={0x0, 0x205171f, 0x2, @discrete={0xc, 0xfffffffc}}) r1 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000d00)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b100090582"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) r3 = socket$kcm(0x2d, 0x2, 0x0) sendmsg$DEVLINK_CMD_GET(0xffffffffffffffff, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[], 0x34}}, 0x0) (async) sendmsg$DEVLINK_CMD_GET(0xffffffffffffffff, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[], 0x34}}, 0x0) r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0xf489c6b0528a089c, 0x85) r5 = openat2(r4, &(0x7f0000000340)='./file0\x00', &(0x7f0000000380)={0x0, 0x0, 0xd}, 0x18) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r5, 0xc0189378, &(0x7f0000000a80)={{0x1, 0x1, 0x18, r5, {r2}}, './file0\x00'}) (async) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r5, 0xc0189378, &(0x7f0000000a80)={{0x1, 0x1, 0x18, r5, {r2}}, './file0\x00'}) ioctl$sock_kcm_SIOCKCMUNATTACH(r3, 0x89e3, &(0x7f0000000a40)={r6}) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x70bd25, 0x0, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x30, 0x80, 0x1d, 0x0, 0xee01}}}, 0xb8}}, 0x0) (async) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x70bd25, 0x0, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x30, 0x80, 0x1d, 0x0, 0xee01}}}, 0xb8}}, 0x0) ptrace(0x10, 0x1) (async) ptrace(0x10, 0x1) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x2500, &(0x7f0000000440)={&(0x7f0000000000)=ANY=[@ANYBLOB="6501000014"], 0x188}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x1, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x0, 0x0, 0x1, 0x0, 0xb}]}, &(0x7f00000003c0)='syzkaller\x00', 0x2, 0x1005, &(0x7f0000001840)=""/4101}, 0x80) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x1, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x0, 0x0, 0x1, 0x0, 0xb}]}, &(0x7f00000003c0)='syzkaller\x00', 0x2, 0x1005, &(0x7f0000001840)=""/4101}, 0x80) syz_usb_control_io$cdc_ncm(r1, 0x0, &(0x7f0000000540)={0x44, &(0x7f0000000280)={0x0, 0x5, 0x1, "14"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r7 = openat$ptp0(0xffffffffffffff9c, &(0x7f00000000c0), 0x208002, 0x0) ioctl$PTP_PEROUT_REQUEST(r7, 0x40383d03, &(0x7f0000000100)={{0x4, 0x5}, {0x6, 0x9}, 0xfffffffe}) (async) ioctl$PTP_PEROUT_REQUEST(r7, 0x40383d03, &(0x7f0000000100)={{0x4, 0x5}, {0x6, 0x9}, 0xfffffffe}) r8 = syz_io_uring_complete(0x0) r9 = socket$inet(0x2, 0x0, 0x8001) setsockopt$SO_TIMESTAMP(r9, 0x1, 0x1d, &(0x7f00000002c0)=0x4, 0x4) r10 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0), 0xffffffffffffffff) r11 = socket$nl_route(0x10, 0x3, 0x0) renameat2(r5, &(0x7f00000004c0)='./file0\x00', r8, &(0x7f0000000500)='./file0\x00', 0x6) (async) renameat2(r5, &(0x7f00000004c0)='./file0\x00', r8, &(0x7f0000000500)='./file0\x00', 0x6) sendmsg$nl_route(r11, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=@ipv4_newrule={0x30, 0x20, 0x301, 0x70bd2c, 0x25dfdbff, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1e}, [@FRA_TUN_ID={0xc}, @FRA_GENERIC_POLICY=@FRA_L3MDEV={0x5, 0x13, 0x6}]}, 0x30}, 0x1, 0x0, 0x0, 0x2000c014}, 0x0) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000100)) (async) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) sendmmsg$alg(r12, &(0x7f0000001340)=[{0x0, 0x0, 0x0}], 0x7, 0x0) (async) sendmmsg$alg(r12, &(0x7f0000001340)=[{0x0, 0x0, 0x0}], 0x7, 0x0) dup2(r12, r8) sendmsg$TIPC_NL_BEARER_ENABLE(r8, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000200)={&(0x7f00000005c0)=ANY=[@ANYBLOB="58040000", @ANYRES16=r10, @ANYBLOB="10002abd7000fddbdf2503000000c800058008000100756470001c00028008000200030000000800030007000000080004000300000007000100696200000700010069620000080001006574680008000100657468004c00028008000400010000000800030000800000080001000600000008000300da05000008000400ffff0000080001000900000008000100160000000800040000010000080004000000000034000280080004006a3c000008000200ff0700000800010005000000080003002ce9000008000400fcff010008000400018000001c000980080001000100000008000100ffffffff08000200000100001c0007800c00040001000000000000000c000400af0c000000000000000106804800040067636d286165732900000000000000000000000000000000000000000000000020000000577584e512d9d21abf7891e002871bfc5faecebd59432684b7e036d15d1b12914800040067636d2861657329000000000000000000000000000000000000000000000000200000002de52825ea7024aafcc0076c212755cb1721ef68ae7834c8932a61157e42b7ed08000600010000000800010094040000040005000400050008000600040000004a00040067636d286165732900000000000000000000000000000000000000000000000022000000a249b818c62fed6907db5f07f4e38d74e21187504b618d72f160fea489bb1cdfc12e0000440005803c000280080001000e000000080004000d000000080001000d000000080003009900000008000300ffff000008000200ffffff7f0800010005000000040002800c00038008000200fd0ca17af401068004000500ce0003009d1c9fc714004157015cca0681fd2894e738d363f256069c6db3645fb63e46dc38bd07534a6b2ba578db4256bdf823d9bd65c23676c9368e69f5e7c8acaf1e888a34d349da3eebd3f80cfe4f2d073cf6a4d4c543b2c91c7ffd96451b2b96fa9387ee501bab2ded89c5e806b12c70d0627db85da1ec870359c7c55c7b9bc626a749df206f19778f46618ac8539bf01047bf55154b59579a80c93fe484b27210587dc594300e4cae6004294d0ec716faa6ec1ae68b9c47e7d33ccf89f1396d2b55b5525f16b081c79eefec000004000500860003004bfa418d3a4c5b5e65b8984a2d0a1f6b4b32e0347983ba80364e013bae263085c4113be116f3f7f3ede392defb54de7be6927a61a161b47c83e73f5aa5fb20b78b2804b4bfe9d62db4c5b26626d85696be49b64eaefb831525b9af6d7cc6b36bf6c80b65e8fb008d38d1555119acfaaf48673c10a7413d902110a53133f8a8fc441700004800040067636d286165732900000000000000000000000000000000000000000000000020000000b7658e6dc2254e82ed2a720053bbe504ab994cdcb39a0fb11bb41dd21bd87fdb08000100010000003e00040067636d2861657329000000000000000000000000000000000000000000000000160000007bf7d890ea774cdf30a23bc4cac2bda98f5ad2ed06490000"], 0x458}, 0x1, 0x0, 0x0, 0x40}, 0x0) 8.07541698s ago: executing program 0 (id=9953): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2, 0x0, @loopback, 0x7}, 0x1c) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(0x0, 0xffffffffffffffff) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x141800, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x4) ioctl$KVM_CAP_SPLIT_IRQCHIP(r4, 0x4068aea3, &(0x7f0000000040)={0x79, 0x0, 0x5}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_GSI_ROUTING(r4, 0x4008ae6a, &(0x7f0000000100)=ANY=[@ANYBLOB="0100000000000000000000000200000001000000000000000b000000070000b29ba2"]) ioctl$KVM_RUN(r5, 0xae80, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(0xffffffffffffffff, &(0x7f0000000000)="ac008ac5ab41a2361d3e86d1e0508b10", 0x10, 0x20040045, &(0x7f00000000c0)={0xa, 0x4e21, 0x5ed1, @empty, 0x4}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000300)='yeah\x00', 0x5) unshare(0x68040200) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x80010, r3, 0xfffff000) socket$nl_xfrm(0x10, 0x3, 0x6) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c0000002100010000000000000000000200000000000000000000000a30cad8b96ed2a7436b6c8b895bbed8fc388f106553a335585c81ca2204a40a90b4349c75d05203238535335b310a2f70f43a9f14cbba26d79429c17b89da7e67886c27bf0aeb5d6558a7da06e178752a2309d09a3477849a34cf1a7fac37f38788a4"], 0x1c}}, 0x44044) syz_usb_connect$uac1(0x3, 0x71, &(0x7f0000000540)=ANY=[@ANYRES64=r2], 0x0) openat$dsp1(0xffffffffffffff9c, 0x0, 0x4000, 0x0) syz_clone(0x800000, 0x0, 0x0, &(0x7f0000000080), &(0x7f0000000380), &(0x7f00000003c0)="3230257fba12322ed5573507928e6f91d7a7b7142217cd771c90e685d7cdbcb9cdc61c3e02315a3616788e8e7b759d11d93a02c816bee155a648ccb0a063cd7c7fddb8c5") socket$inet6_sctp(0xa, 0x5, 0x84) 7.444026492s ago: executing program 5 (id=9955): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) r2 = open(&(0x7f00000000c0)='./file0\x00', 0x108843, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x108843, 0x98) fcntl$setlease(r3, 0x400, 0x0) fcntl$setlease(r2, 0x400, 0x0) fcntl$setlease(r2, 0x400, 0x0) sendmsg$inet6(r0, &(0x7f0000000800)={&(0x7f0000000000)={0xa, 0x4e24, 0x8, @loopback, 0x4}, 0x1c, &(0x7f0000000140)}, 0x20048843) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000600), 0x0) r5 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000000c0), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r5, 0x40345410, &(0x7f0000000300)={{0x0, 0x2}}) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r5, 0x54a2) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_ADD(r6, 0x0, 0x482, &(0x7f0000000080)={0x2c, @rand_addr=0x64010101, 0x4e20, 0x2, 'wrr\x00', 0x9, 0x80, 0xd}, 0x2c) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r4, 0xc08c5332, &(0x7f00000003c0)={0x9c9, 0x0, 0x0, 'queue1\x00', 0x200000}) r7 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000600), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r7, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0x3}, 0x76e0}) r8 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xa8c01) write$sndseq(r8, &(0x7f0000000480)=[{0x8, 0x8, 0x3, 0xf6, @tick=0x1, {0xf, 0x1}, {0x65}, @raw32={[0x2, 0x80000000, 0x3]}}, {0x7, 0x1e, 0x7f, 0x6, @time, {0xb, 0xe}, {0x8, 0x4}, @quote={{0xd, 0x62}, 0x0, &(0x7f0000000040)={0x4, 0x5, 0x6, 0x1, @tick=0x1, {0x2, 0x4}, {0x80, 0x3}, @raw32={[0x1, 0x2, 0x580]}}}}, {0x90, 0xfb, 0x7f, 0x4, @tick=0xfffffffc, {0x9, 0x1}, {0x6, 0x80}, @time=@tick=0x8}, {0x4, 0x8, 0x5, 0x1, @time={0x3, 0x6d03}, {0x5, 0x9}, {0x10, 0x7}, @raw8={"41e6ec608abf5379e93f01a9"}}, {0x0, 0x6, 0xa7, 0x3b, @tick=0xfd99, {0x7, 0x7}, {0x0, 0x5}, @note={0x6, 0xb7, 0xff, 0xbb, 0x5}}], 0x8c) r9 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) r10 = openat$procfs(0xffffffffffffff9c, &(0x7f0000002600)='/proc/bus/input/devices\x00', 0x0, 0x0) read$FUSE(r10, &(0x7f0000002640)={0x2020}, 0x2020) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000040)={0xffffffffffffffff}, 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r10, &(0x7f00000000c0)={0xe, 0x18, 0xfa00, @id_tos={&(0x7f0000000000)=0x1, r11, 0x0, 0x0, 0x1}}, 0x20) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r2, 0x84, 0x13, &(0x7f0000000100)={0x0, 0x5}, &(0x7f0000000140)=0x8) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r10, 0x84, 0x18, &(0x7f0000000180)={r12, 0xf}, &(0x7f00000001c0)=0x8) write$dsp(r9, &(0x7f0000000200)='m', 0x1) ioctl$SNDCTL_DSP_SYNC(r9, 0x5001, 0x0) shutdown(r1, 0x1) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x85, &(0x7f00000012c0)={0x0, @in={{0x2, 0x4c24, @empty}}, 0x6, 0xfffc}, 0x90) 6.530337567s ago: executing program 5 (id=9957): openat$tun(0xffffffffffffff9c, 0x0, 0x20702, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x191141, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) lsetxattr$security_capability(0x0, &(0x7f0000000080), 0x0, 0x0, 0x0) llistxattr(0x0, &(0x7f0000000100)=""/56, 0x38) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000400)={0xffffffffffffffff}) r4 = syz_io_uring_setup(0x117, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x3a6}, &(0x7f0000000000)=0x0, &(0x7f0000000200)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000080)=0xfffffc00, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f00000000c0)=@IORING_OP_SENDMSG={0x9, 0x40, 0x0, r3, 0x0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="180000000000000001000000"], 0x18}, 0x0, 0x20040000}) io_uring_enter(r4, 0x47f6, 0x80ffff, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) 5.836089268s ago: executing program 7 (id=9961): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'dummy0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=@newtfilter={0x24, 0x2a, 0xd27, 0x0, 0x1, {0x0, 0x0, 0x0, r1, {0x0, 0xfff1}, {}, {0x5, 0xffe0}}}, 0x24}}, 0x0) r3 = socket(0x200000100000011, 0x1, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) r5 = socket$l2tp6(0xa, 0x2, 0x73) close(r5) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'hsr0\x00', 0x0}) r7 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x80800) ioctl$SCSI_IOCTL_SEND_COMMAND(r7, 0x1, &(0x7f0000000140)={0x0, 0x6000000, 0xa21b}) bind$packet(r3, &(0x7f0000000080)={0x11, 0x0, r6, 0x1, 0x7, 0x6, @local}, 0x14) r8 = socket$l2tp(0x2, 0x2, 0x73) r9 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x501000) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r9, 0x4040534e, &(0x7f0000000200)={0x33, @tick=0x1ff, 0x40, {0x7, 0x50}, 0x7, 0x2, 0x9}) getsockopt$inet_buf(r8, 0x0, 0x9, 0x0, &(0x7f0000000180)) sendmsg$netlink(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000001c0)=ANY=[@ANYRESOCT=r3], 0x34}], 0x1, 0x0, 0x0, 0x800}, 0x4001) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=@newlink={0x50, 0x10, 0xffffffffffffffff, 0x70bd2f, 0x25dfdbbb, {0x0, 0x0, 0x0, 0x0, 0x50a10, 0x51a23}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_GRE_OFLAGS={0x6, 0x3, 0x30}, @IFLA_GRE_ERSPAN_VER={0x5, 0x16, 0x2}, @IFLA_GRE_ERSPAN_DIR={0x5, 0x17, 0x5}]}}}]}, 0x50}, 0x1, 0x0, 0x0, 0x2004e904}, 0x800) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f00000000c0)={[0x8000000000000001, 0x9, 0xc562, 0x5, 0x1ff, 0x9, 0x0, 0x8001, 0x6, 0x9, 0x3, 0x1, 0x3, 0x100, 0xdba, 0x3], 0x2000, 0x10040}) 5.792652443s ago: executing program 1 (id=9962): r0 = socket$inet6(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0xa48a, @ipv4={'\x00', '\xff\xff', @multicast2}, 0x8}, 0x1c) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000180)=0x1, 0x4) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x3, 0x100000df, @empty}, 0x1c) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000540), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000ac0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010025bd709c6baee81c709cb10008000300", @ANYRES32=r4], 0x3c}, 0x1, 0x0, 0x0, 0x4}, 0x0) 5.702061713s ago: executing program 7 (id=9963): mknod(&(0x7f00000048c0)='./file0\x00', 0x0, 0xffffffff) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000140), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f000000a380)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f00000005c0)={0x50, 0x0, r1, {0x7, 0x1f, 0xffffffff, 0x0, 0x1e64, 0x0, 0x1, 0x5, 0x0, 0x0, 0x80}}, 0x50) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) utimes(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)={{r2, r3/1000+60000}, {0x0, 0x2710}}) syz_fuse_handle_req(r0, &(0x7f0000008380)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008df76a250000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea21056000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000131a5d9400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b600", 0x2000, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r4 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x101001, 0x0) syz_fuse_handle_req(r0, &(0x7f0000004900)="fac4e7c21565f79b73d8d7dcc36944c7d36505ed55b2c535ba5bc78cc94f55e518d13a9f4dd794ecf1b09fe12f2893933931db285710f8c78793ddf30ff7dd86203ab0177f8aa062d6fe9529d65fab047ca34c6840b505eee9082e8ccf311bfb84ee46c0d0dd466ba326c6410b06b48ffc309ddd9fcdd816ded9830e41f8cce8d3bc31a817f29e3ecdd0329aadc8b022c55c70eff8905b9bf223ea44cbb290ffe098bb78fcc9e39f16f4f0e8d60e440abc192d530e146bdb59e9e522668bebec672a965ee7bdb300ab4314235dc0e62e94e398742cfeee3b92ce29e1a62fd8375d95ef502ebc1f04959d83a15ee9496198f0b3440b80cb9950324c9d4dfa69381c5c0920e307ab1528efe02739c2a49fc4cf09ff76c165d5005234b8f9378c74040d212eed9e7485cdd758bf4d34c2cf52b278eb3114b13b43214814ba2e2a357c028c737892d0e8ab1f1d009a00ad0dcdb9ffd0f4fa0b03d3b006fd66e8faa4fd44b64dcb92cbb5e9da64165ef01602538708e5dad3c0986a2b03d4d4276c9268af76d300b01ceef84e2a501e2c3d04e31875d1e81270409516d4272d73e9899c5a939c03be73352b61cf32ea1f6cc2d31847703843cd2e54de294b1c957ae618dddd7fdb018908dd7be379fb3db575b0859d9f2a190d8f7abc8400bbcfc866c8f8454102a5b0c215f140cb17677556241e33443aacb35073752aa65f450b2d03750ebbc07ed809f97b5a55a4f11b920cc9bf0a1db7fce63718f85c3326120c8b774ec22ff9c1b7e9114c0b931b6805fa672b53a6a617881fd73dc1b79fbeade0120e08c7abbba9bed82e9700bbf779328ce0a73f7e60459ecfc3f0daf26da8d1b57c1536ec967fdcab8cca66aab0ce0a02320c0090c78511b1672d65b3d62ed38e2655bc6ebfb2480a0c33fc68bba5c444d8cde3f977a382d6413947fcb25e3e9330f45b8874463e2a3fab87d877652de9c2d35208ad5d3e59ee9e63061af0b119d8174e7eaf71551b1f3551d0247717b5bb7d4db41767e2608a2472c7258932e22eb591c957da5fad5732c86cf18ec338e83ed25e41a2e500360c7ea86755efe0962f0d1d4cc945645e01b5a34fc74630c91cd02c5932f2df9ec1e090dd83bda328a7c8d1b8a8294c3c551c1954a7f024eb7ac01e35538612f2f23a6c52c59beab75910c5abad25a3789baa0001569e93561a8992450bdb0a757b916af413d63badc4aeeb9489357ff7fdb27e913278dbb5f2d69bc196d110638601f31fb4db2b301faa7516955d6971b562288328e14c7957696eaa03d3911ec661279e37a850b7515fb4e122c39fd6dc3af40980173e6324ee678b47f74428a593827d75aae3368e661dbe9738a2704d8f7a086e77b9ffb3eb0e16199c58eff45dbe628d268e88bb2d69a310b60db0a850afcb08a2a7b316c70209ecf034d484a6b1f68de857d4ebfd45936c04b532202bea6b3a6d3751cf73db4ca0a76faf7a972f8a68a523b0a51d593436aed65999fe96058e085b4352c0d5603365ae4cf724e5801da03665ee2071e04b45c6de0a59afc376e3ce2ef206c3161f235049d7e0b52e04ccac4f1699629b3f8736601a6dadfd00dd9545cb7cabd1cba12ddb2a23c58b1da9c69ee4ec9853aaa81e1cf7a169f91a1c077fd6c5c2fd366c9a2a285420d5633bf0544003251768db01281f8259a0d0c489f7f7cfc0fa7ff2878fb0cea89ddb3593539a1184e667f3840e8e5043508777dcef371e2ea3cf489fcfd60066a8dcfc9d0fbc21aac05f24a88ceb5c186326d1fe5b6cb4a40d25e6f847f7a4030d0a9cd29b0f9e3b49471730df5c5d1e172376ab2a27f3aaa3d1c5f354952745db1c54464e9f4d224ca1bcc7a4004bbba7a21d60a1fd5a35c1179738fbcb61241f38703610d51b18afc0e0bce11564167344568875374c6114c64b7cd25cb3c005b2577afe3c0f528d5c838152fe7b307d743596c91f43f3958e1f25f741aa4b30baa4063d0d9c3453fa18de83f744786c7b4294415e0222ecd9bd9a115663f32e9505d3618f9c716f23d9e536d429557774f7910aded24931f373507dba89766d760b714da6e264492ffee985422e60da15b7ea862935d21bb878560b0f8270f82cb3a8fc99ac35c30038b95532fe848f8a2876f5782acbad93f1426fee13fa4f0b778950bb2096c7d1c5bdd481ecae83254800f78a762983418c3fd673deda93c206ad399144b141db743640e3102fb453d553f939ad643ce9faabbb01bfad49cd30a61cce67fd46782447e14c7b2d2dc1df244cd7d72404a0f5b54187c75aa45b9b2a73727de0ce187b7e9cfd471efb73e9a84971185cf335cb33fce92e06992398e53be779782a436579bef6d7b0d93915e758fde3fd67b9a964d5a8ddc5950cb2a78262d0e36d329f9ba56b06266a126334c56852b290937423bc178a575a442046a8a4406e88b829d36bea6786774b0c513dc951b330eb5dd914a907b97e83db55cf73c2897dc3d6944dac797b8b1434327fc15caa6b309b62e1aa52d4e8ca7a7db6f99e423489951961f147b3cb14956e801f7b1a15b959546ea229898ab9b99c9a080f5d9176c59ace26b72e620b9ff6e558bfe7808a7b430c414ab90cb0f1e4101be46dc360928797171922d41bcc8c12d17375222c706b3f864f8937ca947b33eb13216b1cd1d4119fa6de7e1a07c652671d20b1930ccf14c443223a4fb93848969465feaffc703347a5d5a9b68339e3951d3b8fc17c6045201af7e84a7026bc741592bd47768a793abe5009eb9427dfcfc4e4a9b9ae71f8582b0cd9c28c6270d5bbdf0f1415c722384808cc8fdaea65eb97d5fda8dd2014163598411c51495fd9fea5ae48c9e0d158217335c0181db4d196af623b5de7ebb1a0a71090e896c11b33cccd4515d1370b00ca48df5b855b8942cf35a8da12d4eb68b52ad786e2146383c54a13a3de979d03039e42a440c6d0db2a1509ccd1aa5097af5b15b49b90928d82e7b944d0750ac6d9433526e65d3ae79201b4a20175aa12692e4ba41c4733673a47e8ea44ed2b34d3ae80ca8b05aa159662f75ba748ef793aa184c8405796185ffb25ca4cb324f4f77610a3b372f5fad04ef85ab771f2f5efa3d95ca0074b9363b3b4095dacc04d48b9c86ebdfd94981a33b2fdb712409462aca416079a5daf92fd24374b6f3f76277fc36bd6d38832ae14db4711b0503fe12b647516d1df64c11962219c17ecc60fd25704a94742d6655e57ac9f89ae1db77fe8679b7f84b403e101d70352f1d80bba74c4aefe14cec35f4168d2e9c2625a0e692504299cf8ca875e7b45fd3c71df003628c3ac6616b3b1a8edb7879e5781877a9873b3885958edec9d1a7d24cc22c49047335dec3cf9b2821c267ac8dfaea3bdb3dde0fc7d1c1c96ce04f3bd5ddd7ec3ba253cc34e7df4a03d58e716b5bf8d681c65931407a60c28922aceff1edb45417bae99167d99e97669d68efddd00a867f5b3ce5763be30e07ff2cf8b15c90a6f656f717bc1b590231f48e3fc4a85124d43a1a811b6043604870e56b81f127db36a686eb77d612609f44b0fb262b17739fbb36c67ed305e114b7b595626e897af9d59acee1af38295c366bc32e3af59427dc11d5cd594add4e226d947ff26a2140f476a43695ebc8f73cf5b7efeb2ce46d63484b9f3ded774088a0a31cb2eeae9538bf0c071f572657f905b33d4b3fb5280879cab0bc5fc7a89be10a9118c419f974c454a37bb934bd488cb1ecbdcb2ac26094f90b8093fc75454317b92278eff430f6622cbb2c4f6a8a2ef5c7388b504a6cf89bf889990977fd4f5ea1a530131a8e2356e3f1db0d9f93d7a65af79f1fadc0b40279965522d47dfe154d62036ce4e53eeb6e96473d3e2f59ce1f54414af8bada3d9b6089e7a670c7418d0f906ddd8494bbea718fb91acd0fdd0f2c19746f4c1ff87167987f056a86f03aad8c11aec6ea967383c29b9c8bc6d4f46c9c2f44fa5a43f52cda78cf36f270a7a9c77c7007a55b6770847aa8cf4676ea9abcbb91ca9a41ad56682f3dae20ed1a67d75391caabdb66808b91e86b9db4a13f7935fff256b54818a589402967c2242a70afffbc7ca73116a1ca81a126d2d609174a93b16d1fa4d18bd6a4e277aa42a8551765b241d1e54174ba7993d1694d5a191b3036cab5eed5311403ba6de613b73beddc753359f7339417e4f07724c6ba1ce99a55c6b8ec72c0a4df4776146877309382d3af87c204ce86f54c2a7c1027adee9ab2e4f6bd205fb41d7d6b2fabf7308ced5c870f156aaa9dbd24f232ad85d6123426c5e5264b4418ebc7acf1cac380212f48dd87c2000f0f0c7e4a54c04523fb7cebbc50c26691ca8ab9748831851392864c02166f5e2f0c7d5d76b71908de9ba69a88b0bbaad0dcfb9e3ad8680275e35218a60227bfb6f773fea9570831db671ec8912abe6c6190499e0100232aba631b9ab148547041f1bfabec860d19ce987c019249f07bf3effcff35a6c5402a584f0a55a3a580aa8303aa9a67856f8cc27abdfde11fd2b8c5432a46fe2c3c08ae53ff42d1c545fb890d097d9b31437c53f6563fe416570b4cb3d5fb084d9ad4165e6eaa6a24a5b77dfd6c0962d233a2030427dcab08660143dc3853d3ae8907a21f812501b1e96fca4e4c73226827477ae9e5e87f88be74228afc7393d7ed98f090577db9d70158e3acc36e07f959d32de1e34b471e2732e38d0a9397c6d3a218d0abd71af71993cff9e47793dc72d00c5d5079ad76e935c58d349f03c6a976ac204b4663324b63fba9fb7b4a048186d53f72012779b02ecc61faeed40494538a2df95f14be70f80e2c1072f56ccf59ff5d75dea6652ef90138b22c943fd4863e90216cf9ba84e69cbf43661031720bbc22e94bf2fa1dbfe8313487b4cf6cb31e9d26995471ab64a120e0eef82d95620890aaa48afa7acf4ba274dba1b5a1e37c1062fd70fab8218ceddaa8d10154e567c7cb8e5f4bb07c6c6065164c0b374b17c555f9c1ec8d108ae7ada1913db7a447e8ea3713d6e2fd6384ac3286d9941523e01d3fefb32cd65922f2113a5de4c7334657106a2c97a6282b22d7d67f39fd6601916b0d5bdcbe382fa786a3cf74b24cdbb5a2843b56ddb14d5514139b1cffcd68d45f9f082186e2ea8f774c899cbbaac2e6207cbe86645fb346fd360d94a2b61e0cf9d33778cf3b3aac5fbf29288fc065ea5a218b404b82c79098b48a8051d03b6f8c4df4843b665eaf6935ad0e703cd928d228a48b51d23afa1bde22b7655dd4d8fb73b2b10533d6da9b9fe6aac3d1e73e5157c0e33bae4f31f10212d7f87d9341e3090b3c7c8ef79efae8bb744a5f8db2bcedeceea81e8c23716e113bbd24722d6f33dfe6438006fadc9bab9809c5c5b3371994a55263a52e9bcdcd3665f8472bbc0c59d27c0a7d023763ca55f80b7a20014636be698a2f1e0a5ed5320b1591e0c1350fe41593942495ba1a214cf18dee3c73635d208a60737b253cc716d1cdf0c7546dab111bfdc0777c4ae297e9a35153e84d7c5411df5e134f2a128d5c0240aff77e076a1113214ee68fe0c294996944180a7a5c4c35ce341682cb31607c3cf5514b1f1035673f3475376a8cbf20b50cf3272a49c8aafda33fef13aa90781f9c14741886fbdda634205fa98c94dfe5f06533d17d772ec5be90243a24f1db46530fc8b8e167cec2276dc16cd755e371f85827f44da53114333abd41b2ea70faac6762d38b5751e243b2e01ce7d00dce1069419fde74c49ebfabf86eb696fc6f07a8b4f95683449416c9633f3ef6a2eba6a687291e2e7f48a3fd15bdd2187e7790fbfe684b5764d7ef0bb3ba99c2e120300cf58c408608ba6090e15539024787a0290083d808380214a8ecd11effcc05149e476b1ea5b82047411050068806e331171513c57713f0987133e155d3b312aadc9f243f8533fb07ce208d46c42604669ff4b8a28be3bc71f38b45081d262ec130a818d05d8a8b52cf923727f59380441524be1d3448223a2cccaabe7d86a88c4a9ad8683a42cadc41b4f26faa91d9c927edf30cb8137e74d7c8b40a9adc2567de40144ba8f86776a1ee234d02c56fbfecdc636aac44aa59d0392d8e8c13531350f2c4b5b6417db0667a557acca8f931d31a56c3b55f603e9646cc409dd54db6d89be0a7a5b5459639915bacc24885e4a1e2f3a805cd7a315f71601d5fcb2b658deaa676d77ad646003770df1be040641ff3391c4770e5461c38eb2b0eb58e9134de52e78d36c3dfd1ef42d9561b78116e70b3658ba7ff9411a7085b80a8082977d57e9df4851e5f7da33f06f7c47447bab0b4c7d3b9c9a511ff6d8ed4a26287d9ed154302ff6ed1aecaa226d60ded733eebc924ce2df1f7ada22a10db46e768918178cffc926b61544f59f6b0be26900a5204e97b6b91b16c227796f903e5e1d3924a4f3286579507a30a1486d7d186a2fd5059b2e83cecae0c7ae26dc7c262e717263c1599e7da38f3e3ce06abaf77876979c0835c859e101ff6fa4ab2a96e65a497cdf27b1df052d07bbe1bd4284d8f817d586667dca367a668a1904430ee1ca62098d919f0a4eea1244a8e4a7792c86165fdd8b9be99262d2f40ecda00a9a5afc1bde0e630814e8aef82176dcd37463e34e63c115d9d33012e497c41c22e98978ee1e4d44becb9df7920d9f8490427d020d602cc741a03284d01e81804714d46f13ac08e2a6a8677286fd66c528b985dc51d7b150417ce8fe991e2db228bca99fa6eecfe654307fda8a227ce880e7da556ffd3ed3adca545953da9c369033f2e819a1d66636fd1e9794bbd0d7a75e68c44c632eef85b205cab173aa5a9023ecbcdbdd43e4afc7ee5346075ee1bd79795245a8437d41496d3a25144af27fa026fc1b4135e28c753127fa19c147bc14c68b15fe170fff5b916eb069a414c069da3dd2640ddde8e819ae37b670ff42dca8010cced7373d0ee0c2fb05de16dc8959d172c4f467a25038b97fbf9e60bd3c40c73871d4114d6d81acb7d57552495c336e5da9b71b7872e9ebdf082023674118c3f94af6f05ab5e19ecd8ec055dd6eece56f850e902745173f758e2387c1464866348bbb5d436937192371564fd9769eb4542444ef4e60701594fbd6afc80fc7e0f7616ec8286fa1059395a2ff7ffd3fc434b84f23ca88fe44c8cf21e1b13b3f3f66543e71b855f3f785dfe1f954462fbcf57b591c0a725d27381251828d7fdf7e09bdbd625e89e98f61fb76d56ad69106510ecefa93853f0da630f7b4f324c17494d1fa51f94e9daa978b572065f6396a7f3d649060798b32b61ee7bc7ff03fdfd800e8dba8c9b0c8d51433972db34e0cc2666d54dacc4c1da366