last executing test programs: 4m58.039880815s ago: executing program 1 (id=823): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa02, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x12, r0, 0x45809000) r1 = add_key$keyring(&(0x7f0000000080), &(0x7f00000000c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd) add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, r1) r2 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_DEL_MIF(r2, 0x29, 0xc8, 0x0, 0xc000000) unshare(0x6020400) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000400)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581", @ANYRES8], 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io(r3, &(0x7f0000000b00)={0x2c, &(0x7f0000000040)=ANY=[@ANYBLOB="00000f00000009003d"], 0x0, 0x0, 0x0, 0x0}, 0x0) r4 = syz_open_dev$hiddev(&(0x7f0000000080), 0x0, 0x402001) ioctl$HIDIOCSREPORT(r4, 0x400c4808, &(0x7f00000001c0)={0x2, 0x200, 0x7f}) setsockopt$MRT6_ADD_MFC(r2, 0x29, 0xcc, 0x0, 0x0) setsockopt$MRT6_ADD_MFC_PROXY(r2, 0x29, 0xd2, &(0x7f0000000300)={{0xa, 0x0, 0x0, @loopback}, {0xa, 0x0, 0x0, @mcast2}, 0x1}, 0x5c) 4m54.957656667s ago: executing program 1 (id=848): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000100), 0x80000, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="60000000020605000000000000000000070000001400078008001140000000000800124000000c8f0500010006000000050005000200000005000400000000000900020073797a310000000014000300686173683a69702c706f72742c6970"], 0x60}}, 0x2404c024) (async) r2 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x20) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x12, r0, 0x45809000) (async) r3 = syz_kvm_add_vcpu$x86(0x0, &(0x7f00000001c0)={0x0, &(0x7f0000000240)=[@uexit={0x0, 0x18, 0x100000000}, @uexit={0x0, 0x18, 0xcf}, @code={0x1, 0x4e, {"65f30f1044900466b809010f00d066ba610066edda190f785606b9f80b0000b80e000000ba000000000f300f32c461b1fb4301410f01f264660fc5ce00"}}, @uexit={0x0, 0x18, 0x10001}, @cpuid={0x2, 0x18, {0xfa0e, 0xfffffff7}}, @cpuid={0x2, 0x18, {0x5e, 0x1}}, @uexit={0x0, 0x18, 0x8}, @code={0x1, 0x6e, {"c442e999a6a100000066bad104ed2e430f0866ba210066b8000066ef0f20e035000200000f22e0c4237915670f63260fc7ae00600000b8010000000f01d9c74424000d000000c744240235000000c7442406000000000f011c240f01c2"}}, @uexit={0x0, 0x18, 0xfffffffffffffc00}], 0x164}) ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f00000003c0)=0x1) (async, rerun: 32) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x80, 0x0) (rerun: 32) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000180)={'bridge_slave_1\x00', 0x400}) r5 = syz_open_procfs(0x0, &(0x7f0000002180)='net/mcfilter\x00') preadv(r5, &(0x7f0000001b80)=[{&(0x7f0000000440)=""/87, 0x57}, {&(0x7f0000000500)=""/101, 0x65}], 0x2, 0x0, 0x400) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x48) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2125099, 0x0) (async) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x300a000, 0x0) (async) mount$bind(0x0, &(0x7f0000000400)='./file0\x00', 0x0, 0x80000, 0x0) (async) mbind(&(0x7f0000836000/0x3000)=nil, 0x3000, 0x4000, &(0x7f00000004c0)=0xa7, 0x0, 0x0) (async) ioctl$KVM_SET_SREGS(r6, 0x4138ae84, &(0x7f0000000600)={{0x10000, 0xd000, 0xb, 0x5, 0xff, 0x60, 0x1, 0x1, 0x8, 0x6, 0xe, 0x3}, {0x5000, 0x1, 0x9, 0x0, 0x3, 0x3, 0x1, 0x5, 0x1, 0x8, 0x6, 0x3}, {0x2000, 0xf000, 0x0, 0x61, 0x8, 0x5, 0xfb, 0xf, 0x9, 0x1, 0x7, 0x10}, {0xdddd0000, 0x0, 0x8, 0x3, 0x6, 0xb, 0x4, 0x9, 0x4, 0x10, 0xc, 0x4}, {0xf000, 0xeeee8000, 0xf, 0x7, 0x1, 0x1, 0xe, 0x4, 0x4, 0x2, 0x10}, {0xffff1000, 0x8080000, 0xe, 0x3, 0x8, 0x7, 0xc, 0x8, 0x5, 0x6f, 0xc, 0x8}, {0xeeee8000, 0x10000, 0x0, 0x2, 0x3, 0x3, 0x0, 0x7, 0xef, 0x6, 0x8e, 0x7}, {0x2, 0x2000, 0x0, 0x7, 0x7, 0x5, 0x5e, 0x5, 0x9, 0x6, 0x9, 0x1}, {0x8080000, 0x7}, {0xdddd1000, 0x24}, 0x8000, 0x0, 0xeeee0000, 0x15, 0xf, 0xc800, 0xdddd0000, [0x10000, 0x9, 0xa072, 0xce]}) (async, rerun: 32) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000200), 0x416d, 0x0) (rerun: 32) getsockopt$EBT_SO_GET_INIT_INFO(r5, 0x0, 0x82, &(0x7f0000000040)={'filter\x00', 0x0, 0x0, 0x0, [0x1, 0x1, 0x7, 0x52b0, 0xffffffff, 0xfffffffffffffff7]}, &(0x7f00000000c0)=0x78) (async) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) (async) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) (async) mlock2(&(0x7f00002e5000/0xc00000)=nil, 0xc00000, 0x0) 4m54.627146731s ago: executing program 1 (id=849): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x125a80, 0x0) r1 = openat$ptp0(0xffffff9c, &(0x7f0000000240), 0x2642, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r2, 0x29, 0x3c, &(0x7f0000311ffc)=0x1, 0x4) setsockopt$sock_int(r2, 0x1, 0x1d, &(0x7f0000000000)=0x202, 0x4) r3 = socket$can_raw(0x1d, 0x3, 0x1) getsockopt$CAN_RAW_LOOPBACK(r3, 0x65, 0x3, &(0x7f0000000040), &(0x7f0000000080)=0x4) setsockopt$inet6_buf(r2, 0x29, 0x3e, &(0x7f00002cef88)="d84f7398", 0x4) sendto$inet6(r2, &(0x7f0000001380)="51e251578851f74182a74b89b27df427aeef44966d202e4138b5a18e75a0424e7fe93b0d32c7abba87b65f97aba1c26a06b6d94c4aefd8fdca10e744391062c8e612721c20051608d9aa6dace61e1eb331a4daad402b9885599d56130f7149fb1111fa116e94324d585a0569fbd311dad54cb4e32ff7f02216844ef42eeb66c3d526c878d5135ad1c9262239339c18885e2a0a95854d6cde3dd2feeaa50216af6c5760923413af81199a65a6332b02ec7bbf79d557c033cbe032fdc44f66a5c59cc4a3c5d218f5896b359d1efd60baf98df6396567478f7b817ce6e11d59a7def452a068e9607f57f626a5b8d476636ef1ee76307524009ae49be402000000000000001e80fed632155e14da1f7324d97bc61a3c1edc4431ee8a6caa2ed9f85cea5a2a9b2d3630c7d6fc35dda6002da571a2e59821751efa9f393b1a608147e408074c7c5f444fab931bda86d977d7c9ccefd881e5ef05b287f41eea526862885881c2cdc687dff02ba9b70a9b08734ac4d62c7f34465c34aa9e9f136c7f796d9eea41aa37f61830508338bb1f887089070567a1dd96cd700e7a098dabedb60f31acd17d487bc8be1a3101d2b5ac1715003793596c6daa93a27f4adb4d6fbea5669cc43c320544317ea18a2c762457f1bc945fec8f849641d44e7e2a24faeee28f3f266395fe18b0dce20c1f64e8896c8ff0e4a44a116fb32462471a0fcde143e551723d57339722765673b4163d66f473ac10f988cb252f106632f9884a47866d284b4efc6bb1aa74ed48d4a6535795f0873a99907ebc22be2337364cf9acc063e32f7d2e02fad64d04aa405d2dbdee1128ab1e4761d2dd30885ad37dd168478f10789d172feef4c817a5cd372caade57f23300e45f47e001e3ea09364ab42ee9802477368b9910f4e24037c871cb8251568c792287a6f49fa61b7c2600accaa0e7b40c59d88a29af5886c1f5dfc6837c58aaef12a9e100225c70441144ffa82927fa4802ed9ebb03eea8e945af5f4993f21a7f53baf7ec5bb6cc96b917dde82c18840c3500e9565f68f687b1c73d834c0d99d4acb002dc5682dbcdb1217a81f6c3ef8318b7fa93894e8a097b4511ba5c035e27c9fe8bfe7754741ac21bbc0303b81672e3117e5590fe2d92f912759b9937f64204ec5caa92e218daa5a3ef64617beb30cccb31016b13ed8d7bcabb03e176b1c9bda3bf1c1256ab74ab6f42ed9bafbbd0096263be1a7da1e1c88deec55a653d170e1e13c77dacaa60a37a6ba2383e661ebc9f13dbaade2dd884c9951819fb4608e19e70cd2496ccfb12f24c71f496cfe90400fe1bbea1e9a24b1d4664fb0776aca6269b396779680e52f86877d9209988d12ccb137be01ab7496d00547a7d4849d365a18dbb55c429cde87d33c4b74ad2273cdfee88b5418866ef327f25e9cbcd5a64d97184339f7e4cb5f8de171d2779c0f68884ae835e398f982d5749f085628d3608986656ea04b721f828202e9342bd7d19dfa091e772aebf9718030167a8c029df7c58b7f40029d7cfcaf26fd1900d8775ef373e8e2c5bf3525f907add3be426cd5a079c49abffe933e9ee213a3baf34f932d1299312691e1c53e6247ae0989ad66070d51fad22856a8b6b28954e7d41189b11c5321789eec8670de9e8db0b0473ba2e02731e60e7222697d61e052c18d4bcc6d1572fdf426f7b2fee6c1dee66c85c497b90facaf63b8ec5cde4a73400f9180bcfc0f81eca9580a7c81462a077f9034026bf72aa7c6de4b3c15d4a2dbd6fd7d87084aea9f25fb4bf5ec83eb56874a760533792dff2695407ccdd6a7375e0007230fd3f6501c152f1c1ff279b1d67cc95f2820762b7927659368e41657bdef2dd15b63498a93b7884db26809d734aaf98b86fcf9fc643a34d03ebbe072820662d20d4774d66c5ae270adade5b8f6242a059b926221ee3d677487471c432b0d6d64dad030703475bb3ecac3909750f46a9a8e76a13264ed2b654b9a6eb1809", 0x587, 0x0, &(0x7f0000000180)={0xa, 0x5e64, 0x100000, @mcast2, 0x4}, 0x1c) recvmmsg(r2, &(0x7f00000000c0)=[{{0x0, 0xfffffffffffffd15, 0x0, 0xfffffffffffffe5d, 0x0, 0xffffffffffffff9f}, 0xfffffffe}], 0x1, 0x0, 0x0) ioctl$PTP_EXTTS_REQUEST2(r1, 0x40103d0b, 0x0) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) sendfile(r4, r0, 0x0, 0xfffc) 4m54.473765941s ago: executing program 1 (id=850): mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x1) (async) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f0000006300)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000000040)={0x50, 0x0, r1, {0x7, 0x1f, 0x20000000, 0x4041}}, 0x50) (async) r2 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) sendto$netrom(r2, 0x0, 0x0, 0x0, 0x0, 0x0) syz_fuse_handle_req(r0, &(0x7f00000021c0)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003dc150f4000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d90000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = syz_init_net_socket$x25(0x9, 0x5, 0x0) connect$x25(r3, &(0x7f0000000000)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x3, 0x2}}, 0x12) (async) r4 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x80101, 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) (async) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x2, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000300)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r5 = syz_open_dev$loop(&(0x7f0000000000), 0x4, 0x2080) ioctl$LOOP_SET_FD(r5, 0x4c00, r4) dup2(r4, r0) flock(r0, 0x6) (async) mount(&(0x7f0000000100)=@nullb, &(0x7f00000000c0)='./cgroup\x00', &(0x7f0000000040)='binfmt_misc\x00', 0x1238017, 0x0) 4m54.229190401s ago: executing program 1 (id=851): r0 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x1c280) ioctl$I2C_RDWR(r0, 0x707, &(0x7f00000001c0)={&(0x7f0000000180)=[{0xe4, 0x0, 0x10, &(0x7f0000000040)="e225c1975504d8f4c9ac177abbf6ffcd"}, {0x6, 0x0, 0xf3, &(0x7f0000000080)="6ff52fc8e50c4772c1025a62939e81046e5a191d19c591e59e977d6a7c1d30b88317903663af2482862e770ffa5701de3f51864b6e8798bae59cc793c543584ee2c8f91ba5ad37a30bd0d1835b37d12c21e480be41f4aed9e20104da673d0511bab0b9aab96bb4a65b29811199851b39cd577270d0c6973ad0b2a9856e58dd36484b331a2b9debb23b541a90f7afde6a4467538a4e091ce622684bf1aa162e811a2eafc9335301e36427b92b4ce20a326aab5e2a04f4f5bf3887f5d2f6429b76507b448bc04b7d3b3d4175ee9bfee8f79bc8868d13a37109ef5cbc41205366d2ca0ff225733a7a8b38d915f01f98f91ba4e113"}], 0x2}) r1 = socket$inet(0x2, 0xa, 0xf8) connect$inet(r1, &(0x7f0000000200)={0x2, 0x4e23, @remote}, 0x10) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r2, 0x4010640d, &(0x7f0000000240)={0x1}) setsockopt$EBT_SO_SET_COUNTERS(r1, 0x0, 0x81, &(0x7f0000000300)={'broute\x00', 0x0, 0x0, 0x0, [0x10001, 0xfffffffffffffff8, 0x100000001, 0x8000000000000001, 0x7, 0x2], 0x9, &(0x7f0000000280)=[{}, {}, {}, {}, {}], 0x0, [{}, {}, {}, {}, {}, {}, {}, {}, {}]}, 0x108) connect$inet(r1, &(0x7f0000000440)={0x2, 0x4e24, @remote}, 0x10) setsockopt$inet_sctp_SCTP_RECVRCVINFO(r1, 0x84, 0x20, &(0x7f0000000480)=0xdacf, 0x4) syz_clone(0x2a00280, &(0x7f00000004c0)="2453312ef1452b0f4bcbf36d63bc57c29ba2b01fe1cf9a17afc4cb80cb9a7e6c88c75df996", 0x25, &(0x7f0000000500), &(0x7f0000000540), &(0x7f0000000580)="517a8bd8dc623ad0f8e5ccd7fbfd2cd291e464b401fa9e7462a95fe0ebc2c9157933c09d690f86a24b12cbff97306b2a2f7e98878e04844d88173eb0") getsockopt$EBT_SO_GET_INIT_INFO(r1, 0x0, 0x82, &(0x7f00000005c0)={'filter\x00', 0x0, 0x0, 0x0, [0xd6be, 0x9, 0x5, 0x100, 0x100, 0x1]}, &(0x7f0000000640)=0x78) r3 = socket$inet_smc(0x2b, 0x1, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp_SCTP_STATUS(r0, 0x84, 0xe, &(0x7f0000000680)={0x0, 0xfffffffa, 0x200, 0x2, 0x2, 0x8000, 0x7, 0x5, {0x0, @in={{0x2, 0x4e24, @private=0xa010100}}, 0x40, 0x4, 0x4, 0x1, 0x4}}, &(0x7f0000000740)=0xb0) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r4, 0x84, 0x76, &(0x7f0000000780)={r5, 0xfe}, 0x8) socket$inet6_udplite(0xa, 0x2, 0x88) socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r6, 0x84, 0x7b, &(0x7f00000007c0)={r5, 0x4}, &(0x7f0000000800)=0x8) mount(&(0x7f0000000840)=@sg0, &(0x7f0000000880)='./file0\x00', &(0x7f00000008c0)='rootfs\x00', 0x1000000, &(0x7f0000000900)='broute\x00') r7 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000940), 0xca03, 0x0) r8 = accept4$inet(r3, &(0x7f0000000980)={0x2, 0x0, @loopback}, &(0x7f00000009c0)=0x10, 0x0) setsockopt$inet_mreqsrc(r8, 0x0, 0x1, &(0x7f0000000a00)={@private=0xa010101, @initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010102}, 0xc) close(r6) socket$inet_udp(0x2, 0x2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r7, 0xc01064c1, &(0x7f0000000a40)={0x0, 0x0, 0xffffffffffffffff}) close_range(r9, r2, 0x0) socket$inet(0x2, 0x80806, 0x4) socket$inet6(0xa, 0x80000, 0x2) 4m53.652658241s ago: executing program 1 (id=855): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000000280)) madvise(&(0x7f0000ab0000/0x4000)=nil, 0x4000, 0xc) socket$inet6(0xa, 0x3, 0x3a) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000280)={0x26, 'hash\x00', 0x0, 0x0, 'blake2b-384-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000040)="cbb53a4e", 0x4) r3 = accept4(r2, 0x0, 0x0, 0x800) recvfrom$inet(r3, 0x0, 0x0, 0x40000020, 0x0, 0x0) r4 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="020086dd0300000000001400000060ec970012302c00fe8000000000000000000000000000aaff0200000000000000000000000000013a"], 0xfdef) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, &(0x7f0000000300)='usrquota') chdir(&(0x7f0000000080)='./file1\x00') r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='net_prio.prioidx\x00', 0x275a, 0x0) quotactl_fd$Q_SETINFO(r5, 0xffffffff80000601, 0x0, &(0x7f0000000180)={0x0, 0x2c, 0x1, 0x4}) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r6, 0x84, 0x1a, &(0x7f0000000100), &(0x7f00000001c0)=0x8) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x14) mount$afs(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='dyn']) chdir(&(0x7f0000000080)='./file0\x00') mount$nfs(&(0x7f00000001c0)='>/.4\x8e\xc5\x16+\xec\xf6\bP\xca.v%\x05k\xa9\xcb\x00.\xa1\x82\xb5F\x03\xb8\x04\xd6%\x91-a\xb2\xd5\x00\xe5\xa5V8\x16sd@F\r\xb2Y\x8b!r~\xc1\x02\xee,\x93\a\xa2{}h\xaa\xc1e\xc0\x8e\xf4;\x7f\x90\\\'\xc3\r\x9a\x8d\x1d\x86\xff\x03\x973hr\xa3\"w\xf2\xea\xff\xb2\xe3\x9c\x81-\x92\x85\xa4\xf8\'\xc7\x11\xf4\x19\xa0\x1c\x03\x14\xc4P\\\x95h\xb5\x9b\xa3\x1fG5+\x84\xc3(\'\tCA6^)\xa73\xa4|\x04\x84\x03\xadQ\xd1\xf8\xea8\\\x97{F4\xdc\x99)b\xdb.\x9b\xfd2e{#\x8d\xaa\x00\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000140)='./file0\x00', 0x0, 0x2000, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BTRFS_IOC_QGROUP_CREATE(r5, 0x4010942a, &(0x7f00000000c0)={0x1, 0x1}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x22052, r0, 0x2000) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000100)={'ip6tnl0\x00', 0x4000}) 4m53.240097318s ago: executing program 32 (id=855): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000000280)) madvise(&(0x7f0000ab0000/0x4000)=nil, 0x4000, 0xc) socket$inet6(0xa, 0x3, 0x3a) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000280)={0x26, 'hash\x00', 0x0, 0x0, 'blake2b-384-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000040)="cbb53a4e", 0x4) r3 = accept4(r2, 0x0, 0x0, 0x800) recvfrom$inet(r3, 0x0, 0x0, 0x40000020, 0x0, 0x0) r4 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="020086dd0300000000001400000060ec970012302c00fe8000000000000000000000000000aaff0200000000000000000000000000013a"], 0xfdef) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, &(0x7f0000000300)='usrquota') chdir(&(0x7f0000000080)='./file1\x00') r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='net_prio.prioidx\x00', 0x275a, 0x0) quotactl_fd$Q_SETINFO(r5, 0xffffffff80000601, 0x0, &(0x7f0000000180)={0x0, 0x2c, 0x1, 0x4}) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r6, 0x84, 0x1a, &(0x7f0000000100), &(0x7f00000001c0)=0x8) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x14) mount$afs(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='dyn']) chdir(&(0x7f0000000080)='./file0\x00') mount$nfs(&(0x7f00000001c0)='>/.4\x8e\xc5\x16+\xec\xf6\bP\xca.v%\x05k\xa9\xcb\x00.\xa1\x82\xb5F\x03\xb8\x04\xd6%\x91-a\xb2\xd5\x00\xe5\xa5V8\x16sd@F\r\xb2Y\x8b!r~\xc1\x02\xee,\x93\a\xa2{}h\xaa\xc1e\xc0\x8e\xf4;\x7f\x90\\\'\xc3\r\x9a\x8d\x1d\x86\xff\x03\x973hr\xa3\"w\xf2\xea\xff\xb2\xe3\x9c\x81-\x92\x85\xa4\xf8\'\xc7\x11\xf4\x19\xa0\x1c\x03\x14\xc4P\\\x95h\xb5\x9b\xa3\x1fG5+\x84\xc3(\'\tCA6^)\xa73\xa4|\x04\x84\x03\xadQ\xd1\xf8\xea8\\\x97{F4\xdc\x99)b\xdb.\x9b\xfd2e{#\x8d\xaa\x00\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000140)='./file0\x00', 0x0, 0x2000, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BTRFS_IOC_QGROUP_CREATE(r5, 0x4010942a, &(0x7f00000000c0)={0x1, 0x1}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x22052, r0, 0x2000) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000100)={'ip6tnl0\x00', 0x4000}) 2m50.220024277s ago: executing program 0 (id=1492): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000e00), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000e40)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_GET_SCAN(r1, &(0x7f0000000f00)={0x0, 0x0, &(0x7f0000000ec0)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="210f00000000000000002000000008000300", @ANYRES32=r3], 0x1c}}, 0x0) read(r1, &(0x7f0000000480)=""/84, 0x54) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) setfsgid(0xee00) r4 = syz_clone(0x2180, 0x0, 0x0, 0x0, 0x0, 0x0) r5 = syz_open_procfs(0x0, &(0x7f0000000480)='task\x00') fchdir(r5) mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000000)='proc\x00', 0x0, 0x0) futex(&(0x7f000000cffc), 0x80000000000b, 0x0, 0x0, &(0x7f0000048000), 0x0) r6 = syz_open_procfs(r4, &(0x7f0000000280)='stat\x00') pread64(r6, &(0x7f0000000500)=""/31, 0x1f, 0x40000000009) r7 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_WOL_SET(r8, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000019640)={0x2c, r9, 0x1, 0x70bd2c, 0x25dfdbfd, {}, [@ETHTOOL_A_WOL_MODES={0x4}, @ETHTOOL_A_WOL_MODES={0x14, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x15}, @ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_NOMASK={0x4}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8000}, 0x8000) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r10, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="50000000020601080000000000000000000000080c00078008000640200000000500010006000000050005000a00000005000400000000000900020073797a31000000000c000300686173683a6970"], 0x50}}, 0x20040000) r11 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) r12 = dup(r11) ioctl$KVM_SET_MSRS(r12, 0x4048aecb, &(0x7f00000000c0)=ANY=[@ANYRES64=r0]) mount(&(0x7f0000000080)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000240)='hfs\x00', 0x2208080, 0x0) 2m49.247174874s ago: executing program 0 (id=1502): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) brk(0x9) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x22052, r0, 0x2000) sendmsg$inet6(0xffffffffffffffff, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000940)}, 0x40) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000006600), 0x0, 0x0) ioctl$TIOCSSOFTCAR(r1, 0x5453, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) mremap(&(0x7f000051e000/0x2000)=nil, 0x2000, 0x1000, 0x3, &(0x7f0000ffe000/0x1000)=nil) socket$nl_xfrm(0x10, 0x3, 0x6) 2m48.681784595s ago: executing program 0 (id=1504): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000640), 0xffffffffffffffff) inotify_init() sendmsg$DEVLINK_CMD_RATE_SET(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000c40)={0x34, r1, 0x1, 0x0, 0x0, {0x2c}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}}, 0x8040) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000787000/0x2000)=nil, 0x2000, &(0x7f00000003c0)='+++\x00') mremap(&(0x7f0000786000/0x3000)=nil, 0x3000, 0x4000, 0x0, &(0x7f0000787000/0x4000)=nil) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) socket$inet(0x2, 0x2, 0x1) r5 = socket(0x23, 0x80000, 0x0) r6 = socket(0x10, 0x3, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x28}, 0x1, 0x0, 0x0, 0x20000040}, 0x8000000) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0xc, &(0x7f0000000100)={0x2ffc, 0x4000006, 0xfffffefc, 0x6}, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c000000160001f47efde4be701161000a000000040000800400", @ANYRES32=r5], 0x1c}}, 0x804) ioctl$KVM_X86_SET_MCE(r4, 0x4040ae9e, &(0x7f0000000080)={0x80000000000000, 0x5000, 0x0, 0x4, 0x1}) r7 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r8, 0x4048aecb, 0x0) ioctl$KVM_SET_CLOCK(r7, 0x4030ae7b, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x2, &(0x7f0000000000)=0x9, 0x8, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) msgctl$MSG_STAT(0x0, 0xb, &(0x7f0000000000)=""/180) mount(&(0x7f0000000080)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000240)='hfs\x00', 0x200000, 0x0) 2m47.907060757s ago: executing program 0 (id=1508): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000140)='/dev/comedi4\x00', 0x2, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000009, 0x13, r0, 0x0) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000012c0)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b0001000000010904000001faf40d000905820349"], 0x0) r3 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$int_in(r3, 0x5421, &(0x7f0000000100)=0x9) connect$inet(r3, &(0x7f0000000280)={0x2, 0x0, @dev}, 0x10) recvfrom(r3, 0x0, 0x0, 0x2001, 0x0, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x4e20, @rand_addr=0x64010100}, 0x10) syz_usb_control_io(r2, 0x0, 0x0) r4 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$EVIOCGMASK(r4, 0x8028c003, 0x0) r5 = socket$inet(0x2, 0x4000000000000001, 0x0) syz_usb_connect(0x0, 0x3f, &(0x7f0000000400)=ANY=[@ANYBLOB="1201000077f1c910720c0c0059f60102030109022d0001000000000904000003d3223a00090501"], 0x0) ioctl$sock_inet_udp_SIOCINQ(r5, 0x894b, &(0x7f00000000c0)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x22052, r1, 0x2000) 2m45.899481615s ago: executing program 0 (id=1517): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) (async, rerun: 32) mount$fuse(0x0, 0x0, 0x0, 0x2b38094, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) (async, rerun: 32) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') (async) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) (async) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000005c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='fd=', @ANYRESOCT=r0, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r1 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) ioctl$AUTOFS_IOC_PROTOSUBVER(r1, 0x40049366, &(0x7f0000000180)) (async) r2 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$sock_int(r2, 0x1, 0x8, 0x0, &(0x7f0000000200)) (async) mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000080)='./cgroup\x00', &(0x7f0000000040)='hpfs\x00', 0x0, 0x0) 2m45.01539851s ago: executing program 0 (id=1522): r0 = syz_open_dev$evdev(&(0x7f0000000040), 0xfffffffffffffffd, 0x208280) syz_usb_disconnect(r0) r1 = socket$inet_sctp(0x2, 0x5, 0x84) r2 = syz_usb_connect$printer(0x2, 0x36, &(0x7f00000001c0)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x10, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0xb, 0xa0, 0x2, [{{0x9, 0x4, 0x0, 0x6, 0x1, 0x7, 0x1, 0x1, 0x0, "", {{{0x9, 0x5, 0x1, 0x2, 0x8, 0x80, 0x6, 0x7}}, [{{0x9, 0x5, 0x82, 0x2, 0x400, 0x9, 0xb, 0x8}}]}}}]}}]}}, &(0x7f00000004c0)={0xa, &(0x7f0000000200)={0xa, 0x6, 0x110, 0xfc, 0x0, 0x9, 0x40, 0xa0}, 0xc5, &(0x7f00000005c0)={0x5, 0xf, 0xc5, 0x6, [@ss_container_id={0x14, 0x10, 0x4, 0x3, "a1a6d402df4b94443fa61136099afef4"}, @ext_cap={0x7, 0x10, 0x2, 0x6, 0x3, 0x7, 0x7}, @ssp_cap={0x10, 0x10, 0xa, 0xc, 0x1, 0x0, 0xf00, 0xf25, [0xc0f0]}, @generic={0x7e, 0x10, 0x3, "2603e5047a5b81c3c476d5cde7d8f4f885b561012c8c628ad7fceff5f66ed5f6601313ba9bc621cd1db8e0b520825cf0cd221d374f45ccedfd74685460b156ea2e0c50658d74798dff4db19f739a27a963c50f6d99c4c84d3c432288dc4914bc2fbbd4ff22ff401204ceeb01903db01b86303ee676ede13404da31"}, @ss_container_id={0x14, 0x10, 0x4, 0x1, "aadc7a210051f5dabd17905bfacba7fc"}, @ptm_cap={0x3}]}, 0x4, [{0x4, &(0x7f0000000280)=@lang_id={0x4, 0x3, 0x1007}}, {0x6e, &(0x7f0000000380)=@string={0x6e, 0x3, "76178355954a1b5680bae364edd8ea0d7ed1fa757dd5489ec1d8e5c8d139fdf657b7a5fd7d155a3d741021e93f589f5b0f61b0b49d61879bd2ac1aa141fa055513c06ce1f53a1ac2fc720db858ed562eb2d8adb12443730d2c186d4511e250ff958090290f0032b5970a7785"}}, {0x4, &(0x7f00000002c0)=@lang_id={0x4, 0x3, 0x413}}, {0x4, &(0x7f0000000400)=@lang_id={0x4, 0x3, 0x42b}}]}) syz_usb_control_io(r2, &(0x7f0000000900)={0x2c, &(0x7f00000006c0)={0x20, 0x1, 0xf5, {0xf5, 0x7, "0b99493166591e1be38c2097cb9b0129f929bdf09313e9146ac355256b3cc2815efe6799686faaf71c040f01fe51404bd965e398319a494aadce71195e160fa8c99f6f859d1e129617ac8c7ca4e62a295caac11ae35eeb6525f5efa6281760f1ec2e397a53cb47d7abf69b4ceaccf26c03bb2af1dc862c9d73c6090b0f1629c70a090c8a953439b4ce2cd40b40104fbf09842c722c56af70890571ca88807d0cdd97dc2a7eb39d9d788ab785c7d22a200b61dafc0c66312cd098bb01cac88251db76a4dcf9af699cf26a830d87ca3cf90d90b74c5e692360c9b1cc5b97f56d5cae2baa8d9c23f99595dab6df158148bd30d083"}}, &(0x7f00000007c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x807}}, &(0x7f0000000800)={0x0, 0xf, 0x57, {0x5, 0xf, 0x57, 0x5, [@ssp_cap={0x18, 0x10, 0xa, 0xa, 0x3, 0x400, 0xf000, 0x5, [0x0, 0x3f, 0x3fc0]}, @wireless={0xb, 0x10, 0x1, 0x8, 0x23, 0x6, 0x4, 0x6}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "5e665583992caab576e4fc5b29c16459"}, @ext_cap={0x7, 0x10, 0x2, 0x1a, 0x6, 0x4, 0x10a0}, @ss_container_id={0x14, 0x10, 0x4, 0x3d, "0e7316dca2626f73a63a8a30a44c4c20"}]}}, &(0x7f0000000880)={0x20, 0x29, 0xf, {0xf, 0x29, 0xd, 0x0, 0x2, 0x1, "75c01858", "b4f1f4a4"}}, &(0x7f00000008c0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x5, 0x8, 0x3, 0x0, 0xf, 0x5c5}}}, &(0x7f0000000d40)={0x84, &(0x7f0000000940)={0x40, 0x31, 0xb, "5a4ba7da2566bed0856cb7"}, &(0x7f0000000980)={0x0, 0xa, 0x1, 0x1}, &(0x7f00000009c0)={0x0, 0x8, 0x1, 0xfc}, &(0x7f0000000a00)={0x20, 0x0, 0x4, {0x2, 0x1}}, &(0x7f0000000a40)={0x20, 0x0, 0x4, {0x100, 0x4}}, &(0x7f0000000a80)={0x40, 0x7, 0x2, 0x6}, &(0x7f0000000ac0)={0x40, 0x9, 0x1, 0x9}, &(0x7f0000000b00)={0x40, 0xb, 0x2, "80ee"}, &(0x7f0000000b40)={0x40, 0xf, 0x2, 0x795}, &(0x7f0000000b80)={0x40, 0x13, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x17}}, &(0x7f0000000bc0)={0x40, 0x17, 0x6, @broadcast}, &(0x7f0000000c00)={0x40, 0x19, 0x2, "7aad"}, &(0x7f0000000c40)={0x40, 0x1a, 0x2, 0x9}, &(0x7f0000000c80)={0x40, 0x1c, 0x1, 0x2}, &(0x7f0000000cc0)={0x40, 0x1e, 0x1, 0x7e}, &(0x7f0000000d00)={0x40, 0x21, 0x1, 0x1b}}) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) futex(&(0x7f0000000000), 0x10b, 0x0, &(0x7f0000000040)={r3, r4+60000000}, &(0x7f0000000100), 0x0) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x0, @private=0xa010101}]}, &(0x7f0000000080)=0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000180)={'wlan1\x00'}) sendmsg$NL80211_CMD_REGISTER_FRAME(r6, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000040)={0x28, r8, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r9}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x4}, @NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0x40}]}, 0x28}}, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r5, 0x84, 0x1d, &(0x7f0000000140)={0x1, [0x0]}, &(0x7f0000000240)=0x8) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f0000000000)={0xfffb, 0x6, 0x201, 0x4, 0x3, 0x7, 0x0, 0x401, r10}, 0x20) r11 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$sock_int(r11, 0x1, 0x3c, &(0x7f00000001c0)=0x800, 0x4) r12 = add_key$keyring(&(0x7f0000000440), &(0x7f0000000480)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff) keyctl$update(0x2, r12, 0x0, 0x0) r13 = syz_usb_connect(0x6, 0x24, &(0x7f00000000c0)=ANY=[@ANYRES32=r7], 0x0) ioctl$EVIOCRMFF(r0, 0x550c, 0x0) syz_usb_control_io(r13, 0x0, 0x0) syz_usb_control_io$uac1(r13, 0x0, 0x0) syz_usb_control_io$uac1(r13, 0x0, 0x0) syz_usb_control_io$hid(r13, 0x0, 0x0) syz_usb_control_io(r13, 0x0, 0x0) syz_usb_control_io$printer(r13, 0x0, &(0x7f0000000540)={0x34, &(0x7f0000000300)=ANY=[@ANYBLOB="400f32906ff7"], 0x0, 0x0, &(0x7f0000000440)={0x20, 0x0, 0x2}, 0x0, 0x0}) 2m29.716698758s ago: executing program 33 (id=1522): r0 = syz_open_dev$evdev(&(0x7f0000000040), 0xfffffffffffffffd, 0x208280) syz_usb_disconnect(r0) r1 = socket$inet_sctp(0x2, 0x5, 0x84) r2 = syz_usb_connect$printer(0x2, 0x36, &(0x7f00000001c0)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x10, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0xb, 0xa0, 0x2, [{{0x9, 0x4, 0x0, 0x6, 0x1, 0x7, 0x1, 0x1, 0x0, "", {{{0x9, 0x5, 0x1, 0x2, 0x8, 0x80, 0x6, 0x7}}, [{{0x9, 0x5, 0x82, 0x2, 0x400, 0x9, 0xb, 0x8}}]}}}]}}]}}, &(0x7f00000004c0)={0xa, &(0x7f0000000200)={0xa, 0x6, 0x110, 0xfc, 0x0, 0x9, 0x40, 0xa0}, 0xc5, &(0x7f00000005c0)={0x5, 0xf, 0xc5, 0x6, [@ss_container_id={0x14, 0x10, 0x4, 0x3, "a1a6d402df4b94443fa61136099afef4"}, @ext_cap={0x7, 0x10, 0x2, 0x6, 0x3, 0x7, 0x7}, @ssp_cap={0x10, 0x10, 0xa, 0xc, 0x1, 0x0, 0xf00, 0xf25, [0xc0f0]}, @generic={0x7e, 0x10, 0x3, "2603e5047a5b81c3c476d5cde7d8f4f885b561012c8c628ad7fceff5f66ed5f6601313ba9bc621cd1db8e0b520825cf0cd221d374f45ccedfd74685460b156ea2e0c50658d74798dff4db19f739a27a963c50f6d99c4c84d3c432288dc4914bc2fbbd4ff22ff401204ceeb01903db01b86303ee676ede13404da31"}, @ss_container_id={0x14, 0x10, 0x4, 0x1, "aadc7a210051f5dabd17905bfacba7fc"}, @ptm_cap={0x3}]}, 0x4, [{0x4, &(0x7f0000000280)=@lang_id={0x4, 0x3, 0x1007}}, {0x6e, &(0x7f0000000380)=@string={0x6e, 0x3, "76178355954a1b5680bae364edd8ea0d7ed1fa757dd5489ec1d8e5c8d139fdf657b7a5fd7d155a3d741021e93f589f5b0f61b0b49d61879bd2ac1aa141fa055513c06ce1f53a1ac2fc720db858ed562eb2d8adb12443730d2c186d4511e250ff958090290f0032b5970a7785"}}, {0x4, &(0x7f00000002c0)=@lang_id={0x4, 0x3, 0x413}}, {0x4, &(0x7f0000000400)=@lang_id={0x4, 0x3, 0x42b}}]}) syz_usb_control_io(r2, &(0x7f0000000900)={0x2c, &(0x7f00000006c0)={0x20, 0x1, 0xf5, {0xf5, 0x7, "0b99493166591e1be38c2097cb9b0129f929bdf09313e9146ac355256b3cc2815efe6799686faaf71c040f01fe51404bd965e398319a494aadce71195e160fa8c99f6f859d1e129617ac8c7ca4e62a295caac11ae35eeb6525f5efa6281760f1ec2e397a53cb47d7abf69b4ceaccf26c03bb2af1dc862c9d73c6090b0f1629c70a090c8a953439b4ce2cd40b40104fbf09842c722c56af70890571ca88807d0cdd97dc2a7eb39d9d788ab785c7d22a200b61dafc0c66312cd098bb01cac88251db76a4dcf9af699cf26a830d87ca3cf90d90b74c5e692360c9b1cc5b97f56d5cae2baa8d9c23f99595dab6df158148bd30d083"}}, &(0x7f00000007c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x807}}, &(0x7f0000000800)={0x0, 0xf, 0x57, {0x5, 0xf, 0x57, 0x5, [@ssp_cap={0x18, 0x10, 0xa, 0xa, 0x3, 0x400, 0xf000, 0x5, [0x0, 0x3f, 0x3fc0]}, @wireless={0xb, 0x10, 0x1, 0x8, 0x23, 0x6, 0x4, 0x6}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "5e665583992caab576e4fc5b29c16459"}, @ext_cap={0x7, 0x10, 0x2, 0x1a, 0x6, 0x4, 0x10a0}, @ss_container_id={0x14, 0x10, 0x4, 0x3d, "0e7316dca2626f73a63a8a30a44c4c20"}]}}, &(0x7f0000000880)={0x20, 0x29, 0xf, {0xf, 0x29, 0xd, 0x0, 0x2, 0x1, "75c01858", "b4f1f4a4"}}, &(0x7f00000008c0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x5, 0x8, 0x3, 0x0, 0xf, 0x5c5}}}, &(0x7f0000000d40)={0x84, &(0x7f0000000940)={0x40, 0x31, 0xb, "5a4ba7da2566bed0856cb7"}, &(0x7f0000000980)={0x0, 0xa, 0x1, 0x1}, &(0x7f00000009c0)={0x0, 0x8, 0x1, 0xfc}, &(0x7f0000000a00)={0x20, 0x0, 0x4, {0x2, 0x1}}, &(0x7f0000000a40)={0x20, 0x0, 0x4, {0x100, 0x4}}, &(0x7f0000000a80)={0x40, 0x7, 0x2, 0x6}, &(0x7f0000000ac0)={0x40, 0x9, 0x1, 0x9}, &(0x7f0000000b00)={0x40, 0xb, 0x2, "80ee"}, &(0x7f0000000b40)={0x40, 0xf, 0x2, 0x795}, &(0x7f0000000b80)={0x40, 0x13, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x17}}, &(0x7f0000000bc0)={0x40, 0x17, 0x6, @broadcast}, &(0x7f0000000c00)={0x40, 0x19, 0x2, "7aad"}, &(0x7f0000000c40)={0x40, 0x1a, 0x2, 0x9}, &(0x7f0000000c80)={0x40, 0x1c, 0x1, 0x2}, &(0x7f0000000cc0)={0x40, 0x1e, 0x1, 0x7e}, &(0x7f0000000d00)={0x40, 0x21, 0x1, 0x1b}}) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) futex(&(0x7f0000000000), 0x10b, 0x0, &(0x7f0000000040)={r3, r4+60000000}, &(0x7f0000000100), 0x0) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x0, @private=0xa010101}]}, &(0x7f0000000080)=0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000180)={'wlan1\x00'}) sendmsg$NL80211_CMD_REGISTER_FRAME(r6, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000040)={0x28, r8, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r9}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x4}, @NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0x40}]}, 0x28}}, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r5, 0x84, 0x1d, &(0x7f0000000140)={0x1, [0x0]}, &(0x7f0000000240)=0x8) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f0000000000)={0xfffb, 0x6, 0x201, 0x4, 0x3, 0x7, 0x0, 0x401, r10}, 0x20) r11 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$sock_int(r11, 0x1, 0x3c, &(0x7f00000001c0)=0x800, 0x4) r12 = add_key$keyring(&(0x7f0000000440), &(0x7f0000000480)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff) keyctl$update(0x2, r12, 0x0, 0x0) r13 = syz_usb_connect(0x6, 0x24, &(0x7f00000000c0)=ANY=[@ANYRES32=r7], 0x0) ioctl$EVIOCRMFF(r0, 0x550c, 0x0) syz_usb_control_io(r13, 0x0, 0x0) syz_usb_control_io$uac1(r13, 0x0, 0x0) syz_usb_control_io$uac1(r13, 0x0, 0x0) syz_usb_control_io$hid(r13, 0x0, 0x0) syz_usb_control_io(r13, 0x0, 0x0) syz_usb_control_io$printer(r13, 0x0, &(0x7f0000000540)={0x34, &(0x7f0000000300)=ANY=[@ANYBLOB="400f32906ff7"], 0x0, 0x0, &(0x7f0000000440)={0x20, 0x0, 0x2}, 0x0, 0x0}) 2m7.762624522s ago: executing program 5 (id=1784): r0 = socket$l2tp6(0xa, 0x2, 0x73) sendto$l2tp6(r0, &(0x7f0000000000)="1d5e8e13d5cb7f84476dd1863a3eb09bdc7af62abe3afce36d23697614d9f9484f98e5689f4a8986f8a3bd654530d4d1a98d7009d6aeb354eae4b01da5bd0f87c60c32f32f504f14f103d2ed3198f975295a639160b5921d2e583e3a7026b63c12b23b18bd568a7c5ba7ccbd443d5d4f4da85e93678bd4025b496125b4cb88dc7f17d7c90f891110b2b8031ef3", 0x8d, 0x20001080, &(0x7f00000000c0)={0xa, 0x0, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x3, 0x2}, 0x20) r1 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl(r1, 0x7ff, &(0x7f0000000100)="bdca0b927f5b82abcff07ac95174b3a40f") getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f0000000140)={'mangle\x00', 0x45, "e0757b195045454db06dda1710f7c88d46346b674c554900703374b461847ba8d6445cdd1328fef4c53f6beebde19115a0852310b1edf52a6266d67a0c6e8d79ac22296680"}, &(0x7f00000001c0)=0x69) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x2c, r2, 0x4, 0x70bd2a, 0x25dfdbfb, {}, [@ETHTOOL_A_COALESCE_TX_MAX_FRAMES={0x8, 0x7, 0x2}, @ETHTOOL_A_COALESCE_USE_ADAPTIVE_RX={0x5, 0xb, 0x9}, @ETHTOOL_A_COALESCE_RX_MAX_FRAMES_IRQ={0x8, 0x5, 0x9}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4048044}, 0x20004000) ioctl(r0, 0x4, &(0x7f0000000340)="d5a6267ebecdadd5fd50f5b8dcb729f9f3a0f77e8841ad8dfdcc5c8df9adf0b21ca21d019e10b2e1e25c037944d7ee17cef7399d3db52255701be5f986a98117ad7f11b9bc87d38fd5a126ceb145fca96de928ed78223dbf837de4fad88770cfae5e96a5535ad0d7f72f887afe31083a2c36c1d8ecc3aaaced3c347fdd421467ab4b90dc0427cfb1be58b03645574bde732174057c72207abf12b0f6c5b2eb9e") ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000400)={'wlan1\x00', 0x0}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000480), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_MAC_ACL(r4, &(0x7f0000000600)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000005c0)={&(0x7f00000004c0)={0xcc, r5, 0x0, 0x70bd2b, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_MAC_ADDRS={0x64, 0xa6, 0x0, 0x1, [{0xa, 0x6, @device_b}, {0xa}, {0xa}, {0xa}, {0xa}, {0xa, 0x6, @device_b}, {0xa, 0x6, @device_b}, {0xa}]}, @NL80211_ATTR_ACL_POLICY={0x8, 0xa5, 0x1}, @NL80211_ATTR_MAC_ADDRS={0x28, 0xa6, 0x0, 0x1, [{0xa, 0x6, @broadcast}, {0xa, 0x6, @broadcast}, {0xa, 0x6, @broadcast}]}, @NL80211_ATTR_MAC_ADDRS={0x1c, 0xa6, 0x0, 0x1, [{0xa, 0x6, @device_b}, {0xa}]}]}, 0xcc}, 0x1, 0x0, 0x0, 0x4080}, 0x20040804) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000640)={0x0}, &(0x7f0000000680)=0xc) fcntl$setownex(r0, 0xf, &(0x7f00000006c0)={0x2, r6}) ioctl$AUTOFS_IOC_READY(0xffffffffffffffff, 0x9360, 0x8) r7 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CAP_MANUAL_DIRTY_LOG_PROTECT2(r7, 0x4068aea3, &(0x7f0000000700)={0xa8, 0x0, 0x3}) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000780), 0x2, 0x0) ioctl$UI_DEV_CREATE(r9, 0x5501) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f00000007c0)={{0x1, 0x1, 0x18, r1, {r8}}, './file0\x00'}) ioctl$BLKRESETZONE(r10, 0x40101283, &(0x7f0000000800)={0x401, 0x3ff}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r10, 0x89f1, &(0x7f0000000980)={'syztnl2\x00', &(0x7f0000000840)={'syztnl0\x00', 0x0, 0x7f80, 0x8, 0x71, 0x2, {{0x3d, 0x4, 0x1, 0x11, 0xf4, 0x65, 0x0, 0xf7, 0x2f, 0x0, @broadcast, @loopback, {[@lsrr={0x83, 0x7, 0xbb, [@broadcast]}, @timestamp_prespec={0x44, 0x2c, 0x4c, 0x3, 0x5, [{@rand_addr=0x64010101, 0x3f3d}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x9}, {@multicast1, 0x6}, {@broadcast, 0x6}, {@loopback, 0x6}]}, @lsrr={0x83, 0x23, 0xce, [@private=0xa010102, @private=0xa010101, @multicast1, @loopback, @multicast1, @initdev={0xac, 0x1e, 0x1, 0x0}, @rand_addr=0x64010100, @broadcast]}, @timestamp_prespec={0x44, 0x54, 0x16, 0x3, 0x7, [{@dev={0xac, 0x14, 0x14, 0x1a}, 0x4}, {@dev={0xac, 0x14, 0x14, 0x26}, 0x40}, {@remote, 0x763}, {@remote, 0x80}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x8}, {@local, 0x1}, {@broadcast, 0x60}, {@loopback, 0x8}, {@local, 0xa97}, {@remote, 0x7}]}, @timestamp_prespec={0x44, 0x14, 0xa3, 0x3, 0xf, [{@multicast2, 0xc}, {@dev={0xac, 0x14, 0x14, 0x15}, 0x476}]}, @timestamp_prespec={0x44, 0x1c, 0xe3, 0x3, 0xc, [{@remote, 0xf48b}, {@loopback, 0x9}, {@loopback}]}, @generic={0x0, 0x3, "ad"}]}}}}}) connect$packet(r10, &(0x7f00000009c0)={0x11, 0x10, r11, 0x1, 0x8, 0x6, @multicast}, 0x14) r12 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r12, 0x6, 0x21, &(0x7f0000000a00)="ad656ed9ff87abd50b701dfdf807bcfb", 0x10) r13 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r13, &(0x7f0000000a40)={0x2, 0x4e21, @multicast2}, 0x10) ioctl$RFKILL_IOCTL_NOINPUT(r10, 0x5201) ioctl$F2FS_IOC_ABORT_ATOMIC_WRITE(r4, 0xf505, 0x0) 2m7.645544732s ago: executing program 5 (id=1785): r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x1) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000040)={0x0, 0x0, 0x4}) (async) creat(&(0x7f0000000080)='./file0\x00', 0x2) mount(&(0x7f0000000180)=@rnullb, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='jfs\x00', 0x8010, 0x0) 2m7.436793957s ago: executing program 5 (id=1788): r0 = creat(&(0x7f0000001380)='./file0\x00', 0x4) mount(&(0x7f0000001400)=@rnullb, &(0x7f0000001440)='./file0\x00', &(0x7f0000000000)='romfs\x00', 0x0, 0x0) preadv(r0, &(0x7f00000003c0)=[{&(0x7f0000000040)}, {&(0x7f0000000080)=""/202, 0xca}, {&(0x7f0000000180)=""/104, 0x68}, {&(0x7f0000000200)=""/236, 0xec}, {&(0x7f0000000300)=""/79, 0x4f}, {&(0x7f0000000380)=""/4, 0x4}], 0x6, 0x5, 0x6) creat(&(0x7f0000001380)='./file0\x00', 0x4) (async) mount(&(0x7f0000001400)=@rnullb, &(0x7f0000001440)='./file0\x00', &(0x7f0000000000)='romfs\x00', 0x0, 0x0) (async) preadv(r0, &(0x7f00000003c0)=[{&(0x7f0000000040)}, {&(0x7f0000000080)=""/202, 0xca}, {&(0x7f0000000180)=""/104, 0x68}, {&(0x7f0000000200)=""/236, 0xec}, {&(0x7f0000000300)=""/79, 0x4f}, {&(0x7f0000000380)=""/4, 0x4}], 0x6, 0x5, 0x6) (async) 2m7.122647719s ago: executing program 5 (id=1790): r0 = syz_open_dev$ndb(&(0x7f0000001780), 0x0, 0x40001) ioctl$HDIO_GETGEO(r0, 0x301, &(0x7f00000017c0)) creat(&(0x7f0000001380)='./file0\x00', 0x4) r1 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x41, &(0x7f0000000080)=0x4414, 0x4) sendmsg$802154_dgram(r1, &(0x7f00000000c0)={&(0x7f0000000040)={0x24, @short={0x2, 0xffff, 0xaaa1}}, 0x14, &(0x7f0000000100)={0x0}, 0x7, 0x0, 0x0, 0x4002000}, 0x600c010) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f00000004c0)={0x3c, r3, 0x1, 0xffffffff, 0x0, {}, [@NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0xfb2e77a8993c191f}, @NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r4}}]}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xffff}]}, 0x3c}}, 0x20000000) recvmmsg(r1, &(0x7f0000000280)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40000141, 0x0) mount(&(0x7f0000001400)=@rnullb, &(0x7f0000001440)='./file0\x00', &(0x7f0000000000)='romfs\x00', 0x8000, 0x0) syz_open_dev$ndb(&(0x7f0000001780), 0x0, 0x40001) (async) ioctl$HDIO_GETGEO(r0, 0x301, &(0x7f00000017c0)) (async) creat(&(0x7f0000001380)='./file0\x00', 0x4) (async) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) (async) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x41, &(0x7f0000000080)=0x4414, 0x4) (async) sendmsg$802154_dgram(r1, &(0x7f00000000c0)={&(0x7f0000000040)={0x24, @short={0x2, 0xffff, 0xaaa1}}, 0x14, &(0x7f0000000100)={0x0}, 0x7, 0x0, 0x0, 0x4002000}, 0x600c010) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) (async) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)) (async) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f00000004c0)={0x3c, r3, 0x1, 0xffffffff, 0x0, {}, [@NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0xfb2e77a8993c191f}, @NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r4}}]}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xffff}]}, 0x3c}}, 0x20000000) (async) recvmmsg(r1, &(0x7f0000000280)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40000141, 0x0) (async) mount(&(0x7f0000001400)=@rnullb, &(0x7f0000001440)='./file0\x00', &(0x7f0000000000)='romfs\x00', 0x8000, 0x0) (async) 2m6.805980948s ago: executing program 5 (id=1792): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="54000000020605000020000000000000000000000900020073797a3200000000050004000100000005000100060000000c0007800800134020000000050005000a00000010000300686173683a69702c6d6163"], 0x54}}, 0x0) 2m6.75898012s ago: executing program 5 (id=1794): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa02, 0x0) r1 = timerfd_create(0x4, 0x80800) ioctl$TFD_IOC_SET_TICKS(r1, 0x40085400, &(0x7f0000000680)=0x200) (async) sync() (async) readv(r1, &(0x7f0000000340)=[{&(0x7f0000000000)=""/155, 0x9b}], 0x1) (async) r2 = openat$null(0xffffffffffffff9c, &(0x7f00000000c0), 0x40282, 0x0) lseek(r2, 0x4, 0x0) (async) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)) (async) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) (async) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x90) getdents64(r3, &(0x7f0000000f80)=""/4096, 0x1000) (async) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[@ANYBLOB="2800000002030102000000000000000001000000080001000100001f0900020080000000010015da05dc0000"], 0x28}, 0x1, 0x0, 0x0, 0x400c010}, 0x0) (async) fchdir(r0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x12, r0, 0x45809000) (async) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="6000000002060103000000000000000000000004050001000700000013000300686173683a6e65742c696661636500000900020073797a30000000000500040000000000050005"], 0x60}}, 0x0) (async) socket$inet_smc(0x2b, 0x1, 0x0) 1m51.34035335s ago: executing program 34 (id=1794): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa02, 0x0) r1 = timerfd_create(0x4, 0x80800) ioctl$TFD_IOC_SET_TICKS(r1, 0x40085400, &(0x7f0000000680)=0x200) (async) sync() (async) readv(r1, &(0x7f0000000340)=[{&(0x7f0000000000)=""/155, 0x9b}], 0x1) (async) r2 = openat$null(0xffffffffffffff9c, &(0x7f00000000c0), 0x40282, 0x0) lseek(r2, 0x4, 0x0) (async) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)) (async) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) (async) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x90) getdents64(r3, &(0x7f0000000f80)=""/4096, 0x1000) (async) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[@ANYBLOB="2800000002030102000000000000000001000000080001000100001f0900020080000000010015da05dc0000"], 0x28}, 0x1, 0x0, 0x0, 0x400c010}, 0x0) (async) fchdir(r0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x12, r0, 0x45809000) (async) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="6000000002060103000000000000000000000004050001000700000013000300686173683a6e65742c696661636500000900020073797a30000000000500040000000000050005"], 0x60}}, 0x0) (async) socket$inet_smc(0x2b, 0x1, 0x0) 22.971222086s ago: executing program 6 (id=2387): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x44, &(0x7f0000000200)=0x474c, 0x4) 22.720633419s ago: executing program 6 (id=2390): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) open_by_handle_at(r0, &(0x7f0000000340)=@nfs={0x90, 0x24, {0x6, 0x0, 0xffffffc0, 0x80, "0c0c676bae018d01271e2c4b9610b099ac6b6cfc7bd8b9e380032ccd300e636e7616f6d04c08fd1acd43006679db2e1bc6cd3b524ffff37bca19dfce834d4021d43a1a3a3a77333268208020c73d98f5f75cc25f7b167f14ec2e388fc195cdd29e6600af926c0dd152955b1ad236958cb9770508ca737ffce7f0906339362d6d"}}, 0x80001) 22.489759277s ago: executing program 6 (id=2392): r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000080)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000000)={@my=0x0}) ioctl$IOCTL_VMCI_NOTIFICATIONS_RECEIVE(r0, 0x7a6, &(0x7f0000000440)={0x4, 0x13, 0x0, 0xfffffffffffffffd}) 21.778040622s ago: executing program 6 (id=2395): mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x262) 21.488958634s ago: executing program 6 (id=2398): mknod$loop(&(0x7f0000000140)='./file0\x00', 0x20, 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) write$FUSE_INIT(r0, 0x0, 0x0) syz_fuse_handle_req(r0, &(0x7f00000021c0)="316d9eea9431f1652f86f90b69d7fc50bf31a996be815d719e98ba06675fa021322e0ddb52ce8fd7d1a02151dc4f13e8497adbf8a4a4f590fa038207026049ab3f42e412b956c2edadf3c80886048cc8ff1618be857faf6ec24eb4d182250fdb83f9c05e5fa1e4876dea51d5caefa235a0a71998e5bd051375dd7a2c53f2da58817629ea221b969d69c266a08bbe891ac0ea093294c2b6e2a57eade0526a63d92d3f700db17070fe8a5c38c0eccef2a51247052ab3c98013a4c0b2fbd6df26bfe5ff93c1f87f50e09952c36026321b7a70b219884ef743e1eea1ef726f275b24713136365f4f3c92e3f21c29561910e1e7e4f850af9a363dcb6eeebc5e506a6d7dd63ba2051c85f509f76c9d3ce45344f89020d757e30801c95cdd6c2dfb504e8765b8df509b8b97d4eee2aa34aea0c8328e5f5ce713fce073de078002ec4c99a2b1b26bef471f22423cf7a944fa557a259b7281685d36a44a7fef5dc47d7b338b9dd881ba48bf84123f230546624ab7c460c8533275973691d6a3f971a426b961d12ac7eced82b2d08611c06c32cebf317a307e5e955fbec18cc7f3d68386fab05a49a7c35b119a54be48c69031234c92abc3419e1b76a1bc63674a34170733b957e52ecf18cabcd9d1c82eeae2bad11e3ca7705a5ba2be3ce2d0eb751e7ded45b24cbb340c62af03427801b65fb4f10c68928cc788f55c85ca02a5921b3c94b4ddfb6df66f361f9482689db86d991f075cc7f8ff00e66f54933e63504a97b32466ad3a23b1a06ee216ef29c4b7eb203ab38150735c3d5bd453635acafd52c2aafb6c5a396a7ee435d1acdaae372215a873f579342e265996e15b81b087b586e7c38606b35ac3652b438a5834c0cd3a643434960217b95d1ccc468b64e6847de5d13c1a22c24d69d6b2277f48858c70333ccacf6ce27d7db5538e1421b5dd0e01168ce9d520820cb289944ef8634b8611c819ce2672cad3e80990caeca00da645530a23e383a2e38b0e38323ad74ca7dad2efcaecd42c409953fd1b20c53a3b474826ca8bf1f80b80a3825baaff393dd74fe4e17deaee082db122cb6b1939e2317d7544fd388780b9bd8aef7484c14fdcb907af377682dbdf467e3e7dde2d7e1f9a1ec0784fe180c218f464966bc408663eeefc3266938f10d1885e511fdb5d5271eae0a0afee204df07dba73dbde39a7a24c1bf56fa84953238d0b2a19a59febe416fa95ba233051037e986503cbad16089bdeeabb5c8dc108b0b854840f55a01d1484328daf8e4cfe767a3905afb70b452e232e1ea3c048dd332a6c941e2f21e6a8ba168b04bfb9acfcd20f763002a97397f5470bc5cd8ba1e758cb7396d624ea49d416e5f6dc130c0ed62c3757d2070ea63d997bb934b92e07aad66090ae79059adbb76f86fcc6aa14694def846cb678c6855feaafba98489659de31f9e99820f6a73c8e8543c77578b3fd8e66cb8ef5be135f73d943e32008be067bb77aa6c1e8d6c702335caca775682137b04cbbc70a781c1a0d1e639304698313580abab2f92209941596d188d23ebe0511e7c5e4feb169950c73ea4f960fd5b06f9217a210428a2b8f3cccbcc14578c439acfcb2dd15fb7c2978c48f66cee3fdb6f013c443be908a2a3ea3b031746f3fa54909216e88e06fe883e2af5941778bc859b377a0678dac03d891f4b7e2618eaac7a3165fdce83de59aa1152eac59c4fd18c6307a4a4f0a70f01116f91c1999aefb0b59814cebcf4313a95a9773bdb1b43da44328c8ffe6e48fe7e0ae4f2f63d1c4ea43d406be34ed3c4f54be361e2bfd868242619ba6e2f762432d968fbd29b80bb1b2ee1d1a06626d4c573f65530b35ac1e9918a297025764511c5242955323924d958bd5abf442ccafa9c3962e5c73f894e191956914268ec1e6eeae68bc5130599f93770df79c4348f4543e58f7e742643b29fbe9f016c531753f0a9497004b4c1f5248b90d066e824afa3f24a54259461a725565dcfdec91b8f4fd3aa7051c2e02c17525231a3a102b0f83944a9cf8bbf3010e37cf8f36745f69cd1c56c56ffcff9395d735f657fc1fffe1fb062e95abb911f5960c6d369d1fad93b025711421620e6406ac9732f8c1cf4da128ee4e191fddb3da9b5e8f121fd5d1786c68bf83d26656e7a2a62c6c1a0a1ae44e92f2ab93fdeb92c2f4a6e94c27cdad4f2ea7fa1a37a9a76baf83032b8661025400dcf5fb86050211e3757a5a2d6c9cabdd3cbac4d6b11d5036109358c728a326029d97e771434432f00877c4131185b2c829705b66f18019cebfd6583fcddf62a6e9504f46d005923a64b8c0a752cdbfc27638234f886fc233f9e5393345854c11a60d34f51a4aec69b315f8b31c76d5f1fe2051928e7072fb607f9522771193b2c0cf2825ca0a3bb9ecc3e369cd88a53262ddb9a56ba4444379850a6f3f7e8ce8dc120c421dc16671c313be6477a634b32a4888cf0c72c08432c604ee9090671584d864209fef30eb3ae32a363e8d4772f77087a7be22c31e403e6c614d5c40c61b362439f403eb7b382124fc6ca88e1536090b70e628775d95bc17f88092aa67f5d8746487b4175bc19afd489ffbb1500b35774872d545258ccf12ceea1d51e8817fe38dd69802df1df141a8f78b74ebece06ced2f77316e405d36fa313c83384b6bd2f70cd3787b12ec6de7fdf7976d589b3f6c61d7670086bbf825fb5d026be10f50c6e68ac6278516387cc999a9de5e3c980aa10e8db8195cd98ee178e9ce85dfb2e7fca39701bd476d448a3462c30b5f639f32c1a77e01e01722c2c470e8979e06b58f5bba0974eec51403d67ed834fb6454fb2bc8d4f40d0efd891de98df944bbde34e970ac16eaba012838968444879ada46c2096afb66f2adca892a3f2deb7295df8db1f992a0a8397ea322b0c21bc9b91029fa4277572006f872d624c0ef1b0107f296aefbb569aaa9a603be8857e6d96a334b495383694be9c8e900692b132a220d33d537aca4e3475786116c54e53a74793e2e4c38fc5b8c451e679680de5780f26cd8578c8404a7806a2a3365a37c9e7783fb7f3e73cfea52f774635321446f72badd7be1e865c2a63b3e26a6e502e337c1d7badede611ff09b467646addb4ed4ff9530dd6fea149440123ee146a367157256d715863b24edda4b135ba633a5c5fc0b37c2886aef8187e620bbee8f24528fb4efae220b9a4fe825e569f17e9fe8957beaecc12a735e0ee7ae4bd74a4ea7e5d12bab0c3212bcea56536cac64e4817cf62ddfd0bf356fbc8d1ce691dd3a23d12b7f9c0fe7b70a8bffc2ce5de77b779bbd5535bc98ac2c26016c48bf2874c776c875ffa3fa3b10bc8897ec7886c89b1e862c7db9a7d8313ae170f0d3d24ce62b7313a30df140881da148908dda3e5ff47750713568041b5a5471a2f0c480f74f02946f85059651e86002a7ca2a30b6d345957c8612ca9ba203aada9c9419b59747ac8db0d383138ebdbd0a33bb9ae616dec9fb87d5ed94db8827e233dc53804340f366d7a12697cd8c7e11d95277df91854245fd8433bb5b32e752c8070a0dc683c630e783c8f2ed68f57081d51aeb7914ca272aeca4432e47617d73938d2ca0aed7c37ba2a25c2c94c66032d3ede6a8a21899f09766757ff6b6b60bdf268cff7ed645019284a657532b239c2138f42d451a44b113be36e2c0fa26235813434b90cb633245b695ba20462727f311e4748cb22f01cc32d294001031c7be48d2051aed1f2b8330027068cde386b260fedfbe13bcdd8b946238dfbd124a9e0438a26bcf71772ddbdb3f1a448ca3f7b616a64ab7fe1a2eab9a1070b7e981355e7c0027c8fec770dbb39c0b2ebd05bfa14d8acff35170f72b0924fa11a344a834d9156316c657131a0bfb7208063ab3cec0599bcd776a7e2291c200f1218e77cafbdb10c3b514e7d62b30be860997387ac4ea4265af95aa290330130fdb73650cdbc334f3a8884adc408aa48d0e59c2678dc2d18b47ad8f37e36f6b760c049ae9603c80b89fd5148440c093525de9b0a5229736405faff1140b8d770f1ab2c073c8a81cf33d4f4b62a75bc72aeca5c241a8be367d8c8ea6a3c47c686b1d71769af7b6a038bf6214881d29e76dbc95ab3fc4c933f9bdde61f3ec8f8d4f5ec0c0d6312a5f5a23a495962061faae1af9c515a0f5f8a18b09245a02dcab6303b518bf2dde1b495bf8553f6722a75d2f6f4ad07c032da581a6a0a116950cfc028f52a5ccc09e730143b18048ab6d8b9f7e8208285165d44b2e5c2e74606d15f8cbbbab1dc2ed0a527c01d00af1c5a8bb4cbe2d9e40708d4ac8de83782eda99229db1ed120c97cf158319beb8c1ee1d42960e4c23ba8d307a7d75deb7c8b187c1ebad43abcdb53763e9d426046fee7d4f5f7b797be57fc5b52408cfdf73a8e61b64f4be6ba65e6628e277e3017483e891efccaceddd73431e29f48f91eebc459d7f33efe15696f9f82f3103d05943c99df15f5c4399cf392856c8890814df9e789bbc373e42a079fb4f62074a40bbb0eb7ff9b5037644a30b3662cb79e15c21d2730d086030c05cd4d0bfb9142223d28bf7c7fd33ba914b4b272b28d36832d924edb81dd696f04cd004d7a3127e62ef83b4f051858ad45a508dd713b828687fd53d82baaa9420d64c790a376e8fa5fab9f081d1526879eb2481289be07ba9af29f1aa3a2ec5086f55baa4921f845d989fe13efe78e2ffe8400dae22e3b3d39262eacae86186d153878e9881da2ad1b7c275b96d9c469a2da1e10b66e904610f0bc62a77558ca935d99cfa33009ef9b17d53dfb9a8ae0b0dfcd20c7b1315835e5cf6fba77021d01bcc68053519357bcb9f60e7c0b1b2e2dea7876614723bcf50ce37dbbf98c3516e0f3cdb094a9b673c882940decf7583ff28ec646e95c24fd563acf3c15d1f6a81f357990926400b48c795b4b5c697ad4cea7a7484367d8d40440192beb3d3f351ad5fb04851bbd5ef6fd02c7ce60a90ad2b31f7c4339fcdc1b0448b217be4e5f8fee523f875b3d782789a5222b0a236abe070d30d1419f3a9afd1afafb06db2d5e47ac090be88d8d81e73c1263d5b6a8915f55bba272b815f28f1870bbf1655012cf18df7ce503e7210e4f2f339c65b1d82e4bd0ce2473fca827d20d7308a50ecaaa2b11658aead1d5cc9f4c8b7c619f3feb71f7362db381c4f2e40f2c53f7d21911590c43c0232c6f46b421f61fd524b994246bdfecbbd3db64da4928d66ea45c77cae6b8460b91eb04ab156a518880692170cbb7cf28182a17ce7ac852ddcabe2a0cf65e318abe1c52f59e19ed06388aae8e72af8e386a9c8fa84960b5d91a57c1b7d44dd79472a32a35dd557820d1ca776e9b85d31594e8b2b086bbf86838bfd8e394204ee50b841aaf98e97c087f12e61b19dd9d1d4a9f685a2b35270fe0a7c9f29e82f37ec7ea176cee26a42b9fdfd0fa293f8f161fdc6d79198bd2da73a8eec986e388a1b041418420c969471a58e0405462037cf13af929f9d88599ca7968d1b2b9c8841f8ba044f7340aa75746ed23e9291015dd60e0604228ebf356faea2493ef7bf74d7fe8d2db9d4c528bd2f40387477109494b1bf53a4a53250d9d931c321e8cf837fb26fbb40d827948c26d3e2976fe670c4e5dac106e34e4d61a38d4b0d5976a4ffd58135905a913bd87eee1be37a677608d7c1d6c9026fec2ff0b01d016073ae2609b0ba3549ed3b382de230f080adca15620d63f698a9f11c59827f3354c46ee278cc0ad7e04285ab7761fcce0554c4b365356b57ae02417b49c76bd8dee41a9b3eaa3b694a00bde985f0246066bc78317f333482b65e93665dad57f34fcee0d0cdf25377a24ddbd26c85b0cc0d064ccc499f39bdf07c8c708bb2fc7af9f7ba48ad02b54f40be057c176a9a30458f31f1c969b4ffe0f27f59ef2e62fc1a6ada7c4ad02d427ef8494b640a5d716a791f9cc98599ecd029c654afbc3707c4b682a579a4b38d6a004fd3be963ea668279906fdd347ebca29143e2fd8e93b461c03cc8edaa378ccfd424b19c200ade89293f32d1673fad0d8b2cdee0fb258e5ad2d6b731ae038c754ba8671376e1bcc1db06473ae43479c333202b4dc4db55139cb7a5f1364080e20b08434663dfc26d646105e5f798f05bcee684b47c7e0e6b0358ae3be160a27128bec6330f263bb648de395c34147c6dba53905023502daade7aad4dd088c05c37a3adc4666b524a81c6bfbd65e13fd25d9d860a5c7b5ba5ebf8d76432ed17d786dbbd23d4fd64bcea1b0ce50b608c03fc9811c4152c968310dd267984b1f419aef7c6891c25bed7b67a053db68ea702633d737fd7895fb867e33b50b912f8141cf5559b402573e93c9323719423be607a8e660d9c2da2eaa20540b4c468795409e83106d6a7a3ca4f312d392fd3138026cf1ee6301f86d5c6a91815bcf47bff996e10d27832a687a42df2ac7bf866b182e94b7355856eb509d63d42eee1c6f30c059d59774bd9bc2feb055201a47575c8253117f739773cad51b9193efd42041956d56672a42475db90d4bba88197a14417c9d803152d76a8b979350f88a340214d21c36f3b6afa4c249b737d3a036f6e0d3bd5c7abb79938a943705ae3e5683d0513a5d73cd0a7f1224c3e29addd4bff3b7833d152dbb6669e05b09b900087d284e7241a1b885e0628d059c1a027dd5014c2ac0851129cd4b3593a7530a384bf89f5ce8c9869c4753c7d3efc982ab0db25b07552efc4ff8db7734ed6882faec84bf50fa0a07695f9beabdbf4b2779159a8db1736984e417203ee200d47b2a814dd0fb4bd46c718df933161a489f71864e459e442e47e0eb1fbc84de542987bbebec2bf6dbc17d85569b361b1ab945846eef32bfd2bada9f8f8c8bf899e64499a89b16122d5c2a06be0332058ec0acd30e837c09bf10ef75c82d282cf24f6e359ab3b30b9cfe7088cffe45d69795be6704c9ae6aeb44ef7a1e225c1c40e2c1e67b143afb59a091bfa3e9f4b094b3fb45eb1c98013d5a7e400af5e3d9edc2ef5fac57e775a1d1924949ffa39c5080dcadb72e51a8437b666d8b376a0e291fc5f810dd939075aaba4539470bf1bb512f12245945249d84e45bd5c90a02c147fa19c88498572b7acaf0a8a9c7eaf528c1c46ea100a2c372397732038209df8dc16991031f74ce57004cb7741a4aeb44a15d5884ce73e1d0f2efc0af3ea849c9e140dba7faa19c6ddbaa1d57d5c61a3b312fa14bc6eed00a6b9ed961e77ca3b0fae4077f5c9c3a0f5eceb1621e882ad1e8b08a96fe170a9ab894973f5e014c4eb943b51bab0033288a3254f3f4e7b25e679dc952e90c61874e0eeba32d34f307c67ec1da6122278706ed2b74427663973e433a8d93ad93cc6b66db347de485b5f490b24284c34384b7374d55b06bf267d631db4ad719c8783b1de0dd4f9c268582f180d364445ef21f29b6436f3dae5f16a6cbcd3a0d4bef3d45da714cb92f11d500635eb7b8f1a804f78098aca5e09507edd04bc2ad85e7e134d104b381ebfda6ea13e0e2a15b49539b04389f9c0b5c63c2b6bcc4a486f7254c814b1b6d5423909afdb56d97fa7d1845b7949e082bf5d6939ce3fc289eeb65b62152443e481427b6eef145d1f53a6a0788972133a31dc59472b9f2c6211f267f0c9362f3035452358185e2d3847c27b2c7ae59a6a1bed407885460d9481413aaeed8d14811391a5389f548c5cedf0ca4aa22bf47ee388b356df39933dd02269579b66cdc5da830e6df50a0c109bdd329690d3a0ca4318803142f4b43d333f97f647682a2ba609c71e48f55741739010a1c26b4e731e4ed87ba2f3d4f894d6c3e4b135faf20704591ba06c994aedcaee02fce22e16d2b57c01dfb60f5136fe80eed63719968cff4b344b8c1637e18302a3374a00301c8aa5d186488261dc2b6ded36e46c8bcd15473a0494c394e413d5e938d3cd6be8335b4f442da0b1cdfd9ed0fc297604f250e9f18343a28a368dc0e60e83d396709d99557ee9409442eb19c0a0aa000c165865798912dc11e216bdef326dd4e37a4b1abba4ff9c3a3766ce8610657a26f82ffb0ae82f5fc4623be3001c49eeb834368bb9e50e319cf3a7de606919e62f7e81d92b5ca90d4433cd0d7f8983e97ad4659bb7dde68ab5bc2516b68c70e865a5d743d1ebf2f7f6c5e654e72585e340122fd66c3ce9bb7fb6548edae495ba7eef863ae611b5265d6903b98b28e8ac3465fb47f1f4eb35c6119438915acb2a79761bb0903a1bea47acaa736649dce64003f00d0fe1cd189dcba3510088310c78884ba2b317ca9e6183ceb6c2142acf528d2772041db5798298b8717d0df476ce893849913abfbccb320d65986bb6777f55613dfebdae2c00f849cad12136928370ef3ec763a90f05297cab6d5aaa7ac5d24273c135c35b4b9436eed290e943171c73fae6028e7f341bbbc237dff0e829846169b93abab94e8acdadf824602e600abf957ade422d9533941057d27c54280bd7d8f4ba891b2f36abbdd6a5b8b42eb007cda415fb2ec2783741819c26db0452f65fd927e9977937f08532644a1706e1b75875c0b936996080af20f6d914ae07a2dd0a2fb4f2f68fd26b54e1f6ae86b774594d0bf0fbd1a3443ac974fb856d91f64d0384ee492d773490cace64089c49db0e55f5391e9c3ddc55237bc6b42ac760b745a6fcc3234857b368081f1cc656d6432260a6f0675d76bb6e5f2c1b4973f54a19473a00e3c9b2ec3bdf854d047ea0a5898ac3e60d83fafd021b3176bf1e26b0c51ff60aeb209769d241b73637eb197c886609683f5f7a2017a65e553b5a77c33f13b3304d31ba9cbe6145f5da8a6e52fcfced44efcc4ba3ac8bf7f69f0d940504642ed660705d54c101e2787a7061416207969afd45e48ae0448a9c3e79dab372a3b235563936cd51f7165dd3344e01380877be09a52b00917c52f24b3d6d714d83f2462a413ee1084aed08932fd0ce39b33cf926b38d41e4d8db6182ec532c372396a6b806b9fac74a6d613b34d5d838f68ce50f03dc2bc640b1a41acc20373b3fa0a8d4f0bcb739c93635a3b0f256d90add5a2c36f1d2ec50a44382b1aed8380da67d020b8618163989a58165349584253171ad8e3d292608c5c550f47ba087569361a1b0e50b754327a9fefab0d9d88fae579eb9d7698e0d1119b36f5d2d9a3def8bf0f7c0f72e1c1d2cee63a408fdfec07e624a9752f874e8c55b4bc86d109b18ee4d39972cd4e31e8b677e4c6b78bd63240fdd2bbabf7b8ca84abcf432872552d23f3424c72bd987a1b8b264b0c5f122f65111fb7e9d52df4fd2349df73bf2b1b638c7532324f1aac30d0ac2e84f9fa18789be5196b3849f05147b08c588b2de5c3fd27163f79d9cfa218aba07423252591eef584b96fe2561b42184bef0229df62d0f891e900067b885d21495f7f4664a0955afedae12ddd43d469e0c769e0dd3da0e9246c4d2ff2b0af71aebe42909881046365f8d01bee73787b2382a627e5ef8e22ef7f78a11521f3bf2d195c0653f9f8e0608873bf752616fb20680c542d1afe66d4f619d19d77099a27f9e312e46e977b33f565a276690e3bdbd50280fa4382536d3228db1ed340be151e7d48126723826a9480659dda98e3f017b6ec85e5497370e0c66b1c49364398ca8809d9221a9543c7d8a3eb30c2075a3d4792160280baea9dfe358b9ca30979af42937a182747affaf2cf849c0910fd74c7e760207e71322a8a60d098575bc6acd1f4dcb92145d51a88229cb63fc3e2caaf477a89255acba32ad4bf8960222ccb777d097ab48001a9ae302b2e5f3436229fa4a908b4846b8288b2b71040e04c7bfa39734976740772fa04472175e23521f7acfb19eda410d99fa62ea2c1d6feb3ea7578d52c51df548a93e2c1e3f633e1146694a304c353fc1cd719b0363b69b115e1f7f08a1c9499005e0ac991f71da8d34be30527f8fc968dfffb8cbd57931e281a9bd32755e6cebe84312d1bfac78a88b3632d757439bec6fb058d86a68179129b657082bf0c50b1d806523e081c3ba981c8e89f29072489aa71d26a039639294f793babf5ea71eb8a8b3f592ada8261d1774db29a14fe2bdb86fc81cfc8884bfa275ef3391c29e255e57c689b843901fe18cffb6eb893b3023d28dd8bd042dddeac8ba8dd44a1d11ed1e3d33f96ebf693e096efe6b351c35a60fbda8db92f1cb81c44eeceefa3cc7903fec1cc39d7a8e0fc70708cb4804bcaa660cc155659461d3eea0e715d7fbbf5c271bb0cc600dcc9d748cebd3ae05b061c40e32d56b328790729fd039e352af91bed191603d291f31f97daaf89e2c9f30eb93b3fb65f386ccce7698cf1cdb17b727407e0d93a450e0a2af616d45f6fd3a624ed48142391dbac5b0dd5fdad7e3c221b88a60e8ece40b663d657b625214f4f10ec6601004e8df06063d21e6cc7ff147f0e45d999b92492fc8e1827124d0a5dcbfd6e4858cb73389bd01c2e9563c9b51fe072e77e74d0df71d26319e394fe9e1bbf00650c42db2132643e3590369f32002f37c818d4f3e02d46937b42d65cbb75ec4cefd87f71ac08dd9fe0a52047f76a0cd80180167dd99ab620f87a039d115b5a88790acc85991eb646a73da2e881e624afe006a0c0a66444d91587537b7f2294e8d73e7ee5438bc8d066e81086347c741950f657d182bcad688526e7e10a5cce6692fe0b053c950ce12183e71114849c7160ad0c3385b98c79669073e01e334b0693c3b0bde4377bd56b5ff352958a1b212a2989257eb11f61d2198598ec5856f158246fc53040806bf1b6832c18e008090ed54b319317586068ac6cc28bd1d7a26402b454f7b95174e7e6977f3779c6c5f9d00b2ea1ad0f0adbf49169563bc561ebf91ad9406231deb3cbbb9b51dc24dc3b0e8e0bc3c05c6c62be3aa8719d03c670f1674e2e8c22300566cd619b149fc7cf50a9f6bf5ea2f29d0c81a7447939d4604d7a3edbccd4d34adbcfe81a7af6dec17b09e455948c6eda5b3fe0105e71f4f1bde54d4c4e42897ae6a6255e53622bd3ced25e7c33727b212a4370810f0a2d496cae7416718a9d0b529febe0cb29073d3ade0875ac21c1616d4e8d71e19af3caa7ca4b1d932be9f922863652d9401106708d8706b2f4b5b5c6650f9278b872d452a3914f7cb4be96fc12a086066e5ac4ea178f5d0aef094dbbaa92e55420be6946421819fca44a2d1a28de3793b2b0dda910bf7eeed026d456ba3da425c2dae88bacb88aaf830cb75a30b384dee2d4efba39d03d17b9e704d51a0aac3d4326dc8a9c7e6b27937bd929bd4f2880e3dd602a16fa4abda54a4252702b2d9983e71f9ac4e2918f7bd08801d536c624eb2052d51d5ab0ad2feeb6dfda6d04d97a5ceb04562b17bad2c1fe11fa72e04096390cc5b1c57a93e1bdcb5142629a4b9f510452407e6759d2532142723bdb8de70cae60e9870fcc9283170fefb1463a53a2120ac077262bf3c9fe0455cf7495907af96a6771b0626d40714d9d0559e7c217508456d113ce835b9ec64c998b069208682c24254dfde43ae47edd1dfc556c0058d0ef54246aec118d34ccbe1782c5816c767ac7d2a5750bdba1fa46", 