bfd58f5321f6daa88d4e49a450a75e2ae935471886bda66022b4167a743d8e7518fa2b427408f5c3278152f3d97404e34c2e0531a322518bea013e44c82546b135398263854cc3fa21f72389170c4e422e2e221c43634442eec3712c172f3b9a4e29c43d59ed1715391dc27f7254ac5918f9985288b5ff44a52c93c5663312331a3341fdff4d24607f91c4fc0cce634a4f69f686ab52ec6e36e41a1fc87af4eba40ab2da228194a6cc9b98f271f74666c47a3e371e866dd8a41293dd6474b2dde3f6bc452b010490e17cc4e7df92e7436788e7e60dda166a38314f18e631656862ff7ecdbb85cdad2dea4365443da5617877df6bad1abc1be597a2961df6cf34f5f110a60694b406e4ae9e48077132ed583f76b54f3c37108b19c47acc4bc02072a64a0da39bbbbd6f2110a8e925a63389d963057f466d02a10f6a6ba2112b74e28e0aae33b0f028c2270f1f07c42b25c812c3dc34f811b862c3485b4396cceca3ec6a62e47bd519533c30f3d9cf05b0ec9886f8abb796ce31b290ab6b515dcc7d7f3ab11582fff535ffe2746333c1d288f7a22ee36ed232f1a7d6dc3c825d86d211af3eecdfdea7cb7a4e5139ebec4a3b7e81518e76a6d8951bfb090705f21d158d89061815e7dba1cc8134e2f80955dc63f3fc0a5fb953b4ab05c22ca761092418c32725732e54dcf086430f6b114761b745ae8ab00127ca375ca08d7c4ff7e306f7bfeab6d87a7e43218c267ef145095fc7a1ad58a283007734de55aea229a24c63372ae40e32618468612464d61840d79d837722d8204ed09b9bda9f438df009c9a2e4584755dd4ad91a3378255e0b104258baf6175e7d9df45c3caa2aebfb5866e4d20fa09e06ab689903a1c1b622ea04f1208adbf7cd6ab7a53068441eab17dafb00a07bbd5083a6691f6f34a9fa82b1ded4660deaf67343ab9aaae5f70c0b5a287ba669f32a1431ede98ac58bb4f42ef2a23122cd6a3da7658174853a7400bbda3ea58ce0f5589a6d5eb45e0a17aedf12bb175a8d083492e768f52b23881e61f3492fc039e478a712918ff2b1721b9e6e7911e16539f6104fbd0457b5521391672f1e57cdc2632ace97d4e21372213d1546578f7c8c12218600d85bd53cc6a5f2a2b1e88400c55f13703df10ab28a327112404f4663b19c4e938acd3917bfa5580845d0060a9136dfd88000bc05d07476bda0742ced80e1f61103ac1a501cb648ec6ffcfb0c1ce6fcce6e97832a720eb621091f2bb8ca2535e4c4c2335d6cf8a88cdc484b19dd12a0cad69bcef70f1c5a416ea21ccdbaef497a4ae417370531e48fc48fd01106934b6fc6cfae0acfe78f208d5ecbb773707484b57768781f57126d774a75099b308035862572d3fbf86692d474bd92850405bfbb80dc8a525ff594bb0d908ceaa9f51b2ac7b41a2b4c45621b62b1e1ba55e394ee15c4c222598b4e58b8addf87474a3aa94e9233d36520ded5f6ede8be6c32d38af2f8a0fb27562b2e3330490d46047e0a2d383830c2b0525c049d3005888bbbd247162275b157e440942b37eaf4abb9a4d22ef15d6d3009096d9b3d6732c35c2878e4c2fc905f2d961bf3700f0c08740249b57a18be63a18ff2fd7340fa3baa719839cf8eaa389a2f3b81af202c4a9abbdd030bfaef70cb65fc961bb579ed400e648cd8c1b100b289c38067a6d422c1a0a9f027795eecdaa7230d6e0662d0f59ab1cb0671b3b99ec12b65771f0c7416456b99537d10779d496f17e0c04160e879a5d089adf6f8060d92c44039ef2475f4647b5f3b30335ba2a50403d09644a00122d3bf7553c8eccb0e8dc612a83e6e5a7acab9f014fbbc712623ea86edc9bec0e4c392efaea3c56bb5ec45832ccbe6329509a6800ee36e85bb3b65dcf5aff9aa2db6569a230cdf1296e815d717191bad83ba31c1e42b69c6a5cd214739b1af105a244283c59c4f60d730fe6835ca983f3bea050012d6b6bc13a70591950de0d0d8857c200b61158a13f2c2d2536a799b7b4ac302ffbc78e9769e324c6ebfd567f5f4c2b053f7b59b6b07285194526d40ca6a5c4c376fa127b6b100489ce5266ebafa0cdec24b5bd7a22f295402303f8d1ddc3d1427d4c3beece3309d55f138d878c8054b259c53e59489f5f3610b3784489cdfa6083867a92a5f7e30826a6f590b9c809020c0f8eb73b70a971c050a70af2ca3a70573554b97c60037872df3e5c3f2e91103827306e72fbf1b072250e432b7bf8a5540783a2848724989eb86670e1f5b0675a39f7b1548260fd211d9c05e48e1a3df852842c477a36bbbac07317246dc8b4c3383227485556992735bfea38ef7a8a3a372464dc0ee6b9a09548a37dce62d563d04eaec5cb54c9614170e0811b53fd05dbd192744f74b5e0e3cc1b29dc0755ae4fc0c14ae8927f72864a796e65130e05d012336a96e5b15f17ae6258c67ecab6505bc1a26c00d5010e86f243412ca4264da4ed41670238faca1d7c7ed6ae74cc104ff3f9c045ce7efad15db83c3f5bbf001507caf3e6ee0a11a9c10205d91a7bbc12b2a91065352440a18493315df7dfa671bf8e1bd6d67119fbc3bb69d5661a43481b00ee60dab9d725f7f166ff989a0cbe21ec7f0007bf09cf5b5bc65b5835c4d0bfe6981616dffe0eae36d5b8c39d14645801919bc537212fb941ebe346bcb5037cf8b894ca92a0682fb2b37f08609a4a9465f0c423250343fc2367da64b690e273293431a36813cea94de5cf411c5c3c0265239aafb8fbe45c55fabd94baf7053023d1b0f647abcc07be35fa5a0c3aba2da35f6c2d8a739beccd96916cd30bdd8533411a425ae30b5d02b8d79c3622118641fb8551a31e1c1f4a0551d2b57eeee4097e9c48e09481c228bef6aa3c4aa7b9e72e8731cbc57a20a9e3417ec718c6d57a401d3c04ee2e4066d6d950149e277dc2bdaa23879b2c5135611d82ad8d20a4b2235c09da69fbd9878cbc52b25622165e0ab3bffe476eb2884629596dc865f6b13ba510cb375e59195636deeeb06786a7c9904ccdc58eb8664fe7b4d32bcb9fc8ab135c25ee2c22837c6c3a8c116e8fdcfc310799d0fc974e43d3a73fa0f8bd9057a1465823567f681c1d2e6c4a33770a4dccd06bce94b0af0e4d198b040d8094d610bbbd4501d8da6028b5e73f135cba6a8d7bb6cab2f06576eacd823e520282f9f883634a6dd4cc4810cba3f760b9842a0acae7a396892b658e3b6c84d0e75196b4e6a3240e9d2aadf257ae970153238e347d3cbcbfabae300494ea0d1bf292799e09b8064ed885cce1574ee94c216c50017c43b3407716e5919fa0706fc9e9c382bb321e8d6fa2520543d0427a620bb45c56d3f7e66aa025f17863024a2bd693d932bacfa516fec791e86982d020faa819bf2264f8606ef260a29af16300971d0ec49d6f5a21f9c437b75b44eb59bbaf71947621a1e78c68e2767dd42c7f6e3dd6faeebfc8fdfe4dec6db3fdd2d53c906f6040278ea235b37442f34cfa1a1f1064acce6a7cdb9657c1ea2def6c1f2220ab57ececfe53b4bdb6e57afaac1c055f25202c1efa65b3e48f5b57dcd2b7f3572d1d96a736813ca6acc75c967a89edc5dd62eea64cd46eeab6aa879887360aec466dd287705497e832bd4eb3d73524e4847c18f8b46de1a88a00dfa43acf51fe97288d53e30c6f2739b4532c6e8f7286a25c5f5f10532fee71d7c1c1f6a1c56f2535d94e2dd774f424cab2bf3673e097fd3cfb55ba1f29a6d03dc31abc214a6dc5950824f05f0a3036690120684a7117d42e9d40b56f3738428540c27f25ce4130966fc9b08f831756d5448be9ad7d07b95bfe61fb396438bba4ccaffa7a8a21edc5324d72514427a75a3619e48400e1b13a97ae7097f87c9253035ac3a1e3bf6d22725d22e31b7e0c9515f98f34ba357cc136190f81c010f83306d97a89184656bef128a648b9878bbefc508a631f949d8540ed16aead49d51911901d74d7aa9649317356ebd2ac0441be95291c1c2ba803b2e4604ac4b09e29fc6200819fb2603b46dbe929e4cc661c4f31a6cdc94a81fa62eb28bf447fe2ddbbb3d5f2b97d4189ffe5d83bc8be19ee5c92b958488a55c859d7eb5885674bd351c4125a02151529e9ab01685f2e4bba3aef0d5e9ad8678dab470d761beb8785424d51c4aa728417d1edc7cc44d8c7f2f5a09c68f940fc72a4ed2952e1985b2727befdf551d95e8d43e4dcab6f65b12ea706cbc10e5354a894e7646118e60", 0x2000, &(0x7f0000001400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)={0x78, 0x0, 0x2, {0x80, 0x10, 0x0, {0x5, 0x0, 0x1000, 0x1, 0x5, 0x1, 0x7ffffffd, 0xb, 0xc, 0x8000, 0x5, 0x0, 0x0, 0x80, 0xa}}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000000000)='./file0\x00', 0x0) lseek(r4, 0x0, 0x2) 5.459964296s ago: executing program 1 (id=9964): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket(0x10, 0x3, 0x0) r2 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_TABLE(r2, 0x29, 0xd1, &(0x7f0000000040)=0xfe, 0x4) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x3c, &(0x7f0000000100)={&(0x7f0000000640)=ANY=[@ANYBLOB="a000000001000000000000001c14004000000000000e0000840013000000000000000000000000000000000000000000617724c6450000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f161234de53f74114349073d04045227ae14edcaa485f713613281d02261b4f6251056e3cb8a5f644596edc4bc0d9743dab13f6257fd782dfd2f4376223682061b76d4b65893ba2d195f9b3932f7e340a13cde72434afb7af43951d0aeb6464f54e94bcff481e3bbc5cd4ebd2291e6a4775b6eb76da59ceb9409e8e62224f0af67943f8635ebf2659b762f5d5bed863390b0011e27829c92205b9be82b6786cbf5d7074db64e6d6dd0020b05862965f22656695554625a3aea4a57e3d3a485029d930cf21cc0be513735bb3d187f899efd1ff8b29b3e666b17e1c8ec14b07058c6616d1fab6f043d717e7f33aac162db39caea4cc0fb739e5e3ad939dd1eff1091163f9c6ed413cb93aa9df7ce2a28e4cae4a9433ffc08ac84cedd04ade89caa7d2251a389"], 0xa0}}, 0x4040840) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), r0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) getsockopt$sock_int(r4, 0x1, 0x3c, 0x0, &(0x7f0000000080)) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000540)={'wlan1\x00', 0x0}) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f0000000e00)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r6, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r7, 0x0, 0x0, 0x0}) r9 = socket$kcm(0x2, 0x3, 0x2) sendmsg$inet(r9, 0x0, 0x200040c4) r10 = open(&(0x7f0000000140)='./file0\x00', 0x2a4c0, 0x0) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r10, 0x84, 0x18, &(0x7f00000001c0)={0x0, 0xde}, 0x8) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r11, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r12, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r11, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='fd']) r13 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r14 = syz_io_uring_setup(0x4c1e, &(0x7f00000000c0)={0x0, 0x7079, 0x4000, 0x3, 0x288}, &(0x7f0000000180)=0x0, &(0x7f0000000280)=0x0) sendmsg$BATADV_CMD_GET_NEIGHBORS(r13, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000240)={0x0}, 0x1, 0x0, 0x0, 0x8004}, 0x81) syz_memcpy_off$IO_URING_METADATA_GENERIC(r15, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r15, r16, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(r14, 0x3516, 0x0, 0x0, 0x0, 0x0) ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP(r6, 0x3b8c, &(0x7f0000000c80)={0x30, r8, 0x1, 0x0, 0x10000, 0xffffffffffff9dce, 0xe8, 0x0}) sendmsg$NL80211_CMD_DEAUTHENTICATE(r0, &(0x7f0000000600)={0x0, 0x2c, &(0x7f00000005c0)={&(0x7f0000000040)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010025bd7000fedbdf252700000008000300", @ANYRES32=r5, @ANYBLOB="06003600f6fa00000a84a6000802110000010000f52a7a8b2b9c710ec158c726a6d56dfc037cf0f59054006a3db897266b2cb0e020794ba32f9bafedfe7e6b342df7ba93d4d7d8871c29deda82d505d262d2d633df0000000000"], 0x30}, 0x1, 0x0, 0x0, 0x10}, 0x890) 5.303808399s ago: executing program 3 (id=9966): capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)={0x6, 0x6, 0x2, 0x87, 0xffffffff, 0x40}) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000200210d0000aaa8fa017242ba9380d42400000000000000290000003b000000", 0xfe60) 5.202561189s ago: executing program 3 (id=9967): socket$netlink(0x10, 0x3, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000000140)={'wg2\x00', 0x0}) connect$packet(r0, &(0x7f0000000240)={0x11, 0x5, r1, 0x1, 0x4, 0x6, @broadcast}, 0x14) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000001140)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3400000010000305fcffffff000000000000000021aab24d906f8d8de34635c1bd9fbdd56ed5a10941bd313f59f60fb2bbd8de1b851f30672457add7e7dec26dc354124dad738f60ef71982bf7dce81b5c8bb8ccfc16b292d4bbb4735c3a955b77ff2b0a6a", @ANYRES32=0x0, @ANYBLOB="05030200157e0000140012800c0001006d6163767461700004000280"], 0x34}, 0x1, 0x0, 0x0, 0x80}, 0x48094) sendmsg(r3, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x4, 0x8001, 0x0, 0xb49, 0x200000000002, 0x7, 0x8, 0x3}, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x12) pipe2$watch_queue(0x0, 0x80) syz_emit_vhci(&(0x7f0000000380)=ANY=[@ANYBLOB="043b0afffffffffffffaffffffc84bd06d423141125839584cb4bd6c1381efbe1a6917a72dc52a35f90ee4e032cc489b987036ec4cd09c28f056796041e3e8d11e1e07489e6940b83fb2b6894a1c510b531250a66a872bbbcd3aa5f358b1b380c4938c2dab152901ebfe3306f9544c60a18fb6e3fce22d076dd941d7285c65053572750035aaf23c03ccaeaef9e30cc74001678a5f030e7d58b05690f3bde02f4c903fafe231b385b98b78e3d8c6b4fde84baa2e5142ad129f3af9b010eb1705403c25e4da25df270cc6c24f5d527b6ce1696f1986f500"/227], 0xd) socketpair$unix(0x1, 0x2, 0x0, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000080)={'bridge0\x00', 0x0}) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={0x0, 0x50}, 0x1, 0xba01}, 0x0) r9 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r9, 0xaf01, 0x0) syz_usb_connect(0x0, 0x24, 0x0, 0x0) r10 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0201, 0x0) ioctl$SNDCTL_DSP_CHANNELS(r10, 0xc0045006, &(0x7f00000001c0)=0x7) r11 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r11, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=@newlinkprop={0x40, 0x6c, 0x200, 0x70bd2d, 0x25dfdbfe, {0x0, 0x0, 0x0, r4, 0x41c30, 0x53147c912cda52af}, [@IFLA_MASTER={0x8}, @IFLA_EXT_MASK={0x8, 0x1d, 0x5}, @IFLA_LINK={0x8, 0x5, r8}, @IFLA_NET_NS_FD={0x8}]}, 0x40}, 0x1, 0x0, 0x0, 0x240008a0}, 0x20000c59) 4.695934075s ago: executing program 0 (id=9968): socket$inet_sctp(0x2, 0x5, 0x84) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$ptys(0xc, 0x3, 0x1) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="6c000000020601000000000600000000000000000e0003006269746d61703a69700000000500040000ffed000900020073797a3200000000240007800c00028008000140ffffffff0c0001800800014080ffffff050014000200000005000500020000000500010006"], 0x6c}}, 0x0) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r3, 0xfffffffc) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x1000000) openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r4 = socket$rxrpc(0x21, 0x2, 0x2) setsockopt$RXRPC_SECURITY_KEYRING(r4, 0x110, 0x2, 0x0, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x33, &(0x7f0000000040)=0x7, 0x4) bind$inet6(0xffffffffffffffff, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(0xffffffffffffffff, &(0x7f0000000600)=[{{&(0x7f0000000140)=@nfc_llcp, 0x0, &(0x7f0000000780)=[{&(0x7f0000000340)=""/180}, {&(0x7f0000000280)=""/122}, {&(0x7f0000000400)=""/165}, {&(0x7f00000004c0)=""/142}, {&(0x7f0000000640)=""/70}, {&(0x7f00000006c0)=""/179}], 0x0, &(0x7f0000000580)=""/70, 0x11}}], 0x40000000000029d, 0x2, 0x0) r5 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r5, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) syz_io_uring_setup(0x10d2, &(0x7f0000000480)={0x0, 0x7734, 0x80, 0x0, 0x34f}, &(0x7f00000000c0)=0x0, &(0x7f0000000000)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000180)=0xfffffff9, 0x0, 0x4) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) 4.617522981s ago: executing program 7 (id=9969): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$team(0x0, 0xffffffffffffffff) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)={0x54, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0x8000}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:net\x00'}]}, 0x54}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)={0x38, 0x9, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x10, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @empty=0xfffffffe}}]}]}, 0x38}, 0x1, 0x0, 0x300000000000000, 0x10000047}, 0x4000050) 4.384314675s ago: executing program 1 (id=9970): socket$inet_sctp(0x2, 0x5, 0x84) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$ptys(0xc, 0x3, 0x1) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="6c000000020601000000000600000000000000000e0003006269746d61703a69700000000500040000ffed000900020073797a3200000000240007800c00028008000140ffffffff0c0001800800014080ffffff050014000200000005000500020000000500010006"], 0x6c}}, 0x0) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r3, 0xfffffffc) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x1000000) openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r4 = socket$rxrpc(0x21, 0x2, 0x2) setsockopt$RXRPC_SECURITY_KEYRING(r4, 0x110, 0x2, 0x0, 0x0) r5 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r5, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r5, &(0x7f0000000600)=[{{&(0x7f0000000140)=@nfc_llcp, 0x0, &(0x7f0000000780)=[{&(0x7f0000000340)=""/180}, {&(0x7f0000000280)=""/122}, {&(0x7f0000000400)=""/165}, {&(0x7f00000004c0)=""/142}, {&(0x7f0000000640)=""/70}, {&(0x7f00000006c0)=""/179}], 0x0, &(0x7f0000000580)=""/70, 0x11}}], 0x40000000000029d, 0x2, 0x0) r6 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r6, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) syz_io_uring_setup(0x10d2, &(0x7f0000000480)={0x0, 0x7734, 0x80, 0x0, 0x34f}, &(0x7f00000000c0)=0x0, &(0x7f0000000000)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r7, 0x4, &(0x7f0000000180)=0xfffffff9, 0x0, 0x4) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) 3.579932505s ago: executing program 7 (id=9971): r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/dev\x00') read$eventfd(r0, &(0x7f0000000000), 0x8) socket$kcm(0x10, 0x400000002, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000100)={0x2, &(0x7f0000000040)=[{0x30, 0x0, 0x0, 0xc8e}, {0x16}]}, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000480)={'wlan0\x00', 0x0}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r7 = socket$inet_smc(0x2b, 0x1, 0x0) r8 = syz_io_uring_setup(0x10d, &(0x7f0000000540)={0x0, 0xd4bb, 0x0, 0xfffffffd}, &(0x7f0000000380)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r9, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) sendmsg$inet(r7, &(0x7f0000001640)={0x0, 0x0, 0x0}, 0x20000090) syz_io_uring_submit(r9, r10, &(0x7f00000002c0)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, r7, 0x0, 0x0, 0x0, 0x80800}) listen(r7, 0x5) io_uring_enter(r8, 0x3517, 0xc2de, 0x9, 0x0, 0x0) r11 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f00000000c0)={'bridge0\x00', 0x0}) sendmsg$nl_route(r11, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newlink={0x44, 0x10, 0x401, 0xfffffffc, 0x80, {0x0, 0x0, 0x0, 0x0, 0x1503}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r12}, @IFLA_NUM_TX_QUEUES={0x8, 0x1f, 0x5}]}, 0x44}, 0x1, 0x0, 0x0, 0x2004d808}, 0x0) sendmsg$NL80211_CMD_SET_WIPHY(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000040)={0x24, r3, 0x200, 0x70bd2a, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY_FRAG_THRESHOLD={0x0, 0x3f, 0xc}, @NL80211_ATTR_WIPHY_RETRY_SHORT={0x5, 0x3d, 0x9}]}, 0x24}, 0x1, 0x0, 0x0, 0x80d0}, 0x0) sendmsg$NL80211_CMD_SET_COALESCE(r2, &(0x7f0000000200)={0x0, 0xffffffffffffff8c, &(0x7f0000000b00)={&(0x7f0000000040)={0x28, r3, 0x1, 0x0, 0x0, {{0x2}, {@val={0x8, 0x3, r4}, @void}}}, 0x28}}, 0x0) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x8000}, 0x4) r13 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r13, &(0x7f0000000240)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x3c}}, 0x10) sendmmsg$inet(r13, &(0x7f0000000ec0)=[{{&(0x7f0000000080)={0x2, 0x4e25, @multicast2}, 0x10, 0x0}}], 0x1, 0x2000c044) getsockopt$packet_int(r1, 0x107, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) 3.090110613s ago: executing program 5 (id=9972): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@ipv4_newrule={0x1c, 0x20, 0x301, 0xfffffffc, 0x0, {0x2, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x3, 0xf}}, 0x1c}}, 0x42094) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x2e, &(0x7f0000000100)={&(0x7f00000002c0)=@newlink={0x3c, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1303}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipip={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x8, 0x3, @multicast1}]}}}]}, 0x3c}}, 0x0) 2.822405916s ago: executing program 5 (id=9973): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000240)) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x40001, 0x2}, 0x28) ioctl$KVM_RUN(r2, 0xae80, 0x0) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000080)={0x0, 0x0}) setrlimit(0xf, &(0x7f0000000000)={0x40000e, 0x5}) write$P9_RREADDIR(0xffffffffffffffff, &(0x7f0000000440)={0x30, 0x29, 0x1, {0x7fd0, [{{0x0, 0x0, 0x4}, 0x1008, 0xfe, 0xd, './file0/file0'}]}}, 0x30) 2.621617981s ago: executing program 1 (id=9974): setsockopt$packet_fanout_data(0xffffffffffffffff, 0x107, 0x16, &(0x7f0000000100)={0x1, &(0x7f0000000180)=[{0x28, 0x0, 0x0, 0xfffff034}]}, 0x10) r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f0000000140)="2600000022004701050000070000000000000020002b1f000a4a51f1ee839cd53400b017ca5b", 0x26) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e00000008000000000018000380140003801000018004000300080001"], 0x44}}, 0x0) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000001180)={0x38, r2, 0x7, 0x0, 0x0, {}, [@ETHTOOL_A_LINKMODES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}, @ETHTOOL_A_LINKMODES_OURS={0xc, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x4}, @ETHTOOL_A_BITSET_NOMASK={0x4}]}]}, 0x38}}, 0x0) 2.148858262s ago: executing program 0 (id=9975): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x14, 0x3b, 0x9, 0x70bd26, 0x0, {0x10}}, 0x14}, 0x1, 0x0, 0x0, 0x44804}, 0x84) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000180)={&(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x7000)=nil, &(0x7f0000ffb000/0x3000)=nil, 0x0}, 0x68) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='smaps\x00') r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f00000004c0)='veno\x00', 0x5) sendto$inet6(r2, 0x0, 0x0, 0x20000045, &(0x7f00000001c0)={0xa, 0x2, 0xffff, @loopback, 0x3}, 0x1c) shutdown(r2, 0x1) read$FUSE(r1, &(0x7f0000002680)={0x2020}, 0x92e) syz_usb_connect(0x4, 0x2d, &(0x7f0000000e80)=ANY=[@ANYBLOB="1201000003312208c71b00040400000300000000090504000000000000"], 0x0) 2.128714268s ago: executing program 1 (id=9976): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000012000)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x76a9bba1a690db0f, 0x0, 0x0, {0xa, 0x0, 0x5}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x3cb140bb}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x3}]}]}, @NFT_MSG_DELSETELEM={0x20, 0xe, 0xa, 0x801, 0x0, 0x0, {0x5, 0x0, 0x5}, [@NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x88}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) (fail_nth: 12) 2.040217426s ago: executing program 5 (id=9977): openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/fs/cgroup', 0x0, 0x0) (async) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/fs/cgroup', 0x0, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x141400, 0x0) read$sequencer(r1, 0x0, 0xfd1d) (async) read$sequencer(r1, 0x0, 0xfd1d) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r2, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r5, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r6, @ANYBLOB="01000000020000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newlink={0x54, 0x10, 0xffffff1f, 0x70bd26, 0x80, {0x0, 0x0, 0x0, 0x0, 0x1605, 0x2f10}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @gretap={{0xb}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_GRE_ENCAP_TYPE={0x6, 0xe, 0x1}, @IFLA_GRE_REMOTE={0x8, 0x7, @multicast1}, @IFLA_GRE_ENCAP_SPORT={0x6, 0x10, 0x100}]}}}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x54}}, 0x4000) getdents(r0, &(0x7f0000000340)=""/71, 0x47) 1.912751059s ago: executing program 5 (id=9978): r0 = fsopen(&(0x7f0000000040)='gfs2meta\x00', 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da05000000000001090224"], 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x50, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) getsockopt$IP_VS_SO_GET_DAEMON(0xffffffffffffffff, 0x0, 0x32, 0x0, 0x0) syz_usb_connect(0x2, 0x5a, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(r2, 0x0, 0x0, 0x9, 0x6) close(0xffffffffffffffff) r3 = socket$rds(0x15, 0x5, 0x0) setsockopt$RDS_GET_MR(r3, 0x114, 0x2, &(0x7f00000002c0)={{0x0}, 0x0, 0x88}, 0x20) syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000e00)=ANY=[], 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000340)=@updsa={0x180, 0x10, 0x1, 0x0, 0x0, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0xa, 0x20, 0x0, 0x5c}, {@in6=@loopback, 0x0, 0x33}, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, {0x0, 0xffffffffffffffff}, {0x0, 0xfffffffffffffffd}, {0x0, 0x20000}, 0x0, 0x0, 0xa, 0x4, 0x80}, [@algo_auth_trunc={0x8d, 0x14, {{'sm3\x00'}, 0x208, 0x0, "ab84411f518dc9d5565b9e05de67830aeb529f334e285efe3786823a0a1e08b53bec30240d4d6f58f05cd36e941758cf60d4c5a818aca82c12697c43daf8000000"}}]}, 0x180}, 0x1, 0x0, 0x0, 0x20004001}, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r5 = syz_open_dev$sndpcmp(&(0x7f00000001c0), 0x0, 0x101040) ioctl$SNDRV_PCM_IOCTL_REWIND(r5, 0xc0844123, &(0x7f0000000000)=0x2) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="b8000000190001000000000000000000e00000020000000000000000000000000000000000000000000000000000000100000000000000000a00000087000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000000000000009e8c20300000000000000000000000000000000000000000000000000000000000000000000fbfffffffffffffffdffffffffffffff00000000000000000000000000a3ed6c90c3557f04000000000000000001"], 0xb8}}, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=@flushsa={0x74, 0x1c, 0x1, 0x70bd2b, 0x25dfdbfc, {0x32}, [@mark={0xc, 0x15, {0x35075d, 0xf}}, @user_kmaddress={0x2c, 0x13, {@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in=@rand_addr=0x64010100, 0x0, 0xa}}, @address_filter={0x28, 0x1a, {@in=@loopback, @in=@local, 0xa, 0x47, 0x1}}]}, 0x74}}, 0x2c000010) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) r8 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='fd=', @ANYRESDEC=r8, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) 1.294689825s ago: executing program 1 (id=9979): syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000c80)={&(0x7f00000000c0)={0x50, 0x0, 0x1, {0x7, 0x29, 0x1, 0x800, 0x3, 0x200, 0xffff, 0x12800, 0x0, 0x0, 0xa71c7af322690c5f, 0x7f}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000005000/0x18000)=nil, &(0x7f0000000380)=[@text32={0x20, &(0x7f0000000140)="bc050000000f46a78900000066ba210065f30f32ee66ba20006666270fffcb6d6c2f800000c065c3a7a704c0000f3046b800008ed0660f38806f008ee0", 0x3d}], 0x1, 0x20, 0x0, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f0000000400)={0x18, 0x0, {0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xa}, 'lo\x00'}}, 0x1e) sendmmsg$alg(0xffffffffffffffff, 0x0, 0x0, 0x8810) r3 = openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$PPPIOCNEWUNIT(r3, 0xc004743e, 0x0) r4 = syz_io_uring_setup(0x497, 0x0, 0x0, 0x0) io_uring_register$IORING_REGISTER_PBUF_RING(r4, 0x16, 0x0, 0x1) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, 0x0, 0x0, 0x4) socket$inet_mptcp(0x2, 0x1, 0x106) syz_io_uring_submit(0x0, 0x0, 0x0) mknod$loop(0x0, 0x8fff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0xa}, 0x94) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$EVIOCGPROP(r5, 0x40047438, &(0x7f0000000180)=""/246) ioctl$PPPIOCSFLAGS1(r5, 0x4004743a, &(0x7f0000000300)) sendmmsg(r2, &(0x7f0000001840), 0x0, 0x0) ioctl$PPPIOCSCOMPRESS(0xffffffffffffffff, 0x4010744d) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r6 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000600)={0x0, 0x0, @pic={0x2, 0xd8, 0x1, 0x2, 0x2, 0x1, 0x1, 0xff, 0x5, 0x0, 0x0, 0x10, 0xa, 0x1, 0xd, 0x5}}) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f0000000000)={[0x35, 0x7, 0x0, 0x180, 0x7, 0x0, 0xf1, 0x0, 0x8000000000000, 0x5, 0x0, 0x9, 0x0, 0x0, 0x0, 0xbd9], 0x1, 0x3c4210}) ioctl$KVM_RUN(r6, 0xae80, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000000)="5584a7d5fbd061b8fbf130064f4ce687798d95c2c94f7899e60ceda1a8f9", 0x1e, 0x0, &(0x7f0000000040)={0xa, 0x4e24, 0x81, @local, 0x1000}, 0x1c) syz_usb_connect(0x0, 0x64, &(0x7f0000000440)=ANY=[@ANYBLOB="120107dbe208480b03201bd40102030109025200020509300209aadbae9e25723e2504020524040409050a03000000000000000e01ff0303020809050503000240bf08090404da50193ae0f6c95dcd06b20e531d6b644dac72f82b4a511c802d246358251ebb59779793213c61b79232d50e0b1525bfc33c0a9228664d306320ca8dd10165f73e9b36b6ebf6fcf889e5d22566cb8b729284663866979e2e8a403368f09e00666956d9ce2419dab15ec7b1b7687c57ffdb4e81d00cc86bd376640fadbae36fc300000000000000000000000000000091e069a83485e027458fa68511522fdc062c4d0d68c979e4bded6a9df5b4f445ff1beca5fe2a41b87bf0b1569ef81a4837c0d663fc65607dd52ec3b24cd99696782c9a8399ed4b877e8110e8ec5e09cbc52c7aefb7c9c880e6667ac808"], 0x0) 1.136292499s ago: executing program 0 (id=9980): socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r0, 0x1, 0x4c, &(0x7f0000000000), 0x4) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x50, 0xffffffffffffffff, 0x0) r1 = socket(0x2c, 0x3, 0x3a) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x2}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, r1) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) personality(0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0x0, 0xffffffff}, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, &(0x7f0000000240)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000180), 0xffffffffffffffff, 0x0, 0x1, 0x4}}, 0x20) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f00004dd000/0x1000)=nil, 0x1000, 0x3000, 0x7, &(0x7f0000ffc000/0x3000)=nil) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x5) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) r2 = socket(0x2a, 0x2, 0x0) getsockname$packet(r2, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000440)=@gettaction={0x80, 0x32, 0x300, 0x70fd27, 0x25dfdbfd, {}, [@action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x1}}, @action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0x7fffffff}, @action_gd=@TCA_ACT_TAB={0x28, 0x1, [{0xc, 0x12, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x6}}, {0xc, 0x17, 0x0, 0x0, @TCA_ACT_INDEX={0x8}}, {0xc, 0x18, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'nat\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x24, 0x1, [{0x14, 0x16, 0x0, 0x0, @TCA_ACT_KIND={0xf, 0x1, 'tunnel_key\x00'}}, {0xc, 0x1b, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x4}}]}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x0, 0x1}}]}, 0x80}}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newtfilter={0x94, 0x2c, 0x33639abd728caf9f, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r3, {0x6, 0xffeb}, {}, {0x5, 0x2}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x4c, 0x2, [@TCA_CGROUP_ACT={0x48, 0x1, [@m_ct={0x44, 0x1, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x10, 0x7ff, 0x6, 0x1, 0xff}}]}, {0xffffffffffffffc6}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}]}]}}, @TCA_CHAIN={0x8, 0xb, 0xfffd}, @TCA_RATE={0x6}, @TCA_RATE={0x6, 0x5, {0x0, 0xfc}}]}, 0x94}}, 0x200440c4) r4 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r4, &(0x7f00000002c0), 0x40000000000009f, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) 1.133947256s ago: executing program 7 (id=9981): r0 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=[{0x10, 0x8}, {0x18, 0x110, 0xa, "0180"}], 0x28}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$VIDIOC_S_OUTPUT(r2, 0xc004562f, &(0x7f0000000000)=0x80) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000040)={0x3, &(0x7f00000000c0)=[{0x20, 0x0, 0x0, 0xfffff00c}, {0x20, 0x0, 0x0, 0xfffff034}, {0x6, 0xfe}]}, 0x10) sendmmsg(r1, &(0x7f0000008ac0)=[{{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000200)="7f27cf1d", 0x4}], 0x1}}], 0x1, 0x0) unshare(0x4020400) flock(0xffffffffffffffff, 0x0) 1.048089769s ago: executing program 3 (id=9982): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, 0x0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0xc000) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000180)='task\x00') r2 = syz_open_dev$sndctrl(&(0x7f0000000600), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r2, 0xc1105517, &(0x7f0000001340)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x3, 0x0, 0x4, 0x0, 0xfffffffffffffd14, 0x0, 'syz0\x00', 0x0, 0x3}) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x0, 0x32, 0xffffffffffffffff, 0x8528c000) getdents64(r1, &(0x7f0000000fc0)=""/224, 0xe0) r3 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan1\x00', 0x0}) connect$can_bcm(r3, &(0x7f0000000140)={0x1d, r4}, 0x10) sendmsg$can_bcm(r3, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000000080)={0x5, 0x802, 0x0, {0x0, 0x2710}, {0x0, 0xea60}, {0x0, 0x0, 0x1}, 0x1, @canfd={{}, 0x27, 0x0, 0x0, 0x0, "f33d8e7b847ec8b36f1107e036dd98fc469107485e371bcf5c6b77db54f3d984795c49eca9b92241dc9fc39f976ad52e581942d9fc2178681e6866aa6ef10d06"}}, 0x80}, 0x1, 0x0, 0x0, 0x40084}, 0x20000000) sendmsg$can_bcm(r3, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000480)={0x5, 0x180, 0x9, {0x77359400}, {}, {0x2, 0x0, 0x1}, 0x1, @can={{0x4, 0x1, 0x1, 0x1}, 0x5, 0x1, 0x0, 0x0, "c251541693f8cfd1"}}, 0x48}, 0x1, 0x0, 0x0, 0x1}, 0x24004844) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$igmp(0x2, 0x3, 0x2) getsockopt(r6, 0xff, 0x81, 0x0, 0x0) r7 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, &(0x7f0000000180)={'vxcan0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)=@getchain={0x24, 0x11, 0x839, 0x70bd25, 0x0, {0x0, 0x0, 0x0, r8, {0xb, 0x6}, {0xffff, 0xfff9}, {0x1}}}, 0x24}}, 0x0) 958.885036ms ago: executing program 7 (id=9983): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x6, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) unshare(0x8000000) shmget$private(0x0, 0xfffffffffeffffff, 0x4800, &(0x7f0000ffc000/0x3000)=nil) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r2 = syz_open_procfs(0x0, &(0x7f0000000200)='task\x00') lseek(r2, 0x3, 0x0) getdents64(r2, &(0x7f0000003440)=""/92, 0x5c) setsockopt$inet6_group_source_req(r2, 0x29, 0x2f, &(0x7f00000002c0)={0x7, {{0xa, 0x4e21, 0x6, @private0={0xfc, 0x0, '\x00', 0x4}, 0x6}}, {{0xa, 0x4e23, 0x4, @dev={0xfe, 0x80, '\x00', 0x16}, 0x8}}}, 0x108) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) memfd_create(0x0, 0x3) openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x2) r3 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r3, &(0x7f0000000200)=@id={0x1e, 0x3, 0x0, {0x4e21, 0x4}}, 0x10) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r4, 0x0, 0x0) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/netlink\x00') lseek(r5, 0x7ff, 0x3) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000000)={0x42}, 0x10) r6 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(0xffffffffffffffff, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x1, 0x5}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r6, 0x10f, 0x87, &(0x7f0000000240)={0x42, 0x1}, 0x10) close(r3) 740.195897ms ago: executing program 3 (id=9984): r0 = socket(0x10, 0x803, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffe0, 0xfff3}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x1}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newtfilter={0x78, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r2, {0xf}, {}, {0x7, 0xfff3}}, [@filter_kind_options=@f_u32={{0x8}, {0x4c, 0x2, [@TCA_U32_INDEV={0x14, 0x8, 'macvtap0\x00'}, @TCA_U32_SEL={0x34, 0x5, {0xd, 0x87, 0x1, 0x3d3f, 0x6, 0xfff, 0x3, 0x58f, [{0x8001, 0xc295, 0x6000000, 0xfffffff4}, {0x200, 0x53b0, 0xb04, 0x800}]}}]}}]}, 0x78}}, 0x24040084) 620.034755ms ago: executing program 0 (id=9985): r0 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000700)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000006c0), 0x2}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000680)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000400), 0x106}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000b80)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000b40), 0x106}}, 0x20) r1 = ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0x7) ioctl$KDGKBTYPE(r1, 0x4b33, &(0x7f00000000c0)) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000940)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000002c0), 0x2}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000780), 0x13f}}, 0x20) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x80, 0x0) fcntl$lock(r3, 0x6, &(0x7f0000000500)={0x1, 0x0, 0x7344, 0x3}) r4 = openat(0xffffffffffffffff, &(0x7f0000000140)='./file2\x00', 0x42, 0x185) r5 = inotify_init() inotify_add_watch(r5, &(0x7f0000000000)='./file1\x00', 0x4000082) fallocate(r4, 0x0, 0x1000000, 0x3) syz_usb_connect$uac1(0x2, 0xad, &(0x7f0000000980)=ANY=[@ANYBLOB="12010003000000106b1d010140000102030109029b0011015670c809045f0000010100000a24010101bb02010211240601040507000a0008000300020005052405040f0f240602050402000a000a0009000405240402010924060502010600000924030301010505f5090401095e8ad86607bb0000010204010101010200000905010920009301090725010003480f0904020000010200000904000d02040bbf8301a4d0e272558eeeed043c1694ed0ac689a13786319a711ed25849d753fe010679f68283ec5422976501ac108fb149f7f78aec4195aaa5510f92171b89ff1fb1e79b423816dbfb6a292f9a34326ce13d7919f11975146f0061a56702f735a7d56f0194e9a48ad0c746907260ab5e9148cd94d0e94de27741ac30fd6fc7bca964b3209b4f971d46ef511597529e88b3474ce0760d10639730a736202edb62b563345e5fdfe63006fa661c328b008c4b8c5f199b63658ddaa96349b10e3cb6c3f4f4b360b3f65a647be83f2beffc8cc2b83baac1a5280352adf214f014603b112bd8129a5f170dd200000000000000"], &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x7e, &(0x7f0000000540)=ANY=[@ANYBLOB="7e03ecc765558fe865a8284b34177ed7081d662896fbd8d9742dc6514309dfce91b3672e21b35cb42e5abff5f135cb7e6eaeaa91db2df272639aa577bdd6e9401db575ed653892d89357be80165442328fba0ebd23167e463106152e97ce50d2fb405a9afd54843e121cc70a15d182aa12b8f38798a43205586e01b51b69474e9cac11680d1b29cad0d3dbfdc05e1490a1f60a54b443e69826d0023e3bbafb82be49d394f21191f0a65e5a6ef64be7d56bef25572ef51b89f793a8c6a59cee4f7679731a85a52b361800b24482b14eb6c63ef94b0644f1119379e813cb4e24b8a17541f503c632d61ef4f6181c806ad822c39871bec45eb8e73386cd321b059b193db2e2acbfe0bf91e17f5f0eb2044f8fb1b438356c80"]}]}) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100), 0x111, 0x1}}, 0x20) r6 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000680)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000400), 0x111, 0x5}}, 0x20) r7 = getpid() r8 = syz_pidfd_open(r7, 0x0) setns(r8, 0x20000) write$RDMA_USER_CM_CMD_CREATE_ID(r6, &(0x7f0000000b80)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000b40), 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(r6, &(0x7f00000003c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000900), 0x111}}, 0x20) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) creat(&(0x7f00000001c0)='./file0\x00', 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r9, &(0x7f000057eff8)=@abs={0x1}, 0x6e) sendmmsg$unix(r10, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r9, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 442.292385ms ago: executing program 3 (id=9986): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x10b200, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000600)=[@text64={0x40, &(0x7f00000006c0)="f3440fc7b729000000f20f5f0d00000080460f5ba4b07a000000470f38c9403736460fc7b10f240000660f3881078fa9189021da820001c0fef3440f0966b881000f00d8", 0x44}], 0xaaaabbc, 0x74, 0x0, 0x0) tee(r0, r0, 0x100000000, 0xa) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x33, &(0x7f0000000140)=0x80000003, 0x4) r3 = accept$alg(0xffffffffffffffff, 0x0, 0x0) recvmmsg(r3, &(0x7f00000026c0), 0x0, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 0s ago: executing program 3 (id=9987): timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000280)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x62d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), 0xffffffffffffffff) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000180)='/sys/power/freeze_filesystems', 0x0, 0x140) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001680)={0x2c, r3, 0x1, 0x70bd25, 0x25dfdbfa, {}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond0\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8000}, 0x4000080) r4 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) bind$can_j1939(r4, &(0x7f0000000040)={0x1d, r5, 0x8000000000000003}, 0x18) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'erspan0\x00', &(0x7f0000000080)={'gre0\x00', 0x0, 0x8, 0x10, 0x8, 0x7fffffff, {{0x9, 0x4, 0x3, 0x4, 0x24, 0x64, 0x0, 0x80, 0x4, 0x0, @multicast2, @loopback, {[@noop, @generic={0x83, 0xa, "e9c4d21233b1ffc5"}, @noop, @end, @noop]}}}}}) r7 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x8080, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r7, 0x3b88, &(0x7f0000000140)={0xc}) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000140)={'ip6_vti0\x00', &(0x7f0000001540)={'ip6gre0\x00', 0x0, 0x4, 0x5, 0x3, 0x136dbbb9, 0x4a, @remote, @remote, 0x80, 0x10, 0x2, 0x40}}) sendmsg$ETHTOOL_MSG_LINKSTATE_GET(r1, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20005080}, 0xc, &(0x7f00000001c0)={&(0x7f00000015c0)={0x9c, r3, 0x400, 0x70bd29, 0x25dfdbff, {}, [@HEADER={0x60, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pimreg1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_virt_wifi\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team0\x00'}]}, @HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'nr0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}]}]}, 0x9c}, 0x1, 0x0, 0x0, 0x40800}, 0x20040044) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0xd3283d0368e269b2, 0x8031, 0xffffffffffffffff, 0x0) r9 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) writev(r9, &(0x7f0000000180), 0x0) kernel console output (not intermixed with test programs): probe with driver cdc_phonet failed with error -22 [ 2200.769787][ C0] net_ratelimit: 3 callbacks suppressed [ 2200.769811][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2200.782811][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2200.918224][ T4493] netlink: 16 bytes leftover after parsing attributes in process `syz.1.9507'. [ 2201.281013][T31281] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 2201.297319][T31281] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 2201.307018][T31281] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 2201.326549][T31281] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 2201.337351][T31281] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 2201.438945][ T30] audit: type=1326 audit(1757194252.406:3939): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4505 comm="syz.1.9512" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3308b8ebe9 code=0x7ffc0000 [ 2201.524592][ T30] audit: type=1326 audit(1757194252.406:3940): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4505 comm="syz.1.9512" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3308b8ebe9 code=0x7ffc0000 [ 2201.567615][ T30] audit: type=1326 audit(1757194252.406:3941): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4505 comm="syz.1.9512" exe="/root/syz-executor" sig=0 arch=c000003e syscall=23 compat=0 ip=0x7f3308b8ebe9 code=0x7ffc0000 [ 2201.623613][T23651] usb 4-1: USB disconnect, device number 127 [ 2201.779845][ T5936] usb 2-1: new high-speed USB device number 120 using dummy_hcd [ 2201.809778][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2201.817420][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2201.844179][ T4516] usb usb8: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 2201.995647][ T5936] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 2202.069655][ T5936] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 0 [ 2202.470477][ T5936] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 2202.501556][ T5936] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x89 has invalid maxpacket 0 [ 2202.539897][ T5936] usb 2-1: New USB device found, idVendor=2040, idProduct=4900, bcdDevice=4d.8b [ 2202.573621][ T5936] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2202.631845][ T5936] usb 2-1: config 0 descriptor?? [ 2202.849741][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2202.857052][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2202.877050][ T5936] hdpvr 2-1:0.0: unexpected answer of status request, len 0 [ 2202.896639][ T5936] hdpvr 2-1:0.0: device init failed [ 2202.936899][ T5936] hdpvr 2-1:0.0: probe with driver hdpvr failed with error -12 [ 2203.218288][ T4508] chnl_net:caif_netlink_parms(): no params data found [ 2203.410519][T26654] Bluetooth: hci5: command tx timeout [ 2203.889756][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2203.897057][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2204.015758][ T4535] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9516'. [ 2204.313383][ T4508] bridge0: port 1(bridge_slave_0) entered blocking state [ 2204.327104][ T4508] bridge0: port 1(bridge_slave_0) entered disabled state [ 2204.340472][ T4508] bridge_slave_0: entered allmulticast mode [ 2204.349271][ T4508] bridge_slave_0: entered promiscuous mode [ 2204.363575][ T4508] bridge0: port 2(bridge_slave_1) entered blocking state [ 2204.380230][ T4508] bridge0: port 2(bridge_slave_1) entered disabled state [ 2204.390433][ T4508] bridge_slave_1: entered allmulticast mode [ 2204.399103][ T4508] bridge_slave_1: entered promiscuous mode [ 2204.507058][T23651] usb 2-1: USB disconnect, device number 120 [ 2204.613691][ T4508] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2204.693045][ T4508] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2204.838915][ T4544] futex_wake_op: syz.1.9520 tries to shift op by -1; fix this program [ 2204.929768][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2204.938375][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2205.024170][ T4544] netlink: 1072 bytes leftover after parsing attributes in process `syz.1.9520'. [ 2205.106810][ T4508] team0: Port device team_slave_0 added [ 2205.155827][ T4508] team0: Port device team_slave_1 added [ 2205.469462][ T4508] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2205.489965][T26654] Bluetooth: hci5: command tx timeout [ 2205.501995][ T4508] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 2205.530296][ T4508] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2205.545128][ T4508] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2205.554201][ T4508] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 2205.649051][ T4508] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2205.969807][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2205.978369][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2206.192641][ T4508] hsr_slave_0: entered promiscuous mode [ 2206.210925][ T4508] hsr_slave_1: entered promiscuous mode [ 2206.217847][ T4508] debugfs: 'hsr0' already exists in 'hsr' [ 2206.231847][ T4508] Cannot create hsr debugfs directory [ 2206.330130][ T4566] usb 7-1: USB disconnect, device number 45 [ 2206.346564][ T4567] netlink: 11 bytes leftover after parsing attributes in process `syz.1.9527'. [ 2206.990036][T23651] usb 2-1: new full-speed USB device number 121 using dummy_hcd [ 2207.009825][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2207.017085][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2207.192850][T23651] usb 2-1: config index 0 descriptor too short (expected 69, got 36) [ 2207.219745][T23651] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2207.267290][T23651] usb 2-1: New USB device found, idVendor=093a, idProduct=2622, bcdDevice=b7.89 [ 2207.287216][T23651] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2207.315845][T23651] usb 2-1: Product: syz [ 2207.327816][ T4508] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 2207.331745][T23651] usb 2-1: Manufacturer: syz [ 2207.353845][T23651] usb 2-1: SerialNumber: syz [ 2207.356835][ T4508] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 2207.368779][T23651] usb 2-1: config 0 descriptor?? [ 2207.397560][T23651] gspca_main: gspca_pac7302-2.14.0 probing 093a:2622 [ 2207.415714][ T4508] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 2207.456794][ T4508] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 2207.469989][ T5957] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 2207.570174][T26654] Bluetooth: hci5: command tx timeout [ 2207.641499][ T5957] usb 4-1: Using ep0 maxpacket: 32 [ 2207.669064][ T5957] usb 4-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 2207.698061][ T5957] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2207.720574][ T4508] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2207.741668][ T5957] usb 4-1: config 0 descriptor?? [ 2207.795529][ T4508] 8021q: adding VLAN 0 to HW filter on device team0 [ 2207.839578][ T78] bridge0: port 1(bridge_slave_0) entered blocking state [ 2207.846817][ T78] bridge0: port 1(bridge_slave_0) entered forwarding state [ 2207.893307][ T78] bridge0: port 2(bridge_slave_1) entered blocking state [ 2207.900556][ T78] bridge0: port 2(bridge_slave_1) entered forwarding state [ 2207.966709][ T5957] dvb-usb: found a 'Elgato EyeTV Sat' in cold state, will try to load a firmware [ 2207.993737][ T5957] usb 4-1: Direct firmware load for dvb-usb-az6027-03.fw failed with error -2 [ 2208.014246][ T5957] usb 4-1: Falling back to sysfs fallback for: dvb-usb-az6027-03.fw [ 2208.049793][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2208.057041][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2208.161374][ T4508] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 2208.218572][T23651] gspca_pac7302: reg_w() failed i: 78 v: 40 error -71 [ 2208.226552][T23651] gspca_pac7302 2-1:0.0: probe with driver gspca_pac7302 failed with error -71 [ 2208.240100][ T4580] fuse: root generation should be zero [ 2208.274029][T23651] usb 2-1: USB disconnect, device number 121 [ 2208.352622][ T4508] veth0_vlan: entered promiscuous mode [ 2208.392625][ T4508] veth1_vlan: entered promiscuous mode [ 2208.487519][ T4508] veth0_macvtap: entered promiscuous mode [ 2208.509502][ T4508] veth1_macvtap: entered promiscuous mode [ 2208.552998][ T4508] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 2208.568525][ T4508] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 2208.594977][ T4467] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2208.614441][ T4467] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2208.631835][ T78] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2208.647800][ T78] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2208.838795][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2208.864780][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2208.924440][ T4467] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2208.946146][ T4467] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2209.090498][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2209.098096][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2209.267960][ T4593] netlink: 4083 bytes leftover after parsing attributes in process `syz.1.9534'. [ 2209.319429][ T4593] netlink: 52 bytes leftover after parsing attributes in process `syz.1.9534'. [ 2209.514125][ T4593] netlink: 52 bytes leftover after parsing attributes in process `syz.1.9534'. [ 2209.649945][T26654] Bluetooth: hci5: command tx timeout [ 2209.920220][ T4593] netlink: 52 bytes leftover after parsing attributes in process `syz.1.9534'. [ 2210.129806][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2210.136923][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2210.155741][ T4609] netlink: 40 