0x2000, &(0x7f0000000fc0)={&(0x7f0000000200)={0x50, 0xffffffffffffffda, 0xffffffffffff0001, {0x7, 0x2b, 0x3, 0x4010, 0x6, 0x9, 0x2, 0x7, 0x0, 0x0, 0x80, 0x9bb8}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) lgetxattr(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)=@known='system.posix_acl_access\x00', 0x0, 0x0) 20.45978751s ago: executing program 6 (id=2400): r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000380), 0x101040) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000300)={{0x0, 0x2}}) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000600), 0x108200) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f00000003c0)={0x9c9, 0x0, 0x0, 'queue1\x00', 0x200000}) mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x103) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000002280)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x8000}}) read$FUSE(r2, &(0x7f0000002380)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r2, &(0x7f00000004c0)={0x50, 0x0, r3, {0x7, 0x9, 0x0, 0x18292, 0x0, 0x0, 0x0, 0xffffffff}}, 0x50) read$FUSE(r2, &(0x7f0000006580)={0x2020}, 0x2020) write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f0000000200)={0x30, 0x5, 0x0, {0x0, 0x1, 0x7ff, 0xcf40}}, 0x30) truncate(&(0x7f0000000080)='./file0\x00', 0x30) 19.838828369s ago: executing program 35 (id=2400): r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000380), 0x101040) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000300)={{0x0, 0x2}}) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000600), 0x108200) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f00000003c0)={0x9c9, 0x0, 0x0, 'queue1\x00', 0x200000}) mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x103) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000002280)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x8000}}) read$FUSE(r2, &(0x7f0000002380)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r2, &(0x7f00000004c0)={0x50, 0x0, r3, {0x7, 0x9, 0x0, 0x18292, 0x0, 0x0, 0x0, 0xffffffff}}, 0x50) read$FUSE(r2, &(0x7f0000006580)={0x2020}, 0x2020) write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f0000000200)={0x30, 0x5, 0x0, {0x0, 0x1, 0x7ff, 0xcf40}}, 0x30) truncate(&(0x7f0000000080)='./file0\x00', 0x30) 10.523925162s ago: executing program 2 (id=2444): mkdirat(0xffffffffffffff9c, 0x0, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) write$FUSE_INIT(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000a80)='./file0/file0\x00', 0x0, 0x1) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) syz_usb_connect(0x3, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12011001173a6140f41515006ed10102030109022400"], 0x0) 9.100386234s ago: executing program 2 (id=2445): r0 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000040), 0x2000, 0x0) close(0x3) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000fc0)={0x50, 0x2, 0x6, 0x5, 0x0, 0x0, {0x0, 0x0, 0x3}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_SIZE={0x8, 0x17, 0x1, 0x0, 0x8}]}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_NETMASK={0x5, 0x14, 0x4}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}]}, 0x50}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r2, 0x4068aea3, &(0x7f0000000040)={0x79, 0x0, 0x6}) ioctl$KVM_SET_GSI_ROUTING(r2, 0x4008ae6a, &(0x7f0000000100)=ANY=[@ANYBLOB="21000000000000000000000002"]) r3 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x652400, 0x0) r4 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r4, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @mcast1, 0x80}, 0x1c) recvmmsg(r4, &(0x7f0000000200)=[{{0x0, 0x0, &(0x7f0000000140), 0x62}, 0x2}], 0x1, 0x40000406, 0x0) r5 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r5, 0x0, 0x0, 0x2409c8c9, &(0x7f0000000240)={0xa, 0x4e20, 0x0, @mcast2, 0x7}, 0x1c) sendto$inet6(r5, &(0x7f0000000e80)="0d0ad7c36d6617110e434332d6ac582208222cfb7c37ce1148f448455bc37f5f70c92774dcb201629979039d7c8943b207e5bdf9ab8eed9ace110469c51f4f211dd9fad815eb5b273ac04e1edc679bcdf0a0d24482de5454be9003cb80714a95e136bb", 0x63, 0x6d91fb6102d8910c, 0x0, 0x0) sendto$inet6(r5, 0x0, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x22052, r3, 0x2000) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000007, 0x38011, r6, 0x0) mount(0x0, 0x0, 0x0, 0x400, &(0x7f0000000280)='-#\x00') io_submit(0x0, 0x2, &(0x7f0000000f00)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x2, 0x1ff, 0xffffffffffffffff, &(0x7f00000004c0)="ff8257e2dd4e6e695b3bc01628d94dfea10aef76518b28fb28672947bc3f708da3e25f2f028f80f2d63a4b116db6fb23199a3bda6b0eefed4a9853dcde6d5166bc729cd30a3b3eb75a9954242c0d946a3616f6b8966dcd349444b70a588ab1b253e0e43a45955c9893dad02432c7108f6acb3a07a85e55546391d66f5c0c009cc8cabe988f516f13ded34d771dd7c3981c2e5e5682f3b881d8c499a25210796063aa1b9d8f8da8433f27341e45aae54029693d4856cd97532d0338544a00fbb477b2f580c99c65e8cd500aaaaf450930625ad1996d79721f8e639bf6204a621253071d6ceb5b26f62375e827d23ce9dc8e3725f3ce7d2fec9dbdde5efa947568ad3a9f949f75a93c28cc073229e2fa27c21d5c71fa5c2b2d0972d2b526d791215f211ca2b420e291505f65f19b571fcae1843b3eba21d8b73452f6cb34c32670c0399df37d94c2cadb73bb5c11042f4260db6c693a666baa987d275f162029c845a688ed72c90415f3c1ce244fa63ea7037380acd302508cb0c8b6590759f2a75425b2d483b8f07598ca9973305006e21aa4a57293f2d943b7b543d401a736f4216f0476f74edb8a44417321ee471eca9d5089ceda7add1e365fcb69df27861ef589345234bd19be2e8ceb04fb6ab7b231f376ad344029c8b806f5e3da26b6abcc1c9257d8caea40aa63f44a8eab3a1b29180adf4155da05794ebdfa473bb5701821b42da5d11b8bc83c98c73450e45e051301338e56e431ccc4e324eeffb3359c631a8fcfa802cab18ed1dff097fc3d99538176018802da9a4eb144adc1a2135d03de1a9a83eb3ce09636f1c30382fc9005a25de37c6e093e18394441d9f32fc5b8bd49b7a9cfc7e558944f38631fcbd3341dda789ac52c7c1d088b63c034e18a62a3833b54f427c7fbd9230f027d0b4290ff1ee372a63a0eeca778e182b6c254b777afaed2a933dc0bda70e196116c0b18279ae4c58370cefb4bcbaba0f971ab818acf63361271f80783fd31efb7f1e92f91dcb089127d4f04fc4810fb077f7df08b05ffa453089c057d12ba9dbfd2d92a72154b904bc2044406475a080b9dc545b69a6de999192cad6c03a42c7bded956690afa3c24498e0090e2c82f045b11fb93cacff43fb181d76f9269f82f158f6dfc870941c7902d4d84f22952a94f44b7c06cd1287e265083768480979d314a82f6ad97c97088f9bff43185396c2f37309941d28cb996d5454b62273b00b54d212ab8a6e2d6d83ab80ebb26ca857eecefd6d1fa5b2c158ce10fa3e2838b1566c5a05ea5140c287abdc70ee736733d44df847cb3a53d81aec948b87c10c5179dc021b216197d42b1046bf1910a5f561394059a64e8da76319d209b72ea48fde52c2e5ed1b4c3c339af608b5723970c169c041495a0ffab47e9772d9816dd212323621ff7d9e70bbedfd97fb9f192e141dea06a64271b8f037765f48e78d3a9ee4f1390144a08cf79f7174b2b2a4a71680da99dc814fb53d67a048b4d7fe2364e87a9c80bf8bdf8b776ba49b91fa3fb3222c5d452f38172f32197139d636dd3684e9701c1ac2df8740d7dbdbf3507b652feb09c7eb35538c5928628816a98724339632898b6bd865bb86a3a61da709d1967b1f960a8ac88670b97fe5223081fd16d65d85afd35c7643e25bc648596e81845e03be19051ecbfb1ae8b1169330443e63d67f922ae7c9ae70e8a916f408bcf5b0ad85be5e1639b4653a455b0d5328a306e7d35291556943928835ba6cbd26088b06ab3c5dc8abf13d2708ed42fda9d16bbe7873bdb0d97ee6158b04ed932d99bd310f1a10cc417984fbb16ca5d9ef96979852fe797ea8b4f43119588ea7f2b791e77c727bb01d6fcf5493be31c34a0f9ea5927da914b57d2c2158754ff6026da8ca96c5e0059fd358975e778f17d26a43711659db685b6fa68f21ba90133181ee904ea5bc659a6e11121e93b14e00cbb09abd9a3fce43855754e5886c6a96dd703321dd8683e5dcb4ad33291f0000b15efbb3a2838dad5ebfdc051fc724cd792da3700d923854adac2a55302b6e06b0ff2770552194aacb4e234c57e996a34dd2810f3b3b984c1e54a35c592258dacf913b0bb32be1b1ba9017a6edb2ec122610168d8613fa237a3dd0b06e6bc329801e6557ebfee56488621b9a6011273ba21936e8cc4bd8ad7e0a7de69756676f3fa4ee92a6fe3bec8828ae0c575217132ff03dd6e0a5ec887abeab6fbdd85cfab59d7f02c8beaf5b036884c6dd3ef33d0a50d7ffa2786d934cfff5a2c6576238389f98382546abe39d7b542667a59335bc60f9c38802db9fd1beff66bef52ef822caffd4ff22a3f50be2c3c4c34ac7ceeb559d1bfd4f6d25f3de1c3ce3abd1530169f0e2bdbd01fb5171403f3d68d2223d0ea41afbc9a2cfb6dfe9b24becfdb9b6e939ce42dd19893c79881db5ab809df1bac712b5a8adedd32dc649e5df0dca39806c0c6b039153c2c1fac10362f3ff55ef2745968ba2627b2a8549d76fa002f88395c660e28a3e05c6042909dcfd577783cc8e5cfacad07f7123322da055559f7888c913b405872e56a394eaa0035d2fdd3aacf0cd27e051c26df919ba8aca1a07c39078360f202b02f465dc7afe5585cc48ab50815a90882a717219cad8d4a8b8c94bbd6341dc89527afa9059850bf569aeb248f1981578892cb0dc418529dd44c3f83d06ab908412d847f556e7e68a1a476240bf3013c4507681f69684d75d90f81ac511f4ea422536918cd9be4efbcc00b6d2c35ce543e8dfc7ce554b3c75be24fdf6542502764601a4425f1e8f984727df7aa877879a4e982bdef3bc4c5e8c68515273fc334528135ea65065db3a7cb23982fef96e08700523e01373a54e4192d9c924290112573f95010c3d29209bf3a358a93737ea302b444477d3ae569f0411aff1a5861e92bd7b1bb443a3281077c404bbf023dbc1b30cb7438ad2fe5ae8edc8d27ed28069695bac05dca0ea309559a46269796e0bc362c19f947e63fb1434aa45e5e302a3b4e19330f67aeddfa195978600bfe6f749125107c8b4b0d3fc55a084de103e16958412f354a52a1b2ba49e199f265f3f7286104251ad84091d002", 0x895, 0x8, 0x0, 0x1}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x5, 0xe0, r0, &(0x7f0000000d80)="af9347b5742125b6e0316ab27d19e85aba997826ae3ed3120b655b64da81e672ea60d67c39247188152fcf336a3677ead1f35aee9e4c45d2836e82d127b55c19b408280dee40c0125aa9ea67811ed81c9f64604e9ee3be7e32213009d7eeda72fef00bbf115c39d3b0c5804c3926c40fc037cc69158bcccf5f0ac8f6a0c850169ab69527426f082c4b9c5045e2696d3ad417238164c0e70be041a6573478582e344eb4e16a0ce3b24604cbdb96ac417e1e9624aa8c158a9b427fa1ed1e9bde6c51", 0xc1, 0xd}]) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000bc0)=ANY=[@ANYRES16=r7, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="020000010000000000000000000000000000000000000000ffffffffffffffff00000000000000000300000000000000090000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000feffffff00000000000000000000000044010500e0000002000000000000000000000000000004d6320000000a000000ac1414aa000000000000000000000000053500000303030009000000b4000000070000007f000001000000000000000000000000ecff03d36c00000000000000fc0100000000000006000000000000000000000000000900010000000080000008000000ac1414aa000000000000000000000900000004d2330000000a000000ac1414bb0000000000000000ddffffff0235000000"], 0x1fc}, 0x1, 0x0, 0x0, 0x11}, 0x8000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) r8 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCSTI(r8, 0x541b, &(0x7f0000000040)) r9 = syz_kvm_add_vcpu$x86(0x0, &(0x7f00000000c0)={0x0, &(0x7f00000002c0)=[@uexit={0x0, 0x18, 0x1}, @uexit={0x0, 0x18, 0x2}, @uexit={0x0, 0x18, 0x8000}, @code={0x1, 0x3f, {"66b8a7000f00d026f3470fa6c066b83b010f00d80f35450f01f8f2430f79ebf26d460f0fdda4c6f800660f388012"}}, @uexit={0x0, 0x18, 0x9}, @uexit={0x0, 0x18, 0x2}, @uexit={0x0, 0x18, 0x1ece}, @code={0x1, 0x54, {"0f20c035000000200f22c0430f8900000000c4220191040d07000000646466420f009d0a000000250000000066b892000f00d8f0450fc74d003ef30f09470f01df0f09"}}, @uexit={0x0, 0x18, 0x5}, @cpuid={0x2, 0x18, {0x10, 0x6}}, @code={0x1, 0x56, {"3e660fdbbd000000003e652e66470f11ff262e66450f3820f7b9150b00000f3266b8b7000f00d0440f23876526f3430fc73166ba4000b8f9ffffffef650f01cb66471ddf00"}}, @cpuid={0x2, 0x18, {0xdc, 0x990}}, @code={0x1, 0x5d, {"0f0966ba6100ed12acd800000000440f20c03505000000440f22c066ba610066b89e0066ef66b8f4000f00d0f30f0966470fc735995f0000b974070000b804000000ba000000000f308d6600"}}, @cpuid={0x2, 0x18, {0x78, 0xdb}}, @cpuid={0x2, 0x18, {0xffffffff, 0x7}}, @code={0x1, 0x54, {"66bad104b80b000000ef2e0fc71966f20f2a1f0f6ab4e35d0000003e0f79ab4a2500006566470fd7f8c4c3fd00800080000002c422c1bb50a1c4c1fa6f5600670f78fb"}}, @code={0x1, 0x4f, {"0f078f68709e411d00c4837bf06ca9fd586636f30fc7730e400fae800060000066400f3a42620dffc4617910d1c4210c5f48002636410f85887671e6446d"}}, @cpuid={0x2, 0x18, {0x1, 0xed}}, @cpuid={0x2, 0x18, {0x5, 0x10000}}, @code={0x1, 0x6d, {"0f955f00b805000000b95ddf632a0f01d9470f30c744240000000080c7442402a7fc0000c7442406000000000f011424c441a162db66460ff1e066baf80cb8b09e0a84ef66bafc0ced260faef3660f3880a94fd4a51c66b843008ee0"}}, @uexit={0x0, 0x18, 0x6}, @cpuid={0x2, 0x18, {0x2, 0x1}}, @code={0x1, 0x74, {"0f20d835200000000f22d866b8a7000f00d8b805000000b9011300000f01d9470f00d5c744240082000000c744240200000080ff2c24c422413ec8450f35c4017a5b620947d9f2c74424004ae10000c744240203000000c7442406000000000f011424"}}, @cpuid={0x2, 0x18, {0xc}}], 0x44a}) ioctl$KVM_SET_SIGNAL_MASK(r9, 0x4004ae8b, &(0x7f0000000740)={0xe8, "d218d59f874aa86587d7d01b46562b719032d126cafb877ea5a1c2e90ebfd7b2f9bd1d32096b39d211d60bb0b3abcbc63f7ce187aa83b2094fc69288fcaa360e376c61f5e9accc10cf6c769fe95bf08f1bc53e98eaccf9d529206b4c7e4e60dbe5ae4265787dc24be0f127ad8c4163cae56d7264900ec016e7f9ebc0346855d8cdc585868a0d9ea62bb9441ee31937fabb669409e6bfdf1f3674119d2704c1f829a6e66064e8f06e422a825e1a8db2b61dabf117a68160f3841207d989b08c900cf8e8293afc3a6836a89fa8b9589ff076bfe9441d97f32842b5f9f4d02b35dbd885f34178d5e25e"}) sendfile(r6, r6, 0x0, 0x4000b) mmap(&(0x7f00006c0000/0x2000)=nil, 0x2000, 0x100000e, 0x4d032, 0xffffffffffffffff, 0x0) mremap(&(0x7f00009aa000/0x4000)=nil, 0x4000, 0x2000, 0x7, &(0x7f00000ea000/0x2000)=nil) 7.855292777s ago: executing program 2 (id=2447): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x51, 0x0, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2000, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x1) ioctl$KVM_SET_MSRS(r5, 0x4008ae89, &(0x7f0000000500)=ANY=[@ANYBLOB="01001f00000000004503"]) 7.481370806s ago: executing program 2 (id=2449): pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@in6={0xa, 0x0, 0x0, @mcast1}, 0x80, 0x0, 0x0, 0x0, 0x5c8}, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce620300fe"], 0xfe1b) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="563f00001800599c6d0eab070004000523"], 0xfe33) write$binfmt_misc(r1, &(0x7f0000000000), 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) creat(&(0x7f0000001380)='./file0\x00', 0x0) mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ntfs3\x00', 0x8000, 0x0) 6.395580015s ago: executing program 2 (id=2454): openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa02, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x8001, 0x60f80) ioctl$EVIOCGRAB(r0, 0x40044590, &(0x7f0000000040)=0x9) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="1400000015000100fcfffffffcdb"], 0x14}, 0x1, 0x0, 0x0, 0x4800}, 0x0) r1 = socket$rxrpc(0x21, 0x2, 0xa) close(r1) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000100)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) mmap$KVM_VCPU(&(0x7f0000ffd000/0x3000)=nil, 0x930, 0x2, 0x8032, 0xffffffffffffffff, 0x0) timer_create(0x8, &(0x7f00000002c0)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000000)='source', &(0x7f00000000c0)='\\/\xe9\x838\x9d<\f\x91\x01\x00\x00\x00\x00\x00\x00\x00n @\xf4M\xba\xf2<\xd6A\xdb\xd7\xbeY\xa3\xfe%\x11\xc9\xc5\xc4\x96\xb7b\xa7\x15R.\xa3`fd\xdc\x8b\x18rBl{\x82\\/A\x17\n\f\xcd=\'\x11\x1bZ\x8e\xb1\xc3j$v\xefv\x96\\\xff\xa2\xfc\xe3\xb8\xc7\x0f\xaaQ\x98F*T\xd5\xcd4g+\xbd\xd1\xe0R\x9d\x18\x19a:\xa2\xdf\xbe\x8b\x89\x81V\x99\x1d\x1f\xe0\x15\xade\xd2\xea\xce\x04\x01T\xccW\xb9g}\xdcdW$h\xbc\x9fw\x9e\xef\xdc\xa3\bQ\xcf\xe24\xca\x8c\"l&\xf2\r\xdd\x14R\xdf\xe4B\xf9\xe5\xd4\n\xf7\x93^\x1ck\xf9\xab\x1fE{ QRK\xb5\x00\x00\x00\x00\x00\x00\x00', 0x0) ioctl$VIDIOC_G_FREQUENCY(0xffffffffffffffff, 0xc02c5638, &(0x7f0000000040)={0xfffffffe, 0x4, 0x3}) pipe2(&(0x7f0000002880)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r4 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000080), 0x143480, 0x0) splice(r4, 0x0, r3, 0x0, 0x7, 0x4) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000640)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000480)="9da207", 0x3}], 0x1, 0x0, 0x0, 0x11000000}, 0x10) r5 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r5) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="043ef502"], 0xf8) write$bt_hci(r2, &(0x7f0000000240)=ANY=[@ANYBLOB="0000020008"], 0xe) r6 = syz_usb_connect(0x0, 0x36, &(0x7f0000000bc0)={{0x12, 0x1, 0x0, 0x44, 0x39, 0xdc, 0x40, 0x1660, 0x1921, 0x1f84, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x3, 0x0, 0x2, 0xf6, 0x62, 0x70, 0x0, [], [{{0x9, 0x5, 0x7, 0x0, 0x10, 0x9, 0x6, 0x8}}, {{0x9, 0x5, 0xd, 0x3, 0x0, 0x68, 0x37, 0x40}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r6, 0x0, &(0x7f0000000580)={0x44, &(0x7f0000000280)={0x20, 0x0, 0x1, "f6"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_wait_time\x00', 0x275a, 0x0) syz_usb_connect$printer(0x1, 0x2d, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0xff, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0x5, 0x20, 0x0, [{{0x9, 0x4, 0x0, 0x2, 0x1, 0x7, 0x1, 0x3, 0x7a, "", {{{0x9, 0x5, 0x1, 0x2, 0x3ff, 0x3, 0x66, 0x9}}}}}]}}]}}, &(0x7f00000002c0)={0xa, &(0x7f0000000140)={0xa, 0x6, 0x310, 0x81, 0x9, 0x3, 0xff, 0x4}, 0x3b, &(0x7f0000000300)=ANY=[@ANYBLOB="050f3b0001361003b75e6842874b38f1f90f77b319f3c54bc239361c77a698c484732aed62dfb8f20bceeb41c11b9e743b0167c2d57c64760d398d785114591f053787526a2675307d0c41685d719c09a400b6e3db19c97ef8fdd652d127fdcc508e46892a29bda68fdbacc8572f3daf7f744cc81303692618d0f6677a29c36c5a7fe453fe5bc52e384c07623e7d25c775c34239273bd78124a369a072652078d5a55e6e28624aaf70aa5d7415d1dd98e6f4e8f7df37906ac6a4a851dc96e73fb04fb23ec260dc1f6dd88a0682b522342029e3e46cb3228a6560f04f3fd0f66e88b528f61a78858f754007c7db5afb"], 0x1, [{0x85, &(0x7f0000000480)=@string={0x85, 0x3, "460402f8f0c293220da9725c0d1daa99f310baff3522b2a0fa3d7e83e2a6de3ad32ef38d3ddc4b0f1e6e083a14b79f0767478e151488a2f5c31f58b09e775f4c3b4d4dd11ba881244561b922f6a08e23a93627713db111741b70c53b3a461896389168901ea366cc158904d70425816e51f7785fd3ba7a73c63d1099aa91f2da61ae84"}}]}) write$uinput_user_dev(r7, &(0x7f0000000b00)={'syz0\x00', {0x205, 0x7, 0x3, 0x7}, 0x50, [0x2, 0x9, 0x0, 0x1, 0x8, 0xea45, 0xe, 0x1, 0x0, 0x0, 0x9, 0xc, 0x3, 0x405, 0x1, 0x4, 0x1000, 0x7fffffff, 0x51, 0x8, 0x800, 0x5, 0x3ff, 0x4, 0x7, 0x10001, 0x7ff, 0x0, 0x4, 0x6, 0x400, 0xc, 0x9, 0x4, 0x2, 0x1, 0x5, 0x4, 0x1, 0x9, 0xa, 0x8, 0x2, 0x9, 0x804d81, 0x2, 0x8c00, 0x8, 0x939, 0x5, 0x9, 0x2, 0x2, 0x4, 0xfffffff7, 0x7fff, 0x6, 0x5, 0x80000001, 0x6, 0x5, 0x2a, 0x1, 0x23], [0x8, 0x20009, 0x9, 0x1, 0x5, 0x12, 0x800, 0xc, 0x0, 0x2329, 0xfd8, 0x3, 0x5, 0x5, 0x0, 0x24e, 0x2, 0xfffffff7, 0x12, 0x3, 0x5, 0x9, 0x80, 0xb, 0x1, 0x3c, 0xa1, 0x100004, 0xffffffff, 0x5, 0x10004, 0x1, 0xffffff00, 0x7ff, 0x6, 0x7, 0x0, 0xb, 0xffff3f15, 0xa, 0x2, 0x9, 0x7, 0x5, 0x5, 0x7, 0x800, 0x5, 0xc5, 0x3, 0x1000001, 0xb, 0x8, 0x6, 0xfffffff7, 0x2, 0x24c, 0x800001ff, 0x9, 0x5, 0x6, 0x6, 0x7, 0x7], [0x2, 0x9, 0x1a9e1bfa, 0xfffffffa, 0x8, 0x6, 0x1, 0x8000, 0x3, 0x5, 0x2, 0x7ffffff7, 0x8000, 0x1, 0x1, 0x5, 0x4, 0x2, 0x2b0, 0x5, 0x7, 0x8, 0x0, 0x0, 0x9, 0x5, 0x4, 0x10003, 0xaad5, 0xffffff3c, 0x8b2, 0x7, 0x4, 0xff, 0x5, 0x2, 0x4, 0xb, 0x4, 0x6, 0x7, 0x8007c12, 0x5, 0x1, 0x40, 0x8000, 0x8e, 0xf3, 0x80004, 0x8, 0x1, 0xfffdff00, 0x100, 0x7, 0x2, 0x0, 0x9, 0x10, 0x1, 0x1, 0xc3, 0x4, 0x7a3], [0x9, 0x3a8d, 0xffff9a7f, 0x6f68, 0x6, 0x2, 0x1, 0xfffffff3, 0xd077, 0x1, 0xffffffff, 0x1f, 0x81, 0xa, 0x6, 0x2, 0x200, 0x1000, 0x2, 0x66608000, 0x5, 0x7fb, 0x6, 0x3, 0xa476, 0x5, 0x29, 0x3, 0xd, 0x0, 0x1, 0x1, 0x8, 0x61, 0x200010, 0x1000, 0x8, 0x100, 0x8, 0x7ff, 0x8, 0x15, 0xb32a, 0xec000000, 0x2, 0x1904, 0x4, 0xc, 0x8, 0x7ff, 0x280, 0x5, 0xfffffffb, 0x7, 0x2, 0x8, 0x8, 0x9371, 0x4f89, 0x7, 0x580, 0x2d1, 0x80, 0x8]}, 0x45c) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r7, 0x0) 5.512314766s ago: executing program 4 (id=2455): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_OPTION$IOMMU_OPTION_RLIMIT_MODE(r0, 0x3b87, &(0x7f0000000040)={0x18}) mount(&(0x7f0000000000)=@sg0, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='xfs\x00', 0x2000000, 0x0) 5.295580039s ago: executing program 4 (id=2457): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x51, 0x0, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2000, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x1) ioctl$KVM_SET_MSRS(r5, 0x4008ae89, &(0x7f0000000500)=ANY=[@ANYBLOB="0100001f000000004503"]) 4.745902207s ago: executing program 4 (id=2459): r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_rose_SIOCRSCLRRT(r0, 0x8919) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$VT_ACTIVATE(0xffffffffffffffff, 0x5606, 0x7fffffffffffffff) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x51, 0x0, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2000, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x1) ioctl$KVM_SET_MSRS(r6, 0x4008ae89, &(0x7f0000000500)=ANY=[@ANYBLOB="01000000000000004503"]) 3.674259812s ago: executing program 4 (id=2462): ioprio_set$pid(0x1, 0x0, 0x0) timer_create(0x2, 0x0, &(0x7f0000000040)=0x0) timer_settime(r0, 0x1, &(0x7f00000000c0)={{}, {0x77359400}}, 0x0) timer_gettime(r0, &(0x7f0000000140)) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f0000000180), 0xffffffffffffffff) r1 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, 0x0) openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x28200, 0x0) capset(&(0x7f0000000040)={0x19980330}, 0x0) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) ptrace$setregs(0x1a, r2, 0xbd, &(0x7f0000000040)) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) r3 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) syz_init_net_socket$llc(0x1a, 0x1, 0x0) close_range(r3, 0xffffffffffffffff, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000240)={'wlan0\x00'}) setsockopt$packet_int(r5, 0x107, 0xf, 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) ioctl$KVM_SET_GSI_ROUTING(r6, 0x4008ae6a, &(0x7f0000000280)=ANY=[@ANYRESDEC]) syz_usb_connect(0x6, 0x24, &(0x7f0000000340)=ANY=[@ANYBLOB="120100007add1520450580800103000000010902120001000000000904"], 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000080)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x8, 0x2}}, './file0\x00'}) r7 = socket(0x2, 0x80805, 0x0) r8 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r8, 0x0, 0x482, &(0x7f0000000040)={0x84, @dev={0xac, 0x14, 0x14, 0x2d}, 0x4e20, 0x3, 'wrr\x00', 0x1, 0x2, 0x6e}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(r7, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010101, 0x4e21, 0x3, 'lc\x00', 0x4, 0x8, 0x77}, {@rand_addr=0x64010102, 0x4e23, 0x2, 0x0, 0x12d5f, 0x3}}, 0x44) 3.189843009s ago: executing program 4 (id=2466): openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) write$binfmt_script(0xffffffffffffffff, 0x0, 0x0) r0 = add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffff9) syz_usb_connect$hid(0x3, 0x0, 0x0, 0x0) r1 = add_key$fscrypt_v1(0x0, 0x0, &(0x7f0000000480)={0x0, "d53c0eb582cba9f1bc16e9ca85647283ccf9e9b7cfa617c953f8334fb77453e9d63eafb578307ceb8c0de24e1a2799fbe25a20bdffddd2b9708a52e314708472", 0x3d}, 0x48, r0) keyctl$KEYCTL_WATCH_KEY(0x20, r1, 0xffffffffffffffff, 0xfffffffffffffffe) socketpair(0x26, 0x80000, 0x5, &(0x7f0000000600)) r2 = socket(0x10, 0x3, 0x0) r3 = fsopen(0x0, 0x0) sendmsg$nl_generic(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001e00010a"], 0x14}}, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0xfdef) splice(r2, 0x0, r5, 0x0, 0x8002, 0x0) r6 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x1) ioctl$SCSI_IOCTL_SEND_COMMAND(r6, 0x1, &(0x7f0000000040)={0x0, 0x0, 0x4}) dup(0xffffffffffffffff) r7 = syz_usb_connect(0x0, 0x24, &(0x7f0000000980)=ANY=[@ANYBLOB="120100006e40b740e1092151c1400102030109021200010000800000000000003cac2400"], 0x0) r8 = shmget$private(0x0, 0x800000, 0x880, &(0x7f0000173000/0x800000)=nil) shmat(r8, &(0x7f0000000000/0x4000)=nil, 0xffffffffffffcfff) shmctl$IPC_INFO(r8, 0x3, &(0x7f0000001180)=""/4096) clock_gettime(0x0, 0x0) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$UI_SET_RELBIT(r9, 0x40005504, 0x100000000000000) recvmmsg(r4, 0x0, 0x0, 0x52418e567e5a9d8b, 0x0) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x810, r3, 0x5176e000) syz_usb_control_io$printer(r7, 0x0, 0x0) 1.941940537s ago: executing program 7 (id=2469): r0 = syz_open_dev$media(&(0x7f0000000280), 0xb, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc0287c02, &(0x7f0000000180)={0x80000000, 0x0, &(0x7f0000000300)=[{}, {{}, {0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f0000000080)={{}, {r1}, 0x2}) r2 = openat$comedi(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/comedi4\x00', 0x101000, 0x0) ioctl$COMEDI_INSN(r2, 0x8028640c, &(0x7f0000000040)={0x4000000, 0x0, 0x0, 0x0, 0x1000008}) r3 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x585280, 0x0) read(r3, &(0x7f0000000100)=""/159, 0xfffffe5a) 1.877156727s ago: executing program 3 (id=2470): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x51, 0x0, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2000, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x1) ioctl$KVM_SET_MSRS(r5, 