bytes leftover after parsing attributes in process `syz.5.9537'. [ 2210.773971][ T4623] netlink: 4 bytes leftover after parsing attributes in process `syz.5.9538'. [ 2211.169752][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2211.176938][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2212.209778][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2212.216964][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2213.249745][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2213.257137][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2214.272890][ T4657] FAULT_INJECTION: forcing a failure. [ 2214.272890][ T4657] name failslab, interval 1, probability 0, space 0, times 0 [ 2214.294544][ T4657] CPU: 0 UID: 0 PID: 4657 Comm: syz.7.9548 Not tainted syzkaller #0 PREEMPT(full) [ 2214.294574][ T4657] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 2214.294587][ T4657] Call Trace: [ 2214.294595][ T4657] [ 2214.294604][ T4657] dump_stack_lvl+0x189/0x250 [ 2214.294633][ T4657] ? __pfx____ratelimit+0x10/0x10 [ 2214.294655][ T4657] ? __pfx_dump_stack_lvl+0x10/0x10 [ 2214.294681][ T4657] ? __pfx__printk+0x10/0x10 [ 2214.294715][ T4657] ? __pfx___might_resched+0x10/0x10 [ 2214.294752][ T4657] ? fs_reclaim_acquire+0x7d/0x100 [ 2214.294795][ T4657] should_fail_ex+0x414/0x560 [ 2214.294830][ T4657] should_failslab+0xa8/0x100 [ 2214.294861][ T4657] kmem_cache_alloc_noprof+0x73/0x3c0 [ 2214.294886][ T4657] ? prepare_creds+0x31/0x6c0 [ 2214.294916][ T4657] prepare_creds+0x31/0x6c0 [ 2214.294946][ T4657] prepare_exec_creds+0x18/0x220 [ 2214.294973][ T4657] bprm_execve+0xe9/0x1450 [ 2214.295000][ T4657] ? get_arg_page+0x290/0x330 [ 2214.295026][ T4657] ? __pfx_get_arg_page+0x10/0x10 [ 2214.295056][ T4657] ? __pfx_bprm_execve+0x10/0x10 [ 2214.295080][ T4657] ? put_arg_page+0x136/0x270 [ 2214.295106][ T4657] ? copy_string_kernel+0x25f/0x2a0 [ 2214.295134][ T4657] do_execveat_common+0x510/0x6a0 [ 2214.295173][ T4657] __x64_sys_execveat+0xc4/0xe0 [ 2214.295205][ T4657] do_syscall_64+0xfa/0x3b0 [ 2214.295226][ T4657] ? lockdep_hardirqs_on+0x9c/0x150 [ 2214.295246][ T4657] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2214.295265][ T4657] ? clear_bhb_loop+0x60/0xb0 [ 2214.295289][ T4657] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2214.295309][ T4657] RIP: 0033:0x7f1f7138ebe9 [ 2214.295328][ T4657] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2214.295346][ T4657] RSP: 002b:00007f1f721af038 EFLAGS: 00000246 ORIG_RAX: 0000000000000142 [ 2214.295368][ T4657] RAX: ffffffffffffffda RBX: 00007f1f715c5fa0 RCX: 00007f1f7138ebe9 [ 2214.295385][ T4657] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 2214.295398][ T4657] RBP: 00007f1f721af090 R08: 0000000000001000 R09: 0000000000000000 [ 2214.295412][ T4657] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2214.295425][ T4657] R13: 00007f1f715c6038 R14: 00007f1f715c5fa0 R15: 00007f1f716efa28 [ 2214.295456][ T4657] [ 2214.536052][ C0] vkms_vblank_simulate: vblank timer overrun [ 2214.543188][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2214.551438][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2215.048804][ T5876] IPVS: starting estimator thread 0... [ 2215.094178][ T4670] syzkaller1: entered promiscuous mode [ 2215.117752][ T4670] syzkaller1: entered allmulticast mode [ 2215.139860][ T4671] IPVS: using max 37 ests per chain, 88800 per kthread [ 2215.372649][ T4679] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 2215.491335][ T4681] netlink: 'syz.3.9556': attribute type 27 has an invalid length. [ 2215.579849][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2215.587098][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2216.115791][ T4681] bridge0: port 2(bridge_slave_1) entered disabled state [ 2216.123561][ T4681] bridge0: port 1(bridge_slave_0) entered disabled state [ 2216.609804][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2216.618854][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2216.744156][ T4681] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 2216.805976][ T4681] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 2217.126312][ T4681] vlan2: left promiscuous mode [ 2217.152812][ T4681] bond0: left promiscuous mode [ 2217.172086][ T4681] bond_slave_0: left promiscuous mode [ 2217.186517][ T4681] bond_slave_1: left promiscuous mode [ 2217.203113][ T4681] batadv0: left promiscuous mode [ 2217.322351][ T1108] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2217.340796][ T1108] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2217.378562][ T1108] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2217.431093][ T1108] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2217.495826][ T4700] tipc: Started in network mode [ 2217.503357][ T4700] tipc: Node identity 5ad9d2877fa1, cluster identity 3142 [ 2217.517134][ T4700] tipc: Enabled bearer , priority 0 [ 2217.528078][ T4700] syzkaller0: entered promiscuous mode [ 2217.538232][ T4700] syzkaller0: entered allmulticast mode [ 2217.576935][ T4700] unknown channel width for channel at 909000KHz? [ 2217.587338][ T4700] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 2217.658489][ T4698] tipc: Resetting bearer [ 2217.659770][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2217.671464][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2217.773815][ T4698] tipc: Disabling bearer [ 2218.206565][ T4708] netlink: 7 bytes leftover after parsing attributes in process `syz.1.9566'. [ 2218.226102][ T4708] netlink: 7 bytes leftover after parsing attributes in process `syz.1.9566'. [ 2218.348991][ T4714] netlink: 36 bytes leftover after parsing attributes in process `syz.5.9565'. [ 2218.690478][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2218.697741][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2218.949715][ T5936] usb 2-1: new high-speed USB device number 122 using dummy_hcd [ 2219.099871][ T5936] usb 2-1: device descriptor read/64, error -71 [ 2219.499692][ T5936] usb 2-1: new high-speed USB device number 123 using dummy_hcd [ 2219.640834][ T5936] usb 2-1: device descriptor read/64, error -71 [ 2219.740035][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2219.747067][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2219.756514][ T5936] usb usb2-port1: attempt power cycle [ 2220.072002][ T4732] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9572'. [ 2220.090658][ T4732] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9572'. [ 2220.110139][ T5936] usb 2-1: new high-speed USB device number 124 using dummy_hcd [ 2220.180739][ T5936] usb 2-1: device descriptor read/8, error -71 [ 2220.419877][ T5936] usb 2-1: new high-speed USB device number 125 using dummy_hcd [ 2220.440433][ T5936] usb 2-1: device descriptor read/8, error -71 [ 2220.551681][ T5936] usb usb2-port1: unable to enumerate USB device [ 2220.769802][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2220.777162][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2221.275134][ T4741] netlink: 16 bytes leftover after parsing attributes in process `syz.5.9576'. [ 2221.809782][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2221.817088][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2221.901232][ T1305] ieee802154 phy0 wpan0: encryption failed: -22 [ 2221.907609][ T1305] ieee802154 phy1 wpan1: encryption failed: -22 [ 2222.104951][T23651] usb 2-1: new high-speed USB device number 126 using dummy_hcd [ 2222.273107][T23651] usb 2-1: Using ep0 maxpacket: 32 [ 2222.301100][T23651] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2222.329087][T23651] usb 2-1: New USB device found, idVendor=18d1, idProduct=9400, bcdDevice= 0.00 [ 2222.362237][T23651] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2222.378094][T23651] usb 2-1: config 0 descriptor?? [ 2222.719519][ T4766] netlink: 56 bytes leftover after parsing attributes in process `syz.5.9584'. [ 2222.829074][ T4751] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2222.839329][ T4751] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2222.849723][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2222.856867][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2222.866431][T23651] stadia 0003:18D1:9400.0044: hidraw0: USB HID v0.01 Device [HID 18d1:9400] on usb-dummy_hcd.1-1/input0 [ 2222.878714][T23651] stadia 0003:18D1:9400.0044: no inputs found [ 2222.888012][T23651] stadia 0003:18D1:9400.0044: force feedback init failed [ 2223.053890][T23651] usb 2-1: USB disconnect, device number 126 [ 2223.889706][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2223.896877][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2224.929736][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2224.936836][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2225.969757][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2225.976902][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2226.990066][T15918] usb 2-1: new high-speed USB device number 127 using dummy_hcd [ 2227.012277][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2227.019450][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2227.563279][ T30] audit: type=1326 audit(1757194278.486:3942): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4819 comm="syz.7.9600" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1f7138ebe9 code=0x7ffc0000 [ 2227.660061][ T30] audit: type=1326 audit(1757194278.486:3943): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4819 comm="syz.7.9600" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1f7138ebe9 code=0x7ffc0000 [ 2227.946705][ T4825] pim6reg: entered allmulticast mode [ 2227.981929][ T30] audit: type=1326 audit(1757194278.486:3944): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4819 comm="syz.7.9600" exe="/root/syz-executor" sig=0 arch=c000003e syscall=135 compat=0 ip=0x7f1f7138ebe9 code=0x7ffc0000 [ 2228.049797][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2228.057014][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2228.161624][ T30] audit: type=1326 audit(1757194278.486:3945): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4819 comm="syz.7.9600" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1f7138ebe9 code=0x7ffc0000 [ 2228.422233][ T30] audit: type=1326 audit(1757194278.486:3946): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4819 comm="syz.7.9600" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1f7138ebe9 code=0x7ffc0000 [ 2228.598546][ T30] audit: type=1326 audit(1757194278.496:3947): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4819 comm="syz.7.9600" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7f1f7138ebe9 code=0x7ffc0000 [ 2228.734042][ T30] audit: type=1326 audit(1757194278.496:3948): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4819 comm="syz.7.9600" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1f7138ebe9 code=0x7ffc0000 [ 2228.834477][ T30] audit: type=1326 audit(1757194278.496:3949): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4819 comm="syz.7.9600" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1f7138ebe9 code=0x7ffc0000 [ 2228.945403][ T30] audit: type=1326 audit(1757194278.496:3950): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4819 comm="syz.7.9600" exe="/root/syz-executor" sig=0 arch=c000003e syscall=85 compat=0 ip=0x7f1f7138ebe9 code=0x7ffc0000 [ 2229.089762][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2229.096949][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2229.115491][ T30] audit: type=1326 audit(1757194278.496:3951): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4819 comm="syz.7.9600" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1f7138ebe9 code=0x7ffc0000 [ 2229.138530][ T4837] netlink: 24 bytes leftover after parsing attributes in process `syz.5.9604'. [ 2230.129704][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2230.137523][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2230.607128][ T5936] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 2230.727069][ T4870] ip6_tunnel: non-ECT from fc00:0000:0000:0000:0000:0000:0000:0000 with DS=0x3 [ 2230.759456][ T4872] netlink: 16 bytes leftover after parsing attributes in process `syz.7.9616'. [ 2230.782812][ T5936] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 2230.796454][ T5936] usb 2-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 2230.813725][ T5936] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 2230.823237][ T5936] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 2230.834909][ T5936] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 2230.852497][ T5936] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 2230.867809][ T5936] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 2230.882280][ T5936] usb 2-1: Product: syz [ 2230.886689][ T5936] usb 2-1: Manufacturer: syz [ 2230.905962][ T5936] cdc_wdm 2-1:1.0: skipping garbage [ 2230.916895][ T5936] cdc_wdm 2-1:1.0: skipping garbage [ 2230.934394][ T5936] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 2230.949027][ T5936] cdc_wdm 2-1:1.0: Unknown control protocol [ 2231.172111][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 2231.172795][ T5876] usb 2-1: USB disconnect, device number 2 [ 2231.178805][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 2231.190996][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 2231.201617][ C0] vkms_vblank_simulate: vblank timer overrun [ 2231.208018][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2232.141728][ T4467] bridge_slave_1: left allmulticast mode [ 2232.147588][ T4467] bridge_slave_1: left promiscuous mode [ 2232.172146][ T4467] bridge0: port 2(bridge_slave_1) entered disabled state [ 2232.183561][ T4467] bridge_slave_0: left allmulticast mode [ 2232.189498][ T4467] bridge_slave_0: left promiscuous mode [ 2232.198279][ T4467] bridge0: port 1(bridge_slave_0) entered disabled state [ 2232.209751][ C0] net_ratelimit: 1 callbacks suppressed [ 2232.209773][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2232.223179][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2232.533068][ T4887] netlink: 100 bytes leftover after parsing attributes in process `syz.0.9621'. [ 2233.249708][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2233.257303][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2233.609406][ T4893] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2233.759018][ T4467] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 2233.773400][ T4467] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 2233.784701][ T4467] bond0 (unregistering): Released all slaves [ 2234.190568][ T4911] netlink: 'syz.7.9625': attribute type 10 has an invalid length. [ 2234.207593][ T4911] netlink: 40 bytes leftover after parsing attributes in process `syz.7.9625'. [ 2234.260561][ T4912] vimc link validate: Scaler:src:16x16 (0x33424752, 1, 2, 0, 0) RGB/YUV Capture:snk:16x16 (0x38416761, 4, 0, 0, 0) [ 2234.289753][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2234.296977][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2234.476881][ T4911] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 2234.514512][ T30] kauditd_printk_skb: 30 callbacks suppressed [ 2234.514533][ T30] audit: type=1326 audit(1757194285.476:3982): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4915 comm="syz.5.9628" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f880098ebe9 code=0x7ffc0000 [ 2234.752862][ T30] audit: type=1326 audit(1757194285.476:3983): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4915 comm="syz.5.9628" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f880098ebe9 code=0x7ffc0000 [ 2234.776300][ T30] audit: type=1326 audit(1757194285.476:3984): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4915 comm="syz.5.9628" exe="/root/syz-executor" sig=0 arch=c000003e syscall=444 compat=0 ip=0x7f880098ebe9 code=0x7ffc0000 [ 2234.799874][ T30] audit: type=1326 audit(1757194285.476:3985): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4915 comm="syz.5.9628" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f880098ebe9 code=0x7ffc0000 [ 2234.822231][ C0] vkms_vblank_simulate: vblank timer overrun [ 2234.828738][ T30] audit: type=1326 audit(1757194285.476:3986): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4915 comm="syz.5.9628" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f880098ebe9 code=0x7ffc0000 [ 2234.852536][ C0] vkms_vblank_simulate: vblank timer overrun [ 2234.952379][ T30] audit: type=1326 audit(1757194285.476:3987): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4915 comm="syz.5.9628" exe="/root/syz-executor" sig=0 arch=c000003e syscall=445 compat=0 ip=0x7f880098ebe9 code=0x7ffc0000 [ 2235.074745][ T30] audit: type=1326 audit(1757194285.476:3988): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4915 comm="syz.5.9628" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f880098ebe9 code=0x7ffc0000 [ 2235.185880][ T30] audit: type=1326 audit(1757194285.476:3989): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4915 comm="syz.5.9628" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f880098ebe9 code=0x7ffc0000 [ 2235.340013][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2235.348012][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2235.462923][ T30] audit: type=1326 audit(1757194285.476:3990): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4915 comm="syz.5.9628" exe="/root/syz-executor" sig=0 arch=c000003e syscall=2 compat=0 ip=0x7f880098ebe9 code=0x7ffc0000 [ 2235.485142][ C0] vkms_vblank_simulate: vblank timer overrun [ 2235.560660][ T30] audit: type=1326 audit(1757194285.476:3991): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4915 comm="syz.5.9628" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f880098ebe9 code=0x7ffc0000 [ 2235.631428][ T4467] hsr_slave_0: left promiscuous mode [ 2235.657459][ T4467] hsr_slave_1: left promiscuous mode [ 2235.674849][ T4467] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 2235.695118][ T4467] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 2235.716282][ T4467] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 2235.728395][ T4467] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 2236.146999][ T4467] veth1_macvtap: left promiscuous mode [ 2236.166476][ T4467] veth0_macvtap: left promiscuous mode [ 2236.197411][ T4467] veth1_vlan: left promiscuous mode [ 2236.207187][ T4467] veth0_vlan: left promiscuous mode [ 2236.369815][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2237.059646][T31939] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 2237.189951][T31939] usb 2-1: device descriptor read/64, error -71 [ 2237.409803][ C0] net_ratelimit: 1 callbacks suppressed [ 2237.409826][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2237.423097][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2237.489973][T31939] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 2237.636510][T31939] usb 2-1: device descriptor read/64, error -71 [ 2237.781449][T31939] usb usb2-port1: attempt power cycle [ 2238.142506][T31939] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 2238.197508][T31939] usb 2-1: device descriptor read/8, error -71 [ 2238.442568][T31939] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 2238.450388][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2238.450568][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2238.508669][T31939] usb 2-1: device descriptor read/8, error -71 [ 2238.523868][ T4974] FAULT_INJECTION: forcing a failure. [ 2238.523868][ T4974] name failslab, interval 1, probability 0, space 0, times 0 [ 2238.538915][ T4974] CPU: 1 UID: 0 PID: 4974 Comm: syz.7.9646 Not tainted syzkaller #0 PREEMPT(full) [ 2238.538944][ T4974] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 2238.538958][ T4974] Call Trace: [ 2238.538967][ T4974] [ 2238.538977][ T4974] dump_stack_lvl+0x189/0x250 [ 2238.539009][ T4974] ? __pfx____ratelimit+0x10/0x10 [ 2238.539032][ T4974] ? __pfx_dump_stack_lvl+0x10/0x10 [ 2238.539057][ T4974] ? __pfx__printk+0x10/0x10 [ 2238.539103][ T4974] should_fail_ex+0x414/0x560 [ 2238.539139][ T4974] should_failslab+0xa8/0x100 [ 2238.539172][ T4974] __kmalloc_cache_noprof+0x70/0x3d0 [ 2238.539200][ T4974] ? sctp_add_bind_addr+0x8c/0x370 [ 2238.539238][ T4974] sctp_add_bind_addr+0x8c/0x370 [ 2238.539274][ T4974] sctp_copy_local_addr_list+0x30b/0x4e0 [ 2238.539310][ T4974] ? sctp_copy_local_addr_list+0x9b/0x4e0 [ 2238.539342][ T4974] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 2238.539376][ T4974] ? sctp_v6_is_any+0x64/0x80 [ 2238.539399][ T4974] ? sctp_copy_one_addr+0x93/0x360 [ 2238.539434][ T4974] sctp_bind_addr_copy+0xb3/0x3c0 [ 2238.539467][ T4974] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 2238.539500][ T4974] sctp_connect_new_asoc+0x2e0/0x690 [ 2238.539531][ T4974] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 2238.539552][ T4974] ? __local_bh_enable_ip+0x12d/0x1c0 [ 2238.539581][ T4974] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 2238.539605][ T4974] ? security_sctp_bind_connect+0x7e/0x2e0 [ 2238.539637][ T4974] sctp_sendmsg+0x155c/0x2810 [ 2238.539683][ T4974] ? __pfx_sctp_sendmsg+0x10/0x10 [ 2238.539710][ T4974] ? aa_sk_perm+0x81e/0x950 [ 2238.539747][ T4974] ? __pfx_aa_sk_perm+0x10/0x10 [ 2238.539780][ T4974] ? sock_rps_record_flow+0x19/0x410 [ 2238.539814][ T4974] ? inet_sendmsg+0x2f4/0x370 [ 2238.539849][ T4974] __sock_sendmsg+0x19c/0x270 [ 2238.539884][ T4974] ____sys_sendmsg+0x52d/0x830 [ 2238.539916][ T4974] ? __pfx_____sys_sendmsg+0x10/0x10 [ 2238.539952][ T4974] ? import_iovec+0x74/0xa0 [ 2238.539982][ T4974] ___sys_sendmsg+0x21f/0x2a0 [ 2238.540011][ T4974] ? __pfx____sys_sendmsg+0x10/0x10 [ 2238.540078][ T4974] ? __fget_files+0x2a/0x420 [ 2238.540097][ T4974] ? __fget_files+0x3a0/0x420 [ 2238.540127][ T4974] __sys_sendmmsg+0x227/0x430 [ 2238.540160][ T4974] ? __pfx___sys_sendmmsg+0x10/0x10 [ 2238.540183][ T4974] ? __mutex_unlock_slowpath+0x1a1/0x740 [ 2238.540232][ T4974] ? ksys_write+0x22a/0x250 [ 2238.540262][ T4974] ? __pfx_ksys_write+0x10/0x10 [ 2238.540285][ T4974] ? rcu_is_watching+0x15/0xb0 [ 2238.540313][ T4974] __x64_sys_sendmmsg+0xa0/0xc0 [ 2238.540340][ T4974] do_syscall_64+0xfa/0x3b0 [ 2238.540361][ T4974] ? lockdep_hardirqs_on+0x9c/0x150 [ 2238.540381][ T4974] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2238.540402][ T4974] ? clear_bhb_loop+0x60/0xb0 [ 2238.540427][ T4974] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2238.540448][ T4974] RIP: 0033:0x7f1f7138ebe9 [ 2238.540469][ T4974] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2238.540487][ T4974] RSP: 002b:00007f1f721af038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 2238.540509][ T4974] RAX: ffffffffffffffda RBX: 00007f1f715c5fa0 RCX: 00007f1f7138ebe9 [ 2238.540523][ T4974] RDX: 0000000000000001 RSI: 0000200000000200 RDI: 0000000000000005 [ 2238.540536][ T4974] RBP: 00007f1f721af090 R08: 0000000000000000 R09: 0000000000000000 [ 2238.540548][ T4974] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2238.540560][ T4974] R13: 00007f1f715c6038 R14: 00007f1f715c5fa0 R15: 00007f1f716efa28 [ 2238.540593][ T4974] [ 2238.651373][T31939] usb usb2-port1: unable to enumerate USB device [ 2239.031800][ T4467] team0 (unregistering): Port device team_slave_1 removed [ 2239.148284][ T4467] team0 (unregistering): Port device team_slave_0 removed [ 2239.499794][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2239.507021][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2240.481549][T15696] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 2240.529797][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2240.537051][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2240.662622][T15696] usb 2-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 2240.671994][T15696] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2240.685989][T15696] usb 2-1: config 0 descriptor?? [ 2241.243225][ T5001] netlink: 36 bytes leftover after parsing attributes in process `syz.0.9654'. [ 2241.569818][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2241.576983][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2242.609787][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2242.616956][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2243.208757][T15696] usb 2-1: Cannot read MAC address [ 2243.218688][T15696] MOSCHIP usb-ethernet driver 2-1:0.0: probe with driver MOSCHIP usb-ethernet driver failed with error -71 [ 2243.274791][T15696] usb 2-1: USB disconnect, device number 7 [ 2243.344873][ T5020] FAULT_INJECTION: forcing a failure. [ 2243.344873][ T5020] name failslab, interval 1, probability 0, space 0, times 0 [ 2243.366536][ T5020] CPU: 1 UID: 0 PID: 5020 Comm: syz.7.9660 Not tainted syzkaller #0 PREEMPT(full) [ 2243.366566][ T5020] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 2243.366581][ T5020] Call Trace: [ 2243.366589][ T5020] [ 2243.366597][ T5020] dump_stack_lvl+0x189/0x250 [ 2243.366619][ T5020] ? __pfx____ratelimit+0x10/0x10 [ 2243.366636][ T5020] ? __pfx_dump_stack_lvl+0x10/0x10 [ 2243.366654][ T5020] ? __pfx__printk+0x10/0x10 [ 2243.366679][ T5020] ? __pfx___might_resched+0x10/0x10 [ 2243.366693][ T5020] ? fs_reclaim_acquire+0x7d/0x100 [ 2243.366720][ T5020] should_fail_ex+0x414/0x560 [ 2243.366746][ T5020] should_failslab+0xa8/0x100 [ 2243.366769][ T5020] __kmalloc_noprof+0xcb/0x4f0 [ 2243.366789][ T5020] ? kfree+0x4d/0x440 [ 2243.366805][ T5020] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 2243.366825][ T5020] tomoyo_realpath_from_path+0xe3/0x5d0 [ 2243.366843][ T5020] ? tomoyo_domain+0xd9/0x130 [ 2243.366863][ T5020] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 2243.366885][ T5020] tomoyo_path_number_perm+0x1e8/0x5a0 [ 2243.366908][ T5020] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 2243.366943][ T5020] ? __lock_acquire+0xab9/0xd20 [ 2243.366980][ T5020] ? __fget_files+0x2a/0x420 [ 2243.366995][ T5020] ? __fget_files+0x2a/0x420 [ 2243.367008][ T5020] ? __fget_files+0x3a0/0x420 [ 2243.367019][ T5020] ? __fget_files+0x2a/0x420 [ 2243.367036][ T5020] security_file_ioctl+0xcb/0x2d0 [ 2243.367058][ T5020] __se_sys_ioctl+0x47/0x170 [ 2243.367079][ T5020] do_syscall_64+0xfa/0x3b0 [ 2243.367094][ T5020] ? lockdep_hardirqs_on+0x9c/0x150 [ 2243.367109][ T5020] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2243.367124][ T5020] ? clear_bhb_loop+0x60/0xb0 [ 2243.367142][ T5020] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2243.367157][ T5020] RIP: 0033:0x7f1f7138ebe9 [ 2243.367171][ T5020] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2243.367184][ T5020] RSP: 002b:00007f1f721af038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2243.367201][ T5020] RAX: ffffffffffffffda RBX: 00007f1f715c5fa0 RCX: 00007f1f7138ebe9 [ 2243.367212][ T5020] RDX: 0000200000000080 RSI: 0000000000002285 RDI: 0000000000000003 [ 2243.367222][ T5020] RBP: 00007f1f721af090 R08: 0000000000000000 R09: 0000000000000000 [ 2243.367232][ T5020] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2243.367240][ T5020] R13: 00007f1f715c6038 R14: 00007f1f715c5fa0 R15: 00007f1f716efa28 [ 2243.367264][ T5020] [ 2243.367271][ T5020] ERROR: Out of memory at tomoyo_realpath_from_path. [ 2243.650628][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2243.658048][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2244.169715][ T5936] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 2244.344030][ T5936] usb 2-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 2244.368041][ T5936] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2244.397965][ T5936] usb 2-1: Product: syz [ 2244.414642][ T5936] usb 2-1: Manufacturer: syz [ 2244.429380][ T5936] usb 2-1: SerialNumber: syz [ 2244.617156][ T5037] netlink: 'syz.0.9669': attribute type 1 has an invalid length. [ 2244.631538][ T5037] netlink: 'syz.0.9669': attribute type 7 has an invalid length. [ 2244.642545][ T5037] netlink: 676 bytes leftover after parsing attributes in process `syz.0.9669'. [ 2244.699749][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2244.706895][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2245.602149][ T5936] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPROTO [ 2245.625339][ T5059] fuse: Bad value for 'fd' [ 2245.631221][ T5236] Dev loop6: unable to read RDB block 1 [ 2245.636893][ T5236] loop6: unable to read partition table [ 2245.704612][ T5936] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 2245.715379][ T5236] loop6: partition table beyond EOD, truncated [ 2245.729727][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2245.736891][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2245.747662][ T5936] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 2245.788164][ T5936] lan78xx 2-1:1.0: probe with driver lan78xx failed with error -71 [ 2245.850163][ T5936] usb 2-1: USB disconnect, device number 8 [ 2246.080584][ T5066] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1500) ! [ 2246.244667][ T5072] veth1_to_batadv: entered promiscuous mode [ 2246.369824][ T5936] usb 2-1: new full-speed USB device number 9 using dummy_hcd [ 2246.602442][ T5936] usb 2-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 2246.626282][ T5936] usb 2-1: New USB device found, idVendor=7a69, idProduct=0001, bcdDevice=a8.6b [ 2246.642376][ T5936] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2246.657345][ T5936] usb 2-1: Product: syz [ 2246.666641][ T5936] usb 2-1: Manufacturer: syz [ 2246.688714][ T5936] usb 2-1: SerialNumber: syz [ 2246.725186][ T5936] usb 2-1: dvb_usb_v2: found a '774 Friio White ISDB-T USB2.0' in warm state [ 2246.769754][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2247.152980][ T5936] usb 2-1: dvb_usb_v2: this USB2.0 device cannot be run on a USB1.1 port (it lacks a hardware PID filter) [ 2247.810025][ C0] net_ratelimit: 1 callbacks suppressed [ 2247.810048][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2247.822997][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2248.684485][ T5096] FAULT_INJECTION: forcing a failure. [ 2248.684485][ T5096] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2248.698076][ T5096] CPU: 1 UID: 0 PID: 5096 Comm: syz.5.9687 Not tainted syzkaller #0 PREEMPT(full) [ 2248.698106][ T5096] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 2248.698119][ T5096] Call Trace: [ 2248.698136][ T5096] [ 2248.698145][ T5096] dump_stack_lvl+0x189/0x250 [ 2248.698175][ T5096] ? __pfx____ratelimit+0x10/0x10 [ 2248.698196][ T5096] ? __pfx_dump_stack_lvl+0x10/0x10 [ 2248.698222][ T5096] ? __pfx__printk+0x10/0x10 [ 2248.698252][ T5096] ? __might_fault+0xb0/0x130 [ 2248.698292][ T5096] should_fail_ex+0x414/0x560 [ 2248.698329][ T5096] _copy_from_iter+0x1de/0x1790 [ 2248.698360][ T5096] ? rcu_is_watching+0x15/0xb0 [ 2248.698383][ T5096] ? kmem_cache_alloc_node_noprof+0x217/0x3c0 [ 2248.698413][ T5096] ? __pfx__copy_from_iter+0x10/0x10 [ 2248.698439][ T5096] ? __build_skb_around+0x257/0x3e0 [ 2248.698466][ T5096] ? netlink_sendmsg+0x642/0xb30 [ 2248.698486][ T5096] ? skb_put+0x11b/0x210 [ 2248.698513][ T5096] netlink_sendmsg+0x6b2/0xb30 [ 2248.698545][ T5096] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2248.698571][ T5096] ? aa_sock_msg_perm+0xf1/0x1d0 [ 2248.698594][ T5096] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 2248.698617][ T5096] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2248.698640][ T5096] __sock_sendmsg+0x21c/0x270 [ 2248.698674][ T5096] ____sys_sendmsg+0x505/0x830 [ 2248.698704][ T5096] ? __pfx_____sys_sendmsg+0x10/0x10 [ 2248.698737][ T5096] ? import_iovec+0x74/0xa0 [ 2248.698765][ T5096] ___sys_sendmsg+0x21f/0x2a0 [ 2248.698793][ T5096] ? __pfx____sys_sendmsg+0x10/0x10 [ 2248.698857][ T5096] ? __fget_files+0x2a/0x420 [ 2248.698875][ T5096] ? __fget_files+0x3a0/0x420 [ 2248.698905][ T5096] __x64_sys_sendmsg+0x19b/0x260 [ 2248.698934][ T5096] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 2248.698970][ T5096] ? __pfx_ksys_write+0x10/0x10 [ 2248.698996][ T5096] ? rcu_is_watching+0x15/0xb0 [ 2248.699022][ T5096] ? do_syscall_64+0xbe/0x3b0 [ 2248.699048][ T5096] do_syscall_64+0xfa/0x3b0 [ 2248.699069][ T5096] ? lockdep_hardirqs_on+0x9c/0x150 [ 2248.699089][ T5096] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2248.699115][ T5096] ? clear_bhb_loop+0x60/0xb0 [ 2248.699150][ T5096] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2248.699171][ T5096] RIP: 0033:0x7f880098ebe9 [ 2248.699190][ T5096] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2248.699208][ T5096] RSP: 002b:00007f880178a038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2248.699231][ T5096] RAX: ffffffffffffffda RBX: 00007f8800bc5fa0 RCX: 00007f880098ebe9 [ 2248.699247][ T5096] RDX: 0000000000000000 RSI: 0000200000000400 RDI: 0000000000000003 [ 2248.699260][ T5096] RBP: 00007f880178a090 R08: 0000000000000000 R09: 0000000000000000 [ 2248.699274][ T5096] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2248.699287][ T5096] R13: 00007f8800bc6038 R14: 00007f8800bc5fa0 R15: 00007f8800cefa28 [ 2248.699320][ T5096] [ 2248.849799][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2248.992118][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2249.264290][ T5106] FAULT_INJECTION: forcing a failure. [ 2249.264290][ T5106] name failslab, interval 1, probability 0, space 0, times 0 [ 2249.277540][ T5106] CPU: 1 UID: 0 PID: 5106 Comm: syz.3.9691 Not tainted syzkaller #0 PREEMPT(full) [ 2249.277570][ T5106] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 2249.277584][ T5106] Call Trace: [ 2249.277592][ T5106] [ 2249.277602][ T5106] dump_stack_lvl+0x189/0x250 [ 2249.277633][ T5106] ? __pfx____ratelimit+0x10/0x10 [ 2249.277655][ T5106] ? __pfx_dump_stack_lvl+0x10/0x10 [ 2249.277680][ T5106] ? __pfx__printk+0x10/0x10 [ 2249.277712][ T5106] ? __pfx___might_resched+0x10/0x10 [ 2249.277733][ T5106] ? fs_reclaim_acquire+0x7d/0x100 [ 2249.277770][ T5106] should_fail_ex+0x414/0x560 [ 2249.277806][ T5106] should_failslab+0xa8/0x100 [ 2249.277838][ T5106] __kmalloc_cache_noprof+0x70/0x3d0 [ 2249.277867][ T5106] ? nft_setelem_insert+0x22c/0x3f0 [ 2249.277886][ T5106] ? __kmalloc_cache_noprof+0x230/0x3d0 [ 2249.277919][ T5106] nft_setelem_insert+0x22c/0x3f0 [ 2249.277947][ T5106] nf_tables_newsetelem+0x2585/0x4340 [ 2249.278020][ T5106] ? __pfx_nf_tables_newsetelem+0x10/0x10 [ 2249.278046][ T5106] ? __lock_acquire+0xab9/0xd20 [ 2249.278110][ T5106] ? nla_validate_array+0xfc/0x260 [ 2249.278167][ T5106] ? __pfx___nla_validate_parse+0x10/0x10 [ 2249.278195][ T5106] ? __lock_acquire+0xab9/0xd20 [ 2249.278237][ T5106] ? nfnl_pernet+0x23/0x240 [ 2249.278278][ T5106] ? __nla_parse+0x40/0x60 [ 2249.278305][ T5106] nfnetlink_rcv+0x1132/0x2520 [ 2249.278371][ T5106] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 2249.278457][ T5106] ? netlink_deliver_tap+0x2e/0x1b0 [ 2249.278499][ T5106] netlink_unicast+0x82c/0x9e0 [ 2249.278540][ T5106] ? __pfx_netlink_unicast+0x10/0x10 [ 2249.278574][ T5106] ? netlink_sendmsg+0x642/0xb30 [ 2249.278595][ T5106] ? skb_put+0x11b/0x210 [ 2249.278622][ T5106] netlink_sendmsg+0x805/0xb30 [ 2249.278655][ T5106] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2249.278682][ T5106] ? aa_sock_msg_perm+0xf1/0x1d0 [ 2249.278705][ T5106] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 2249.278728][ T5106] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2249.278752][ T5106] __sock_sendmsg+0x21c/0x270 [ 2249.278787][ T5106] ____sys_sendmsg+0x505/0x830 [ 2249.278820][ T5106] ? __pfx_____sys_sendmsg+0x10/0x10 [ 2249.278856][ T5106] ? import_iovec+0x74/0xa0 [ 2249.278888][ T5106] ___sys_sendmsg+0x21f/0x2a0 [ 2249.278917][ T5106] ? __pfx____sys_sendmsg+0x10/0x10 [ 2249.278983][ T5106] ? __fget_files+0x2a/0x420 [ 2249.279002][ T5106] ? __fget_files+0x3a0/0x420 [ 2249.279033][ T5106] __x64_sys_sendmsg+0x19b/0x260 [ 2249.279062][ T5106] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 2249.279108][ T5106] ? __pfx_ksys_write+0x10/0x10 [ 2249.279133][ T5106] ? rcu_is_watching+0x15/0xb0 [ 2249.279161][ T5106] ? do_syscall_64+0xbe/0x3b0 [ 2249.279188][ T5106] do_syscall_64+0xfa/0x3b0 [ 2249.279209][ T5106] ? lockdep_hardirqs_on+0x9c/0x150 [ 2249.279230][ T5106] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2249.279251][ T5106] ? clear_bhb_loop+0x60/0xb0 [ 2249.279277][ T5106] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2249.279298][ T5106] RIP: 0033:0x7f89a898ebe9 [ 2249.279317][ T5106] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2249.279337][ T5106] RSP: 002b:00007f89a97c2038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2249.279360][ T5106] RAX: ffffffffffffffda RBX: 00007f89a8bc5fa0 RCX: 00007f89a898ebe9 [ 2249.279376][ T5106] RDX: 0000000000044050 RSI: 00002000000000c0 RDI: 0000000000000003 [ 2249.279390][ T5106] RBP: 00007f89a97c2090 R08: 0000000000000000 R09: 0000000000000000 [ 2249.279403][ T5106] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2249.279416][ T5106] R13: 00007f89a8bc6038 R14: 00007f89a8bc5fa0 R15: 00007f89a8cefa28 [ 2249.279449][ T5106] [ 2249.699743][ T5078] netlink: 76 bytes leftover after parsing attributes in process `syz.7.9682'. [ 2249.742465][T15696] usb 2-1: USB disconnect, device number 9 [ 2249.769176][ T5110] loop8: detected capacity change from 0 to 8 [ 2249.788104][ T5110] Dev loop8: unable to read RDB block 8 [ 2249.801646][ T5110] loop8: unable to read partition table [ 2249.808920][ T5110] loop8: partition table beyond EOD, truncated [ 2249.816219][ T5110] loop_reread_partitions: partition scan of loop8 (þ被xü^>Ñà– ) failed (rc=-5) [ 2249.889781][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2249.897003][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2250.047297][ T30] kauditd_printk_skb: 15 callbacks suppressed [ 2250.047317][ T30] audit: type=1800 audit(1757194301.016:4007): pid=5118 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.9696" name="admmidi3" dev="devtmpfs" ino=5449 res=0 errno=0 [ 2250.349658][T15696] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 2250.509946][T15696] usb 2-1: Using ep0 maxpacket: 8 [ 2250.525659][T15696] usb 2-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 2250.543042][T15696] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x9A, changing to 0x8A [ 2250.558042][T15696] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 2250.575151][T15696] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0 [ 2250.585517][T15696] usb 2-1: config 0 interface 0 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 2250.617193][T15696] usb 2-1: New USB device found, idVendor=07c0, idProduct=1505, bcdDevice=b8.c5 [ 2250.645914][T15696] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2250.667157][T15696] usb 2-1: Product: syz [ 2250.677278][T15696] usb 2-1: Manufacturer: syz [ 2250.687224][T15696] usb 2-1: SerialNumber: syz [ 2250.706916][T15696] usb 2-1: config 0 descriptor?? [ 2250.929773][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2250.937094][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2250.938533][ T5124] netlink: 8 bytes leftover after parsing attributes in process `syz.7.9699'. [ 2251.160444][T15696] iowarrior 2-1:0.0: IOWarrior product=0x1505, serial=42424242 interface=0 now attached to iowarrior0 [ 2251.209175][T15696] usb 2-1: USB disconnect, device number 10 [ 2251.323977][ T5134] FAULT_INJECTION: forcing a failure. [ 2251.323977][ T5134] name failslab, interval 1, probability 0, space 0, times 0 [ 2251.338791][ T5134] CPU: 1 UID: 0 PID: 5134 Comm: syz.5.9702 Not tainted syzkaller #0 PREEMPT(full) [ 2251.338822][ T5134] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 2251.338837][ T5134] Call Trace: [ 2251.338846][ T5134] [ 2251.338857][ T5134] dump_stack_lvl+0x189/0x250 [ 2251.338888][ T5134] ? __pfx____ratelimit+0x10/0x10 [ 2251.338911][ T5134] ? __pfx_dump_stack_lvl+0x10/0x10 [ 2251.338936][ T5134] ? __pfx__printk+0x10/0x10 [ 2251.338970][ T5134] ? __pfx___might_resched+0x10/0x10 [ 2251.338996][ T5134] should_fail_ex+0x414/0x560 [ 2251.339032][ T5134] should_failslab+0xa8/0x100 [ 2251.339065][ T5134] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 2251.339099][ T5134] ? __alloc_skb+0x112/0x2d0 [ 2251.339127][ T5134] __alloc_skb+0x112/0x2d0 [ 2251.339153][ T5134] netlink_sendmsg+0x5c6/0xb30 [ 2251.339186][ T5134] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2251.339212][ T5134] ? aa_sock_msg_perm+0xf1/0x1d0 [ 2251.339235][ T5134] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 2251.339258][ T5134] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2251.339282][ T5134] __sock_sendmsg+0x21c/0x270 [ 2251.339316][ T5134] ____sys_sendmsg+0x505/0x830 [ 2251.339348][ T5134] ? __pfx_____sys_sendmsg+0x10/0x10 [ 2251.339384][ T5134] ? import_iovec+0x74/0xa0 [ 2251.339416][ T5134] ___sys_sendmsg+0x21f/0x2a0 [ 2251.339444][ T5134] ? __pfx____sys_sendmsg+0x10/0x10 [ 2251.339512][ T5134] ? __fget_files+0x2a/0x420 [ 2251.339528][ T5134] ? __fget_files+0x3a0/0x420 [ 2251.339555][ T5134] __x64_sys_sendmsg+0x19b/0x260 [ 2251.339583][ T5134] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 2251.339619][ T5134] ? __pfx_ksys_write+0x10/0x10 [ 2251.339644][ T5134] ? rcu_is_watching+0x15/0xb0 [ 2251.339676][ T5134] ? do_syscall_64+0xbe/0x3b0 [ 2251.339701][ T5134] do_syscall_64+0xfa/0x3b0 [ 2251.339721][ T5134] ? lockdep_hardirqs_on+0x9c/0x150 [ 2251.339741][ T5134] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2251.339762][ T5134] ? clear_bhb_loop+0x60/0xb0 [ 2251.339785][ T5134] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2251.339805][ T5134] RIP: 0033:0x7f880098ebe9 [ 2251.339825][ T5134] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2251.339842][ T5134] RSP: 002b:00007f880178a038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2251.339865][ T5134] RAX: ffffffffffffffda RBX: 00007f8800bc5fa0 RCX: 00007f880098ebe9 [ 2251.339881][ T5134] RDX: 0000000000000000 RSI: 0000200000000180 RDI: 0000000000000004 [ 2251.339895][ T5134] RBP: 00007f880178a090 R08: 0000000000000000 R09: 0000000000000000 [ 2251.339909][ T5134] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2251.339922][ T5134] R13: 00007f8800bc6038 R14: 00007f8800bc5fa0 R15: 00007f8800cefa28 [ 2251.339955][ T5134] [ 2251.773464][ T5140] netlink: 'syz.0.9705': attribute type 2 has an invalid length. [ 2251.969854][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2251.976999][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2252.700750][ T5166] netlink: 'syz.5.9712': attribute type 1 has an invalid length. [ 2252.709398][ T5166] workqueue: Failed to create a rescuer kthread for wq "bond3": -EINTR [ 2253.009780][ C0] net_ratelimit: 1 callbacks suppressed [ 2253.009801][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2253.031244][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2253.142191][ T5188] random: crng reseeded on system resumption [ 2253.356591][ T5193] input: syz1 as /devices/virtual/input/input76 [ 2254.059829][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2254.067064][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2254.599217][ T5208] netlink: 'syz.1.9723': attribute type 9 has an invalid length. [ 2254.608705][ T5208] netlink: 212160 bytes leftover after parsing attributes in process `syz.1.9723'. [ 2255.089776][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2255.096921][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2255.791963][ T5219] random: crng reseeded on system resumption [ 2255.931828][ T5219] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_rx_wq": -EINTR [ 2256.130051][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2256.146309][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2256.770014][T30201] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 2256.919714][T30201] usb 2-1: Using ep0 maxpacket: 16 [ 2256.926789][T30201] usb 2-1: config 0 interface 0 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 9 [ 2256.941092][T30201] usb 2-1: config 0 interface 0 has no altsetting 0 [ 2256.947837][T30201] usb 2-1: New USB device found, idVendor=045e, idProduct=05da, bcdDevice= 0.00 [ 2256.956940][T30201] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2256.967288][T30201] usb 2-1: config 0 descriptor?? [ 2256.984523][T30201] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 2257.170018][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2257.177346][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2257.323633][ T5234] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2257.333585][ T5234] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2257.370832][ T5234] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2257.384611][ T5234] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2258.209779][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2258.216981][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2258.442390][ T5241] syz.7.9731 (5241): drop_caches: 2 [ 2259.249770][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2259.256948][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2259.566699][ T5255] kvm: kvm [5254]: vcpu0, guest rIP: 0x1be Unhandled WRMSR(0xc1) = 0x4000 [ 2259.600192][ T5255] kvm: kvm [5254]: vcpu0, guest rIP: 0x1be Unhandled WRMSR(0xc2) = 0x4000 [ 2259.630608][ T5255] kvm: kvm [5254]: vcpu0, guest rIP: 0x1be Unhandled WRMSR(0x11e) = 0xbe706111 [ 2259.648847][ T5255] kvm: kvm [5254]: vcpu0, guest rIP: 0x1be Unhandled WRMSR(0x186) = 0x4000 [ 2259.659038][ T5255] kvm: kvm [5254]: vcpu0, guest rIP: 0x1be Unhandled WRMSR(0x187) = 0x4000 [ 2259.670966][ T5260] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9736'. [ 2260.106062][ T5266] openvswitch: netlink: Flow actions attr not present in new flow. [ 2260.287934][T15918] usb 2-1: USB disconnect, device number 11 [ 2260.294837][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2260.294973][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2261.111620][ T5269] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 2261.117900][ T5269] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 2261.124491][ T5269] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 2261.131092][ T5269] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 2261.137280][ T5269] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 2261.149344][ T5269] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 2261.165600][ T5269] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 2261.175124][ T5269] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 2261.181699][ T5269] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 2261.192362][ T5269] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 2261.299276][ T5276] bridge_slave_0: vlans aren't supported yet for dev_uc|mc_add() [ 2261.329726][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2261.336899][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2261.439822][T30201] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 2261.609658][T30201] usb 2-1: Using ep0 maxpacket: 8 [ 2261.647014][T30201] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 2261.670309][T30201] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2261.692255][T30201] usb 2-1: Product: syz [ 2261.696492][T30201] usb 2-1: Manufacturer: syz [ 2261.716135][T30201] usb 2-1: SerialNumber: syz [ 2262.367596][ T5293] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2262.376277][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2262.398719][ T5293] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2262.449665][T26654] Bluetooth: hci1: command 0x0406 tx timeout [ 2263.171652][T31281] Bluetooth: hci0: command 0x0405 tx timeout [ 2263.172960][T15426] Bluetooth: hci4: command 0x0c1a tx timeout [ 2263.179347][T31281] Bluetooth: hci3: command 0x0405 tx timeout [ 2263.191897][T26654] Bluetooth: hci2: command 0x0c1a tx timeout [ 2263.250078][T31281] Bluetooth: hci5: command 0x0c1a tx timeout [ 2263.288746][ T5306] netlink: 16 bytes leftover after parsing attributes in process `syz.3.9747'. [ 2263.352822][ T5305] netlink: 196 bytes leftover after parsing attributes in process `syz.7.9750'. [ 2263.409791][ C0] net_ratelimit: 1 callbacks suppressed [ 2263.409814][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2263.422668][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2263.475295][T30201] usblp 2-1:1.0: usblp0: USB Unidirectional printer dev 12 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 2263.520679][T30201] usb 2-1: USB disconnect, device number 12 [ 2263.577755][T30201] usblp0: removed [ 2264.059776][T23651] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 2264.222349][T23651] usb 2-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 2264.233284][T23651] usb 2-1: config 27 has 0 interfaces, different from the descriptor's value: 1 [ 2264.242817][T23651] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 2264.252282][T23651] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2264.449856][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2264.456994][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2264.478950][T23651] usb 2-1: USB disconnect, device number 13 [ 2265.249849][T31281] Bluetooth: hci2: command 0x0c1a tx timeout [ 2265.329934][T31281] Bluetooth: hci5: command 0x0c1a tx timeout [ 2265.499775][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2265.506984][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2266.232807][ T5336] netlink: 'syz.5.9761': attribute type 10 has an invalid length. [ 2266.245750][ T5336] macvlan0: entered promiscuous mode [ 2266.258401][ T5336] bond0: (slave macvlan0): Enslaving as an active interface with an up link [ 2266.417067][ T5338] FAULT_INJECTION: forcing a failure. [ 2266.417067][ T5338] name failslab, interval 1, probability 0, space 0, times 0 [ 2266.435531][ T5338] CPU: 1 UID: 0 PID: 5338 Comm: syz.5.9762 Not tainted syzkaller #0 PREEMPT(full) [ 2266.435563][ T5338] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 2266.435584][ T5338] Call Trace: [ 2266.435593][ T5338] [ 2266.435603][ T5338] dump_stack_lvl+0x189/0x250 [ 2266.435634][ T5338] ? __pfx____ratelimit+0x10/0x10 [ 2266.435656][ T5338] ? __pfx_dump_stack_lvl+0x10/0x10 [ 2266.435681][ T5338] ? __pfx__printk+0x10/0x10 [ 2266.435707][ T5338] ? trace_contention_end+0x39/0x120 [ 2266.435747][ T5338] should_fail_ex+0x414/0x560 [ 2266.435784][ T5338] should_failslab+0xa8/0x100 [ 2266.435817][ T5338] kmem_cache_alloc_noprof+0x73/0x3c0 [ 2266.435845][ T5338] ? skb_clone+0x212/0x3a0 [ 2266.435877][ T5338] skb_clone+0x212/0x3a0 [ 2266.435908][ T5338] __netlink_deliver_tap+0x404/0x850 [ 2266.435944][ T5338] ? netlink_deliver_tap+0x2e/0x1b0 [ 2266.435967][ T5338] netlink_deliver_tap+0x19c/0x1b0 [ 2266.435991][ T5338] netlink_dump+0x92b/0xe90 [ 2266.436025][ T5338] ? __pfx_netlink_dump+0x10/0x10 [ 2266.436067][ T5338] ? kmem_cache_free+0x18f/0x400 [ 2266.436101][ T5338] netlink_recvmsg+0x676/0xa30 [ 2266.436134][ T5338] ? __pfx_netlink_recvmsg+0x10/0x10 [ 2266.436161][ T5338] ? __lock_acquire+0xab9/0xd20 [ 2266.436189][ T5338] ? aa_sock_msg_perm+0xf1/0x1d0 [ 2266.436212][ T5338] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 2266.436237][ T5338] ? __pfx_netlink_recvmsg+0x10/0x10 [ 2266.436260][ T5338] sock_recvmsg_nosec+0x183/0x1c0 [ 2266.436297][ T5338] ____sys_recvmsg+0x3aa/0x460 [ 2266.436334][ T5338] ? __pfx_____sys_recvmsg+0x10/0x10 [ 2266.436378][ T5338] ? import_iovec+0x74/0xa0 [ 2266.436411][ T5338] ___sys_recvmsg+0x1b5/0x510 [ 2266.436444][ T5338] ? __pfx____sys_recvmsg+0x10/0x10 [ 2266.436506][ T5338] ? __might_fault+0xb0/0x130 [ 2266.436538][ T5338] do_recvmmsg+0x307/0x770 [ 2266.436582][ T5338] ? __pfx_do_recvmmsg+0x10/0x10 [ 2266.436621][ T5338] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 2266.436666][ T5338] __x64_sys_recvmmsg+0x190/0x240 [ 2266.436697][ T5338] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 2266.436722][ T5338] ? rcu_is_watching+0x15/0xb0 [ 2266.436750][ T5338] ? do_syscall_64+0xbe/0x3b0 [ 2266.436776][ T5338] do_syscall_64+0xfa/0x3b0 [ 2266.436797][ T5338] ? lockdep_hardirqs_on+0x9c/0x150 [ 2266.436818][ T5338] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2266.436839][ T5338] ? clear_bhb_loop+0x60/0xb0 [ 2266.436865][ T5338] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2266.436886][ T5338] RIP: 0033:0x7f880098ebe9 [ 2266.436906][ T5338] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2266.436924][ T5338] RSP: 002b:00007f880178a038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 2266.436947][ T5338] RAX: ffffffffffffffda RBX: 00007f8800bc5fa0 RCX: 00007f880098ebe9 [ 2266.436964][ T5338] RDX: 0000000000000004 RSI: 0000200000002c00 RDI: 0000000000000003 [ 2266.436978][ T5338] RBP: 00007f880178a090 R08: 0000000000000000 R09: 0000000000000000 [ 2266.436991][ T5338] R10: 0000000040010020 R11: 0000000000000246 R12: 0000000000000002 [ 2266.437004][ T5338] R13: 00007f8800bc6038 R14: 00007f8800bc5fa0 R15: 00007f8800cefa28 [ 2266.437039][ T5338] [ 2266.540304][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2266.754668][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2267.148420][ T5349] syzkaller0: entered promiscuous mode [ 2267.155233][ T5349] syzkaller0: entered allmulticast mode [ 2267.350305][T31281] Bluetooth: hci2: command 0x0c1a tx timeout [ 2267.410211][T31281] Bluetooth: hci5: command 0x0c1a tx timeout [ 2267.429754][T31939] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 2267.569806][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2267.579396][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2267.599768][T31939] usb 2-1: Using ep0 maxpacket: 16 [ 2267.607202][T31939] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2267.617563][T31939] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 2267.628674][T31939] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 2267.638427][T31939] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 2267.648285][T31939] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 2267.662518][T31939] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 2267.672525][T31939] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 2267.681682][T31939] usb 2-1: Manufacturer: syz [ 2267.689046][T31939] usb 2-1: config 0 descriptor?? [ 2267.959756][T31939] rc_core: IR keymap rc-hauppauge not found [ 2267.965839][T31939] Registered IR keymap rc-empty [ 2267.988848][T31939] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 2268.010531][T31939] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 2268.032297][T31939] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 2268.046975][T31939] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input77 [ 2268.200988][T31939] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 2268.230033][T31939] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 2268.259856][T31939] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 2268.290383][T31939] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 2268.331182][T31939] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 2268.359947][T31939] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 2268.400426][T31939] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 2268.620049][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2268.627215][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2269.190864][T31939] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 2269.219823][T31939] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 2269.450620][T31939] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 2269.519112][T31939] mceusb 2-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 2269.534569][T31939] mceusb 2-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 2269.556858][T31939] usb 2-1: USB disconnect, device number 14 [ 2269.659767][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2269.666858][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2270.689724][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2270.696880][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2270.940842][ T5399] FAULT_INJECTION: forcing a failure. [ 2270.940842][ T5399] name failslab, interval 1, probability 0, space 0, times 0 [ 2270.970221][ T5399] CPU: 1 UID: 0 PID: 5399 Comm: syz.0.9778 Not tainted syzkaller #0 PREEMPT(full) [ 2270.970249][ T5399] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 2270.970262][ T5399] Call Trace: [ 2270.970270][ T5399] [ 2270.970279][ T5399] dump_stack_lvl+0x189/0x250 [ 2270.970306][ T5399] ? __pfx____ratelimit+0x10/0x10 [ 2270.970326][ T5399] ? __pfx_dump_stack_lvl+0x10/0x10 [ 2270.970349][ T5399] ? __pfx__printk+0x10/0x10 [ 2270.970380][ T5399] ? __pfx___might_resched+0x10/0x10 [ 2270.970397][ T5399] ? fs_reclaim_acquire+0x7d/0x100 [ 2270.970431][ T5399] should_fail_ex+0x414/0x560 [ 2270.970463][ T5399] should_failslab+0xa8/0x100 [ 2270.970491][ T5399] __kmalloc_cache_noprof+0x70/0x3d0 [ 2270.970516][ T5399] ? rtnl_newlink+0xed/0x1c70 [ 2270.970540][ T5399] rtnl_newlink+0xed/0x1c70 [ 2270.970559][ T5399] ? __lock_acquire+0xab9/0xd20 [ 2270.970595][ T5399] ? __pfx_rtnl_newlink+0x10/0x10 [ 2270.970623][ T5399] ? is_bpf_text_address+0x26/0x2b0 [ 2270.970658][ T5399] ? __lock_acquire+0xab9/0xd20 [ 2270.970696][ T5399] ? __lock_acquire+0xab9/0xd20 [ 2270.970742][ T5399] ? is_bpf_text_address+0x26/0x2b0 [ 2270.970773][ T5399] ? is_bpf_text_address+0x292/0x2b0 [ 2270.970799][ T5399] ? is_bpf_text_address+0x26/0x2b0 [ 2270.970834][ T5399] ? __lock_acquire+0xab9/0xd20 [ 2270.970884][ T5399] ? __pfx_rtnl_newlink+0x10/0x10 [ 2270.970903][ T5399] rtnetlink_rcv_msg+0x7cf/0xb70 [ 2270.970921][ T5399] ? __lock_acquire+0xab9/0xd20 [ 2270.970962][ T5399] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 2270.970981][ T5399] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 2270.971016][ T5399] netlink_rcv_skb+0x205/0x470 [ 2270.971034][ T5399] ? __lock_acquire+0xab9/0xd20 [ 2270.971061][ T5399] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 2270.971081][ T5399] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 2270.971112][ T5399] ? netlink_deliver_tap+0x2e/0x1b0 [ 2270.971139][ T5399] netlink_unicast+0x82c/0x9e0 [ 2270.971175][ T5399] ? __pfx_netlink_unicast+0x10/0x10 [ 2270.971206][ T5399] ? netlink_sendmsg+0x642/0xb30 [ 2270.971224][ T5399] ? skb_put+0x11b/0x210 [ 2270.971249][ T5399] netlink_sendmsg+0x805/0xb30 [ 2270.971277][ T5399] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2270.971301][ T5399] ? aa_sock_msg_perm+0xf1/0x1d0 [ 2270.971321][ T5399] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 2270.971342][ T5399] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2270.971363][ T5399] __sock_sendmsg+0x21c/0x270 [ 2270.971394][ T5399] ____sys_sendmsg+0x505/0x830 [ 2270.971423][ T5399] ? __pfx_____sys_sendmsg+0x10/0x10 [ 2270.971455][ T5399] ? import_iovec+0x74/0xa0 [ 2270.971483][ T5399] ___sys_sendmsg+0x21f/0x2a0 [ 2270.971508][ T5399] ? __pfx____sys_sendmsg+0x10/0x10 [ 2270.971566][ T5399] ? __fget_files+0x2a/0x420 [ 2270.971582][ T5399] ? __fget_files+0x3a0/0x420 [ 2270.971609][ T5399] __x64_sys_sendmsg+0x19b/0x260 [ 2270.971635][ T5399] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 2270.971668][ T5399] ? __pfx_ksys_write+0x10/0x10 [ 2270.971691][ T5399] ? rcu_is_watching+0x15/0xb0 [ 2270.971714][ T5399] ? do_syscall_64+0xbe/0x3b0 [ 2270.971737][ T5399] do_syscall_64+0xfa/0x3b0 [ 2270.971755][ T5399] ? lockdep_hardirqs_on+0x9c/0x150 [ 2270.971773][ T5399] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2270.971793][ T5399] ? clear_bhb_loop+0x60/0xb0 [ 2270.971816][ T5399] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2270.971835][ T5399] RIP: 0033:0x7ff563d8ebe9 [ 2270.971853][ T5399] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2270.971869][ T5399] RSP: 002b:00007ff564b1f038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2270.971890][ T5399] RAX: ffffffffffffffda RBX: 00007ff563fc5fa0 RCX: 00007ff563d8ebe9 [ 2270.971904][ T5399] RDX: 0000000000000000 RSI: 0000200000000400 RDI: 0000000000000003 [ 2270.971917][ T5399] RBP: 00007ff564b1f090 R08: 0000000000000000 R09: 0000000000000000 [ 2270.971928][ T5399] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2270.971982][ T5399] R13: 00007ff563fc6038 R14: 00007ff563fc5fa0 R15: 00007ff5640efa28 [ 2270.972012][ T5399] [ 2271.729733][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2271.736977][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2272.769776][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2272.777122][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2273.119285][ T5957] dvb-usb: did not find the firmware file 'dvb-usb-az6027-03.fw' (status -110). You can use /scripts/get_dvb_firmware to get the firmware [ 2273.142939][ T5957] dvb_usb_az6027 4-1:0.0: probe with driver dvb_usb_az6027 failed with error -110 [ 2273.288074][ T5957] usb 4-1: USB disconnect, device number 2 [ 2273.809765][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2273.816963][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2274.869767][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2274.876979][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2275.899732][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2275.907256][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2276.743725][ T5431] vlan2: entered allmulticast mode [ 2276.876539][ T5439] netlink: 'syz.3.9787': attribute type 10 has an invalid length. [ 2276.921904][ T5439] batman_adv: batadv0: Adding interface: wlan1 [ 2276.930070][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2276.937186][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2276.956876][ T5439] batman_adv: batadv0: The MTU of interface wlan1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 2276.982722][ C0] vkms_vblank_simulate: vblank timer overrun [ 2277.129077][ T5439] batman_adv: batadv0: Not using interface wlan1 (retrying later): interface not active [ 2277.670472][ T5452] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(3) [ 2277.677188][ T5452] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 2277.692890][ T5452] vhci_hcd vhci_hcd.0: Device attached [ 2277.704107][ T5452] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 2277.745031][ T5452] vhci_hcd vhci_hcd.0: pdev(0) rhport(2) sockfd(7) [ 2277.753376][ T5452] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 2277.784655][ T5452] vhci_hcd vhci_hcd.0: Device attached [ 2277.820065][ T5460] vhci_hcd vhci_hcd.0: pdev(0) rhport(3) sockfd(9) [ 2277.826746][ T5460] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 2277.835541][ T5460] vhci_hcd vhci_hcd.0: Device attached [ 2277.855202][ T5452] vhci_hcd vhci_hcd.0: pdev(0) rhport(4) sockfd(11) [ 2277.862132][ T5452] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 2277.879820][ T5957] vhci_hcd: vhci_device speed not set [ 2277.889932][T23651] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 2277.917307][ T5460] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 2277.935781][ T5452] vhci_hcd vhci_hcd.0: Device attached [ 2277.959665][ T5957] usb 33-1: new full-speed USB device number 4 using vhci_hcd [ 2277.969754][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2277.977063][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2277.986603][ T5452] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 2278.039768][T23651] usb 2-1: Using ep0 maxpacket: 16 [ 2278.071203][T23651] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2278.097371][ T5463] vhci_hcd: connection closed [ 2278.097707][ T78] vhci_hcd: stop threads [ 2278.097926][T23651] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 6 [ 2278.124183][ T5456] vhci_hcd: connection closed [ 2278.129652][ T5454] vhci_hcd: connection reset by peer [ 2278.144227][T23651] usb 2-1: New USB device found, idVendor=0d49, idProduct=7010, bcdDevice= c.90 [ 2278.163170][T23651] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2278.189421][ T5461] vhci_hcd: connection closed [ 2278.194614][ T78] vhci_hcd: release socket [ 2278.196908][T23651] usb 2-1: Product: syz [ 2278.218592][T23651] usb 2-1: Manufacturer: syz [ 2278.230118][T23651] usb 2-1: SerialNumber: syz [ 2278.232272][ T78] vhci_hcd: disconnect device [ 2278.253833][T23651] usb 2-1: config 0 descriptor?? [ 2278.288099][ T78] vhci_hcd: stop threads [ 2278.293492][ T78] vhci_hcd: release socket [ 2278.303028][ T78] vhci_hcd: disconnect device [ 2278.310301][ T78] vhci_hcd: stop threads [ 2278.315462][ T78] vhci_hcd: release socket [ 2278.320461][ T78] vhci_hcd: disconnect device [ 2278.327166][ T78] vhci_hcd: stop threads [ 2278.332403][ T78] vhci_hcd: release socket [ 2278.337116][ T78] vhci_hcd: disconnect device [ 2278.962092][T31939] usb 2-1: USB disconnect, device number 15 [ 2279.009739][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2279.016959][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2279.739892][ T5493] lo: left promiscuous mode [ 2279.745430][ T5493] tunl0: left promiscuous mode [ 2279.752965][ T5493] gre0: left promiscuous mode [ 2279.759222][ T5493] gretap0: left promiscuous mode [ 2279.765835][ T5493] erspan0: left promiscuous mode [ 2279.772095][ T5493] ip_vti0: left promiscuous mode [ 2279.778917][ T5493] ip6_vti0: left promiscuous mode [ 2279.785057][ T5493] sit0: left promiscuous mode [ 2279.798551][ T5493] ip6tnl0: left promiscuous mode [ 2279.805964][ T5493] ip6gre0: left promiscuous mode [ 2279.814155][ T5493] syz_tun: left promiscuous mode [ 2279.821116][ T5494] netlink: 92 bytes leftover after parsing attributes in process `syz.1.9800'. [ 2279.834638][ T5493] ip6gretap0: left promiscuous mode [ 2279.843300][ T5493] bridge0: left promiscuous mode [ 2279.856960][ T5493] vcan0: left promiscuous mode [ 2279.875926][ T5493] bond0: left promiscuous mode [ 2279.899323][ T5493] bond_slave_0: left promiscuous mode [ 2279.926144][ T5493] bond_slave_1: left promiscuous mode [ 2279.933899][ T5493] team0: left promiscuous mode [ 2279.938783][ T5493] team_slave_0: left promiscuous mode [ 2279.954084][ T5493] team_slave_1: left promiscuous mode [ 2279.960858][ T5493] dummy0: left promiscuous mode [ 2279.974140][ T5493] nlmon0: left promiscuous mode [ 2280.049730][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2280.057194][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2280.074032][ T5493] caif0: left promiscuous mode [ 2280.079449][ T5493] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 2281.089733][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2281.096861][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2282.129799][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2282.137639][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2283.079740][ T5957] vhci_hcd: vhci_device speed not set [ 2283.169902][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2283.290876][T15696] usb 4-1: new full-speed USB device number 3 using dummy_hcd [ 2283.337121][ T1305] ieee802154 phy0 wpan0: encryption failed: -22 [ 2283.345412][ T1305] ieee802154 phy1 wpan1: encryption failed: -22 [ 2283.502922][T15696] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 4 [ 2283.517908][T15696] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 4 [ 2283.535809][T15696] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 2283.556262][T15696] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 2283.576841][T15696] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2283.586429][T15696] usb 4-1: Product: syz [ 2283.595587][T15696] usb 4-1: Manufacturer: syz [ 2283.600426][T15696] usb 4-1: SerialNumber: syz [ 2283.607092][ T5550] netlink: 16 bytes leftover after parsing attributes in process `syz.1.9816'. [ 2283.960138][T30201] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 2284.106398][T30201] usb 2-1: device descriptor read/64, error -71 [ 2284.219955][ C0] net_ratelimit: 1 callbacks suppressed [ 2284.219981][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2284.232803][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2284.651340][T30201] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 2284.789754][T30201] usb 2-1: device descriptor read/64, error -71 [ 2284.960381][T30201] usb usb2-port1: attempt power cycle [ 2285.249865][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2285.257095][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2285.339956][T30201] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 2285.394699][T30201] usb 2-1: device descriptor read/8, error -71 [ 2285.571604][ T5565] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 2285.670237][T30201] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 2285.703158][T30201] usb 2-1: device descriptor read/8, error -71 [ 2285.820927][T30201] usb usb2-port1: unable to enumerate USB device [ 2286.127156][T15696] usb 4-1: USB disconnect, device number 3 [ 2286.222306][ T3023] udevd[3023]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 2286.289771][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2286.296983][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2286.791420][ T5573] netlink: 15 bytes leftover after parsing attributes in process `syz.3.9824'. [ 2287.329726][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2287.337098][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2287.551427][ T5588] trusted_key: encrypted_key: master key parameter 'defVult' is invalid [ 2288.109912][ T5593] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2288.369765][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2288.921100][T15696] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 2289.094654][T15696] usb 2-1: New USB device found, idVendor=0572, idProduct=cb01, bcdDevice=26.65 [ 2289.114517][T15696] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2289.149694][T15696] usb 2-1: Product: syz [ 2289.153925][T15696] usb 2-1: Manufacturer: syz [ 2289.179680][T15696] usb 2-1: SerialNumber: syz [ 2289.201628][T15696] usb 2-1: config 0 descriptor?? [ 2289.409748][ C0] net_ratelimit: 1 callbacks suppressed [ 2289.409769][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2289.422890][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2289.440235][T15696] cx82310_eth 2-1:0.0: probe with driver cx82310_eth failed with error -22 [ 2289.620158][ T5620] sctp: [Deprecated]: syz.3.9836 (pid 5620) Use of int in max_burst socket option deprecated. [ 2289.620158][ T5620] Use struct sctp_assoc_value instead [ 2289.743974][ T5622] tipc: Started in network mode [ 2289.749027][ T5622] tipc: Node identity 7f000001, cluster identity 4711 [ 2289.764149][ T5622] tipc: Enabled bearer , priority 0 [ 2289.803178][ T5622] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 2289.831046][ T5622] tipc: Enabled bearer , priority 0 [ 2289.874859][T15696] cxacru 2-1:0.0: usbatm_usb_probe: bind failed: -19! [ 2290.088728][T15696] usb 2-1: USB disconnect, device number 20 [ 2290.449743][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2290.456981][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2290.889998][ T5957] tipc: Node number set to 2130706433 [ 2291.218645][ T5644] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9841'. [ 2291.489743][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2291.496975][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2292.070854][T31939] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 2292.258269][T31939] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 2292.268492][T31939] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 2292.280737][T31939] usb 4-1: New USB device found, idVendor=2040, idProduct=1605, bcdDevice= a.94 [ 2292.353945][T31939] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2292.367914][T31939] usb 4-1: config 0 descriptor?? [ 2292.539733][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2292.546896][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2292.596355][T15696] usb 4-1: USB disconnect, device number 4 [ 2292.909661][T30201] usb 2-1: new full-speed USB device number 21 using dummy_hcd [ 2293.452825][T30201] usb 2-1: config 0 has an invalid interface number: 128 but max is 0 [ 2293.463455][T30201] usb 2-1: config 0 has no interface number 0 [ 2293.510824][T30201] usb 2-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 2293.520072][T30201] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2293.528433][T30201] usb 2-1: Product: syz [ 2293.545998][T30201] usb 2-1: Manufacturer: syz [ 2293.564447][T30201] usb 2-1: SerialNumber: syz [ 2293.571745][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2293.578843][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2293.594456][T30201] usb 2-1: config 0 descriptor?? [ 2293.702830][ T5669] FAULT_INJECTION: forcing a failure. [ 2293.702830][ T5669] name failslab, interval 1, probability 0, space 0, times 0 [ 2293.769731][ T5669] CPU: 1 UID: 0 PID: 5669 Comm: syz.3.9848 Not tainted syzkaller #0 PREEMPT(full) [ 2293.769771][ T5669] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 2293.769789][ T5669] Call Trace: [ 2293.769797][ T5669] [ 2293.769809][ T5669] dump_stack_lvl+0x189/0x250 [ 2293.769841][ T5669] ? __pfx____ratelimit+0x10/0x10 [ 2293.769863][ T5669] ? __pfx_dump_stack_lvl+0x10/0x10 [ 2293.769888][ T5669] ? __pfx__printk+0x10/0x10 [ 2293.769923][ T5669] ? __pfx___might_resched+0x10/0x10 [ 2293.769946][ T5669] ? fs_reclaim_acquire+0x7d/0x100 [ 2293.769987][ T5669] should_fail_ex+0x414/0x560 [ 2293.770027][ T5669] should_failslab+0xa8/0x100 [ 2293.770059][ T5669] __kmalloc_cache_noprof+0x70/0x3d0 [ 2293.770090][ T5669] ? nci_allocate_device+0xe8/0x360 [ 2293.770118][ T5669] ? __kasan_kmalloc+0x93/0xb0 [ 2293.770147][ T5669] ? __pfx_virtual_nci_send+0x10/0x10 [ 2293.770181][ T5669] nci_allocate_device+0xe8/0x360 [ 2293.770218][ T5669] virtual_ncidev_open+0x75/0x1a0 [ 2293.770247][ T5669] ? __pfx_virtual_ncidev_open+0x10/0x10 [ 2293.770276][ T5669] misc_open+0x2bc/0x330 [ 2293.770321][ T5669] chrdev_open+0x4c9/0x5e0 [ 2293.770360][ T5669] ? __pfx_chrdev_open+0x10/0x10 [ 2293.770399][ T5669] ? fsnotify_open_perm_and_set_mode+0x113/0x610 [ 2293.770441][ T5669] ? __pfx_chrdev_open+0x10/0x10 [ 2293.770473][ T5669] do_dentry_open+0x950/0x13f0 [ 2293.770514][ T5669] vfs_open+0x3b/0x340 [ 2293.770535][ T5669] ? path_openat+0x2ecd/0x3830 [ 2293.770567][ T5669] path_openat+0x2ee5/0x3830 [ 2293.770593][ T5669] ? arch_stack_walk+0xfc/0x150 [ 2293.770639][ T5669] ? stack_depot_save_flags+0x40/0x860 [ 2293.770687][ T5669] ? __pfx_path_openat+0x10/0x10 [ 2293.770711][ T5669] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2293.770762][ T5669] do_filp_open+0x1fa/0x410 [ 2293.770788][ T5669] ? __lock_acquire+0xab9/0xd20 [ 2293.770823][ T5669] ? __pfx_do_filp_open+0x10/0x10 [ 2293.770877][ T5669] ? _raw_spin_unlock+0x28/0x50 [ 2293.770910][ T5669] ? alloc_fd+0x64c/0x6c0 [ 2293.770957][ T5669] do_sys_openat2+0x121/0x1c0 [ 2293.770986][ T5669] ? __pfx_do_sys_openat2+0x10/0x10 [ 2293.771011][ T5669] ? ksys_write+0x22a/0x250 [ 2293.771043][ T5669] ? __pfx_ksys_write+0x10/0x10 [ 2293.771076][ T5669] __x64_sys_openat+0x138/0x170 [ 2293.771108][ T5669] do_syscall_64+0xfa/0x3b0 [ 2293.771130][ T5669] ? lockdep_hardirqs_on+0x9c/0x150 [ 2293.771152][ T5669] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2293.771174][ T5669] ? clear_bhb_loop+0x60/0xb0 [ 2293.771202][ T5669] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2293.771225][ T5669] RIP: 0033:0x7f89a898ebe9 [ 2293.771246][ T5669] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2293.771267][ T5669] RSP: 002b:00007f89a97a1038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 2293.771298][ T5669] RAX: ffffffffffffffda RBX: 00007f89a8bc6090 RCX: 00007f89a898ebe9 [ 2293.771313][ T5669] RDX: 0000000000005400 RSI: 0000200000000080 RDI: ffffffffffffff9c [ 2293.771329][ T5669] RBP: 00007f89a97a1090 R08: 0000000000000000 R09: 0000000000000000 [ 2293.771342][ T5669] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2293.771355][ T5669] R13: 00007f89a8bc6128 R14: 00007f89a8bc6090 R15: 00007f89a8cefa28 [ 2293.771391][ T5669] [ 2294.104237][ T5671] netlink: 36 bytes leftover after parsing attributes in process `syz.7.9847'. [ 2294.113506][ T5671] netlink: 36 bytes leftover after parsing attributes in process `syz.7.9847'. [ 2294.609711][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2294.619096][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2294.687827][T30201] usb 2-1: Firmware: major: 0, minor: 83, hardware type: ATUSB (1) [ 2295.321162][T23651] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 2295.514535][T23651] usb 4-1: config 0 has no interfaces? [ 2295.528310][T23651] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 2295.547996][T23651] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2295.563471][T23651] usb 4-1: Product: syz [ 2295.576270][T23651] usb 4-1: Manufacturer: syz [ 2295.585987][T23651] usb 4-1: SerialNumber: syz [ 2295.603313][T23651] usb 4-1: config 0 descriptor?? [ 2295.650087][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2295.657546][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2295.731152][T30201] usb 2-1: failed to fetch extended address, random address set [ 2295.837119][ T5683] netlink: 76 bytes leftover after parsing attributes in process `syz.3.9849'. [ 2296.184429][ T5957] usb 2-1: USB disconnect, device number 21 [ 2296.689713][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2296.697076][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2297.729778][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2297.737251][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2298.779706][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2298.786773][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2298.882521][ T5718] FAULT_INJECTION: forcing a failure. [ 2298.882521][ T5718] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2298.896059][ T5957] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 2298.905571][ T5718] CPU: 0 UID: 0 PID: 5718 Comm: syz.0.9860 Not tainted syzkaller #0 PREEMPT(full) [ 2298.905598][ T5718] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 2298.905609][ T5718] Call Trace: [ 2298.905615][ T5718] [ 2298.905623][ T5718] dump_stack_lvl+0x189/0x250 [ 2298.905646][ T5718] ? __pfx____ratelimit+0x10/0x10 [ 2298.905661][ T5718] ? __pfx_dump_stack_lvl+0x10/0x10 [ 2298.905679][ T5718] ? __pfx__printk+0x10/0x10 [ 2298.905701][ T5718] ? __might_fault+0xb0/0x130 [ 2298.905731][ T5718] should_fail_ex+0x414/0x560 [ 2298.905757][ T5718] _copy_from_iter+0x1de/0x1790 [ 2298.905781][ T5718] ? rcu_is_watching+0x15/0xb0 [ 2298.905799][ T5718] ? kmem_cache_alloc_node_noprof+0x217/0x3c0 [ 2298.905822][ T5718] ? __pfx__copy_from_iter+0x10/0x10 [ 2298.905841][ T5718] ? __build_skb_around+0x257/0x3e0 [ 2298.905860][ T5718] ? netlink_sendmsg+0x642/0xb30 [ 2298.905876][ T5718] ? skb_put+0x11b/0x210 [ 2298.905895][ T5718] netlink_sendmsg+0x6b2/0xb30 [ 2298.905925][ T5718] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2298.905944][ T5718] ? aa_sock_msg_perm+0xf1/0x1d0 [ 2298.905960][ T5718] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 2298.905976][ T5718] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2298.905993][ T5718] __sock_sendmsg+0x21c/0x270 [ 2298.906018][ T5718] ____sys_sendmsg+0x505/0x830 [ 2298.906042][ T5718] ? __pfx_____sys_sendmsg+0x10/0x10 [ 2298.906067][ T5718] ? import_iovec+0x74/0xa0 [ 2298.906088][ T5718] ___sys_sendmsg+0x21f/0x2a0 [ 2298.906109][ T5718] ? __pfx____sys_sendmsg+0x10/0x10 [ 2298.906153][ T5718] ? __fget_files+0x2a/0x420 [ 2298.906166][ T5718] ? __fget_files+0x3a0/0x420 [ 2298.906186][ T5718] __x64_sys_sendmsg+0x19b/0x260 [ 2298.906207][ T5718] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 2298.906233][ T5718] ? __pfx_ksys_write+0x10/0x10 [ 2298.906252][ T5718] ? rcu_is_watching+0x15/0xb0 [ 2298.906270][ T5718] ? do_syscall_64+0xbe/0x3b0 [ 2298.906289][ T5718] do_syscall_64+0xfa/0x3b0 [ 2298.906304][ T5718] ? lockdep_hardirqs_on+0x9c/0x150 [ 2298.906318][ T5718] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2298.906333][ T5718] ? clear_bhb_loop+0x60/0xb0 [ 2298.906351][ T5718] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2298.906366][ T5718] RIP: 0033:0x7ff563d8ebe9 [ 2298.906380][ T5718] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2298.906393][ T5718] RSP: 002b:00007ff564b1f038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2298.906409][ T5718] RAX: ffffffffffffffda RBX: 00007ff563fc5fa0 RCX: 00007ff563d8ebe9 [ 2298.906421][ T5718] RDX: 0000000000000000 RSI: 0000200000000400 RDI: 0000000000000003 [ 2298.906430][ T5718] RBP: 00007ff564b1f090 R08: 0000000000000000 R09: 0000000000000000 [ 2298.906440][ T5718] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2298.906449][ T5718] R13: 00007ff563fc6038 R14: 00007ff563fc5fa0 R15: 00007ff5640efa28 [ 2298.906472][ T5718] [ 2299.194488][ C0] vkms_vblank_simulate: vblank timer overrun [ 2299.219756][T23651] usb 4-1: USB disconnect, device number 5 [ 2299.291381][ T5957] usb 2-1: Using ep0 maxpacket: 16 [ 2299.311608][ T5957] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 11 [ 2299.322329][ T5957] usb 2-1: config 1 interface 0 altsetting 3 endpoint 0xB has invalid wMaxPacketSize 0 [ 2299.332465][ T5957] usb 2-1: config 1 interface 0 altsetting 3 bulk endpoint 0xB has invalid maxpacket 0 [ 2299.342685][ T5957] usb 2-1: config 1 interface 0 altsetting 3 endpoint 0x8A has invalid wMaxPacketSize 0 [ 2299.353399][ T5957] usb 2-1: config 1 interface 0 altsetting 3 bulk endpoint 0x8A has invalid maxpacket 0 [ 2299.363378][ T5957] usb 2-1: config 1 interface 0 has no altsetting 0 [ 2299.370085][ T5957] usb 2-1: New USB device found, idVendor=04e6, idProduct=0003, bcdDevice= 1.77 [ 2299.379165][ T5957] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2299.398842][ T5720] netlink: 'syz.3.9861': attribute type 10 has an invalid length. [ 2299.423902][ T5957] ums-sddr09 2-1:1.0: USB Mass Storage device detected [ 2299.432052][ T5720] team0: Device hsr_slave_0 failed to register rx_handler [ 2299.809730][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2299.817510][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2299.855857][ T5957] ums-sddr09 2-1:1.0: probe with driver ums-sddr09 failed with error -22 [ 2300.655556][ T5957] usb 2-1: USB disconnect, device number 22 [ 2300.849763][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2300.856910][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2301.839629][ T5957] usb 2-1: new full-speed USB device number 23 using dummy_hcd [ 2301.889704][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2301.897374][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2302.011700][ T5957] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 2302.050428][ T5957] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x4 has an invalid bInterval 0, changing to 10 [ 2302.063666][ T5957] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x4 has invalid maxpacket 255, setting to 64 [ 2302.077978][ T5957] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9375, bcdDevice=1a.de [ 2302.087391][ T5957] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2302.110281][ T5957] usb 2-1: config 0 descriptor?? [ 2302.116797][ T5747] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 2302.424499][ T5957] ath6kl: Failed to submit usb control message: -71 [ 2302.516455][ T5957] ath6kl: unable to send the bmi data to the device: -71 [ 2302.629628][ T5957] ath6kl: Unable to send get target info: -71 [ 2302.657516][ T5957] ath6kl: Failed to init ath6kl core: -71 [ 2302.701074][ T5957] ath6kl_usb 2-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 2302.843309][ T5957] usb 2-1: USB disconnect, device number 23 [ 2302.939723][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2302.947018][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2303.632236][ T5957] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 2303.969748][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2303.977052][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2304.113127][ T5957] usb 2-1: config 0 has no interfaces? [ 2304.264829][ T5777] vimc link validate: Scaler:src:16x16 (0x33424752, 1, 2, 0, 0) RGB/YUV Capture:snk:16x16 (0x38416761, 4, 0, 0, 0) [ 2304.298231][ T5957] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 2304.323165][ T5957] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2304.344743][ T5957] usb 2-1: Product: syz [ 2304.355874][ T5957] usb 2-1: Manufacturer: syz [ 2304.372058][ T5957] usb 2-1: SerialNumber: syz [ 2304.427690][ T5957] usb 2-1: config 0 descriptor?? [ 2304.611980][T31939] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 2304.844918][T31939] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2304.879549][ T5781] netlink: 76 bytes leftover after parsing attributes in process `syz.1.9871'. [ 2305.019722][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2305.026853][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2305.088488][T31939] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 2305.130046][T31939] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 2305.156663][T31939] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 2305.168967][T31939] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2305.177177][T31939] usb 4-1: Product: syz [ 2305.181508][T31939] usb 4-1: Manufacturer: syz [ 2305.186134][T31939] usb 4-1: SerialNumber: syz [ 2305.525652][T31939] cdc_ncm 4-1:1.0: CDC Union missing and no IAD found [ 2305.571273][T31939] cdc_ncm 4-1:1.0: bind() failure [ 2305.724702][T30201] usb 4-1: USB disconnect, device number 6 [ 2306.059680][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2306.066851][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2306.593834][ T5785] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9879'. [ 2307.027320][T13600] usb 2-1: USB disconnect, device number 24 [ 2307.089694][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2307.097001][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2307.514244][ T5803] bridge0: port 2(bridge_slave_1) entered disabled state [ 2307.521882][ T5803] bridge0: port 1(bridge_slave_0) entered disabled state [ 2307.533885][T13600] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 2307.707418][ T5803] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 2307.824268][ T5803] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 2307.930151][T13600] usb 2-1: Using ep0 maxpacket: 16 [ 2307.966816][T13600] usb 2-1: config 0 interface 0 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 9 [ 2308.049903][T13600] usb 2-1: config 0 interface 0 has no altsetting 0 [ 2308.099411][ T4467] netdevsim netdevsim5 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2308.120386][T13600] usb 2-1: New USB device found, idVendor=045e, idProduct=05da, bcdDevice= 0.00 [ 2308.121152][ T4467] netdevsim netdevsim5 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2308.129963][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2308.146075][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2308.196884][ T4467] netdevsim netdevsim5 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2308.207265][ T4467] netdevsim netdevsim5 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2308.244748][T13600] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2308.412006][T13600] usb 2-1: config 0 descriptor?? [ 2308.468618][T13600] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 2308.770924][ T5815] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2308.785351][ T5815] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2308.810112][ T5815] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2308.856128][ T5815] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2309.179762][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2309.187352][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2310.209760][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2310.217016][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2310.491559][T30201] usb 2-1: USB disconnect, device number 25 [ 2311.019706][T30201] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 2311.049666][T23651] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 2311.168372][ T5837] netlink: 5 bytes leftover after parsing attributes in process `syz.7.9892'. [ 2311.178090][ T5837] 0ªî{X¹¦: renamed from gretap0 (while UP) [ 2311.206530][ T5837] 0ªî{X¹¦: entered allmulticast mode [ 2311.213837][ T5837] A link change request failed with some changes committed already. Interface 30ªî{X¹¦ may have been left with an inconsistent configuration, please check. [ 2311.230135][T30201] usb 4-1: Using ep0 maxpacket: 16 [ 2311.237517][T30201] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2311.249753][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2311.257130][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2311.259330][T30201] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2311.371462][T23651] usb 2-1: too many configurations: 217, using maximum allowed: 8 [ 2311.413194][T23651] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 2311.445029][T23651] usb 2-1: can't read configurations, error -61 [ 2311.485526][T30201] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 2311.526029][T30201] usb 4-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 2311.547224][T30201] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2311.578423][T30201] usb 4-1: config 0 descriptor?? [ 2311.639707][T23651] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 2311.665448][ T5847] netlink: 8 bytes leftover after parsing attributes in process `syz.5.9895'. [ 2311.800848][T23651] usb 2-1: too many configurations: 217, using maximum allowed: 8 [ 2312.220911][T23651] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 2312.289712][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2312.296931][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2312.306019][T23651] usb 2-1: can't read configurations, error -61 [ 2312.318220][T23651] usb usb2-port1: attempt power cycle [ 2312.505775][ T5828] random: crng reseeded on system resumption [ 2312.691421][T23651] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 2312.751216][T23651] usb 2-1: too many configurations: 217, using maximum allowed: 8 [ 2312.795846][T23651] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 2312.807104][T23651] usb 2-1: can't read configurations, error -61 [ 2312.999860][T23651] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 2313.021772][T23651] usb 2-1: too many configurations: 217, using maximum allowed: 8 [ 2313.034600][T23651] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 2313.053077][T23651] usb 2-1: can't read configurations, error -61 [ 2313.087460][T23651] usb usb2-port1: unable to enumerate USB device [ 2313.329718][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2313.337018][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2313.634564][ T5871] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1500) ! [ 2313.882849][T30201] usbhid 4-1:0.0: can't add hid device: -71 [ 2313.889157][T30201] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 2313.984729][T30201] usb 4-1: USB disconnect, device number 7 [ 2314.369687][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2314.429641][T23651] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 2314.753833][T23651] usb 2-1: config 0 has no interfaces? [ 2314.829657][T23651] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 2314.876739][T23651] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2315.028567][T23651] usb 2-1: Product: syz [ 2315.037726][T23651] usb 2-1: Manufacturer: syz [ 2315.047463][T23651] usb 2-1: SerialNumber: syz [ 2315.068344][T23651] usb 2-1: config 0 descriptor?? [ 2315.409708][ C0] net_ratelimit: 1 callbacks suppressed [ 2315.409732][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2315.422797][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2315.857057][ T5875] : entered promiscuous mode [ 2316.311292][ T5888] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 2316.319254][ T5888] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 2316.326250][ T5888] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 2316.343343][ T5888] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 2316.373064][ T5888] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 2316.381287][ T5888] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 2316.449730][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2316.457102][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2317.161331][T23651] usb 2-1: USB disconnect, device number 30 [ 2317.489907][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2317.497097][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2317.740682][ T5904] vimc link validate: Scaler:src:16x16 (0x33424752, 1, 2, 0, 0) RGB/YUV Capture:snk:16x16 (0x38416761, 4, 0, 0, 0) [ 2318.050611][ T5300] Bluetooth: hci1: command 0x0406 tx timeout [ 2318.053882][ T30] audit: type=1326 audit(1757194368.996:4008): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5906 comm="syz.7.9906" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f1f7138ebe9 code=0x0 [ 2318.078584][ C0] vkms_vblank_simulate: vblank timer overrun [ 2318.420335][ T5300] Bluetooth: hci0: command 0x0405 tx timeout [ 2318.426459][ T5300] Bluetooth: hci4: command 0x0c1a tx timeout [ 2318.433207][ T5300] Bluetooth: hci3: command 0x0405 tx timeout [ 2318.459992][T31281] Bluetooth: hci5: command 0x0c1a tx timeout [ 2318.460515][ T5300] Bluetooth: hci2: command 0x0c1a tx timeout [ 2318.530051][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2318.537341][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2319.569760][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2319.577040][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2320.609713][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2320.617004][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2321.010165][ T5944] FAULT_INJECTION: forcing a failure. [ 2321.010165][ T5944] name failslab, interval 1, probability 0, space 0, times 0 [ 2321.027558][ T5944] CPU: 1 UID: 0 PID: 5944 Comm: syz.3.9920 Not tainted syzkaller #0 PREEMPT(full) [ 2321.027581][ T5944] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 2321.027591][ T5944] Call Trace: [ 2321.027598][ T5944] [ 2321.027605][ T5944] dump_stack_lvl+0x189/0x250 [ 2321.027628][ T5944] ? __pfx____ratelimit+0x10/0x10 [ 2321.027643][ T5944] ? __pfx_dump_stack_lvl+0x10/0x10 [ 2321.027661][ T5944] ? __pfx__printk+0x10/0x10 [ 2321.027686][ T5944] ? __pfx___might_resched+0x10/0x10 [ 2321.027701][ T5944] ? fs_reclaim_acquire+0x7d/0x100 [ 2321.027736][ T5944] should_fail_ex+0x414/0x560 [ 2321.027761][ T5944] ? rhashtable_init_noprof+0x4ee/0xbb0 [ 2321.027778][ T5944] should_failslab+0xa8/0x100 [ 2321.027801][ T5944] __kvmalloc_node_noprof+0x161/0x5f0 [ 2321.027824][ T5944] ? rhashtable_init_noprof+0x4ee/0xbb0 [ 2321.027845][ T5944] rhashtable_init_noprof+0x4ee/0xbb0 [ 2321.027865][ T5944] ? fl_check_assign_mask+0xa2/0x1b80 [ 2321.027887][ T5944] fl_check_assign_mask+0x8de/0x1b80 [ 2321.027909][ T5944] ? fl_set_key+0x41ff/0x59d0 [ 2321.027932][ T5944] ? fl_check_assign_mask+0xa2/0x1b80 [ 2321.027955][ T5944] ? __pfx_fl_check_assign_mask+0x10/0x10 [ 2321.027976][ T5944] ? __pfx_fl_set_key+0x10/0x10 [ 2321.028000][ T5944] ? fl_mask_fits_tmplt+0x89/0x190 [ 2321.028022][ T5944] fl_change+0xbec/0x1ac0 [ 2321.028062][ T5944] ? __pfx_fl_change+0x10/0x10 [ 2321.028087][ T5944] ? __pfx_fl_get+0x10/0x10 [ 2321.028114][ T5944] tc_new_tfilter+0xdca/0x15b0 [ 2321.028153][ T5944] ? __pfx_tc_new_tfilter+0x10/0x10 [ 2321.028197][ T5944] ? __pfx_tc_new_tfilter+0x10/0x10 [ 2321.028213][ T5944] rtnetlink_rcv_msg+0x7cf/0xb70 [ 2321.028229][ T5944] ? __lock_acquire+0xab9/0xd20 [ 2321.028252][ T5944] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 2321.028267][ T5944] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 2321.028295][ T5944] netlink_rcv_skb+0x205/0x470 [ 2321.028310][ T5944] ? __lock_acquire+0xab9/0xd20 [ 2321.028332][ T5944] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 2321.028348][ T5944] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 2321.028372][ T5944] ? netlink_deliver_tap+0x2e/0x1b0 [ 2321.028394][ T5944] netlink_unicast+0x82c/0x9e0 [ 2321.028423][ T5944] ? __pfx_netlink_unicast+0x10/0x10 [ 2321.028447][ T5944] ? netlink_sendmsg+0x642/0xb30 [ 2321.028461][ T5944] ? skb_put+0x11b/0x210 [ 2321.028482][ T5944] netlink_sendmsg+0x805/0xb30 [ 2321.028505][ T5944] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2321.028523][ T5944] ? aa_sock_msg_perm+0xf1/0x1d0 [ 2321.028540][ T5944] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 2321.028556][ T5944] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2321.028573][ T5944] __sock_sendmsg+0x21c/0x270 [ 2321.028599][ T5944] ____sys_sendmsg+0x505/0x830 [ 2321.028622][ T5944] ? __pfx_____sys_sendmsg+0x10/0x10 [ 2321.028648][ T5944] ? import_iovec+0x74/0xa0 [ 2321.028671][ T5944] ___sys_sendmsg+0x21f/0x2a0 [ 2321.028691][ T5944] ? __pfx____sys_sendmsg+0x10/0x10 [ 2321.028742][ T5944] ? __fget_files+0x2a/0x420 [ 2321.028755][ T5944] ? __fget_files+0x3a0/0x420 [ 2321.028776][ T5944] __x64_sys_sendmsg+0x19b/0x260 [ 2321.028797][ T5944] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 2321.028823][ T5944] ? __pfx_ksys_write+0x10/0x10 [ 2321.028847][ T5944] ? do_syscall_64+0xbe/0x3b0 [ 2321.028866][ T5944] do_syscall_64+0xfa/0x3b0 [ 2321.028881][ T5944] ? lockdep_hardirqs_on+0x9c/0x150 [ 2321.028895][ T5944] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2321.028910][ T5944] ? clear_bhb_loop+0x60/0xb0 [ 2321.028928][ T5944] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2321.028943][ T5944] RIP: 0033:0x7f89a898ebe9 [ 2321.028957][ T5944] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2321.028970][ T5944] RSP: 002b:00007f89a97c2038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2321.028988][ T5944] RAX: ffffffffffffffda RBX: 00007f89a8bc5fa0 RCX: 00007f89a898ebe9 [ 2321.028999][ T5944] RDX: 0000000020004804 RSI: 0000200000000000 RDI: 0000000000000004 [ 2321.029009][ T5944] RBP: 00007f89a97c2090 R08: 0000000000000000 R09: 0000000000000000 [ 2321.029019][ T5944] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2321.029028][ T5944] R13: 00007f89a8bc6038 R14: 00007f89a8bc5fa0 R15: 00007f89a8cefa28 [ 2321.029051][ T5944] [ 2321.649715][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2321.657077][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2322.689702][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2322.696927][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2323.739701][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2323.746892][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2324.042004][ T30] audit: type=1800 audit(1757194375.006:4009): pid=5967 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.7.9919" name="SYSV00000000" dev="tmpfs" ino=0 res=0 errno=0 [ 2324.062436][ C0] vkms_vblank_simulate: vblank timer overrun [ 2324.091222][ T5965] pim6reg: entered allmulticast mode [ 2324.770217][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2324.778173][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2325.023906][ T5971] netlink: 12 bytes leftover after parsing attributes in process `syz.1.9925'. [ 2325.098129][ T5971] netlink: 'syz.1.9925': attribute type 1 has an invalid length. [ 2325.124770][ T5971] netlink: 168864 bytes leftover after parsing attributes in process `syz.1.9925'. [ 2325.321329][ T5980] netlink: 40 bytes leftover after parsing attributes in process `syz.7.9928'. [ 2325.360189][T31939] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 2325.419709][T30201] usb 2-1: new high-speed USB device number 31 using dummy_hcd [ 2325.471817][ T5982] input: syz1 as /devices/virtual/input/input78 [ 2325.544634][T31939] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 2325.572742][T30201] usb 2-1: Using ep0 maxpacket: 32 [ 2325.572810][T31939] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 2325.587427][ T5985] netlink: 28 bytes