0x4008ae89, &(0x7f0000000500)=ANY=[@ANYBLOB="01000000000000004503"]) 1.767623984s ago: executing program 7 (id=2471): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x51, 0x0, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2000, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x1) ioctl$KVM_SET_MSRS(r5, 0x4008ae89, &(0x7f0000000500)=ANY=[@ANYBLOB="01000000000000004503"]) (fail_nth: 6) 1.101914761s ago: executing program 3 (id=2472): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_GSI_ROUTING(r1, 0x4008ae6a, &(0x7f0000000100)=ANY=[@ANYBLOB="21000000000000000000000002"]) 1.101149317s ago: executing program 2 (id=2473): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x0, 0x0) write$binfmt_script(0xffffffffffffffff, 0x0, 0x0) r1 = add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffff9) syz_usb_connect$hid(0x2, 0x0, 0x0, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000180)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(md5)\x00'}, 0x58) r3 = accept$alg(r2, 0x0, 0x0) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, 0x0, 0x0) sendmsg$alg(r3, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000400)="be", 0x1}, {&(0x7f0000000280)="98cebbebd043f74af311583db6192345dacc78e8042042dc6c4b6adc982771481fc41def9febb06c7d31756eb4203f566de133602d638f5fd71acdfb45a0c8ab86ec3f395cf8b73a10bd533153775efd256f32bfa22e93f2e666d35a4b50a45ecd4bc7eb8673812f02cf58ed26b3b40adada1428b676766ac08a085ff69d4829e6bed14010270ca158523b49a2bff05c8b9423d72f0f3bb9eb511a3f3d4dbd6ac96d06f25287131be98acc4daad38b23e08c462790298361e9165518271ce42408e137442ea9f53a39524d4783bf03cfcf346b05", 0xd4}], 0x2, 0x0, 0x0, 0x80}, 0x8000) r4 = accept4(r3, 0x0, 0x0, 0x0) sendmsg$unix(r4, &(0x7f0000000b40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40800}, 0x8044010) r5 = add_key$fscrypt_v1(0x0, 0x0, &(0x7f0000000480)={0x0, "d53c0eb582cba9f1bc16e9ca85647283ccf9e9b7cfa617c953f8334fb77453e9d63eafb578307ceb8c0de24e1a2799fbe25a20bdffddd2b9708a52e314708472", 0x3d}, 0x48, r1) keyctl$KEYCTL_WATCH_KEY(0x20, r5, 0xffffffffffffffff, 0xfffffffffffffffe) socketpair(0x2, 0x3, 0xc125, &(0x7f0000000600)) add_key(&(0x7f0000000000)='dns_resolver\x00', &(0x7f0000000080)={'syz', 0x1}, &(0x7f0000000100)="51a85104b18d6ed38d32dfde5a16eb94269f42a3d9e7f41b74c655e512603a7884822c640857bfb2fd35151fb4e833d14ca7186a813a8b604a7cd1333db7c203", 0x40, 0xfffffffffffffffa) r6 = socket(0x10, 0x3, 0x0) fsopen(0x0, 0x0) sendmsg$nl_generic(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001e00010a"], 0x14}}, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0xfdef) splice(r6, 0x0, r8, 0x0, 0x8002, 0x0) dup(0xffffffffffffffff) syz_usb_connect(0x0, 0x24, &(0x7f0000000140)=ANY=[@ANYRESOCT], 0x0) r9 = shmget$private(0x0, 0x800000, 0x880, &(0x7f0000173000/0x800000)=nil) shmat(r9, &(0x7f0000000000/0x4000)=nil, 0x4000) shmctl$IPC_INFO(r9, 0x3, &(0x7f0000001180)=""/4088) clock_gettime(0x0, 0x0) recvmmsg(r7, 0x0, 0x0, 0x52418e567e5a9d8b, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x22052, r0, 0x2000) 1.097291899s ago: executing program 7 (id=2474): socketpair(0x10, 0x800, 0x1, &(0x7f0000000000)) r0 = socket$inet6(0xa, 0x80001, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r3 = epoll_create1(0x0) epoll_pwait(r3, &(0x7f00008c9fc4)=[{}], 0x1, 0xfffffffffffffff7, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r1, &(0x7f0000000000)={0x30000008}) dup3(r1, r2, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x5, {{0xa, 0x4e21, 0x10, @mcast2, 0xff}}}, 0x88) setsockopt$inet6_group_source_req(r0, 0x29, 0x2d, &(0x7f0000000340)={0x2000001, {{0xa, 0x4e24, 0xfffffffc, @mcast2, 0xfffffffb}}, {{0xa, 0x0, 0x82, @local, 0x5}}}, 0x158) r4 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r4, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$inet6_udp_int(r4, 0x11, 0x68, &(0x7f0000000080)=0xa40, 0x4) r5 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r6 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r5, &(0x7f0000000200)=ANY=[@ANYBLOB="0a000000bbbbbbbbbbbbaaaaaaaaaabb86dd6d002000000111ff00000000000000000000000000000000ff0200000000000000000000000000014f194e20"], 0x4b) creat(&(0x7f0000001380)='./file0\x00', 0x4) mount(&(0x7f0000001400)=@rnullb, &(0x7f0000001440)='./file0\x00', &(0x7f0000000000)='omfs\x00', 0x0, 0x0) 896.623577ms ago: executing program 3 (id=2475): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r0, 0x84, 0x81, 0x0, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x401, @loopback}], 0x1c) r1 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) close_range(r1, r0, 0x0) sendto$inet6(r0, &(0x7f0000000200)="cf", 0x1, 0x400c0d4, &(0x7f0000000140)={0xa, 0x4e23, 0xfa82, @loopback, 0xffffffff}, 0x1c) r2 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa02, 0x0) r3 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x12, r2, 0x45809000) r4 = openat$cuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$FUSE_ENTRY(r4, &(0x7f00000041c0)={0x90, 0x4, 0x0, {0x0, 0x0, 0x0, 0xfffffffffffffffe}}, 0x90) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010600000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff1b000000020000000900010073797a30000001000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a3c000000120a01020000000000100000020000000900020073797a310000000008000440000000000900010073797a3000000000080003400000000a14000000110001"], 0x64}}, 0x480d0) sendmsg$NFT_BATCH(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000180)={{0x14}, [@NFT_MSG_NEWOBJ={0x38, 0x12, 0xa, 0x401, 0x0, 0x0, {0x7, 0x0, 0x7}, @NFT_OBJECT_CONNLIMIT=@NFTA_OBJ_DATA={0x24, 0x4, 0x0, 0x1, [@NFTA_CONNLIMIT_COUNT={0x8}, @NFTA_CONNLIMIT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_CONNLIMIT_COUNT={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_CONNLIMIT_FLAGS={0x8}]}}, @NFT_MSG_DELTABLE={0x14, 0x2, 0xa, 0x101, 0x0, 0x0, {0x0, 0x0, 0xa}}], {0x14}}, 0x74}, 0x1, 0x0, 0x0, 0x40888}, 0x0) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f00000000c0)={0x0, 0x80000001}, 0x8) 770.666633ms ago: executing program 7 (id=2476): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="54000000020605000000000000002000000000000900020073797a3200000000050004000100000005000100060000000c0007800800134020000000050005000a00000010000300686173683a69702c6d6163"], 0x54}}, 0x0) 693.822391ms ago: executing program 3 (id=2477): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_group_source_req(r0, 0x0, 0x2e, &(0x7f00000004c0)={0x1000, {{0x2, 0x4e20, @local}}, {{0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x108) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x8a00, 0x0) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000ac0), r3) sendmsg$NLBL_CALIPSO_C_REMOVE(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r4, @ANYBLOB="010025bd7000ffdbdf2502000000080001"], 0x1c}, 0x1, 0x0, 0x0, 0x40005}, 0xc054) (async) sendmsg$NLBL_CALIPSO_C_REMOVE(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r4, @ANYBLOB="010025bd7000ffdbdf2502000000080001"], 0x1c}, 0x1, 0x0, 0x0, 0x40005}, 0xc054) r5 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r5) (async) ptrace(0x10, r5) ptrace$setregs(0xd, r5, 0xfffffffffffffffe, &(0x7f0000000140)="18607651149d7b10b4024fbbdc08899b8f589df2dbb5d7a8d1b36cfab675cb3976ee8100e2878c9cfa178c0900000000000000f39ed4b41924dc225ad4028dd63debb87d698be5c749450b350a789dcfc6b2d6a69600026d1e52f19274566d1da0f353dd65e330ebf71c5e823f2753c5fd76724828ef31b353e71805205c3dceb44cc4c7b3664e29fb") ptrace$getregset(0x4204, r5, 0x1, &(0x7f0000000080)={&(0x7f0000002400)=""/4096, 0x1000}) (async) ptrace$getregset(0x4204, r5, 0x1, &(0x7f0000000080)={&(0x7f0000002400)=""/4096, 0x1000}) setsockopt(r2, 0x75b5, 0x7fffffff, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x22052, r1, 0x2000) mmap(&(0x7f0000400000/0x3000)=nil, 0x3000, 0x2000009, 0x4d032, 0xffffffffffffffff, 0x0) syz_open_dev$usbmon(&(0x7f0000000000), 0x0, 0x0) (async) r6 = syz_open_dev$usbmon(&(0x7f0000000000), 0x0, 0x0) ioctl$MON_IOCT_RING_SIZE(r6, 0x9204, 0x111691) (async) ioctl$MON_IOCT_RING_SIZE(r6, 0x9204, 0x111691) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r7 = add_key$user(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)="a022be5ac9", 0x5, 0xfffffffffffffffe) pipe2$watch_queue(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) keyctl$KEYCTL_WATCH_KEY(0x20, r7, r8, 0xaa) ioctl$AUTOFS_IOC_READY(r8, 0x9360, 0x100371e6) (async) ioctl$AUTOFS_IOC_READY(r8, 0x9360, 0x100371e6) 591.751966ms ago: executing program 7 (id=2478): r0 = socket$l2tp(0x2, 0x2, 0x73) connect(r0, &(0x7f0000000cc0)=@vsock={0x28, 0x0, 0x2710, @host}, 0x80) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000000)={'gre0\x00', &(0x7f00000000c0)={'tunl0\x00', 0x0, 0x80, 0x20, 0xffff, 0x2, {{0x1e, 0x4, 0x1, 0x2, 0x78, 0x67, 0x0, 0x5, 0x2f, 0x0, @multicast1, @multicast2, {[@timestamp_addr={0x44, 0x3c, 0x2e, 0x1, 0x8, [{@dev={0xac, 0x14, 0x14, 0x3c}, 0x3ff}, {@private=0xa010100, 0x6}, {@private=0xa010102, 0x1}, {@empty, 0xe}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x5}, {@local, 0x4}, {@empty, 0xfff}]}, @generic={0x44, 0xe, "a220f4594bee83d45c046c21"}, @generic={0x7, 0xd, "7573b9c9e6b704a9108544"}, @rr={0x7, 0x7, 0x6d, [@rand_addr=0x64010102]}, @ra={0x94, 0x4}]}}}}}) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000000)={'gre0\x00', &(0x7f00000000c0)={'tunl0\x00', 0x0, 0x80, 0x20, 0xffff, 0x2, {{0x1e, 0x4, 0x1, 0x2, 0x78, 0x67, 0x0, 0x5, 0x2f, 0x0, @multicast1, @multicast2, {[@timestamp_addr={0x44, 0x3c, 0x2e, 0x1, 0x8, [{@dev={0xac, 0x14, 0x14, 0x3c}, 0x3ff}, {@private=0xa010100, 0x6}, {@private=0xa010102, 0x1}, {@empty, 0xe}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x5}, {@local, 0x4}, {@empty, 0xfff}]}, @generic={0x44, 0xe, "a220f4594bee83d45c046c21"}, @generic={0x7, 0xd, "7573b9c9e6b704a9108544"}, @rr={0x7, 0x7, 0x6d, [@rand_addr=0x64010102]}, @ra={0x94, 0x4}]}}}}}) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000000c0)={'dummy0\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r3, 0x8916, &(0x7f00000001c0)={@initdev={0xfe, 0x88, '\x00', 0x8, 0x0}, 0x80000005, r4}) (async) ioctl$sock_inet6_SIOCSIFADDR(r3, 0x8916, &(0x7f00000001c0)={@initdev={0xfe, 0x88, '\x00', 0x8, 0x0}, 0x80000005, r4}) stat(&(0x7f0000000180)='./cgroup\x00', &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000280)={{{@in6=@private0={0xfc, 0x0, '\x00', 0x1}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x4e24, 0x0, 0xfb5, 0x1, 0x8, 0x20, 0x120, 0x88, r1, r5}, {0x3, 0x800, 0x0, 0x7fff, 0x7, 0x2, 0xb4f}, {0x4, 0x4, 0x95a, 0x3}, 0x6, 0x6e6bb3, 0x2, 0x1, 0x1, 0x3}, {{@in=@rand_addr=0x64010102, 0x4d6, 0xf1}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x3, 0x1, 0x8, 0x978d, 0x0, 0x6}}, 0xe8) (async) setsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000280)={{{@in6=@private0={0xfc, 0x0, '\x00', 0x1}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x4e24, 0x0, 0xfb5, 0x1, 0x8, 0x20, 0x120, 0x88, r1, r5}, {0x3, 0x800, 0x0, 0x7fff, 0x7, 0x2, 0xb4f}, {0x4, 0x4, 0x95a, 0x3}, 0x6, 0x6e6bb3, 0x2, 0x1, 0x1, 0x3}, {{@in=@rand_addr=0x64010102, 0x4d6, 0xf1}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x3, 0x1, 0x8, 0x978d, 0x0, 0x6}}, 0xe8) socket$alg(0x26, 0x5, 0x0) (async) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(twofish)\x00'}, 0x4f) (async) bind$alg(r6, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(twofish)\x00'}, 0x4f) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r7 = accept4(r6, 0x0, 0x0, 0x800) sendmmsg$alg(r7, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e", 0x19}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef45", 0xb7}], 0x3}], 0x1, 0x40800) recvmsg(r7, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) setsockopt$XDP_RX_RING(r7, 0x11b, 0x2, &(0x7f0000000380), 0x4) mount(&(0x7f0000000080)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000240)='hfs\x00', 0x3020080, 0x0) 471.154638ms ago: executing program 7 (id=2479): mkdirat(0xffffffffffffff9c, 0x0, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) write$FUSE_INIT(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000a80)='./file0/file0\x00', 0x0, 0x1) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) syz_usb_connect(0x3, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12011001173a6140f41515006ed10102030109022400013600a0"], 0x0) 181.710581ms ago: executing program 3 (id=2480): r0 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ifreq(r0, 0x8970, &(0x7f0000000680)={'macvlan1\x00', @ifru_flags=0x1000}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)={0x94, 0x0, 0x1, 0x505, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @mcast2}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private1={0xfc, 0x1, '\x00', 0x1}}, {0x14, 0x4, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}}}}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x1}]}, 0x94}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)={0x98, 0x0, 0x1, 0x505, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @mcast2}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast2}, {0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}]}, @CTA_TIMEOUT={0x8}, @CTA_NAT_DST={0x4}]}, 0x98}}, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, &(0x7f0000000180)="b9800000c00f3235010000000f3066f2a48fc9b8012866baf80cb8be0de68bef66bafc0c66b847d066ef0f3066baf80cb86c13d68def66bafc0c66ed66baf80cb8a8eb668cef66bafc0ced660f062f66ba4200b0fcee", 0x56}], 0x1, 0x53, 0x0, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2000, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = socket$kcm(0xa, 0x5, 0x0) sendmsg$kcm(r8, &(0x7f0000000600)={&(0x7f0000000100)=@in={0x2, 0x4e21, @remote}, 0x80, &(0x7f0000000000)=[{&(0x7f00000006c0)='@', 0x1}], 0x1, &(0x7f0000000040)=[{0x10, 0x84, 0x8}], 0x10}, 0x41) r9 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x1) ioctl$KVM_SET_MSRS(r9, 0x4008ae89, &(0x7f0000000500)=ANY=[@ANYBLOB="01000000000000004503"]) r10 = syz_open_dev$tty1(0xc, 0x4, 0x1) r11 = dup(r10) write$UHID_INPUT(r11, &(0x7f0000001980)={0xc, {"a2e3ad214fc752f91b23060987f70e06d038e7ff7fc6e5539b325d078b089b3b08386e090890e0878f0e1ac6e7049b334d959b429a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31303b305d0936cd3b78130daa61d8e809ea882f5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000002335875271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617601000000be70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710a80000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c478b095b68441a34cb51682a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e01feffffffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369d75f2e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00f16e2d0174035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf463661c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afae5136651b1b9bd522d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c105000000302a808d7f5251440613d17ca51055f2f416a44fe180d2d50c312cca7cb14a20dc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb40100000006376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4908b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6522fb5f6ffcdd56fed88935fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae233a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe360500000000000000b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817bb903729a7db6ff957697c9ede7885d94ffb0759be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f9c55f4901203a9a8a2c3e90f39c3dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600", 0x5c1}}, 0x505) ioctl$KVM_SET_USER_MEMORY_REGION(r11, 0x4020ae46, &(0x7f0000000080)={0x0, 0x6, 0x2, 0x2000, &(0x7f0000007000/0x2000)=nil}) 69.249492ms ago: executing program 4 (id=2481): r0 = creat(&(0x7f0000001380)='./file0\x00', 0x4) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0xa2081, 0x0) ioctl$KVM_GET_SUPPORTED_CPUID(r1, 0x4018aee3, &(0x7f0000000180)=""/216) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001", @ANYRES8=r2], 0x7c}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a50000000060a0b040000000000000000020000072400048020000180070001006374000014000280080001400000001708000240000000030900010073797a30000000000900020073797a32000000001400000011e82d961ca6cec72e2c0001000000004565ce6e91b0423b7e16e4e8f8d1f9cf1d55eb9930e4032d5324b1d249b746baa177a623ca2c9d91122481747689b06bd196e56285bf00dd560158e3c8299c67a0bd5ee13f369005c7f37ce4617ee4cab0d931cb13b3829070523babf606cbcc59945286a2e6ed7c91e43fb5b6ab25f0fb3c16f5841432ed9c5433875d3d20bf6d21d98f7142eba0eedc52aca70f4acb5316fcfe538948b410d30695cfd6c7dbfe26015c297cdb1e7bc345e289b5f8c79e0c45907ded497dae97078bf537bc3ca5750cb1324d5478d8bb3700db36ca1a96daae640c987fae7ab583de80f5e3890988b75802a141b6757c686ad981b4ae5c4c6a01398bfcb0034624b83c"], 0x78}, 0x1, 0x0, 0x0, 0x4004804}, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x200, 0x0) r3 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r3, 0x4068aea3, &(0x7f00000001c0)={0x79, 0x0, 0xc73}) ioctl$KVM_CREATE_DEVICE(r3, 0xc00caee0, &(0x7f0000000080)={0x3, 0xffffffffffffffff, 0x1}) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYRESHEX=r3], 0x50}, 0x1, 0x0, 0x0, 0x4000840}, 0x0) mkdir(&(0x7f0000000080)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000140)='./file1\x00', &(0x7f0000000040)='system.posix_acl_default\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="02000000010000000000f400040000000000000020"], 0x1c, 0x0) mkdir(&(0x7f0000000100)='./file1/file1\x00', 0x111) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r6, 0x10e, 0xc, &(0x7f0000000100)={0xc, 0x0, 0xfffffffc}, 0x10) write(r6, &(0x7f0000000000)="240000001a005f0214f9f4070008000000000000000000000000000008001a00fd000000", 0x24) setsockopt$inet6_tcp_int(r5, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r5, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r5, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r5, 0x11a, 0x1, &(0x7f0000000500)=@gcm_128={{0x303}, "a959fc5ec5071900", "8e083700daf38a6d69e9b5e9c2f133d7", "e2739528", "12772541f8ebfebb"}, 0x28) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000580)='memory.events\x00', 0x275a, 0x0) write$cgroup_int(r7, &(0x7f0000000000), 0xffffff6a) sendfile(r5, r7, 0x0, 0x2) ioctl$KVM_SET_GSI_ROUTING(r3, 0x4008ae6a, &(0x7f00000003c0)=ANY=[@ANYBLOB="010000000000c15f5bc815dbe66ca56965ff8d00000a000000010000000000000000000000010000800000000004000000000000009e3d0000000000009700000009000000"]) mount(&(0x7f0000001400)=@rnullb, &(0x7f0000001440)='./file0\x00', &(0x7f0000001480)='qnx4\x00', 0x0, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000680)={{{@in=@initdev, @in=@multicast1}}, {{@in6=@loopback}, 0x0, @in6=@mcast1}}, &(0x7f0000000480)=0xe8) ioctl$KVM_SET_VAPIC_ADDR(r0, 0x4008ae93, &(0x7f0000000000)=0x10000) 0s ago: executing program 3 (id=2482): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) r2 = socket$netlink(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$team(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000000240)) sendmsg$TEAM_CMD_OPTIONS_SET(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000840)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100"], 0x58}, 0x1, 0x0, 0x0, 0x24004000}, 0x24040840) sendmmsg$unix(r1, &(0x7f0000000000), 0x400000000000041, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000280)={0x1c, 0x34, 0x1, 0x70bd2a, 0x25dbdc01, {0x2}, [@typed={0x8, 0x4, 0x0, 0x0, @u32=0x24}]}, 0x1c}, 0x1, 0x0, 0x0, 0x24001}, 0x4000000) r6 = syz_open_dev$video(&(0x7f0000000000), 0x7ff, 0x0) ioctl$VIDIOC_ENUM_FRAMEINTERVALS(r6, 0xc034564b, &(0x7f00000002c0)={0x103, 0x35315258, 0xf00, 0x3c0, 0x1, @stepwise={{0xbe, 0x4}, {0x395c}, {0x0, 0x800}}}) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=@updsa={0x10c, 0x1a, 0x1, 0x0, 0x0, {{@in=@multicast2, @in=@initdev={0xac, 0x1e, 0x0, 0x0}}, {@in6=@loopback, 0x0, 0x3c}, @in=@multicast1, {}, {0x0, 0x0, 0x0, 0x1}, {}, 0x0, 0x0, 0xa}, [@coaddr={0x14}, @extra_flags={0x8, 0x18, 0x81}]}, 0x10c}}, 0x0) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@mcast1, @in=@multicast1, 0x4e24, 0x0, 0x0, 0x0, 0xa}, {0x10000, 0x3, 0x5, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0xfffffffffffffff7}, {0x0, 0x8, 0xfffffffffffffffc, 0x8}, 0x0, 0x0, 0x1, 0x0, 0x1}, {{@in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x2, 0x6c}, 0x2, @in=@empty, 0x0, 0x5, 0x0, 0xb7}}, 0xe8) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) shutdown(r0, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x2000000, 0x80010, r1, 0x5c5a0000) r8 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x480a22, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x12, r8, 0x45809000) socket$igmp6(0xa, 0x3, 0x2) r9 = socket$inet(0xa, 0x801, 0x84) connect$inet(r9, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r9, 0xfffffffd) r10 = accept4(r9, 0x0, 0x0, 0x0) ioctl$int_in(r10, 0x5452, &(0x7f0000000000)=0xd0c) setsockopt$inet_sctp6_SCTP_EVENTS(r10, 0x84, 0xb, &(0x7f00000002c0)={0x3, 0x1, 0x2, 0xff, 0xa4, 0x0, 0x1, 0x0, 0x5, 0x8, 0x0, 0x0, 0x2, 0x20}, 0xe) setsockopt$SO_BINDTODEVICE(r10, 0x1, 0x19, &(0x7f0000000040)='ip6gretap0\x00', 0x10) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000680)={0xb0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x3, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000100)={@fda={0x66646185, 0x3, 0x0, 0x13}, @ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/40, 0x28, 0x2}, @fd={0x66642a85, 0x0, r8}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x40}, @dead_binder_done, @acquire_done={0x40106309, 0x2}, @transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x71, 0x0, 0x0, 0x60, 0x18, &(0x7f00000004c0)={@ptr={0x70742a85, 0x1, &(0x7f0000000280)=""/48, 0x30, 0x0, 0x2a}, @flat=@handle={0x73682a85, 0xb, 0x3}, @fda={0x66646185, 0x8, 0x0, 0x1c}}, &(0x7f0000000540)={0x0, 0x28, 0x40}}}], 0x29, 0x0, &(0x7f0000000640)="17336e5eab6599ce42bf3dcebd6ac049af228276c1986988011367c559fd7b7e1526604ceb48bb7968"}) kernel console output (not intermixed with test programs): 024][ T5943] usb 3-1: Manufacturer: syz [ 413.500671][ T5943] usb 3-1: SerialNumber: syz [ 413.526536][ T5943] usb 3-1: config 0 descriptor?? [ 413.537209][T12519] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 413.550560][ T5943] ssu100 3-1:0.0: Quatech SSU-100 USB to Serial Driver converter detected [ 413.568032][T12519] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 413.584335][T12519] netlink: 428 bytes leftover after parsing attributes in process `syz.3.1798'. [ 413.601587][T12519] netlink: 56 bytes leftover after parsing attributes in process `syz.3.1798'. [ 413.632672][T12506] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1793'. [ 413.739543][T12512] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 413.751082][T12512] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 414.243896][T12525] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1800'. [ 414.335885][T12527] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 414.344749][T12527] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 414.595978][ T5943] ssu100 3-1:0.0: probe with driver ssu100 failed with error -71 [ 414.614411][ T5943] usb 3-1: USB disconnect, device number 7 [ 416.915763][ T3528] usb 3-1: new full-speed USB device number 8 using dummy_hcd [ 417.068213][ T3528] usb 3-1: not running at top speed; connect to a high speed hub [ 417.082502][ T3528] usb 3-1: config 1 interface 0 altsetting 14 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 417.098845][ T3528] usb 3-1: config 1 interface 0 altsetting 14 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 417.112273][ T3528] usb 3-1: config 1 interface 0 has no altsetting 0 [ 417.121933][ T3528] usb 3-1: New USB device found, idVendor=05ac, idProduct=022b, bcdDevice= 0.40 [ 417.132631][ T3528] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 417.142086][ T3528] usb 3-1: Product: ⽺ෲ⤧闥淥陚俦괕샋г퉹㵒ꖨ↯얔拤⃒褲蒣꿙놖ꎒ棍蠔胍皵⥢࣮㋪௞⤌㪁헔옰듢嫫ၧࡸ펉킩㦝㏫핣἖Ѯ䤭 [ 417.161297][ T3528] usb 3-1: Manufacturer: Д [ 417.168398][ T3528] usb 3-1: SerialNumber: 掹ኒꏒ멌񷪹ᖕ悅喧㇠থ巚벿㷐괢③ꥋ큲ꁭ殡㩵ꍰጹ둋ጽᡭ఼霟滹훭⡈̸ϒdz䬄훅䇼᏷ᧀ㣿짻轶ﶁ㢬㤪畐襷ꥵ鍽䲻쳠ᅼ獅맨æ୅ᒒꀇ둮ᅄ [ 417.193380][T12563] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 417.278358][T12567] /dev/rnullb0: Can't open blockdev [ 417.764061][ T3528] usbhid 3-1:1.0: can't add hid device: -71 [ 417.772845][ T3528] usbhid 3-1:1.0: probe with driver usbhid failed with error -71 [ 417.799441][ T3528] usb 3-1: USB disconnect, device number 8 [ 417.890283][T12576] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 417.899545][T12576] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 418.322680][T12592] PKCS7: Unknown OID: [5] (bad) [ 418.328908][T12592] PKCS7: Only support pkcs7_signedData type [ 418.778202][T12607] /dev/rnullb0: Can't open blockdev [ 419.200190][T12629] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1838'. [ 419.325803][ T5946] usb 5-1: new high-speed USB device number 73 using dummy_hcd [ 419.407907][ T10] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 419.486314][ T5946] usb 5-1: Using ep0 maxpacket: 32 [ 419.498174][ T5946] usb 5-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 419.508434][ T5946] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 419.517620][ T5946] usb 5-1: Product: syz [ 419.521901][ T5946] usb 5-1: Manufacturer: syz [ 419.526962][ T5946] usb 5-1: SerialNumber: syz [ 419.533972][ T5946] usb 5-1: config 0 descriptor?? [ 419.546192][ T10] usb 3-1: device descriptor read/64, error -71 [ 419.554622][ T5946] gspca_main: ov534_9-2.14.0 probing 05a9:1550 [ 419.795758][ T10] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 419.925745][ T10] usb 3-1: device descriptor read/64, error -71 [ 420.045948][ T10] usb usb3-port1: attempt power cycle [ 420.133646][T12634] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 420.146227][T12634] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 420.162627][T12634] /dev/rnullb0: Can't open blockdev [ 420.244824][T12636] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 420.259777][T12636] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 420.295174][ T30] audit: type=1326 audit(1751782204.286:29): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12635 comm="syz.3.1840" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fe00258e929 code=0x0 [ 420.385783][ T10] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 420.406375][ T10] usb 3-1: device descriptor read/8, error -71 [ 420.655803][ T10] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 420.678105][ T10] usb 3-1: device descriptor read/8, error -71 [ 420.788666][ T10] usb usb3-port1: unable to enumerate USB device [ 421.375175][ T5946] gspca_ov534_9: reg_r err -71 [ 421.655961][ T5946] gspca_ov534_9: Unknown sensor 0000 [ 421.656093][ T5946] ov534_9 5-1:0.0: probe with driver ov534_9 failed with error -22 [ 421.679233][ T5946] usb 5-1: USB disconnect, device number 73 [ 422.691044][T12660] NILFS (nullb0): couldn't find nilfs on the device [ 422.720186][T12660] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1847'. [ 422.730010][T12662] /dev/rnullb0: Can't open blockdev [ 422.734022][T12660] openvswitch: netlink: nsh attribute has 65532 unknown bytes. [ 422.746240][T12660] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 423.444255][T12673] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 423.459560][T12673] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 423.795718][ T3528] usb 5-1: new high-speed USB device number 74 using dummy_hcd [ 423.815807][ T5943] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 423.925930][ T3528] usb 5-1: device descriptor read/64, error -71 [ 423.945814][ T5943] usb 3-1: device descriptor read/64, error -71 [ 424.175830][ T3528] usb 5-1: new high-speed USB device number 75 using dummy_hcd [ 424.185714][ T5943] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 424.305724][ T3528] usb 5-1: device descriptor read/64, error -71 [ 424.326682][ T5943] usb 3-1: device descriptor read/64, error -71 [ 424.422091][ T3528] usb usb5-port1: attempt power cycle [ 424.436900][ T5943] usb usb3-port1: attempt power cycle [ 424.765832][ T3528] usb 5-1: new high-speed USB device number 76 using dummy_hcd [ 424.785715][ T5943] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 424.794011][ T3528] usb 5-1: device descriptor read/8, error -71 [ 424.806262][ T5943] usb 3-1: device descriptor read/8, error -71 [ 425.038730][ T3528] usb 5-1: new high-speed USB device number 77 using dummy_hcd [ 425.047028][ T5943] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 425.077090][ T3528] usb 5-1: device descriptor read/8, error -71 [ 425.083990][ T5943] usb 3-1: device descriptor read/8, error -71 [ 425.196275][ T3528] usb usb5-port1: unable to enumerate USB device [ 425.203142][ T5943] usb usb3-port1: unable to enumerate USB device [ 