leftover after parsing attributes in process `syz.5.9930'. [ 2325.597550][T31939] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 2325.617876][T31939] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 2325.632942][T31939] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 2325.633148][T30201] usb 2-1: config 0 has an invalid interface number: 51 but max is 0 [ 2325.642289][T31939] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2325.659153][T30201] usb 2-1: config 0 has an invalid descriptor of length 18, skipping remainder of the config [ 2325.682679][T31939] usb 4-1: config 0 descriptor?? [ 2325.694530][T30201] usb 2-1: config 0 has no interface number 0 [ 2325.708071][T30201] usb 2-1: config 0 interface 51 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 2325.754220][T30201] usb 2-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 2325.771898][T30201] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2325.781036][T30201] usb 2-1: Product: syz [ 2325.785342][T30201] usb 2-1: Manufacturer: syz [ 2325.793679][T30201] usb 2-1: SerialNumber: syz [ 2325.805352][T30201] usb 2-1: config 0 descriptor?? [ 2325.816780][T30201] quatech2 2-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 2325.819780][ C0] net_ratelimit: 1 callbacks suppressed [ 2325.819805][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2325.838619][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2326.018688][T30201] usb 2-1: qt2_setup_urbs - submit read urb failed -8 [ 2326.032950][T30201] quatech2 2-1:0.51: probe with driver quatech2 failed with error -8 [ 2326.124226][T31939] plantronics 0003:047F:FFFF.0045: ignoring exceeding usage max [ 2326.163042][T31939] plantronics 0003:047F:FFFF.0045: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 2326.224158][T15696] usb 2-1: USB disconnect, device number 31 [ 2326.859863][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2326.867146][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2327.889710][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2327.896818][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2328.270867][T15696] usb 4-1: USB disconnect, device number 8 [ 2328.518599][ T6012] fuse: Bad value for 'group_id' [ 2328.530029][ T6012] fuse: Bad value for 'group_id' [ 2328.548548][ T6012] netlink: 64859 bytes leftover after parsing attributes in process `syz.7.9936'. [ 2328.700647][ T6016] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9938'. [ 2328.929710][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2328.936884][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2329.055802][ T6025] netlink: 'syz.7.9943': attribute type 63 has an invalid length. [ 2329.150949][ T6027] netlink: 24 bytes leftover after parsing attributes in process `syz.3.9942'. [ 2329.544468][ T30] audit: type=1400 audit(1757194380.516:4010): apparmor="DENIED" operation="setprocattr" info="invalid" error=-22 profile="unconfined" pid=6033 comm="syz.7.9945" [ 2329.979733][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2329.986951][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2330.091684][T30201] usb 2-1: new high-speed USB device number 32 using dummy_hcd [ 2330.282629][T30201] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 2330.299725][T30201] usb 2-1: config 0 has no interface number 0 [ 2330.333461][T30201] usb 2-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 2330.359940][T30201] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2330.380103][T30201] usb 2-1: Product: syz [ 2330.390081][T30201] usb 2-1: Manufacturer: syz [ 2330.394803][T30201] usb 2-1: SerialNumber: syz [ 2330.426178][T30201] usb 2-1: config 0 descriptor?? [ 2330.655481][T30201] usb 2-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 2330.692549][T30201] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 2330.720001][T30201] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 2330.759788][T30201] usb 2-1: media controller created [ 2330.860453][T30201] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 2330.931228][T30201] i2c i2c-2: ec100: i2c rd failed=-32 reg=33 [ 2331.009690][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2331.016902][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2331.301548][ T6057] netlink: 522 bytes leftover after parsing attributes in process `syz.1.9947'. [ 2332.049689][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2332.056859][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2332.830470][ T6068] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20000 [ 2332.934980][T30201] usb 2-1: USB disconnect, device number 32 [ 2333.089797][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2333.097003][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2333.299464][ T6073] fuse: Unknown parameter 'gro00000000000000000000' [ 2334.129706][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2334.137083][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2334.197257][ T6088] program syz.7.9961 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2334.417071][ T6090] netlink: 32 bytes leftover after parsing attributes in process `syz.1.9962'. [ 2334.700423][ T6098] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2334.949074][ T6107] netlink: 20 bytes leftover after parsing attributes in process `syz.3.9967'. [ 2335.169729][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2335.176764][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2335.251429][ T6102] netlink: 12 bytes leftover after parsing attributes in process `syz.1.9964'. [ 2336.219703][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2336.226808][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2337.249748][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2337.257061][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2337.296355][ T6132] bridge0: entered promiscuous mode [ 2337.325922][ T6132] macsec2: entered promiscuous mode [ 2337.405561][ T6132] netlink: 4 bytes leftover after parsing attributes in process `syz.7.9971'. [ 2337.977029][ T6143] FAULT_INJECTION: forcing a failure. [ 2337.977029][ T6143] name failslab, interval 1, probability 0, space 0, times 0 [ 2338.055643][ T6143] CPU: 0 UID: 0 PID: 6143 Comm: syz.1.9976 Not tainted syzkaller #0 PREEMPT(full) [ 2338.055673][ T6143] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 2338.055687][ T6143] Call Trace: [ 2338.055697][ T6143] [ 2338.055708][ T6143] dump_stack_lvl+0x189/0x250 [ 2338.055739][ T6143] ? __pfx____ratelimit+0x10/0x10 [ 2338.055763][ T6143] ? __pfx_dump_stack_lvl+0x10/0x10 [ 2338.055787][ T6143] ? __pfx__printk+0x10/0x10 [ 2338.055823][ T6143] ? __pfx___might_resched+0x10/0x10 [ 2338.055842][ T6143] ? fs_reclaim_acquire+0x7d/0x100 [ 2338.055880][ T6143] should_fail_ex+0x414/0x560 [ 2338.055916][ T6143] should_failslab+0xa8/0x100 [ 2338.055949][ T6143] __kmalloc_cache_noprof+0x70/0x3d0 [ 2338.055977][ T6143] ? nfnetlink_rcv+0xeff/0x2520 [ 2338.056013][ T6143] nfnetlink_rcv+0xeff/0x2520 [ 2338.056077][ T6143] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 2338.056126][ T6143] ? ref_tracker_free+0x63a/0x7d0 [ 2338.056184][ T6143] ? __netlink_deliver_tap+0x807/0x850 [ 2338.056207][ T6143] ? netlink_deliver_tap+0x2e/0x1b0 [ 2338.056249][ T6143] netlink_unicast+0x82c/0x9e0 [ 2338.056289][ T6143] ? __pfx_netlink_unicast+0x10/0x10 [ 2338.056323][ T6143] ? netlink_sendmsg+0x642/0xb30 [ 2338.056343][ T6143] ? skb_put+0x11b/0x210 [ 2338.056384][ T6143] netlink_sendmsg+0x805/0xb30 [ 2338.056416][ T6143] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2338.056443][ T6143] ? aa_sock_msg_perm+0xf1/0x1d0 [ 2338.056467][ T6143] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 2338.056490][ T6143] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2338.056514][ T6143] __sock_sendmsg+0x21c/0x270 [ 2338.056549][ T6143] ____sys_sendmsg+0x505/0x830 [ 2338.056582][ T6143] ? __pfx_____sys_sendmsg+0x10/0x10 [ 2338.056618][ T6143] ? import_iovec+0x74/0xa0 [ 2338.056649][ T6143] ___sys_sendmsg+0x21f/0x2a0 [ 2338.056678][ T6143] ? __pfx____sys_sendmsg+0x10/0x10 [ 2338.056743][ T6143] ? __fget_files+0x2a/0x420 [ 2338.056762][ T6143] ? __fget_files+0x3a0/0x420 [ 2338.056793][ T6143] __x64_sys_sendmsg+0x19b/0x260 [ 2338.056822][ T6143] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 2338.056859][ T6143] ? __pfx_ksys_write+0x10/0x10 [ 2338.056884][ T6143] ? rcu_is_watching+0x15/0xb0 [ 2338.056911][ T6143] ? do_syscall_64+0xbe/0x3b0 [ 2338.056937][ T6143] do_syscall_64+0xfa/0x3b0 [ 2338.056957][ T6143] ? lockdep_hardirqs_on+0x9c/0x150 [ 2338.056979][ T6143] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2338.057000][ T6143] ? clear_bhb_loop+0x60/0xb0 [ 2338.057026][ T6143] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2338.057046][ T6143] RIP: 0033:0x7f3308b8ebe9 [ 2338.057065][ T6143] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2338.057084][ T6143] RSP: 002b:00007f3309a7b038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2338.057106][ T6143] RAX: ffffffffffffffda RBX: 00007f3308dc5fa0 RCX: 00007f3308b8ebe9 [ 2338.057122][ T6143] RDX: 0000000024000840 RSI: 0000200000009b40 RDI: 0000000000000003 [ 2338.057137][ T6143] RBP: 00007f3309a7b090 R08: 0000000000000000 R09: 0000000000000000 [ 2338.057150][ T6143] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2338.057171][ T6143] R13: 00007f3308dc6038 R14: 00007f3308dc5fa0 R15: 00007f3308eefa28 [ 2338.057205][ T6143] [ 2338.372566][ C0] vkms_vblank_simulate: vblank timer overrun [ 2338.379435][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2338.386607][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2339.026210][ T6158] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9982'. [ 2339.229653][T15696] usb 2-1: new high-speed USB device number 33 using dummy_hcd [ 2339.399719][T15696] usb 2-1: device descriptor read/64, error -71 [ 2339.418332][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2339.425475][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2339.669741][T15696] usb 2-1: new high-speed USB device number 34 using dummy_hcd [ 2339.802690][T15696] usb 2-1: device descriptor read/64, error -71 [ 2339.910075][T15696] usb usb2-port1: attempt power cycle [ 2340.279689][T15696] usb 2-1: new high-speed USB device number 35 using dummy_hcd [ 2340.290022][ T31] INFO: task kworker/1:8:15697 blocked for more than 143 seconds. [ 2340.298473][ T31] Not tainted syzkaller #0 [ 2340.304572][T15696] usb 2-1: device descriptor read/8, error -71 [ 2340.459717][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2340.466921][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2340.619752][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 2340.664299][ T31] task:kworker/1:8 state:D stack:21304 pid:15697 tgid:15697 ppid:2 task_flags:0x4288060 flags:0x00004000 [ 2340.687633][ T31] Workqueue: usb_hub_wq hub_event [ 2340.708014][ T31] Call Trace: [ 2340.716054][ T31] [ 2340.720614][ T31] __schedule+0x1798/0x4cc0 [ 2340.732434][ T31] ? do_raw_spin_lock+0x121/0x290 [ 2340.819327][ T31] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 2340.828259][ T31] ? __pfx___schedule+0x10/0x10 [ 2340.845638][ T31] ? schedule+0x91/0x360 [ 2340.854733][ T31] schedule+0x165/0x360 [ 2340.859332][ T31] schedule_timeout+0x9a/0x270 [ 2340.871547][ T31] ? __pfx_schedule_timeout+0x10/0x10 [ 2340.879428][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 2340.885332][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 2340.902359][ T31] ? wait_for_completion+0x267/0x5d0 [ 2340.907889][ T31] wait_for_completion+0x2bf/0x5d0 [ 2340.919679][T15696] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 2340.928599][ T31] ? __pfx_wait_for_completion+0x10/0x10 [ 2340.940385][T15696] usb 2-1: device descriptor read/8, error -71 [ 2340.945237][ T31] i2c_del_adapter+0x581/0x6e0 [ 2340.955471][ T31] ? __pfx_i2c_del_adapter+0x10/0x10 [ 2340.964578][ T31] ? dvb_usb_adapter_exit+0xd7/0x240 [ 2340.989576][ T31] dvb_usb_i2c_exit+0x64/0xb0 [ 2341.001414][ T31] dvb_usb_device_exit+0x1be/0x350 [ 2341.013105][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 2341.021064][ T31] ? __pfx_dvb_usb_device_exit+0x10/0x10 [ 2341.026864][ T31] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 2341.033234][ T31] ? usb_disable_interface+0x31d/0x350 [ 2341.038775][ T31] usb_unbind_interface+0x26e/0x910 [ 2341.044177][ T31] ? __pfx_usb_unbind_interface+0x10/0x10 [ 2341.050325][ T31] device_release_driver_internal+0x4d9/0x800 [ 2341.050553][T15696] usb usb2-port1: unable to enumerate USB device [ 2341.056450][ T31] bus_remove_device+0x34d/0x410 [ 2341.068160][ T31] device_del+0x511/0x8e0 [ 2341.073858][ T31] ? __pm_runtime_barrier+0x212/0x460 [ 2341.079322][ T31] ? __pfx_device_del+0x10/0x10 [ 2341.085149][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 2341.090343][ T31] usb_disable_device+0x3e9/0x8a0 [ 2341.095463][ T31] usb_disconnect+0x330/0x950 [ 2341.100424][ T31] hub_event+0x1cf5/0x4a20 [ 2341.105072][ T31] ? dequeue_entity+0x72e/0x1690 [ 2341.110278][ T31] ? do_raw_spin_lock+0x121/0x290 [ 2341.115354][ T31] ? register_lock_class+0x51/0x320 [ 2341.120784][ T31] ? __pfx_hub_event+0x10/0x10 [ 2341.125595][ T31] ? process_scheduled_works+0x9ef/0x17b0 [ 2341.131488][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 2341.136777][ T31] ? process_scheduled_works+0x9ef/0x17b0 [ 2341.142738][ T31] ? process_scheduled_works+0x9ef/0x17b0 [ 2341.148963][ T31] process_scheduled_works+0xae1/0x17b0 [ 2341.154691][ T31] ? __pfx_process_scheduled_works+0x10/0x10 [ 2341.160909][ T31] worker_thread+0x8a0/0xda0 [ 2341.165722][ T31] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 2341.172299][ T31] ? __kthread_parkme+0x7b/0x200 [ 2341.182580][ T31] kthread+0x70e/0x8a0 [ 2341.187799][ T31] ? __pfx_worker_thread+0x10/0x10 [ 2341.193628][ T31] ? __pfx_kthread+0x10/0x10 [ 2341.198513][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 2341.204166][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 2341.209415][ T31] ? __pfx_kthread+0x10/0x10 [ 2341.214210][ T31] ret_from_fork+0x3fc/0x770 [ 2341.218875][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 2341.224117][ T31] ? __switch_to_asm+0x39/0x70 [ 2341.228962][ T31] ? __switch_to_asm+0x33/0x70 [ 2341.233824][ T31] ? __pfx_kthread+0x10/0x10 [ 2341.238458][ T31] ret_from_fork_asm+0x1a/0x30 [ 2341.243431][ T31] [ 2341.246560][ T31] INFO: task syz.6.9446:4277 blocked for more than 144 seconds. [ 2341.254275][ T31] Not tainted syzkaller #0 [ 2341.259226][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 2341.268010][ T31] task:syz.6.9446 state:D stack:26504 pid:4277 tgid:4276 ppid:4115 task_flags:0x400040 flags:0x00004004 [ 2341.280990][ T31] Call Trace: [ 2341.284311][ T31] [ 2341.287313][ T31] __schedule+0x1798/0x4cc0 [ 2341.293494][ T31] ? __lock_acquire+0xab9/0xd20 [ 2341.298421][ T31] ? __lock_acquire+0xab9/0xd20 [ 2341.303402][ T31] ? __pfx___schedule+0x10/0x10 [ 2341.308585][ T31] ? schedule+0x91/0x360 [ 2341.312950][ T31] schedule+0x165/0x360 [ 2341.317172][ T31] schedule_preempt_disabled+0x13/0x30 [ 2341.322813][ T31] __mutex_lock+0x7e6/0x1350 [ 2341.327477][ T31] ? __mutex_lock+0x5bb/0x1350 [ 2341.332371][ T31] ? usbdev_open+0x16e/0x760 [ 2341.336998][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 2341.342462][ T31] ? bus_find_device+0x273/0x2b0 [ 2341.347468][ T31] ? __pfx_bus_find_device+0x10/0x10 [ 2341.352836][ T31] ? __kasan_kmalloc+0x93/0xb0 [ 2341.357871][ T31] ? usbdev_open+0xa7/0x760 [ 2341.362583][ T31] usbdev_open+0x16e/0x760 [ 2341.367055][ T31] ? __pfx_usbdev_open+0x10/0x10 [ 2341.372204][ T31] ? do_raw_spin_unlock+0x122/0x240 [ 2341.377559][ T31] chrdev_open+0x4c9/0x5e0 [ 2341.382167][ T31] ? __pfx_chrdev_open+0x10/0x10 [ 2341.387328][ T31] ? fsnotify_open_perm_and_set_mode+0x113/0x610 [ 2341.394565][ T31] ? __pfx_chrdev_open+0x10/0x10 [ 2341.399650][ T31] do_dentry_open+0x950/0x13f0 [ 2341.404475][ T31] vfs_open+0x3b/0x340 [ 2341.408750][ T31] ? path_openat+0x2ecd/0x3830 [ 2341.414243][ T31] path_openat+0x2ee5/0x3830 [ 2341.419002][ T31] ? arch_stack_walk+0xfc/0x150 [ 2341.424263][ T31] ? stack_depot_save_flags+0x40/0x860 [ 2341.430031][ T31] ? __pfx_path_openat+0x10/0x10 [ 2341.435153][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2341.441587][ T31] do_filp_open+0x1fa/0x410 [ 2341.446136][ T31] ? __lock_acquire+0xab9/0xd20 [ 2341.451573][ T31] ? __pfx_do_filp_open+0x10/0x10 [ 2341.456677][ T31] ? _raw_spin_unlock+0x28/0x50 [ 2341.461739][ T31] ? alloc_fd+0x64c/0x6c0 [ 2341.466117][ T31] do_sys_openat2+0x121/0x1c0 [ 2341.470932][ T31] ? __se_sys_futex+0x36f/0x400 [ 2341.475842][ T31] ? __pfx_do_sys_openat2+0x10/0x10 [ 2341.481401][ T31] ? rcu_is_watching+0x15/0xb0 [ 2341.486218][ T31] __x64_sys_openat+0x138/0x170 [ 2341.491275][ T31] do_syscall_64+0xfa/0x3b0 [ 2341.496368][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 2341.499765][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2341.501972][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2341.508750][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 2341.514685][ T31] ? clear_bhb_loop+0x60/0xb0 [ 2341.526408][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2341.533466][ T31] RIP: 0033:0x7f1a87f8d550 [ 2341.538090][ T31] RSP: 002b:00007f1a88d2bb70 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 [ 2341.546718][ T31] RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007f1a87f8d550 [ 2341.554948][ T31] RDX: 0000000000000002 RSI: 00007f1a88d2bc10 RDI: 00000000ffffff9c [ 2341.563619][ T31] RBP: 00007f1a88d2bc10 R08: 0000000000000000 R09: 0000000000000000 [ 2341.572007][ T31] R10: 0000000000000000 R11: 0000000000000293 R12: cccccccccccccccd [ 2341.580134][ T31] R13: 00007f1a881c6038 R14: 00007f1a881c5fa0 R15: 00007f1a882efa28 [ 2341.588413][ T31] [ 2341.591828][ T31] [ 2341.591828][ T31] Showing all locks held in the system: [ 2341.600951][ T31] 1 lock held by ksoftirqd/1/23: [ 2341.606250][ T31] 1 lock held by khungtaskd/31: [ 2341.615350][ T31] #0: ffffffff8e139f20 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 2341.625695][ T31] 1 lock held by klogd/5225: [ 2341.633765][ T31] #0: ffff8880b8639f98 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0xad/0x140 [ 2341.644884][ T31] 2 locks held by getty/5640: [ 2341.652013][ T31] #0: ffff8880333a00a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 2341.662322][ T31] #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 [ 2341.673016][ T31] 5 locks held by kworker/1:8/15697: [ 2341.678344][ T31] #0: ffff888021adc548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 2341.689795][ T31] #1: ffffc9000437fbc0 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 2341.702441][ T31] #2: ffff888027b0b198 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4a20 [ 2341.711533][ T31] #3: ffff88807881f198 (&dev->mutex){....}-{4:4}, at: usb_disconnect+0xf8/0x950 [ 2341.720830][ T31] #4: ffff88806c409160 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb6/0x800 [ 2341.731751][ T31] 1 lock held by syz.6.9446/4277: [ 2341.736822][ T31] #0: ffff888027b0b198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x16e/0x760 [ 2341.746062][ T31] [ 2341.748427][ T31] ============================================= [ 2341.748427][ T31] [ 2341.758033][ T31] NMI backtrace for cpu 1 [ 2341.758047][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 2341.758064][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 2341.758074][ T31] Call Trace: [ 2341.758080][ T31] [ 2341.758087][ T31] dump_stack_lvl+0x189/0x250 [ 2341.758112][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 2341.758129][ T31] ? __pfx__printk+0x10/0x10 [ 2341.758161][ T31] nmi_cpu_backtrace+0x39e/0x3d0 [ 2341.758185][ T31] ? __pfx_nmi_cpu_backtrace+0x10/0x10 [ 2341.758208][ T31] ? __pfx__printk+0x10/0x10 [ 2341.758232][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 2341.758257][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 2341.758281][ T31] watchdog+0xf93/0xfe0 [ 2341.758305][ T31] ? watchdog+0x1de/0xfe0 [ 2341.758330][ T31] kthread+0x70e/0x8a0 [ 2341.758351][ T31] ? __pfx_watchdog+0x10/0x10 [ 2341.758371][ T31] ? __pfx_kthread+0x10/0x10 [ 2341.758390][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 2341.758413][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 2341.758426][ T31] ? __pfx_kthread+0x10/0x10 [ 2341.758445][ T31] ret_from_fork+0x3fc/0x770 [ 2341.758462][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 2341.758482][ T31] ? __switch_to_asm+0x39/0x70 [ 2341.758500][ T31] ? __switch_to_asm+0x33/0x70 [ 2341.758518][ T31] ? __pfx_kthread+0x10/0x10 [ 2341.758537][ T31] ret_from_fork_asm+0x1a/0x30 [ 2341.758567][ T31] [ 2341.758573][ T31] Sending NMI from CPU 1 to CPUs 0: [ 2341.906914][ C0] NMI backtrace for cpu 0 [ 2341.906934][ C0] CPU: 0 UID: 0 PID: 4478 Comm: kworker/u8:22 Not tainted syzkaller #0 PREEMPT(full) [ 2341.906955][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 2341.906968][ C0] Workqueue: bat_events batadv_nc_worker [ 2341.906999][ C0] RIP: 0010:__lock_acquire+0xa4f/0xd20 [ 2341.907027][ C0] Code: e5 ff 90 0f 0b 90 90 90 31 c0 48 8b 3c 24 48 83 78 40 00 0f 84 8c 02 00 00 41 8b 46 20 25 ff 1f 00 00 48 0f a3 05 21 08 0b 12 <73> 10 48 69 c0 c8 00 00 00 48 8d 80 10 73 49 93 eb 40 83 3d 88 97 [ 2341.907043][ C0] RSP: 0018:ffffc9000a8cf8f0 EFLAGS: 00000003 [ 2341.907058][ C0] RAX: 0000000000000007 RBX: 0000000000000002 RCX: 000000003cb19ffd [ 2341.907070][ C0] RDX: 0000000048dd1c3c RSI: 00000000189d2709 RDI: ffff88806cd01e00 [ 2341.907083][ C0] RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff8b47a5a2 [ 2341.907094][ C0] R10: dffffc0000000000 R11: fffffbfff1f473e7 R12: 00000000e9591a06 [ 2341.907107][ C0] R13: ffff88806cd028f0 R14: ffff88806cd02940 R15: 444d79323cb19ffd [ 2341.907121][ C0] FS: 0000000000000000(0000) GS:ffff888125c15000(0000) knlGS:0000000000000000 [ 2341.907136][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2341.907148][ C0] CR2: 000055557748f5c8 CR3: 0000000064a98000 CR4: 00000000003526f0 [ 2341.907164][ C0] Call Trace: [ 2341.907171][ C0] [ 2341.907182][ C0] ? batadv_nc_worker+0xd2/0x610 [ 2341.907215][ C0] lock_acquire+0x120/0x360 [ 2341.907240][ C0] ? batadv_nc_worker+0xd2/0x610 [ 2341.907268][ C0] ? batadv_nc_worker+0xd2/0x610 [ 2341.907292][ C0] ? batadv_nc_worker+0xd2/0x610 [ 2341.907316][ C0] batadv_nc_worker+0xef/0x610 [ 2341.907340][ C0] ? batadv_nc_worker+0xd2/0x610 [ 2341.907365][ C0] ? process_scheduled_works+0x9ef/0x17b0 [ 2341.907384][ C0] process_scheduled_works+0xae1/0x17b0 [ 2341.907412][ C0] ? __pfx_process_scheduled_works+0x10/0x10 [ 2341.907437][ C0] worker_thread+0x8a0/0xda0 [ 2341.907466][ C0] kthread+0x70e/0x8a0 [ 2341.907488][ C0] ? __pfx_worker_thread+0x10/0x10 [ 2341.907505][ C0] ? __pfx_kthread+0x10/0x10 [ 2341.907527][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 2341.907554][ C0] ? lockdep_hardirqs_on+0x9c/0x150 [ 2341.907570][ C0] ? __pfx_kthread+0x10/0x10 [ 2341.907596][ C0] ret_from_fork+0x3fc/0x770 [ 2341.907615][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 2341.907634][ C0] ? __switch_to_asm+0x39/0x70 [ 2341.907658][ C0] ? __switch_to_asm+0x33/0x70 [ 2341.907679][ C0] ? __pfx_kthread+0x10/0x10 [ 2341.907700][ C0] ret_from_fork_asm+0x1a/0x30 [ 2341.907730][ C0] [ 2341.934750][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 2341.934777][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 2341.934807][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 2341.934824][ T31] Call Trace: [ 2341.934835][ T31] [ 2341.934846][ T31] dump_stack_lvl+0x99/0x250 [ 2341.934882][ T31] ? __asan_memcpy+0x40/0x70 [ 2341.934911][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 2341.934951][ T31] ? __pfx__printk+0x10/0x10 [ 2341.935000][ T31] vpanic+0x281/0x750 [ 2341.935033][ T31] ? __pfx_vpanic+0x10/0x10 [ 2341.935061][ T31] ? __x2apic_send_IPI_mask+0x1e4/0x260 [ 2341.935093][ T31] ? preempt_schedule+0xae/0xc0 [ 2341.935133][ T31] ? preempt_schedule_common+0x83/0xd0 [ 2341.935161][ T31] panic+0xb9/0xc0 [ 2341.935188][ T31] ? __pfx_panic+0x10/0x10 [ 2341.935216][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 2341.935256][ T31] ? nmi_trigger_cpumask_backtrace+0x2bb/0x300 [ 2341.935292][ T31] watchdog+0xfd2/0xfe0 [ 2341.935330][ T31] ? watchdog+0x1de/0xfe0 [ 2341.935368][ T31] kthread+0x70e/0x8a0 [ 2341.935403][ T31] ? __pfx_watchdog+0x10/0x10 [ 2341.935434][ T31] ? __pfx_kthread+0x10/0x10 [ 2341.935467][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 2341.935503][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 2341.935524][ T31] ? __pfx_kthread+0x10/0x10 [ 2341.935554][ T31] ret_from_fork+0x3fc/0x770 [ 2341.935584][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 2341.935615][ T31] ? __switch_to_asm+0x39/0x70 [ 2341.935645][ T31] ? __switch_to_asm+0x33/0x70 [ 2341.935674][ T31] ? __pfx_kthread+0x10/0x10 [ 2341.935706][ T31] ret_from_fork_asm+0x1a/0x30 [ 2341.935754][ T31] [ 2342.321715][ T31] Kernel Offset: disabled [ 2342.326069][ T31] Rebooting in 86400 seconds..