425.727782][T12714] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 425.742643][T12714] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 426.713108][T12723] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 426.747931][T12723] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 426.810368][T12729] /dev/rnullb0: Can't open blockdev [ 426.945829][ T3528] usb 5-1: new high-speed USB device number 78 using dummy_hcd [ 427.139347][ T3528] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 427.150149][ T3528] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 427.160758][ T3528] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 427.172748][ T3528] usb 5-1: config 0 descriptor?? [ 427.182268][ T3528] pwc: Askey VC010 type 2 USB webcam detected. [ 427.353966][T12748] syzkaller1: entered promiscuous mode [ 427.359881][T12748] syzkaller1: entered allmulticast mode [ 427.380161][ T3528] pwc: recv_control_msg error -32 req 02 val 2b00 [ 427.398207][ T3528] pwc: recv_control_msg error -32 req 02 val 2700 [ 427.407574][ T3528] pwc: recv_control_msg error -32 req 02 val 2c00 [ 427.415299][ T3528] pwc: recv_control_msg error -32 req 04 val 1000 [ 427.423843][T12724] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 427.432471][ T3528] pwc: recv_control_msg error -32 req 04 val 1300 [ 427.440615][T12724] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 427.451334][ T3528] pwc: recv_control_msg error -32 req 04 val 1400 [ 427.458658][ T3528] pwc: recv_control_msg error -32 req 02 val 2000 [ 427.468223][ T3528] pwc: recv_control_msg error -32 req 02 val 2100 [ 427.486008][ T3528] pwc: recv_control_msg error -32 req 04 val 1500 [ 427.600529][T12756] /dev/rnullb0: Can't open blockdev [ 427.646027][ T5906] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 427.711832][ T3528] pwc: recv_control_msg error -71 req 02 val 2400 [ 427.724601][ T3528] pwc: recv_control_msg error -71 req 02 val 2600 [ 427.731974][ T3528] pwc: recv_control_msg error -71 req 02 val 2900 [ 427.746399][ T3528] pwc: recv_control_msg error -71 req 02 val 2800 [ 427.753337][ T3528] pwc: recv_control_msg error -71 req 04 val 1100 [ 427.760470][ T3528] pwc: recv_control_msg error -71 req 04 val 1200 [ 427.770431][ T3528] pwc: Registered as video103. [ 427.775877][ T5906] usb 3-1: device descriptor read/64, error -71 [ 427.787776][ T3528] input: PWC snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/input/input42 [ 427.823064][ T3528] usb 5-1: USB disconnect, device number 78 [ 427.853254][ T30] audit: type=1326 audit(1751782211.846:30): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12763 comm="syz.3.1882" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fe00258e929 code=0x0 [ 428.045936][ T5906] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 428.185660][ T5906] usb 3-1: device descriptor read/64, error -71 [ 428.296006][ T5906] usb usb3-port1: attempt power cycle [ 428.605388][ T5861] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 428.614515][ T5861] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 428.625173][ T5861] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 428.637649][ T5861] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 428.648712][ T5861] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 428.656716][ T5906] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 428.691779][ T5906] usb 3-1: device descriptor read/8, error -71 [ 428.945922][ T5906] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 428.996062][ T5906] usb 3-1: device descriptor read/8, error -71 [ 429.003268][T12773] chnl_net:caif_netlink_parms(): no params data found [ 429.032849][T12789] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 429.048711][T12789] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 429.107074][ T5906] usb usb3-port1: unable to enumerate USB device [ 429.135218][T12773] bridge0: port 1(bridge_slave_0) entered blocking state [ 429.142732][T12773] bridge0: port 1(bridge_slave_0) entered disabled state [ 429.150267][T12773] bridge_slave_0: entered allmulticast mode [ 429.158539][T12773] bridge_slave_0: entered promiscuous mode [ 429.166941][T12773] bridge0: port 2(bridge_slave_1) entered blocking state [ 429.174071][T12773] bridge0: port 2(bridge_slave_1) entered disabled state [ 429.181688][T12773] bridge_slave_1: entered allmulticast mode [ 429.189314][T12773] bridge_slave_1: entered promiscuous mode [ 429.233518][T12773] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 429.246525][T12773] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 429.287313][T12773] team0: Port device team_slave_0 added [ 429.295325][T12773] team0: Port device team_slave_1 added [ 429.333149][T12773] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 429.341273][T12773] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 429.368137][T12773] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 429.381008][T12773] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 429.388062][T12773] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 429.414211][T12773] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 429.470346][T12773] hsr_slave_0: entered promiscuous mode [ 429.477142][T12773] hsr_slave_1: entered promiscuous mode [ 429.483307][T12773] debugfs: 'hsr0' already exists in 'hsr' [ 429.489724][T12773] Cannot create hsr debugfs directory [ 429.784118][T12773] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 429.803147][T12773] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 429.815027][T12773] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 429.825768][ T3528] usb 5-1: new high-speed USB device number 79 using dummy_hcd [ 429.839566][T12773] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 429.893037][T12773] bridge0: port 2(bridge_slave_1) entered blocking state [ 429.901681][T12773] bridge0: port 2(bridge_slave_1) entered forwarding state [ 429.909454][T12773] bridge0: port 1(bridge_slave_0) entered blocking state [ 429.916694][T12773] bridge0: port 1(bridge_slave_0) entered forwarding state [ 429.935107][T12808] /dev/rnullb0: Can't open blockdev [ 429.936057][ T36] bridge0: port 1(bridge_slave_0) entered disabled state [ 429.952222][ T36] bridge0: port 2(bridge_slave_1) entered disabled state [ 429.998227][ T3528] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 430.017928][ T3528] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 430.033024][ T3528] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 430.064146][ T3528] usb 5-1: config 0 descriptor?? [ 430.073702][ T3528] pwc: Askey VC010 type 2 USB webcam detected. [ 430.095274][T12773] 8021q: adding VLAN 0 to HW filter on device bond0 [ 430.174513][ T36] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 430.230833][T12773] 8021q: adding VLAN 0 to HW filter on device team0 [ 430.250335][ T4345] bridge0: port 1(bridge_slave_0) entered blocking state [ 430.257661][ T4345] bridge0: port 1(bridge_slave_0) entered forwarding state [ 430.276290][ T3528] pwc: recv_control_msg error -32 req 02 val 2b00 [ 430.322260][ T36] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 430.323387][ T3528] pwc: recv_control_msg error -71 req 02 val 2700 [ 430.362887][ T3528] pwc: recv_control_msg error -71 req 02 val 2c00 [ 430.380722][T10091] bridge0: port 2(bridge_slave_1) entered blocking state [ 430.381039][ T3528] pwc: recv_control_msg error -71 req 04 val 1000 [ 430.388040][T10091] bridge0: port 2(bridge_slave_1) entered forwarding state [ 430.492331][ T3528] pwc: recv_control_msg error -71 req 04 val 1300 [ 430.516419][ T3528] pwc: recv_control_msg error -71 req 04 val 1400 [ 430.536204][ T3528] pwc: recv_control_msg error -71 req 02 val 2000 [ 430.544385][ T3528] pwc: recv_control_msg error -71 req 02 val 2100 [ 430.548479][ T36] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 430.576952][ T3528] pwc: recv_control_msg error -71 req 04 val 1500 [ 430.597163][ T3528] pwc: recv_control_msg error -71 req 02 val 2500 [ 430.616736][ T3528] pwc: recv_control_msg error -71 req 02 val 2400 [ 430.635269][ T3528] pwc: recv_control_msg error -71 req 02 val 2600 [ 430.653376][ T3528] pwc: recv_control_msg error -71 req 02 val 2900 [ 430.669821][ T36] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 430.687331][ T3528] pwc: recv_control_msg error -71 req 02 val 2800 [ 430.705758][ T3528] pwc: recv_control_msg error -71 req 04 val 1100 [ 430.712772][ T3528] pwc: recv_control_msg error -71 req 04 val 1200 [ 430.731475][ T5861] Bluetooth: hci0: command tx timeout [ 430.738837][ T3528] pwc: Registered as video103. [ 430.749021][ T3528] input: PWC snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/input/input44 [ 430.851849][ T3528] usb 5-1: USB disconnect, device number 79 [ 431.210930][ T36] bridge_slave_1: left allmulticast mode [ 431.230407][ T36] bridge_slave_1: left promiscuous mode [ 431.250412][ T36] bridge0: port 2(bridge_slave_1) entered disabled state [ 431.305996][ T5943] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 431.312613][ T36] bridge_slave_0: left allmulticast mode [ 431.338816][ T36] bridge_slave_0: left promiscuous mode [ 431.347063][ T36] bridge0: port 1(bridge_slave_0) entered disabled state [ 431.465905][ T5943] usb 3-1: Using ep0 maxpacket: 32 [ 431.486981][ T5943] usb 3-1: config index 0 descriptor too short (expected 156, got 27) [ 431.507887][ T5943] usb 3-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 431.542332][ T5943] usb 3-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 431.567350][ T5943] usb 3-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 431.593981][ T5943] usb 3-1: config 0 interface 0 has no altsetting 0 [ 431.604460][ T5943] usb 3-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 431.619884][ T5943] usb 3-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 431.629637][ T5943] usb 3-1: Product: syz [ 431.633848][ T5943] usb 3-1: Manufacturer: syz [ 431.643679][T12842] netlink: 'syz.3.1902': attribute type 1 has an invalid length. [ 431.653025][ T5943] usb 3-1: SerialNumber: syz [ 431.662028][T12842] netlink: 208 bytes leftover after parsing attributes in process `syz.3.1902'. [ 431.675396][ T5943] usb 3-1: config 0 descriptor?? [ 431.697369][ T5943] ldusb 3-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 431.719112][ T5943] ldusb 3-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 431.733279][T12842] netlink: 'syz.3.1902': attribute type 1 has an invalid length. [ 431.751878][T12842] netlink: 'syz.3.1902': attribute type 2 has an invalid length. [ 432.295037][ T3528] usb 3-1: USB disconnect, device number 21 [ 432.297723][ C0] ldusb 3-1:0.0: usb_submit_urb failed (-19) [ 432.323183][ T3528] ldusb 3-1:0.0: LD USB Device #0 now disconnected [ 432.370807][ T5943] usb 5-1: new high-speed USB device number 80 using dummy_hcd [ 432.425180][ T36] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 432.440808][ T36] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 432.453920][ T36] bond0 (unregistering): Released all slaves [ 432.507918][ T5943] usb 5-1: device descriptor read/64, error -71 [ 432.672013][T12866] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 432.672742][T12773] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 432.681844][T12866] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 432.755688][ T5943] usb 5-1: new high-speed USB device number 81 using dummy_hcd [ 432.817476][ T5861] Bluetooth: hci0: command tx timeout [ 432.916574][ T5943] usb 5-1: device descriptor read/64, error -71 [ 433.032874][ T5943] usb usb5-port1: attempt power cycle [ 433.053056][T12874] /dev/rnullb0: Can't open blockdev [ 433.275347][ T36] hsr_slave_0: left promiscuous mode [ 433.300979][ T36] hsr_slave_1: left promiscuous mode [ 433.313286][T12881] /dev/rnullb0: Can't open blockdev [ 433.322614][ T36] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 433.349637][ T36] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 433.367530][ T36] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 433.400831][ T36] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 433.408811][ T5943] usb 5-1: new high-speed USB device number 82 using dummy_hcd [ 433.457418][ T5943] usb 5-1: device descriptor read/8, error -71 [ 433.506596][ T36] veth1_macvtap: left promiscuous mode [ 433.512229][ T36] veth0_macvtap: left promiscuous mode [ 433.542025][ T36] veth1_vlan: left promiscuous mode [ 433.561311][ T36] veth0_vlan: left promiscuous mode [ 433.719254][ T5943] usb 5-1: new high-speed USB device number 83 using dummy_hcd [ 433.757727][ T5943] usb 5-1: device descriptor read/8, error -71 [ 433.866163][ T5943] usb usb5-port1: unable to enumerate USB device [ 434.885703][ T5861] Bluetooth: hci0: command tx timeout [ 435.182969][ T36] team0 (unregistering): Port device team_slave_1 removed [ 435.250363][T12899] /dev/rnullb0: Can't open blockdev [ 435.297454][ T36] team0 (unregistering): Port device team_slave_0 removed [ 436.263777][T12915] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 436.303892][T12915] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 436.348080][T12915] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 436.416705][T12915] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 436.764900][T12773] veth0_vlan: entered promiscuous mode [ 436.804848][T12773] veth1_vlan: entered promiscuous mode [ 436.888846][T12773] veth0_macvtap: entered promiscuous mode [ 436.910203][T12773] veth1_macvtap: entered promiscuous mode [ 436.967773][ T5861] Bluetooth: hci0: command tx timeout [ 436.985266][T12773] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 437.032414][T12773] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 437.069660][T10098] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 437.130770][T10098] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 437.156503][T10098] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 437.190506][ T12] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 437.321615][T12936] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 437.347653][T12936] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 437.365848][T10098] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 437.373825][T10098] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 437.439748][T10098] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 437.452350][T10098] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 438.060652][T12952] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 438.158461][T12959] netlink: 'syz.3.1920': attribute type 21 has an invalid length. [ 438.173276][T12959] netlink: 156 bytes leftover after parsing attributes in process `syz.3.1920'. [ 438.306191][T12965] MTD: Attempt to mount non-MTD device "/dev/rnullb0" [ 438.316112][T12965] /dev/rnullb0: Can't open blockdev [ 438.551157][T12973] /dev/rnullb0: Can't open blockdev [ 438.904118][T12982] /dev/rnullb0: Can't open blockdev [ 439.184276][T12997] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 439.204295][T12997] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 439.235421][T13001] /dev/rnullb0: Can't open blockdev [ 439.245149][T12997] /dev/rnullb0: Can't open blockdev [ 439.366856][ T5943] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 439.515930][ T5943] usb 3-1: device descriptor read/64, error -71 [ 439.585853][ T5946] usb 5-1: new high-speed USB device number 84 using dummy_hcd [ 439.655899][ T24] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 439.745800][ T5946] usb 5-1: Using ep0 maxpacket: 32 [ 439.757366][ T5946] usb 5-1: config 0 has an invalid interface number: 184 but max is 0 [ 439.771453][ T5946] usb 5-1: config 0 has no interface number 0 [ 439.786843][ T5946] usb 5-1: config 0 interface 184 has no altsetting 0 [ 439.796062][ T5943] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 439.802370][ T5946] usb 5-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 439.813565][ T5946] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 439.829560][ T24] usb 7-1: config 0 has too many interfaces: 202, using maximum allowed: 32 [ 439.830957][ T5946] usb 5-1: Product: syz [ 439.855717][ T5946] usb 5-1: Manufacturer: syz [ 439.855720][ T24] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 439.855745][ T24] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 202 [ 439.871347][ T5946] usb 5-1: SerialNumber: syz [ 439.907444][ T24] usb 7-1: New USB device found, idVendor=07fd, idProduct=0001, bcdDevice=48.99 [ 439.921324][ T5946] usb 5-1: config 0 descriptor?? [ 439.926112][ T24] usb 7-1: New USB device strings: Mfr=33, Product=2, SerialNumber=3 [ 439.932358][ T5946] smsc75xx v1.0.0 [ 439.942529][ T24] usb 7-1: Product: syz [ 439.955993][ T5943] usb 3-1: device descriptor read/64, error -71 [ 439.963369][ T24] usb 7-1: Manufacturer: syz [ 439.987667][ T24] usb 7-1: SerialNumber: syz [ 440.008325][ T24] usb 7-1: config 0 descriptor?? [ 440.030175][ T24] usb 7-1: Quirk or no altset; falling back to MIDI 1.0 [ 440.051745][ T5861] Bluetooth: hci3: unexpected cc 0x2007 length: 100 > 2 [ 440.063213][ T5861] Bluetooth: hci3: unexpected event for opcode 0x2007 [ 440.076222][ T5943] usb usb3-port1: attempt power cycle [ 440.222205][T13013] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1933'. [ 440.228988][T13034] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1933'. [ 440.435738][ T5943] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 440.468316][ T5943] usb 3-1: device descriptor read/8, error -71 [ 440.715755][ T5943] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 440.766084][ T5943] usb 3-1: device descriptor read/8, error -71 [ 440.876457][ T5943] usb usb3-port1: unable to enumerate USB device [ 441.288437][T13059] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 441.308236][T13059] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 442.014771][T13078] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 442.029718][ T5946] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000040: -71 [ 442.041254][ T5946] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Error writing E2P_CMD [ 442.051221][T13078] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 442.080912][ T5946] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 442.102271][ T5946] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 442.112603][ T5946] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 442.139892][ T5946] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 442.182430][ T5946] smsc75xx 5-1:0.184: probe with driver smsc75xx failed with error -71 [ 442.226959][ T5946] usb 5-1: USB disconnect, device number 84 [ 442.521015][ T24] snd-usb-audio 7-1:0.0: probe with driver snd-usb-audio failed with error -2 [ 442.531854][ T3528] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 442.573231][ T24] usb 7-1: USB disconnect, device number 2 [ 442.601664][T13093] netlink: 'syz.6.1942': attribute type 2 has an invalid length. [ 442.669674][ T6228] udevd[6228]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 442.708684][ T3528] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 442.741820][ T3528] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 442.788777][ T3528] usb 3-1: New USB device found, idVendor=09e1, idProduct=5121, bcdDevice=40.c1 [ 442.815184][T13099] MTD: Attempt to mount non-MTD device "/dev/rnullb0" [ 442.815641][ T3528] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 442.832657][T13099] /dev/rnullb0: Can't open blockdev [ 442.850736][ T3528] usb 3-1: Product: syz [ 442.855069][ T3528] usb 3-1: Manufacturer: syz [ 442.875785][ T3528] usb 3-1: SerialNumber: syz [ 442.895206][ T123] block nbd0: Possible stuck request ffff888025480000: control (read@0,1024B). Runtime 30 seconds [ 442.901801][ T3528] usb 3-1: config 0 descriptor?? [ 442.907031][ T123] block nbd0: Possible stuck request ffff8880254801c0: control (read@1024,1024B). Runtime 30 seconds [ 442.922437][ T123] block nbd0: Possible stuck request ffff888025480380: control (read@2048,1024B). Runtime 30 seconds [ 442.933626][ T123] block nbd0: Possible stuck request ffff888025480540: control (read@3072,1024B). Runtime 30 seconds [ 443.136391][T13106] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1944'. [ 443.183917][ T30] audit: type=1800 audit(1751782227.176:31): pid=13082 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.1941" name="SYSV00000000" dev="hugetlbfs" ino=2 res=0 errno=0 [ 443.219812][T13107] FAULT_INJECTION: forcing a failure. [ 443.219812][T13107] name failslab, interval 1, probability 0, space 0, times 0 [ 443.263331][T13107] CPU: 1 UID: 0 PID: 13107 Comm: syz.3.1945 Not tainted 6.16.0-rc4-next-20250704-syzkaller #0 PREEMPT(full) [ 443.263366][T13107] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 443.263381][T13107] Call Trace: [ 443.263390][T13107] [ 443.263401][T13107] dump_stack_lvl+0x189/0x250 [ 443.263441][T13107] ? __pfx____ratelimit+0x10/0x10 [ 443.263467][T13107] ? __pfx_dump_stack_lvl+0x10/0x10 [ 443.263499][T13107] ? __pfx__printk+0x10/0x10 [ 443.263538][T13107] ? __pfx___might_resched+0x10/0x10 [ 443.263567][T13107] ? fs_reclaim_acquire+0x7d/0x100 [ 443.263597][T13107] should_fail_ex+0x414/0x560 [ 443.263637][T13107] should_failslab+0xa8/0x100 [ 443.263660][T13107] __kmalloc_noprof+0xcb/0x4f0 [ 443.263692][T13107] ? kfree+0x4d/0x440 [ 443.263720][T13107] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 443.263761][T13107] tomoyo_realpath_from_path+0xe3/0x5d0 [ 443.263799][T13107] ? tomoyo_domain+0xd9/0x130 [ 443.263825][T13107] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 443.263854][T13107] tomoyo_path_number_perm+0x1e8/0x5a0 [ 443.263893][T13107] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 443.263942][T13107] ? __lock_acquire+0xab9/0xd20 [ 443.263992][T13107] ? __fget_files+0x2a/0x420 [ 443.264021][T13107] ? __fget_files+0x2a/0x420 [ 443.264049][T13107] ? __fget_files+0x3a0/0x420 [ 443.264073][T13107] ? __fget_files+0x2a/0x420 [ 443.264102][T13107] security_file_ioctl+0xcb/0x2d0 [ 443.264132][T13107] __se_sys_ioctl+0x47/0x170 [ 443.264167][T13107] do_syscall_64+0xfa/0x3b0 [ 443.264199][T13107] ? lockdep_hardirqs_on+0x9c/0x150 [ 443.264222][T13107] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 443.264245][T13107] ? clear_bhb_loop+0x60/0xb0 [ 443.264273][T13107] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 443.264295][T13107] RIP: 0033:0x7fe00258e929 [ 443.264316][T13107] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 443.264337][T13107] RSP: 002b:00007fe0034d6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 443.264362][T13107] RAX: ffffffffffffffda RBX: 00007fe0027b5fa0 RCX: 00007fe00258e929 [ 443.264379][T13107] RDX: 0000200000000500 RSI: 000000004008ae89 RDI: 0000000000000008 [ 443.264394][T13107] RBP: 00007fe0034d6090 R08: 0000000000000000 R09: 0000000000000000 [ 443.264408][T13107] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 443.264421][T13107] R13: 0000000000000000 R14: 00007fe0027b5fa0 R15: 00007ffc635f5868 [ 443.264456][T13107] [ 443.264797][T13107] ERROR: Out of memory at tomoyo_realpath_from_path. [ 444.083107][T13132] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 444.094657][ T5861] Bluetooth: hci3: Controller not accepting commands anymore: ncmd = 0 [ 444.103719][ T5861] Bluetooth: hci3: Injecting HCI hardware error event [ 444.106299][T13132] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 444.115756][T12097] Bluetooth: hci3: hardware error 0x00 [ 444.150512][T13134] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 445.123881][ T3528] usb 4-1: USB disconnect, device number 110 [ 445.285708][ T5946] usb 3-1: USB disconnect, device number 26 [ 445.419311][T13165] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1959'. [ 445.451417][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 445.465878][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 446.039788][ T44] usb 5-1: new high-speed USB device number 85 using dummy_hcd [ 446.205145][ T51] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 446.215482][ T51] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 446.225336][ T51] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 446.238297][ T51] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 446.248068][ T51] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 446.257049][T12097] Bluetooth: hci3: Opcode 0x0c03 failed: -110 [ 446.529042][ T73] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 446.847903][ T73] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 447.018613][T13201] netlink: 'syz.6.1968': attribute type 1 has an invalid length. [ 447.070443][T13202] netlink: 'syz.6.1968': attribute type 1 has an invalid length. [ 447.084565][T13201] netlink: 'syz.6.1968': attribute type 4 has an invalid length. [ 447.093046][T13202] netlink: 'syz.6.1968': attribute type 4 has an invalid length. [ 447.102995][ T73] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 447.136504][T13202] netlink: 9462 bytes leftover after parsing attributes in process `syz.6.1968'. [ 447.146375][T13201] netlink: 9462 bytes leftover after parsing attributes in process `syz.6.1968'. [ 447.178337][T13176] chnl_net:caif_netlink_parms(): no params data found [ 447.324829][ T73] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 447.353915][T13213] binder: 13208:13213 ioctl c0306201 2000000003c0 returned -14 [ 447.409823][ T30] audit: type=1326 audit(1751782231.406:32): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13207 comm="syz.4.1969" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f4a6858e929 code=0x0 [ 447.631089][T13176] bridge0: port 1(bridge_slave_0) entered blocking state [ 447.638851][T13176] bridge0: port 1(bridge_slave_0) entered disabled state [ 447.646227][T13176] bridge_slave_0: entered allmulticast mode [ 447.655838][T13176] bridge_slave_0: entered promiscuous mode [ 447.739579][T13176] bridge0: port 2(bridge_slave_1) entered blocking state [ 447.755767][T13176] bridge0: port 2(bridge_slave_1) entered disabled state [ 447.763118][T13176] bridge_slave_1: entered allmulticast mode [ 447.772532][T13176] bridge_slave_1: entered promiscuous mode [ 447.846443][T13176] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 447.862068][ T73] bridge_slave_1: left allmulticast mode [ 447.869403][ T73] bridge_slave_1: left promiscuous mode [ 447.875381][ T73] bridge0: port 2(bridge_slave_1) entered disabled state [ 447.887320][ T73] bridge_slave_0: left allmulticast mode [ 447.893091][ T73] bridge_slave_0: left promiscuous mode [ 447.899455][ T73] bridge0: port 1(bridge_slave_0) entered disabled state [ 448.330865][T13234] netlink: 'syz.6.1975': attribute type 1 has an invalid length. [ 448.331713][ T5861] Bluetooth: hci5: command tx timeout [ 448.341643][T13235] netlink: 'syz.6.1975': attribute type 1 has an invalid length. [ 448.358371][T13234] /dev/rnullb0: Can't open blockdev [ 448.622532][T13240] /dev/rnullb0: Can't open blockdev [ 448.837997][ T73] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 448.863676][ T73] bond0 (unregistering): Released all slaves [ 448.934129][T13176] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 449.085502][T13176] team0: Port device team_slave_0 added [ 449.117175][T13176] team0: Port device team_slave_1 added [ 449.442257][T13265] ./file0: Can't lookup blockdev [ 449.463221][T13176] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 449.480672][T13176] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 449.548658][T13176] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 449.616753][T13176] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 449.623761][T13176] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 449.660424][T13176] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 449.954328][ T73] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 449.967078][ T73] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 449.979786][ T73] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 449.995688][ T73] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 450.053553][ T73] batman_adv: batadv0: Interface deactivated: virt_wifi0 [ 450.075349][ T73] batman_adv: batadv0: Removing interface: virt_wifi0 [ 450.126002][ T73] veth1_macvtap: left promiscuous mode [ 450.138202][ T73] veth0_macvtap: left promiscuous mode [ 450.151235][ T73] veth1_vlan: left promiscuous mode [ 450.163373][ T73] veth0_vlan: left promiscuous mode [ 450.405885][ T5861] Bluetooth: hci5: command tx timeout [ 450.411219][ T5954] usb 5-1: new high-speed USB device number 86 using dummy_hcd [ 450.568191][ T5954] usb 5-1: Using ep0 maxpacket: 16 [ 450.576467][ T5954] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 450.609156][ T5954] usb 5-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 450.637094][ T5954] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 450.686911][ T5954] usb 5-1: config 0 descriptor?? [ 451.132493][T13291] binder: 13290:13291 ioctl 4018620d 0 returned -22 [ 451.137917][T13308] /dev/rnullb0: Can't open blockdev [ 451.161636][ T5954] mcp2221 0003:04D8:00DD.001A: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.4-1/input0 [ 451.178967][ T73] team0 (unregistering): Port device team_slave_1 removed [ 451.236741][ T73] team0 (unregistering): Port device team_slave_0 removed [ 451.562218][ T5954] usb 5-1: USB disconnect, device number 86 [ 451.802598][T13176] hsr_slave_0: entered promiscuous mode [ 451.811184][T13176] hsr_slave_1: entered promiscuous mode [ 451.818235][T13176] debugfs: 'hsr0' already exists in 'hsr' [ 451.824116][T13176] Cannot create hsr debugfs directory [ 452.235769][ T24] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 452.266928][T13328] /dev/rnullb0: Can't open blockdev [ 452.407136][T13331] netlink: 5 bytes leftover after parsing attributes in process `syz.4.1994'. [ 452.428658][ T24] usb 3-1: Using ep0 maxpacket: 32 [ 452.486214][ T5861] Bluetooth: hci5: command tx timeout [ 452.503512][ T24] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 452.535519][ T24] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 452.554211][ T24] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 452.565542][ T24] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x7 has an invalid bInterval 255, changing to 11 [ 452.585040][ T24] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid maxpacket 59391, setting to 1024 [ 452.632111][ T24] usb 3-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 452.643148][ T73] IPVS: stop unused estimator thread 0... [ 452.656283][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 452.685398][ T24] usb 3-1: Product: syz [ 452.695176][ T24] usb 3-1: Manufacturer: syz [ 452.705097][ T24] usb 3-1: SerialNumber: syz [ 452.736842][ T24] usb 3-1: config 0 descriptor?? [ 452.852303][T13342] /dev/rnullb0: Can't open blockdev [ 453.010574][T13346] /dev/rnullb0: Can't open blockdev [ 453.151647][T13313] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 453.180796][T13313] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 453.214815][ T24] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 453.252654][ T24] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 453.273297][ T24] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 453.319886][ T24] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 453.331304][ T24] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 453.345910][ T24] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 453.352596][ T24] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 453.366604][ T24] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 453.388625][ T24] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 453.407671][ T24] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 453.414162][ T24] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 453.426639][ T24] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 453.442018][ T24] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 453.456177][ T24] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 453.456611][ T5954] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 453.466383][ T24] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 453.506229][ T24] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 453.512700][ T24] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 453.523707][T13176] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 453.541425][ T24] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 453.554428][ T24] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 453.568400][ T24] input input45: Timeout waiting for response from device. [ 453.570637][T13176] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 453.606284][ T24] usb 3-1: USB disconnect, device number 27 [ 453.612869][T13176] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 453.650283][T13365] overlayfs: option "volatile" is meaningless in a non-upper mount, ignoring it. [ 453.660227][T13365] overlayfs: missing 'lowerdir' [ 453.670564][ T5954] usb 7-1: Using ep0 maxpacket: 32 [ 453.687759][T13176] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 453.698421][ T5954] usb 7-1: config 0 has an invalid interface number: 67 but max is 0 [ 453.708046][ T5954] usb 7-1: config 0 has no interface number 0 [ 453.730249][ T5954] usb 7-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 453.760066][ T5954] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 453.808076][ T5954] usb 7-1: Product: syz [ 453.812315][ T5954] usb 7-1: Manufacturer: syz [ 453.857120][ T5954] usb 7-1: SerialNumber: syz [ 453.888412][ T5954] usb 7-1: config 0 descriptor?? [ 453.924238][ T5954] smsc95xx v2.0.0 [ 454.054877][T13176] 8021q: adding VLAN 0 to HW filter on device bond0 [ 454.112273][T13176] 8021q: adding VLAN 0 to HW filter on device team0 [ 454.131197][T10098] bridge0: port 1(bridge_slave_0) entered blocking state [ 454.138467][T10098] bridge0: port 1(bridge_slave_0) entered forwarding state [ 454.180517][ T73] bridge0: port 2(bridge_slave_1) entered blocking state [ 454.187770][ T73] bridge0: port 2(bridge_slave_1) entered forwarding state [ 454.225892][ T10] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 454.332340][ T5954] smsc95xx 7-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 454.362311][ T5954] smsc95xx 7-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 454.413732][ T10] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 454.445614][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 454.469832][T13389] /dev/rnullb0: Can't open blockdev [ 454.496716][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 454.519641][ T10] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 454.542057][ T10] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 454.562221][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 454.567308][ T5861] Bluetooth: hci5: command tx timeout [ 454.624610][ T10] usb 3-1: config 0 descriptor?? [ 454.776514][T13398] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2005'. [ 454.923042][T13176] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 455.023005][T13176] veth0_vlan: entered promiscuous mode [ 455.071864][T13176] veth1_vlan: entered promiscuous mode [ 455.084405][ T10] plantronics 0003:047F:FFFF.001B: ignoring exceeding usage max [ 455.145620][ T10] plantronics 0003:047F:FFFF.001B: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 455.172641][T13176] veth0_macvtap: entered promiscuous mode [ 455.234344][T13176] veth1_macvtap: entered promiscuous mode [ 455.300694][T13176] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 455.334444][T13176] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 455.360283][ T73] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 455.392533][ T73] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 455.423408][ T73] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 455.434967][T13412] /dev/rnullb0: Can't open blockdev [ 455.454250][ T73] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 455.522648][ T73] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 455.546668][ T73] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 455.589426][ T4345] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 455.599242][ T4345] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 455.788782][T13416] FAULT_INJECTION: forcing a failure. [ 455.788782][T13416] name failslab, interval 1, probability 0, space 0, times 0 [ 455.803744][T13416] CPU: 1 UID: 0 PID: 13416 Comm: syz.3.1956 Not tainted 6.16.0-rc4-next-20250704-syzkaller #0 PREEMPT(full) [ 455.803777][T13416] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 455.803792][T13416] Call Trace: [ 455.803802][T13416] [ 455.803812][T13416] dump_stack_lvl+0x189/0x250 [ 455.803850][T13416] ? __pfx____ratelimit+0x10/0x10 [ 455.803876][T13416] ? __pfx_dump_stack_lvl+0x10/0x10 [ 455.803908][T13416] ? __pfx__printk+0x10/0x10 [ 455.803944][T13416] ? __pfx___might_resched+0x10/0x10 [ 455.803973][T13416] ? fs_reclaim_acquire+0x7d/0x100 [ 455.804003][T13416] should_fail_ex+0x414/0x560 [ 455.804043][T13416] should_failslab+0xa8/0x100 [ 455.804067][T13416] __kmalloc_noprof+0xcb/0x4f0 [ 455.804099][T13416] ? tomoyo_encode+0x28b/0x550 [ 455.804149][T13416] tomoyo_encode+0x28b/0x550 [ 455.804191][T13416] tomoyo_realpath_from_path+0x58d/0x5d0 [ 455.804228][T13416] ? tomoyo_domain+0xd9/0x130 [ 455.804256][T13416] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 455.804286][T13416] tomoyo_path_number_perm+0x1e8/0x5a0 [ 455.804319][T13416] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 455.804368][T13416] ? __lock_acquire+0xab9/0xd20 [ 455.804417][T13416] ? __fget_files+0x2a/0x420 [ 455.804445][T13416] ? __fget_files+0x2a/0x420 [ 455.804469][T13416] ? __fget_files+0x3a0/0x420 [ 455.804493][T13416] ? __fget_files+0x2a/0x420 [ 455.804522][T13416] security_file_ioctl+0xcb/0x2d0 [ 455.804553][T13416] __se_sys_ioctl+0x47/0x170 [ 455.804589][T13416] do_syscall_64+0xfa/0x3b0 [ 455.804614][T13416] ? lockdep_hardirqs_on+0x9c/0x150 [ 455.804638][T13416] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 455.804661][T13416] ? clear_bhb_loop+0x60/0xb0 [ 455.804689][T13416] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 455.804711][T13416] RIP: 0033:0x7fe39e98e929 [ 455.804733][T13416] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 455.804753][T13416] RSP: 002b:00007fe39f788038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 455.804777][T13416] RAX: ffffffffffffffda RBX: 00007fe39ebb5fa0 RCX: 00007fe39e98e929 [ 455.804794][T13416] RDX: 0000200000000500 RSI: 000000004008ae89 RDI: 0000000000000008 [ 455.804809][T13416] RBP: 00007fe39f788090 R08: 0000000000000000 R09: 0000000000000000 [ 455.804824][T13416] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 455.804839][T13416] R13: 0000000000000000 R14: 00007fe39ebb5fa0 R15: 00007ffcbefb5518 [ 455.804873][T13416] [ 455.804896][T13416] ERROR: Out of memory at tomoyo_realpath_from_path. [ 456.240090][T13423] netlink: 60 bytes leftover after parsing attributes in process `syz.4.2007'. [ 456.472388][T13352] /dev/rnullb0: Can't open blockdev [ 456.479260][ T5954] smsc95xx 7-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000006c: -71 [ 456.521352][ T5954] smsc95xx 7-1:0.67: probe with driver smsc95xx failed with error -71 [ 456.566242][ T5954] usb 7-1: USB disconnect, device number 3 [ 457.120492][ T10] usb 3-1: USB disconnect, device number 28 [ 457.669208][ T5908] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 457.844320][ T5908] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 457.881881][ T5908] usb 3-1: config 0 has no interfaces? [ 457.906443][ T5908] usb 3-1: New USB device found, idVendor=15f4, idProduct=0015, bcdDevice=d1.6e [ 457.925912][ T5908] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 457.945290][ T5908] usb 3-1: Product: syz [ 457.968334][ T5908] usb 3-1: Manufacturer: syz [ 457.973003][ T5908] usb 3-1: SerialNumber: syz [ 457.988908][ T5908] usb 3-1: config 0 descriptor?? [ 458.187565][ T5899] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 458.214021][ T3528] usb 3-1: USB disconnect, device number 29 [ 458.355629][ T5899] usb 7-1: Using ep0 maxpacket: 8 [ 458.366273][ T5899] usb 7-1: New USB device found, idVendor=10d2, idProduct=2865, bcdDevice=a4.c9 [ 458.375471][ T5899] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 458.413967][ T5899] usb 7-1: config 0 descriptor?? [ 458.426519][ T5899] usblcd 7-1:0.0: USBLCD model not supported. [ 459.407968][ T5861] Bluetooth: hci2: unexpected cc 0x0c2d length: 69 > 4 [ 459.414894][ T5861] Bluetooth: hci2: unexpected event for opcode 0x0c2d [ 460.568360][ T5908] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 460.752262][ T5908] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 460.778090][ T5908] usb 3-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 460.812557][ T5908] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 460.845645][ T5908] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 460.903378][ T5908] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 460.940022][ T5908] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 460.963042][ T5908] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 460.987664][ T24] usb 7-1: USB disconnect, device number 4 [ 461.006109][ T5908] usb 3-1: Product: syz [ 461.010348][ T5908] usb 3-1: Manufacturer: syz [ 461.075673][ T5908] cdc_wdm 3-1:1.0: skipping garbage [ 461.091220][ T5908] cdc_wdm 3-1:1.0: skipping garbage [ 461.120001][ T5908] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 461.148255][ T5908] cdc_wdm 3-1:1.0: Unknown control protocol [ 461.465743][T13549] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 461.498499][T13549] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 461.768484][ T5899] usb 5-1: new low-speed USB device number 87 using dummy_hcd [ 461.790854][T13543] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 461.892198][T13543] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 461.910649][T13562] netlink: 104 bytes leftover after parsing attributes in process `syz.3.2040'. [ 462.010633][ T5899] usb 5-1: config 0 has an invalid interface number: 55 but max is 0 [ 462.058532][ T5899] usb 5-1: config 0 has no interface number 0 [ 462.120924][ T5899] usb 5-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 462.193802][ T5899] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 462.251756][ T5899] usb 5-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 462.315710][ T5899] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 462.348074][ T5899] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 8 [ 462.373353][ T5899] usb 5-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 462.446140][ T0] NOHZ tick-stop error: local softirq work is pending, handler #100!!! [ 462.463800][ T5899] usb 5-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 462.495973][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 462.505447][ T5899] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 462.580509][ T5899] usb 5-1: config 0 descriptor?? [ 462.586568][T13553] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 462.602290][T13553] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 462.702348][ T5899] ldusb 5-1:0.55: LD USB Device #1 now attached to major 180 minor 1 [ 462.736201][T13571] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2042'. [ 463.845785][ T5861] Bluetooth: hci1: Controller not accepting commands anymore: ncmd = 0 [ 463.854543][ T5861] Bluetooth: hci1: Injecting HCI hardware error event [ 463.864732][ T5861] Bluetooth: hci1: hardware error 0x00 [ 464.497721][ T5899] usb 5-1: USB disconnect, device number 87 [ 464.522109][ T5899] ldusb 5-1:0.55: LD USB Device #1 now disconnected [ 465.652154][T13641] random: crng reseeded on system resumption [ 466.008510][ T5861] Bluetooth: hci1: Opcode 0x0c03 failed: -110 [ 466.638770][T13669] binder: 13668:13669 ioctl c0306201 0 returned -14 [ 467.644747][T13686] fanotify: failed to encode fid (type=0, len=0, err=-2) [ 468.365705][ T5908] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 468.542354][ T5908] usb 7-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 468.584561][ T5908] usb 7-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 468.605313][ T5908] usb 7-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 468.625710][ T5908] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 468.654425][T13695] raw-gadget.2 gadget.6: fail, usb_ep_enable returned -22 [ 468.695645][ T5946] usb 4-1: new high-speed USB device number 111 using dummy_hcd [ 468.699437][ T5908] usb 7-1: Quirk or no altset; falling back to MIDI 1.0 [ 468.886691][ T5946] usb 4-1: Using ep0 maxpacket: 8 [ 468.897255][ T5946] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 468.938408][ T5946] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 468.969863][ T5908] usb 7-1: USB disconnect, device number 5 [ 469.010636][ T5946] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 469.064211][ T5946] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 469.101388][T13519] Set syz1 is full, maxelem 65536 reached [ 469.155884][ T5946] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 469.191336][ T5946] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 469.236725][ T5906] usb 3-1: USB disconnect, device number 30 [ 469.422765][ T5946] usb 4-1: GET_CAPABILITIES returned 0 [ 469.435751][ T5946] usbtmc 4-1:16.0: can't read capabilities [ 469.637186][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 469.647421][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 469.656563][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 469.665677][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 469.674802][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 469.686141][ C0] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 469.695274][ C0] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 469.704395][ C0] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 469.736012][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 469.745191][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 469.754285][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 469.763360][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 469.774666][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 469.783795][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 469.792874][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 469.801937][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 469.831081][ T5906] usb 4-1: USB disconnect, device number 111 [ 470.263380][T13730] netlink: 'syz.6.2080': attribute type 12 has an invalid length. [ 470.725132][T13747] tipc: Enabling of bearer rejected, failed to enable media [ 472.392315][T13793] comedi comedi2: pcl816: I/O port conflict (0x1009e1,16) [ 472.517607][ T5899] usb 4-1: new high-speed USB device number 112 using dummy_hcd [ 472.531640][T13797] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2099'. [ 472.676635][ T5899] usb 4-1: too many configurations: 9, using maximum allowed: 8 [ 472.698018][ T5899] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 472.720717][ T5899] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 472.752458][ T5899] usb 4-1: config 0 interface 0 has no altsetting 0 [ 472.773923][ T5899] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 472.788464][ T5899] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 472.806485][ T5899] usb 4-1: config 0 interface 0 has no altsetting 0 [ 472.822090][ T5899] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 472.832302][ T5899] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 472.865632][ T5899] usb 4-1: config 0 interface 0 has no altsetting 0 [ 472.877913][ T5899] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 472.893994][ T5899] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 472.925650][ T5899] usb 4-1: config 0 interface 0 has no altsetting 0 [ 472.937614][ T5899] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 472.955651][ T5899] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 472.968719][ T123] block nbd0: Possible stuck request ffff888025480000: control (read@0,1024B). Runtime 60 seconds [ 472.980689][ T123] block nbd0: Possible stuck request ffff8880254801c0: control (read@1024,1024B). Runtime 60 seconds [ 472.992258][ T123] block nbd0: Possible stuck request ffff888025480380: control (read@2048,1024B). Runtime 60 seconds [ 473.003514][ T123] block nbd0: Possible stuck request ffff888025480540: control (read@3072,1024B). Runtime 60 seconds [ 473.015906][ T5899] usb 4-1: config 0 interface 0 has no altsetting 0 [ 473.024151][ T5899] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 473.033237][ T5899] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 473.045842][ T5899] usb 4-1: config 0 interface 0 has no altsetting 0 [ 473.054170][ T5899] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 473.063380][ T5899] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 473.074554][ T5899] usb 4-1: config 0 interface 0 has no altsetting 0 [ 473.082913][ T5899] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 473.092013][ T5899] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 473.103136][ T5899] usb 4-1: config 0 interface 0 has no altsetting 0 [ 473.113425][ T5899] usb 4-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 473.122715][ T5899] usb 4-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 473.131595][ T5899] usb 4-1: Product: syz [ 473.135984][ T5899] usb 4-1: Manufacturer: syz [ 473.140944][ T5899] usb 4-1: SerialNumber: syz [ 473.150809][ T5899] usb 4-1: config 0 descriptor?? [ 473.170546][ T5899] yurex 4-1:0.0: USB YUREX device now attached to Yurex #0 [ 473.449937][ T5899] usb 4-1: USB disconnect, device number 112 [ 473.461382][ T5899] yurex 4-1:0.0: USB YUREX #0 now disconnected [ 473.755686][ T30] audit: type=1400 audit(1751782257.566:33): apparmor="DENIED" operation="change_profile" class="file" info="label not found" error=-2 profile="unconfined" name=3AF4F9904E7FDB3635A70D23C73EEAF23A3F503280080CA26230668AD9DCF8B061228F8599D34E45087D21AA56759E1651B3DD467BDEF390C76D pid=13805 comm="syz.6.2104" [ 473.784556][ C0] vkms_vblank_simulate: vblank timer overrun [ 474.506494][T13816] netlink: 'syz.4.2106': attribute type 1 has an invalid length. [ 475.002346][T13825] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 475.021278][T13825] netdevsim netdevsim3 netdevsim0: entered allmulticast mode [ 475.756034][T13835] 9pnet: p9_errstr2errno: server reported unknown error 184467 [ 475.878670][T13839] netlink: 21 bytes leftover after parsing attributes in process `syz.4.2116'. [ 475.902445][T13839] macvtap0: entered allmulticast mode [ 475.939970][T13839] veth0_macvtap: entered allmulticast mode [ 476.154424][T13851] overlayfs: overlapping lowerdir path [ 476.262506][T13852] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 477.268035][ T30] audit: type=1804 audit(1751782260.376:34): pid=13857 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.2121" name="/newroot/494/bus/bus" dev="overlay" ino=2660 res=1 errno=0 [ 477.304999][ T30] audit: type=1804 audit(1751782260.386:35): pid=13857 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.2121" name="/newroot/494/bus/bus" dev="overlay" ino=2660 res=1 errno=0 [ 478.136369][T13883] comedi comedi2: das16m1: I/O port conflict (0x21009e1,16) [ 478.441499][T13896] comedi comedi0: pcl711: I/O port conflict (0x3,16) [ 478.755053][T13908] netlink: 64 bytes leftover after parsing attributes in process `syz.6.2147'. [ 478.984335][T13912] nbd4: detected capacity change from 0 to 12 [ 479.023109][ T5849] block nbd4: Send control failed (result -89) [ 479.030232][ T5849] block nbd4: Request send failed, requeueing [ 479.050744][ T5861] block nbd4: Receive control failed (result -32) [ 479.053150][ T55] block nbd4: Dead connection, failed to find a fallback [ 479.067070][ T55] block nbd4: shutting down sockets [ 479.072758][ T55] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 479.082521][ T55] Buffer I/O error on dev nbd4, logical block 0, async page read [ 479.092794][ T5849] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 479.102364][ T5849] Buffer I/O error on dev nbd4, logical block 0, async page read [ 479.111234][ T5849] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 479.120838][ T5849] Buffer I/O error on dev nbd4, logical block 0, async page read [ 479.129362][ T5849] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 479.138881][ T5849] Buffer I/O error on dev nbd4, logical block 0, async page read [ 479.147178][ T5849] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 479.156811][ T5849] Buffer I/O error on dev nbd4, logical block 0, async page read [ 479.164773][ T5849] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 479.174432][ T5849] Buffer I/O error on dev nbd4, logical block 0, async page read [ 479.182900][ T5849] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 479.194079][ T5849] Buffer I/O error on dev nbd4, logical block 0, async page read [ 479.206417][ T5849] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 479.225783][ T5849] Buffer I/O error on dev nbd4, logical block 0, async page read [ 479.239126][ T5849] ldm_validate_partition_table(): Disk read failed. [ 479.247835][ T5849] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 479.261707][ T5849] Buffer I/O error on dev nbd4, logical block 0, async page read [ 479.271826][ T5849] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 479.303200][ T5849] Buffer I/O error on dev nbd4, logical block 0, async page read [ 479.313956][ T5849] Dev nbd4: unable to read RDB block 0 [ 479.326667][ T5849] nbd4: unable to read partition table [ 479.333009][ T5849] nbd4: partition table beyond EOD, truncated [ 479.336239][T13924] openvswitch: netlink: VXLAN extension message has 4 unknown bytes. [ 479.367740][ T5849] ldm_validate_partition_table(): Disk read failed. [ 479.375107][ T5849] Dev nbd4: unable to read RDB block 0 [ 479.410173][ T5849] nbd4: unable to read partition table [ 479.429051][ T5849] nbd4: partition table beyond EOD, truncated [ 479.482141][T13899] ucma_write: process 1519 (syz.2.2144) changed security contexts after opening file descriptor, this is not allowed. [ 481.156551][T13947] netlink: 'syz.2.2161': attribute type 1 has an invalid length. [ 481.361712][T13946] infiniband syz1: set active [ 481.366615][T13946] infiniband syz1: added syz_tun [ 481.586180][T13946] RDS/IB: syz1: added [ 481.590274][T13946] smc: adding ib device syz1 with port count 1 [ 481.597154][T13946] smc: ib device syz1 port 1 has pnetid [ 484.117506][T13975] fuse: Bad value for 'fd' [ 484.228633][T13979] binder_alloc: 13977: binder_alloc_buf size 12344 failed, no address space [ 484.239861][T13979] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 484.415682][ T5946] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 484.586534][ T5946] usb 7-1: too many configurations: 9, using maximum allowed: 8 [ 484.621184][ T5946] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 484.686159][ T5946] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 484.697457][ T5946] usb 7-1: config 0 interface 0 has no altsetting 0 [ 484.707395][ T5946] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 484.717620][ T5946] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 484.729135][ T5946] usb 7-1: config 0 interface 0 has no altsetting 0 [ 484.776208][ T5946] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 484.838428][ T5946] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 484.905146][ T5946] usb 7-1: config 0 interface 0 has no altsetting 0 [ 484.926579][ T5946] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 484.965705][ T5946] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 484.995959][ T5946] usb 7-1: config 0 interface 0 has no altsetting 0 [ 485.014291][ T5946] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 485.034358][ T5946] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 485.085680][ T5946] usb 7-1: config 0 interface 0 has no altsetting 0 [ 485.128475][ T5946] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 485.158510][ T5946] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 485.196508][ T5946] usb 7-1: config 0 interface 0 has no altsetting 0 [ 485.212562][ T12] wlan0: IBSS 50:50:50:50:50:50 switches to unsupported channel (2484 MHz, width:0, CF1/2: 2484/0 MHz), disconnecting [ 485.214958][ T5946] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 485.247084][ T5946] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 485.268311][ T5946] usb 7-1: config 0 interface 0 has no altsetting 0 [ 485.279727][ T5946] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 485.290484][ T5946] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 485.328207][ T5946] usb 7-1: config 0 interface 0 has no altsetting 0 [ 485.357175][T13989] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2175'. [ 485.373639][ T5946] usb 7-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 485.395638][ T5946] usb 7-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 485.416257][ T12] wlan0: Selected IBSS BSSID 50:50:50:50:50:50 based on configured SSID [ 485.424542][ T5946] usb 7-1: Product: syz [ 485.435150][ T5946] usb 7-1: Manufacturer: syz [ 485.444890][ T5946] usb 7-1: SerialNumber: syz [ 485.478387][ T5946] usb 7-1: config 0 descriptor?? [ 485.516908][ T5946] yurex 7-1:0.0: USB YUREX device now attached to Yurex #0 [ 485.746651][ T5908] Process accounting resumed [ 485.771189][ T5908] usb 7-1: USB disconnect, device number 6 [ 485.781883][ T5908] yurex 7-1:0.0: USB YUREX #0 now disconnected [ 486.302787][T14019] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2187'. [ 486.839257][T14035] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2195'. [ 486.964689][T14037] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 486.991273][T14042] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2198'. [ 487.012080][T14042] netlink: 76 bytes leftover after parsing attributes in process `syz.4.2198'. [ 487.087032][T14045] bridge0: port 3(erspan0) entered blocking state [ 487.105843][T14045] bridge0: port 3(erspan0) entered disabled state [ 487.112785][T14045] erspan0: entered allmulticast mode [ 487.146226][T14045] erspan0: entered promiscuous mode [ 487.182856][T14045] bridge0: port 3(erspan0) entered blocking state [ 487.189857][T14045] bridge0: port 3(erspan0) entered forwarding state [ 487.440650][T14042] infiniband syz0: set active [ 487.445472][T14042] infiniband syz0: added veth1_vlan [ 487.490261][T14042] RDS/IB: syz0: added [ 487.494436][T14042] smc: adding ib device syz0 with port count 1 [ 487.500817][T14042] smc: ib device syz0 port 1 has pnetid [ 490.035933][ T5899] usb 4-1: new full-speed USB device number 113 using dummy_hcd [ 490.208362][ T5899] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 490.240808][ T5899] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 490.244863][T14098] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2218'. [ 490.275719][ T5899] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 490.295640][ T5899] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 490.340443][ T5899] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 490.365377][ T5899] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 490.379953][ T5899] usb 4-1: Manufacturer: syz [ 490.393880][ T5899] usb 4-1: config 0 descriptor?? [ 490.502593][T14104] tmpfs: Bad value for 'grpquota_block_hardlimit' [ 490.615715][ T3528] usb 5-1: new full-speed USB device number 88 using dummy_hcd [ 490.679268][T14109] comedi comedi0: adq12b: I/O port conflict (0x3,16) [ 490.706101][ T5899] rc_core: IR keymap rc-hauppauge not found [ 490.714287][ T5899] Registered IR keymap rc-empty [ 490.720362][ T5899] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 490.749902][ T5899] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 490.776884][ T5899] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 490.797851][ T5899] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input46 [ 490.822829][ T3528] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 490.831337][ T5899] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 490.853629][ T3528] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 490.865808][ T5899] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 490.877630][ T3528] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 490.892661][ T3528] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 490.892791][ T5899] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 490.935691][ T5899] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 490.955701][ T5899] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 490.982134][ T5899] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 491.019549][ T5899] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 491.046089][ T5899] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 491.068827][ T5899] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 491.105768][ T5899] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 491.118029][ T3528] usb 5-1: usb_control_msg returned -32 [ 491.130241][ T5899] mceusb 4-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 491.133739][ T3528] usbtmc 5-1:16.0: can't read capabilities [ 491.152134][ T5899] mceusb 4-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 491.185887][ T5899] usb 4-1: USB disconnect, device number 113 [ 491.495221][T14122] usbtmc 5-1:16.0: send_request_dev_dep_msg_in returned -90 [ 491.905956][ T24] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 492.275797][ T24] usb 3-1: Using ep0 maxpacket: 8 [ 492.282700][ T24] usb 3-1: config index 0 descriptor too short (expected 301, got 45) [ 492.291106][ T24] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 492.302425][ T24] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 492.312891][ T24] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 492.323531][ T24] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 492.337069][ T24] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 492.346212][ T24] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 492.365722][ T44] usb 4-1: new full-speed USB device number 114 using dummy_hcd [ 492.518810][ T44] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 492.529126][ T44] usb 4-1: config 0 has no interfaces? [ 492.534656][ T44] usb 4-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 492.543938][ T44] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 492.554888][ T44] usb 4-1: config 0 descriptor?? [ 492.562561][ T24] usb 3-1: GET_CAPABILITIES returned 0 [ 492.574141][ T24] usbtmc 3-1:16.0: can't read capabilities [ 492.767193][T14127] usbtmc 5-1:16.0: usb_control_msg returned -32 [ 492.777136][ T24] usb 3-1: USB disconnect, device number 31 [ 492.778046][ T5899] usb 5-1: USB disconnect, device number 88 [ 493.120491][T14135] vhci_hcd vhci_hcd.0: pdev(6) rhport(0) sockfd(3) [ 493.127185][T14135] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 493.150182][T14135] vhci_hcd vhci_hcd.0: Device attached [ 493.385672][ T44] usb 45-1: new low-speed USB device number 2 using vhci_hcd [ 493.396180][ T24] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 493.400907][ T5906] usb 4-1: USB disconnect, device number 114 [ 493.548095][ T24] usb 7-1: Using ep0 maxpacket: 16 [ 493.568477][ T24] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 493.580884][ T24] usb 7-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 493.597526][ T24] usb 7-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 493.607097][ T24] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 493.616377][ T5899] usb 5-1: new high-speed USB device number 89 using dummy_hcd [ 493.619449][ T24] usb 7-1: config 0 descriptor?? [ 493.652777][ T24] usbhid 7-1:0.0: couldn't find an input interrupt endpoint [ 493.775743][ T5899] usb 5-1: Using ep0 maxpacket: 8 [ 493.786029][ T5899] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 493.794335][ T5899] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 493.810978][ T5899] usb 5-1: config 0 has no interface number 0 [ 493.818494][ T5899] usb 5-1: config 0 interface 1 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 493.838785][ T5899] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 493.848897][ T5899] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 493.852796][T14136] usb 45-1: recv xbuf, 0 [ 493.866094][ T24] usb 7-1: USB disconnect, device number 7 [ 493.866144][ T5899] usb 5-1: config 0 descriptor?? [ 493.896729][ T4345] vhci_hcd: stop threads [ 493.910647][ T4345] vhci_hcd: release socket [ 493.925626][ T5899] iowarrior 5-1:0.1: no interrupt-in endpoint found [ 493.946579][ T4345] vhci_hcd: disconnect device [ 493.968784][ T44] vhci_hcd: vhci_device speed not set [ 495.885763][ T5906] usb 4-1: new high-speed USB device number 115 using dummy_hcd [ 496.081093][ T5906] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 496.109919][ T5906] usb 4-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 496.132249][ T5906] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 496.152207][ T5906] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 496.236931][T14188] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 496.254669][ T5906] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 496.426550][ T24] usb 5-1: USB disconnect, device number 89 [ 496.464795][ T5906] usb 4-1: USB disconnect, device number 115 [ 496.857726][T14206] veth1_macvtap: left promiscuous mode [ 496.910081][T14206] veth1_macvtap: entered promiscuous mode [ 497.204415][T14216] netlink: 260 bytes leftover after parsing attributes in process `syz.2.2267'. [ 497.335852][T14221] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2270'. [ 498.105954][T14243] tipc: Started in network mode [ 498.119591][T14243] tipc: Node identity 00000000000000000000000000000001, cluster identity 4711 [ 498.146901][T14243] tipc: Enabled bearer , priority 10 [ 498.238671][T14247] netlink: 'syz.6.2281': attribute type 4 has an invalid length. [ 498.269985][ T30] audit: type=1326 audit(1751782282.266:36): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14248 comm="syz.3.2282" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe39e98e929 code=0x7ffc0000 [ 498.305761][T14247] netlink: 152 bytes leftover after parsing attributes in process `syz.6.2281'. [ 498.353460][ T30] audit: type=1326 audit(1751782282.266:37): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14248 comm="syz.3.2282" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe39e98e929 code=0x7ffc0000 [ 498.372000][T14247] : renamed from bond0 (while UP) [ 498.450993][ T30] audit: type=1326 audit(1751782282.266:38): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14248 comm="syz.3.2282" exe="/root/syz-executor" sig=0 arch=c000003e syscall=222 compat=0 ip=0x7fe39e98e929 code=0x7ffc0000 [ 498.526050][ T30] audit: type=1326 audit(1751782282.266:39): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14248 comm="syz.3.2282" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe39e98e929 code=0x7ffc0000 [ 498.599445][ T30] audit: type=1326 audit(1751782282.266:40): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14248 comm="syz.3.2282" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe39e98e929 code=0x7ffc0000 [ 498.705783][ T30] audit: type=1326 audit(1751782282.266:41): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14248 comm="syz.3.2282" exe="/root/syz-executor" sig=0 arch=c000003e syscall=223 compat=0 ip=0x7fe39e98e929 code=0x7ffc0000 [ 498.765926][ T30] audit: type=1326 audit(1751782282.266:42): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14248 comm="syz.3.2282" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fe39e92ab19 code=0x7ffc0000 [ 498.835667][ T30] audit: type=1326 audit(1751782282.266:43): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14248 comm="syz.3.2282" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fe39e92ab19 code=0x7ffc0000 [ 498.910678][T14257] input: syz1 as /devices/virtual/input/input48 [ 498.917157][ T30] audit: type=1326 audit(1751782282.266:44): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14248 comm="syz.3.2282" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fe39e92ab19 code=0x7ffc0000 [ 498.995787][ T30] audit: type=1326 audit(1751782282.266:45): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14248 comm="syz.3.2282" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fe39e92ab19 code=0x7ffc0000 [ 499.278653][ T44] tipc: Node number set to 1 [ 499.965518][T14277] tmpfs: Unknown parameter 'smackfsfloor' [ 501.270693][T14297] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 501.277384][T14297] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 501.301411][T14297] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 501.315341][T14297] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 501.332729][T14297] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 501.339068][T14297] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 501.363008][T14297] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 501.394325][T14297] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 501.400613][T14297] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 501.414049][T14297] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 501.824698][T14316] wlan0 speed is unknown, defaulting to 1000 [ 501.833171][T14316] wlan0 speed is unknown, defaulting to 1000 [ 501.847263][T14316] wlan0 speed is unknown, defaulting to 1000 [ 501.863014][T14316] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 501.893244][T14316] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 501.963530][T14316] wlan0 speed is unknown, defaulting to 1000 [ 501.973304][T14316] wlan0 speed is unknown, defaulting to 1000 [ 501.987794][T14316] wlan0 speed is unknown, defaulting to 1000 [ 501.996753][T14316] wlan0 speed is unknown, defaulting to 1000 [ 502.005303][T14316] wlan0 speed is unknown, defaulting to 1000 [ 502.143874][T14319] evm: overlay not supported [ 502.320778][T14325] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2313'. [ 502.885707][ T44] usb 4-1: new high-speed USB device number 116 using dummy_hcd [ 503.046930][ T123] block nbd0: Possible stuck request ffff888025480000: control (read@0,1024B). Runtime 90 seconds [ 503.047320][ T44] usb 4-1: Using ep0 maxpacket: 8 [ 503.057879][ T123] block nbd0: Possible stuck request ffff8880254801c0: control (read@1024,1024B). Runtime 90 seconds [ 503.074645][ T123] block nbd0: Possible stuck request ffff888025480380: control (read@2048,1024B). Runtime 90 seconds [ 503.085906][ T123] block nbd0: Possible stuck request ffff888025480540: control (read@3072,1024B). Runtime 90 seconds [ 503.092436][ T44] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 503.120408][ T44] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 503.181976][ T44] usb 4-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 503.228232][ T44] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 503.292015][ T5861] Bluetooth: hci4: command 0x0405 tx timeout [ 503.292030][ T51] Bluetooth: hci2: command 0x0c1a tx timeout [ 503.329488][ T44] hub 4-1:1.0: bad descriptor, ignoring hub [ 503.335749][ T44] hub 4-1:1.0: probe with driver hub failed with error -5 [ 503.365946][ T5861] Bluetooth: hci0: command 0x0c1a tx timeout [ 503.448802][ T5861] Bluetooth: hci5: command 0x0405 tx timeout [ 503.544724][T14331] hub 6-0:1.0: USB hub found [ 503.568664][T14331] hub 6-0:1.0: 1 port detected [ 503.718442][ T44] usb 4-1: USB disconnect, device number 116 [ 505.375639][ T5861] Bluetooth: hci4: command 0x0405 tx timeout [ 505.446016][ T5861] Bluetooth: hci0: command 0x0c1a tx timeout [ 505.525720][ T5861] Bluetooth: hci5: command 0x0405 tx timeout [ 506.415683][ T44] usb 5-1: new high-speed USB device number 90 using dummy_hcd [ 506.595851][ T44] usb 5-1: Using ep0 maxpacket: 8 [ 506.611170][ T44] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 506.639906][ T44] usb 5-1: config 0 has no interface number 0 [ 506.653706][ T44] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 506.674066][ T44] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 506.684013][ T44] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 506.719924][ T44] usb 5-1: config 0 descriptor?? [ 506.761792][ T44] iowarrior 5-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 506.893545][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 506.902755][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 507.064091][T14375] 9pnet_virtio: no channels available for device syz [ 507.197457][ T44] usb 5-1: USB disconnect, device number 90 [ 507.445760][ T5861] Bluetooth: hci4: command 0x0405 tx timeout [ 507.527132][ T5861] Bluetooth: hci0: command 0x0c1a tx timeout [ 507.605794][ T5861] Bluetooth: hci5: command 0x0405 tx timeout [ 508.836070][T14412] [U]  [ 508.839181][T14412] [U] K{ [ 508.842214][T14412] [U] t 1ŠFfˊ`GJgo/mC [ 508.865744][T14412] [U] tؖ/,~Ĝj}8'o1"7-JQKWq5c%"H12YX``+(!(z'tXlnIgjݭp~7!" (5Ob̓J [ 508.945740][T14412] [U] k\&}66XHX .`a$40|϶9ި U4Vbz}wMTQΦr 4 [ 508.965980][ T30] kauditd_printk_skb: 778 callbacks suppressed [ 508.966000][ T30] audit: type=1326 audit(1751782292.926:824): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14413 comm="syz.3.2351" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe39e98e929 code=0x7ffc0000 [ 509.015698][T14412] [U] ".h6"k[J4In[Z(C|T]z{3c=x4w)\TXJSH{q;칢t+gd.˂>ywUhfNhl]S2\g%O&z)'pul_< ذ`ұT;_"(u{7j2X /'cIHcճV=Ai%wEs RjgrhIa6-DV i"n Asc~48c*OO5/J~wvK+3Y)Mvyq潀DTrOtpem%fejA5T_-X~^aaۂq [ 509.133517][ T30] audit: type=1326 audit(1751782292.926:825): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14413 comm="syz.3.2351" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe39e98e929 code=0x7ffc0000 [ 509.163834][T14412] [U] +wG?]'a: )' B>tf/<'U'hi.+]e.-ɿ%>2`^U8F.63+A«g3p6:^0tv'EtYCnrϩnPj ;Z8!\Aʖ2$­wi.#/Bai`4jdy@zgW5˿B ٜNy"vI2 [ 509.187623][T14412] [U] T_K5tYJ9c$brLNul 9w|G"ʃ%C؝q 3qN^HP*$ .7yӱ2 [ 509.201102][T14412] [U] ? h*37鍾^#Q"0~ (oX Lb,'v=CSGS0ւ`ه=1(p#2DO*Ƀ [ 509.223935][T14412] [U] sgGud-{|&2Lc_!`oz֥B%>rwSsH"yA4O.Y䏄RTԶB[+/<>{q_՝LX8U{Z)7?rR;crhײڣ1>)Măt(aϝ}9ڥJ*Mќġ'Lq DW=|q ÆW;5Ž!dBx`/E`ƦMX"\ [ 509.379341][T14412] [U] {; ٘_o2)o.2W2yx_ HPϱSD:]{ [ 509.388223][T14412] [U] I,> 51^1N4oǶ'0?֒i9w._.WaV`)Zc6GiӹaXL[F*OW)+'\n[K@2Ǭp"^` [ 509.388546][ T30] audit: type=1326 audit(1751782292.996:826): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14413 comm="syz.3.2351" exe="/root/syz-executor" sig=0 arch=c000003e syscall=222 compat=0 ip=0x7fe39e98e929 code=0x7ffc0000 [ 509.442934][T14412] [U] 22Ʃx?0;3u [ 509.467678][T14412] [U] ޜsObx8W4(~/KUԖoQe+G-ygY_>v3.hә]̈́2)D, D~d+w; A\FPȘ|$)KؐIɿkYT^R癵A=#ܜ aet1ݯ4K.e"RS|s:>p r"z#P!KY"}FN84hޱosߙ̫%Dlwm [ 509.493173][T14412] [U] [['xn' ,mr/1D=!Dx91BwRlfKZ#` l؛˜b~m [ 509.518217][T14412] [U] L>d+d"5h3<iR=F^fnvDOIO:U>Y [ 509.527347][T14412] [U] 'B6v20瞥׌"t8{9FW]쩍 [ 509.533579][T14412] [U] 72uC6τI]8ctۨQSkYI |V'TV/g$[ 9kh`"}[^=0]%̂TF_v4C [ 509.555756][T14412] [U] ec [ 509.559013][T14412] [U] |<:^3$7nK~-@?/mtl۾Iw@g~t{P+$jp| IRipm Y 8tV,l, [ 509.574046][ T30] audit: type=1326 audit(1751782292.996:827): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14413 comm="syz.3.2351" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe39e98e929 code=0x7ffc0000 [ 509.586883][T14411] [U] K)0~ʪiP'fzr @B]5{ʼ'8ƥFUTqUdǩK;70c[yYCذmL8T͚5rxW xoQhVi'8L [ 509.601657][ T30] audit: type=1326 audit(1751782292.996:828): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14413 comm="syz.3.2351" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe39e98e929 code=0x7ffc0000 [ 509.637786][ T30] audit: type=1326 audit(1751782292.996:829): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14413 comm="syz.3.2351" exe="/root/syz-executor" sig=0 arch=c000003e syscall=223 compat=0 ip=0x7fe39e98e929 code=0x7ffc0000 [ 509.683208][ T30] audit: type=1326 audit(1751782292.996:830): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14413 comm="syz.3.2351" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fe39e92ab19 code=0x7ffc0000 [ 509.738954][ T30] audit: type=1326 audit(1751782292.996:831): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14413 comm="syz.3.2351" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fe39e92ab19 code=0x7ffc0000 [ 509.790437][ T30] audit: type=1326 audit(1751782292.996:832): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14413 comm="syz.3.2351" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fe39e92ab19 code=0x7ffc0000 [ 509.875688][ T30] audit: type=1326 audit(1751782292.996:833): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14413 comm="syz.3.2351" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fe39e92ab19 code=0x7ffc0000 [ 510.199610][T14421] 9pnet_virtio: no channels available for device syz [ 511.003633][T14427] comedi comedi3: dt2814: I/O port conflict (0xcf7,2) [ 511.723374][ T5861] Bluetooth: hci5: unexpected subevent 0x0a length: 91 > 30 [ 511.916511][ T5906] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 512.095754][ T5906] usb 7-1: Using ep0 maxpacket: 8 [ 512.111850][ T5906] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 512.135876][ T5906] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 512.157299][ T5906] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 100, changing to 10 [ 512.916476][ T5906] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 24936, setting to 1024 [ 512.929472][ T5906] usb 7-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 512.940065][ T5906] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 512.982764][ T5906] hub 7-1:1.0: bad descriptor, ignoring hub [ 513.005191][ T5906] hub 7-1:1.0: probe with driver hub failed with error -5 [ 513.017820][T14467] netlink: 'syz.2.2372': attribute type 10 has an invalid length. [ 513.033449][T14467] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2372'. [ 513.061520][ T5906] cdc_wdm 7-1:1.0: skipping garbage [ 513.073932][ T5906] cdc_wdm 7-1:1.0: skipping garbage [ 513.098555][ T5906] cdc_wdm 7-1:1.0: cdc-wdm0: USB WDM device [ 513.117925][ T5906] cdc_wdm 7-1:1.0: Unknown control protocol [ 513.232550][T14475] tipc: Started in network mode [ 513.241904][T14475] tipc: Node identity 4, cluster identity 4711 [ 513.248592][T14475] tipc: Node number set to 4 [ 513.447292][ T24] usb 4-1: new high-speed USB device number 117 using dummy_hcd [ 513.617846][ T24] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 513.629778][ T24] usb 4-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 513.642182][ T24] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 513.651494][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 513.659588][ T24] usb 4-1: Product: syz [ 513.663767][ T24] usb 4-1: Manufacturer: syz [ 513.668695][ T24] usb 4-1: SerialNumber: syz [ 513.682265][ T24] cdc_mbim 4-1:1.0: skipping garbage [ 513.687775][ T44] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 513.765874][ T51] Bluetooth: hci5: command 0x0405 tx timeout [ 513.847534][ T44] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 513.858728][ T44] usb 3-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 513.872053][ T44] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 513.881468][ T44] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 513.890120][T14474] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 513.898008][ T44] usb 3-1: Product: syz [ 513.903761][ T44] usb 3-1: Manufacturer: syz [ 513.908788][ T44] usb 3-1: SerialNumber: syz [ 513.921146][ T44] cdc_mbim 3-1:1.0: skipping garbage [ 514.128857][T14486] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 514.343991][T14490] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 514.509415][T14474] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 514.518610][ T24] cdc_mbim 4-1:1.0: setting tx_max = 184 [ 514.759700][T14486] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 514.767581][ T44] cdc_mbim 3-1:1.0: setting tx_max = 184 [ 514.962382][T14495] netlink: 'syz.4.2383': attribute type 4 has an invalid length. [ 515.355825][ T5906] usb 5-1: new full-speed USB device number 91 using dummy_hcd [ 515.537642][ T5906] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 515.548953][ T5906] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 515.560134][ T5906] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 515.570010][ T5906] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 515.584611][ T5906] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 515.593871][ T5906] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 515.602048][ T5906] usb 5-1: Manufacturer: syz [ 515.610807][ T5906] usb 5-1: config 0 descriptor?? [ 515.885618][ T5906] rc_core: IR keymap rc-hauppauge not found [ 515.891602][ T5906] Registered IR keymap rc-empty [ 515.898104][ T5906] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 515.928133][ T5906] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 515.950900][ T5906] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0 [ 515.964377][ T5906] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input49 [ 515.982603][ T5906] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 516.005989][ T5906] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 516.045845][ T5906] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 516.076226][ T5906] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 516.105699][ T5906] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 516.125740][ T5906] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 516.145750][ T5906] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 516.175864][ T5906] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 516.205709][ T5906] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 516.235759][ T5906] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 516.267676][ T5906] mceusb 5-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 516.280280][ T5906] mceusb 5-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 516.293352][ T5906] usb 5-1: USB disconnect, device number 91 [ 516.471596][ T5943] usb 7-1: USB disconnect, device number 8 [ 516.477559][T14453] cdc_wdm 7-1:1.0: Error autopm - -16 [ 516.490432][ T24] cdc_mbim 4-1:1.0: cdc-wdm1: USB WDM device [ 516.490442][T14474] cdc_wdm 7-1:1.0: Error autopm - -16 [ 516.505760][T14486] cdc_wdm 7-1:1.0: Error autopm - -16 [ 516.546399][ T24] wwan wwan0: port wwan0mbim0 attached [ 516.555990][ T44] cdc_mbim 3-1:1.0: cdc-wdm0: USB WDM device [ 516.593730][ T44] wwan wwan1: port wwan1mbim0 attached [ 516.602353][ T24] cdc_mbim 4-1:1.0 wwan0: register 'cdc_mbim' at usb-dummy_hcd.3-1, CDC MBIM, fa:22:65:a1:87:f1 [ 516.652427][ T44] cdc_mbim 3-1:1.0 wwan1: register 'cdc_mbim' at usb-dummy_hcd.2-1, CDC MBIM, 6a:23:28:e7:a9:60 [ 516.692769][ T24] usb 4-1: USB disconnect, device number 117 [ 516.717584][ T44] usb 3-1: USB disconnect, device number 32 [ 516.735035][ T24] cdc_mbim 4-1:1.0 wwan0: unregister 'cdc_mbim' usb-dummy_hcd.3-1, CDC MBIM [ 516.760033][ T44] cdc_mbim 3-1:1.0 wwan1: unregister 'cdc_mbim' usb-dummy_hcd.2-1, CDC MBIM [ 517.046083][ T24] wwan wwan0: port wwan0mbim0 disconnected [ 517.114887][T14517] netlink: 5 bytes leftover after parsing attributes in process `syz.3.2391'. [ 517.258633][ T44] wwan wwan1: port wwan1mbim0 disconnected [ 517.269526][T14511] netlink: 'syz.4.2386': attribute type 1 has an invalid length. [ 518.085954][ T44] usb 4-1: new high-speed USB device number 118 using dummy_hcd [ 518.267249][ T44] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 518.347821][ T44] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0xB has invalid maxpacket 24623, setting to 1024 [ 518.362098][ T44] usb 4-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 1024 [ 518.381659][ T44] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 518.402269][ T44] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 518.432327][T14524] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 518.482859][ T44] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 519.109670][ T5943] usb 4-1: USB disconnect, device number 118 [ 519.304510][ T13] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 519.449394][ T13] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 519.592186][ T13] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 519.804646][T14543] comedi comedi0: pcmda12: I/O port conflict (0x4,16) [ 519.821363][ T13] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 520.018187][ T5906] kernel write not supported for file /radio5 (pid: 5906 comm: kworker/0:4) [ 520.210571][T14553] rdma_rxe: rxe_newlink: failed to add syz_tun [ 520.297331][ T13] bridge_slave_1: left allmulticast mode [ 520.326131][ T13] bridge_slave_1: left promiscuous mode [ 520.358039][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 520.434430][ T13] bridge_slave_0: left allmulticast mode [ 520.434461][ T13] bridge_slave_0: left promiscuous mode [ 520.434691][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 521.495452][T14570] input: syz1 as /devices/virtual/input/input50 [ 521.611223][ T5861] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 521.627920][ T5861] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 521.636847][ T5861] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 521.647475][ T5861] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 521.656798][ T5861] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 521.978832][T14580] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(3) [ 521.985428][T14580] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 522.048273][T14580] vhci_hcd vhci_hcd.0: Device attached [ 522.295696][ T5899] usb 41-1: new low-speed USB device number 2 using vhci_hcd [ 522.335645][ T10] usb 5-1: new high-speed USB device number 92 using dummy_hcd [ 522.502319][ T10] usb 5-1: Using ep0 maxpacket: 16 [ 522.517405][ T10] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 522.539520][ T10] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 522.575612][ T10] usb 5-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 522.584774][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 522.634665][ T10] usb 5-1: config 0 descriptor?? [ 522.656736][ T10] usbhid 5-1:0.0: couldn't find an input interrupt endpoint [ 522.879809][ T5943] usb 5-1: USB disconnect, device number 92 [ 522.898836][T14581] vhci_hcd: connection closed [ 522.900195][ T12] vhci_hcd: stop threads [ 522.926949][ T12] vhci_hcd: release socket [ 522.944907][ T12] vhci_hcd: disconnect device [ 522.959233][ T5899] vhci_hcd: vhci_device speed not set [ 523.004969][ T13]  (unregistering): (slave bond_slave_0): Releasing backup interface [ 523.024283][ T13]  (unregistering): (slave bond_slave_1): Releasing backup interface [ 523.042915][ T13]  (unregistering): Released all slaves [ 523.093234][T14596] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2418'. [ 523.776348][ T5861] Bluetooth: hci0: command tx timeout [ 524.858789][T14572] wlan0 speed is unknown, defaulting to 1000 [ 525.037381][ T5954] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 525.223412][ T5954] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 525.235587][ T5954] usb 3-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 525.255448][ T5954] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 525.264912][ T5954] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 525.283073][ T5954] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 525.302627][ T5954] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 525.313466][ T5954] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 525.353782][ T5954] usb 3-1: Product: syz [ 525.365615][ T5954] usb 3-1: Manufacturer: syz [ 525.461714][ T5954] cdc_wdm 3-1:1.0: skipping garbage [ 525.489922][ T5954] cdc_wdm 3-1:1.0: skipping garbage [ 525.547639][ T5954] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 525.553720][ T5954] cdc_wdm 3-1:1.0: Unknown control protocol [ 525.701334][ C1] wdm_int_callback: 255 callbacks suppressed [ 525.701363][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 525.714101][ C1] wdm_int_callback: 255 callbacks suppressed [ 525.714134][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 525.728543][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 525.735296][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 525.742235][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 525.748889][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 525.755753][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 525.762388][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 525.768827][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 525.775468][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 525.786332][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 525.792989][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 525.799595][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 525.806232][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 525.812781][ T5943] usb 3-1: USB disconnect, device number 33 [ 525.818829][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 525.818858][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 525.818881][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 525.861999][ T5861] Bluetooth: hci0: command tx timeout [ 526.088110][ T13] hsr_slave_0: left promiscuous mode [ 526.094253][ T13] hsr_slave_1: left promiscuous mode [ 526.121431][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 526.139223][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 526.161377][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 526.169635][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 526.228944][ T13] veth1_macvtap: left promiscuous mode [ 526.245106][ T13] veth0_macvtap: left promiscuous mode [ 526.259083][ T13] veth1_vlan: left promiscuous mode [ 526.264484][ T13] veth0_vlan: left promiscuous mode [ 527.792621][ T13] team0 (unregistering): Port device team_slave_1 removed [ 527.854664][ T13] team0 (unregistering): Port device team_slave_0 removed [ 527.935635][ T5861] Bluetooth: hci0: command tx timeout [ 527.992177][ T5908] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 528.157607][ T5908] usb 3-1: config index 0 descriptor too short (expected 23569, got 27) [ 528.170015][ T5908] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 528.190680][ T5908] usb 3-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 528.200479][ T5908] usb 3-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 528.209975][ T5908] usb 3-1: Manufacturer: syz [ 528.230189][ T5908] usb 3-1: config 0 descriptor?? [ 528.354160][ T5908] rc_core: IR keymap rc-hauppauge not found [ 528.360395][ T5908] Registered IR keymap rc-empty [ 528.377552][ T5908] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0 [ 528.390740][ T5908] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input51 [ 528.483427][ T5908] usb 3-1: USB disconnect, device number 34 [ 528.720127][T14572] chnl_net:caif_netlink_parms(): no params data found [ 529.127132][T14572] bridge0: port 1(bridge_slave_0) entered blocking state [ 529.142216][T14572] bridge0: port 1(bridge_slave_0) entered disabled state [ 529.167358][T14572] bridge_slave_0: entered allmulticast mode [ 529.178325][T14572] bridge_slave_0: entered promiscuous mode [ 529.194625][T14572] bridge0: port 2(bridge_slave_1) entered blocking state [ 529.216893][T14572] bridge0: port 2(bridge_slave_1) entered disabled state [ 529.224236][T14572] bridge_slave_1: entered allmulticast mode [ 529.247822][T14572] bridge_slave_1: entered promiscuous mode [ 529.314424][T14572] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 529.332493][T14572] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 529.397662][T14572] team0: Port device team_slave_0 added [ 529.408942][T14572] team0: Port device team_slave_1 added [ 529.425817][ T5908] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 529.468233][T14572] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 529.475319][T14572] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 529.502898][T14572] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 529.517294][T14572] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 529.524359][T14572] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 529.551994][T14572] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 529.608499][ T5908] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 529.620992][ T5908] usb 3-1: config 0 has no interfaces? [ 529.635343][ T5908] usb 3-1: New USB device found, idVendor=15f4, idProduct=0015, bcdDevice=d1.6e [ 529.656823][T14572] hsr_slave_0: entered promiscuous mode [ 529.659932][ T5908] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 529.672152][T14572] hsr_slave_1: entered promiscuous mode [ 529.679751][ T5908] usb 3-1: Product: syz [ 529.684112][ T5908] usb 3-1: Manufacturer: syz [ 529.688645][T14572] debugfs: 'hsr0' already exists in 'hsr' [ 529.691451][ T5908] usb 3-1: SerialNumber: syz [ 529.694462][T14572] Cannot create hsr debugfs directory [ 529.720183][ T5908] usb 3-1: config 0 descriptor?? [ 529.939461][ T5954] usb 3-1: USB disconnect, device number 35 [ 530.005990][ T5861] Bluetooth: hci0: command tx timeout [ 530.140123][T14572] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 530.151855][T14572] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 530.163660][T14572] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 530.190737][T14572] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 530.320472][T14572] 8021q: adding VLAN 0 to HW filter on device bond0 [ 530.363800][T14572] 8021q: adding VLAN 0 to HW filter on device team0 [ 530.379350][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 530.386647][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 530.412121][ T73] bridge0: port 2(bridge_slave_1) entered blocking state [ 530.419339][ T73] bridge0: port 2(bridge_slave_1) entered forwarding state [ 531.990091][T14754] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2448'. [ 532.001805][T14572] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 532.329847][T14764] netlink: 16186 bytes leftover after parsing attributes in process `syz.2.2449'. [ 532.373218][T14764] /dev/rnullb0: Can't open blockdev [ 532.409834][T14769] /dev/rnullb0: Can't open blockdev [ 532.477230][T14771] netlink: 'syz.3.2450': attribute type 10 has an invalid length. [ 532.509067][T14771] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2450'. [ 532.543545][T14774] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2450'. [ 532.610177][T14771] batman_adv: batadv0: Adding interface: virt_wifi0 [ 532.655932][T14771] batman_adv: batadv0: Interface activated: virt_wifi0 [ 532.750590][T14572] veth0_vlan: entered promiscuous mode [ 532.782407][T14572] veth1_vlan: entered promiscuous mode [ 532.883248][T14572] veth0_macvtap: entered promiscuous mode [ 532.913283][T14572] veth1_macvtap: entered promiscuous mode [ 532.953694][T14572] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 532.966582][ T10] usb 5-1: new high-speed USB device number 93 using dummy_hcd [ 533.137740][ T123] block nbd0: Possible stuck request ffff888025480000: control (read@0,1024B). Runtime 120 seconds [ 533.152541][ T123] block nbd0: Possible stuck request ffff8880254801c0: control (read@1024,1024B). Runtime 120 seconds [ 533.165674][ T123] block nbd0: Possible stuck request ffff888025480380: control (read@2048,1024B). Runtime 120 seconds [ 533.177269][ T123] block nbd0: Possible stuck request ffff888025480540: control (read@3072,1024B). Runtime 120 seconds [ 533.193474][ T10] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 533.203818][ T10] usb 5-1: config 0 has no interfaces? [ 533.211224][T14572] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 533.230928][ T10] usb 5-1: New USB device found, idVendor=15f4, idProduct=0015, bcdDevice=d1.6e [ 533.242087][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 533.250632][ T10] usb 5-1: Product: syz [ 533.256109][ T10] usb 5-1: Manufacturer: syz [ 533.260763][ T10] usb 5-1: SerialNumber: syz [ 533.288943][ T10] usb 5-1: config 0 descriptor?? [ 533.338002][ T13] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 533.363230][ T13] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 533.409152][ T13] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 533.425700][ T13] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 533.503133][ T44] usb 5-1: USB disconnect, device number 93 [ 533.639802][T10098] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 533.674114][T10098] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 533.752193][ T4345] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 533.790534][ T4345] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 534.186836][T14797] /dev/sg0: Can't lookup blockdev [ 534.271619][T14799] /dev/rnullb0: Can't open blockdev [ 534.339695][T14799] /dev/rnullb0: Can't open blockdev [ 534.353119][T14799] tipc: Started in network mode [ 534.364808][T14799] tipc: Node identity 00000000000000000000000000000001, cluster identity 4711 [ 534.399866][T14799] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 534.419940][T14799] tipc: Enabled bearer , priority 10 [ 534.565324][T14763] wlan0 speed is unknown, defaulting to 1000 [ 534.998797][T14814] FAULT_INJECTION: forcing a failure. [ 534.998797][T14814] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 535.065097][T14814] CPU: 1 UID: 0 PID: 14814 Comm: syz.7.2460 Not tainted 6.16.0-rc4-next-20250704-syzkaller #0 PREEMPT(full) [ 535.065131][T14814] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 535.065145][T14814] Call Trace: [ 535.065154][T14814] [ 535.065164][T14814] dump_stack_lvl+0x189/0x250 [ 535.065202][T14814] ? __pfx____ratelimit+0x10/0x10 [ 535.065227][T14814] ? __pfx_dump_stack_lvl+0x10/0x10 [ 535.065259][T14814] ? __pfx__printk+0x10/0x10 [ 535.065292][T14814] ? __might_fault+0xb0/0x130 [ 535.065336][T14814] should_fail_ex+0x414/0x560 [ 535.065383][T14814] _copy_from_user+0x2d/0xb0 [ 535.065417][T14814] memdup_user+0x5e/0xd0 [ 535.065444][T14814] kvm_arch_vcpu_ioctl+0x1aa8/0x2a40 [ 535.065473][T14814] ? __lock_acquire+0xab9/0xd20 [ 535.065498][T14814] ? kvm_arch_vcpu_ioctl+0x5f8/0x2a40 [ 535.065530][T14814] ? __pfx_kvm_arch_vcpu_ioctl+0x10/0x10 [ 535.065558][T14814] ? __lock_acquire+0xab9/0xd20 [ 535.065604][T14814] ? is_bpf_text_address+0x26/0x2b0 [ 535.065636][T14814] ? is_bpf_text_address+0x292/0x2b0 [ 535.065661][T14814] ? is_bpf_text_address+0x26/0x2b0 [ 535.065689][T14814] ? kernel_text_address+0xa5/0xe0 [ 535.065714][T14814] ? __kernel_text_address+0xd/0x40 [ 535.065735][T14814] ? unwind_get_return_address+0x4d/0x90 [ 535.065764][T14814] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 535.065796][T14814] ? arch_stack_walk+0xfc/0x150 [ 535.065840][T14814] ? stack_trace_save+0x9c/0xe0 [ 535.065873][T14814] ? stack_depot_save_flags+0x40/0x900 [ 535.065916][T14814] ? kasan_save_track+0x4f/0x80 [ 535.065944][T14814] ? kasan_save_track+0x3e/0x80 [ 535.065985][T14814] ? __lock_acquire+0xab9/0xd20 [ 535.066020][T14814] ? __mutex_trylock_common+0x153/0x260 [ 535.066055][T14814] ? __pfx___mutex_trylock_common+0x10/0x10 [ 535.066093][T14814] ? rcu_is_watching+0x15/0xb0 [ 535.066123][T14814] ? trace_contention_end+0x39/0x120 [ 535.066155][T14814] ? __mutex_lock+0x330/0xe80 [ 535.066183][T14814] ? kasan_quarantine_put+0xdd/0x220 [ 535.066227][T14814] ? kvm_vcpu_ioctl+0x22e/0xe90 [ 535.066261][T14814] ? __pfx___mutex_lock+0x10/0x10 [ 535.066286][T14814] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 535.066317][T14814] ? do_vfs_ioctl+0xbe8/0x1430 [ 535.066361][T14814] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 535.066397][T14814] kvm_vcpu_ioctl+0x74d/0xe90 [ 535.066436][T14814] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 535.066466][T14814] ? __lock_acquire+0xab9/0xd20 [ 535.066512][T14814] ? __fget_files+0x2a/0x420 [ 535.066541][T14814] ? __fget_files+0x2a/0x420 [ 535.066563][T14814] ? __fget_files+0x3a0/0x420 [ 535.066587][T14814] ? __fget_files+0x2a/0x420 [ 535.066615][T14814] ? bpf_lsm_file_ioctl+0x9/0x20 [ 535.066646][T14814] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 535.066677][T14814] __se_sys_ioctl+0xf9/0x170 [ 535.066712][T14814] do_syscall_64+0xfa/0x3b0 [ 535.066737][T14814] ? lockdep_hardirqs_on+0x9c/0x150 [ 535.066761][T14814] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 535.066784][T14814] ? clear_bhb_loop+0x60/0xb0 [ 535.066812][T14814] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 535.066834][T14814] RIP: 0033:0x7f4afeb8e929 [ 535.066855][T14814] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 535.066874][T14814] RSP: 002b:00007f4affac9038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 535.066898][T14814] RAX: ffffffffffffffda RBX: 00007f4afedb5fa0 RCX: 00007f4afeb8e929 [ 535.066916][T14814] RDX: 0000200000000500 RSI: 000000004008ae89 RDI: 0000000000000008 [ 535.066931][T14814] RBP: 00007f4affac9090 R08: 0000000000000000 R09: 0000000000000000 [ 535.066946][T14814] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 535.066959][T14814] R13: 0000000000000000 R14: 00007f4afedb5fa0 R15: 00007fffdfce4a28 [ 535.066993][T14814] [ 535.455084][ T5954] tipc: Node number set to 1 [ 536.116709][T14830] /dev/rnullb0: Can't open blockdev [ 536.445626][ T44] usb 4-1: new high-speed USB device number 119 using dummy_hcd [ 536.497572][T14840] program syz.4.2466 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 536.631802][ T44] usb 4-1: config 54 has an invalid descriptor of length 0, skipping remainder of the config [ 536.665626][ T44] usb 4-1: config 54 has 0 interfaces, different from the descriptor's value: 1 [ 536.716448][ T44] usb 4-1: New USB device found, idVendor=15f4, idProduct=0015, bcdDevice=d1.6e [ 536.755677][ T5943] usb 5-1: new high-speed USB device number 94 using dummy_hcd [ 536.764140][ T44] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 536.822122][ T44] usb 4-1: Product: syz [ 536.839658][ T44] usb 4-1: Manufacturer: syz [ 536.860082][ T44] usb 4-1: SerialNumber: syz [ 536.963369][ T5943] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 536.994133][ T5943] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 537.058181][ T5943] usb 5-1: New USB device found, idVendor=09e1, idProduct=5121, bcdDevice=40.c1 [ 537.106049][ T5943] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 537.137982][ T24] usb 4-1: USB disconnect, device number 119 [ 537.162719][ T5943] usb 5-1: Product: syz [ 537.184749][ T5943] usb 5-1: Manufacturer: syz [ 537.215632][ T5943] usb 5-1: SerialNumber: syz [ 537.241116][ T5943] usb 5-1: config 0 descriptor?? [ 537.738441][T14866] comedi comedi4: bad chanlist[0]=0x01000008 chan=8 range length=2 [ 537.854939][ T5861] Bluetooth: hci2: Dropping invalid advertising data [ 537.867045][ T5861] Bluetooth: hci2: Malformed LE Event: 0x02 [ 537.943118][T14871] FAULT_INJECTION: forcing a failure. [ 537.943118][T14871] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 537.966278][T14871] CPU: 1 UID: 0 PID: 14871 Comm: syz.7.2471 Not tainted 6.16.0-rc4-next-20250704-syzkaller #0 PREEMPT(full) [ 537.966312][T14871] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 537.966327][T14871] Call Trace: [ 537.966337][T14871] [ 537.966347][T14871] dump_stack_lvl+0x189/0x250 [ 537.966385][T14871] ? __pfx____ratelimit+0x10/0x10 [ 537.966410][T14871] ? __pfx_dump_stack_lvl+0x10/0x10 [ 537.966443][T14871] ? __pfx__printk+0x10/0x10 [ 537.966490][T14871] should_fail_ex+0x414/0x560 [ 537.966530][T14871] _copy_to_user+0x31/0xb0 [ 537.966567][T14871] simple_read_from_buffer+0xe1/0x170 [ 537.966596][T14871] proc_fail_nth_read+0x1df/0x250 [ 537.966630][T14871] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 537.966664][T14871] ? rw_verify_area+0x258/0x650 [ 537.966697][T14871] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 537.966727][T14871] vfs_read+0x200/0x980 [ 537.966766][T14871] ? __pfx___mutex_lock+0x10/0x10 [ 537.966804][T14871] ? __pfx_vfs_read+0x10/0x10 [ 537.966841][T14871] ? __fget_files+0x2a/0x420 [ 537.966871][T14871] ? __fget_files+0x3a0/0x420 [ 537.966895][T14871] ? __fget_files+0x2a/0x420 [ 537.966930][T14871] ksys_read+0x145/0x250 [ 537.966949][T14871] ? __fget_files+0x3a0/0x420 [ 537.966976][T14871] ? __pfx_ksys_read+0x10/0x10 [ 537.967017][T14871] ? do_syscall_64+0xbe/0x3b0 [ 537.967048][T14871] do_syscall_64+0xfa/0x3b0 [ 537.967072][T14871] ? lockdep_hardirqs_on+0x9c/0x150 [ 537.967096][T14871] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 537.967118][T14871] ? clear_bhb_loop+0x60/0xb0 [ 537.967147][T14871] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 537.967169][T14871] RIP: 0033:0x7f4afeb8d33c [ 537.967190][T14871] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 537.967210][T14871] RSP: 002b:00007f4affac9030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 537.967234][T14871] RAX: ffffffffffffffda RBX: 00007f4afedb5fa0 RCX: 00007f4afeb8d33c [ 537.967252][T14871] RDX: 000000000000000f RSI: 00007f4affac90a0 RDI: 0000000000000009 [ 537.967267][T14871] RBP: 00007f4affac9090 R08: 0000000000000000 R09: 0000000000000000 [ 537.967281][T14871] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 537.967295][T14871] R13: 0000000000000000 R14: 00007f4afedb5fa0 R15: 00007fffdfce4a28 [ 537.967330][T14871] [ 538.637753][T14882] /dev/rnullb0: Can't open blockdev [ 538.828593][ T5943] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 538.975735][ T5943] usb 3-1: device descriptor read/64, error -71 [ 539.217650][ T5943] usb 3-1: new high-speed USB device number 37 using dummy_hcd [ 539.365731][ T5943] usb 3-1: device descriptor read/64, error -71 [ 539.467108][ T10] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 539.476812][ T5943] usb usb3-port1: attempt power cycle [ 539.495074][ T44] usb 5-1: USB disconnect, device number 94 [ 539.639854][T10098] [ 539.642242][T10098] ============================================ [ 539.648395][T10098] WARNING: possible recursive locking detected [ 539.654573][T10098] 6.16.0-rc4-next-20250704-syzkaller #0 Not tainted [ 539.661200][T10098] -------------------------------------------- [ 539.667340][T10098] kworker/u8:19/10098 is trying to acquire lock: [ 539.673687][T10098] ffffe8ffffd24b70 (&pd_list->lock){+...}-{3:3}, at: padata_do_serial+0x73e/0xb80 [ 539.682915][T10098] [ 539.682915][T10098] but task is already holding lock: [ 539.690271][T10098] ffffe8ffffc24bc0 (&pd_list->lock){+...}-{3:3}, at: padata_do_serial+0x5b5/0xb80 [ 539.699497][T10098] [ 539.699497][T10098] other info that might help us debug this: [ 539.707548][T10098] Possible unsafe locking scenario: [ 539.707548][T10098] [ 539.714995][T10098] CPU0 [ 539.718267][T10098] ---- [ 539.721537][T10098] lock(&pd_list->lock); [ 539.725866][T10098] lock(&pd_list->lock); [ 539.730287][T10098] [ 539.730287][T10098] *** DEADLOCK *** [ 539.730287][T10098] [ 539.738421][T10098] May be due to missing lock nesting notation [ 539.738421][T10098] [ 539.746735][T10098] 3 locks held by kworker/u8:19/10098: [ 539.752188][T10098] #0: ffff88801ff40948 ((wq_completion)pencrypt_parallel){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 539.764112][T10098] #1: ffffc90003df7bc0 ((work_completion)(&pw->pw_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 539.775947][T10098] #2: ffffe8ffffc24bc0 (&pd_list->lock){+...}-{3:3}, at: padata_do_serial+0x5b5/0xb80 [ 539.785624][T10098] [ 539.785624][T10098] stack backtrace: [ 539.791511][T10098] CPU: 1 UID: 0 PID: 10098 Comm: kworker/u8:19 Not tainted 6.16.0-rc4-next-20250704-syzkaller #0 PREEMPT(full) [ 539.791530][T10098] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 539.791542][T10098] Workqueue: pencrypt_parallel padata_parallel_worker [ 539.791566][T10098] Call Trace: [ 539.791574][T10098] [ 539.791581][T10098] dump_stack_lvl+0x189/0x250 [ 539.791606][T10098] ? __pfx_dump_stack_lvl+0x10/0x10 [ 539.791628][T10098] ? __pfx__printk+0x10/0x10 [ 539.791656][T10098] ? print_lock_name+0xde/0x100 [ 539.791678][T10098] print_deadlock_bug+0x28b/0x2a0 [ 539.791701][T10098] validate_chain+0x1a3f/0x2140 [ 539.791724][T10098] ? irqentry_exit+0x74/0x90 [ 539.791741][T10098] ? lockdep_hardirqs_on+0x9c/0x150 [ 539.791756][T10098] ? look_up_lock_class+0x74/0x170 [ 539.791773][T10098] ? register_lock_class+0x51/0x320 [ 539.791791][T10098] __lock_acquire+0xab9/0xd20 [ 539.791811][T10098] ? padata_do_serial+0x73e/0xb80 [ 539.791832][T10098] lock_acquire+0x120/0x360 [ 539.791848][T10098] ? padata_do_serial+0x73e/0xb80 [ 539.791871][T10098] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 539.791897][T10098] _raw_spin_lock+0x2e/0x40 [ 539.791921][T10098] ? padata_do_serial+0x73e/0xb80 [ 539.791942][T10098] padata_do_serial+0x73e/0xb80 [ 539.791968][T10098] ? padata_parallel_worker+0x44/0x1d0 [ 539.791989][T10098] padata_parallel_worker+0x72/0x1d0 [ 539.792010][T10098] ? process_scheduled_works+0x9ef/0x17b0 [ 539.792030][T10098] process_scheduled_works+0xae1/0x17b0 [ 539.792059][T10098] ? __pfx_process_scheduled_works+0x10/0x10 [ 539.792084][T10098] worker_thread+0x8a0/0xda0 [ 539.792104][T10098] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 539.792122][T10098] ? __kthread_parkme+0x7b/0x200 [ 539.792145][T10098] kthread+0x70e/0x8a0 [ 539.792170][T10098] ? __pfx_worker_thread+0x10/0x10 [ 539.792188][T10098] ? __pfx_kthread+0x10/0x10 [ 539.792212][T10098] ? _raw_spin_unlock_irq+0x23/0x50 [ 539.792225][T10098] ? lockdep_hardirqs_on+0x9c/0x150 [ 539.792240][T10098] ? __pfx_kthread+0x10/0x10 [ 539.792263][T10098] ret_from_fork+0x3fc/0x770 [ 539.792283][T10098] ? __pfx_ret_from_fork+0x10/0x10 [ 539.792303][T10098] ? __switch_to_asm+0x39/0x70 [ 539.792317][T10098] ? __switch_to_asm+0x33/0x70 [ 539.792330][T10098] ? __pfx_kthread+0x10/0x10 [ 539.792353][T10098] ret_from_fork_asm+0x1a/0x30 [ 539.792372][T10098] [ 540.024739][T14913] netlink: 68 bytes leftover after parsing attributes in process `syz.3.2482'. SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 540.038384][T14914] /dev/rnullb0: Can't open blockdev [ 540.062588][ T10] usb 8-1: config 54 has an invalid descriptor of length 0, skipping remainder of the config [ 540.075643][ T5943] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 540.076119][ T10] usb 8-1: config 54 has 0 interfaces, different from the descriptor's value: 1 [ 540.121489][ T5943] usb 3-1: device descriptor read/8, error -71 [ 540.679114][ T4345] smc: removing ib device syz1 [ 540.791579][ T24] syz1: Port: 1 Link DOWN [ 541.052121][ T10] usb 8-1: New USB device found, idVendor=15f4, idProduct=0015, bcdDevice=d1.6e [ 541.062262][ T10] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 541.079299][ T12] netdevsim netdevsim7 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 541.118053][ T10] usb 8-1: can't set config #54, error -71 [ 541.187111][ T10] usb 8-1: USB disconnect, device number 2 [ 541.205369][ T12] netdevsim netdevsim7 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 541.302140][ T12] netdevsim netdevsim7 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 541.439607][ T4345] ------------[ cut here ]------------ [ 541.445135][ T4345] GID entry ref leak for dev syz1 index 2 ref=1 [ 541.454862][ T4345] WARNING: drivers/infiniband/core/cache.c:809 at gid_table_release_one+0x346/0x4d0, CPU#0: kworker/u8:8/4345 [ 541.466657][ T4345] Modules linked in: [ 541.470593][ T4345] CPU: 0 UID: 0 PID: 4345 Comm: kworker/u8:8 Not tainted 6.16.0-rc4-next-20250704-syzkaller #0 PREEMPT(full) [ 541.482313][ T4345] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 541.492426][ T4345] Workqueue: ib-unreg-wq ib_unregister_work [ 541.498699][ T4345] RIP: 0010:gid_table_release_one+0x346/0x4d0 [ 541.504817][ T4345] Code: e8 03 48 b9 00 00 00 00 00 fc ff df 0f b6 04 08 84 c0 75 3d 41 8b 0e 48 c7 c7 60 87 92 8c 4c 89 e6 44 89 fa e8 7b 0c f8 f8 90 <0f> 0b 90 90 e9 e3 fe ff ff 44 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c [ 541.524798][ T4345] RSP: 0018:ffffc9000db2f928 EFLAGS: 00010246 [ 541.531227][ T4345] RAX: 8185935f8a017600 RBX: ffff888030e184d8 RCX: ffff8880327d0000 [ 541.539729][ T4345] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002 [ 541.548562][ T4345] RBP: 1ffff110061c309b R08: ffffc9000db2f647 R09: 1ffff92001b65ec8 [ 541.557396][ T4345] R10: dffffc0000000000 R11: fffff52001b65ec9 R12: ffff88805b4c85e0 [ 541.565414][ T4345] R13: ffff888030e18400 R14: ffff88814ce71500 R15: 0000000000000002 [ 541.573814][ T4345] FS: 0000000000000000(0000) GS:ffff8881257af000(0000) knlGS:0000000000000000 [ 541.583078][ T4345] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 541.590066][ T4345] CR2: 00007ffdbd7c72f0 CR3: 0000000020bc4000 CR4: 00000000003526f0 [ 541.598290][ T4345] DR0: 0000000000000000 DR1: 0000000000000097 DR2: 0000000000000000 [ 541.606851][ T4345] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 541.614852][ T4345] Call Trace: [ 541.618491][ T4345] [ 541.621443][ T4345] ib_device_release+0xd2/0x1c0 [ 541.626636][ T4345] ? __pfx_ib_device_release+0x10/0x10 [ 541.632122][ T4345] device_release+0x99/0x1c0 [ 541.637030][ T4345] kobject_put+0x22b/0x480 [ 541.641791][ T4345] ? process_scheduled_works+0x9ef/0x17b0 [ 541.647813][ T4345] process_scheduled_works+0xae1/0x17b0 [ 541.653955][ T4345] ? __pfx_process_scheduled_works+0x10/0x10 [ 541.660771][ T4345] worker_thread+0x8a0/0xda0 [ 541.665404][ T4345] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 541.672028][ T4345] ? __kthread_parkme+0x7b/0x200 [ 541.677317][ T4345] kthread+0x70e/0x8a0 [ 541.681423][ T4345] ? __pfx_worker_thread+0x10/0x10 [ 541.686977][ T4345] ? __pfx_kthread+0x10/0x10 [ 541.691605][ T4345] ? _raw_spin_unlock_irq+0x23/0x50 [ 541.697128][ T4345] ? lockdep_hardirqs_on+0x9c/0x150 [ 541.702355][ T4345] ? __pfx_kthread+0x10/0x10 [ 541.707242][ T4345] ret_from_fork+0x3fc/0x770 [ 541.711867][ T4345] ? __pfx_ret_from_fork+0x10/0x10 [ 541.717274][ T4345] ? __switch_to_asm+0x39/0x70 [ 541.722046][ T4345] ? __switch_to_asm+0x33/0x70 [ 541.727091][ T4345] ? __pfx_kthread+0x10/0x10 [ 541.731720][ T4345] ret_from_fork_asm+0x1a/0x30 [ 541.736822][ T4345] [ 541.739868][ T4345] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 541.747168][ T4345] CPU: 0 UID: 0 PID: 4345 Comm: kworker/u8:8 Not tainted 6.16.0-rc4-next-20250704-syzkaller #0 PREEMPT(full) [ 541.758813][ T4345] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 541.768881][ T4345] Workqueue: ib-unreg-wq ib_unregister_work [ 541.774798][ T4345] Call Trace: [ 541.778087][ T4345] [ 541.781021][ T4345] dump_stack_lvl+0x99/0x250 [ 541.785626][ T4345] ? __asan_memcpy+0x40/0x70 [ 541.790224][ T4345] ? __pfx_dump_stack_lvl+0x10/0x10 [ 541.795433][ T4345] ? __pfx__printk+0x10/0x10 [ 541.800059][ T4345] panic+0x2db/0x790 [ 541.803963][ T4345] ? __pfx_panic+0x10/0x10 [ 541.808393][ T4345] ? ret_from_fork_asm+0x1a/0x30 [ 541.813335][ T4345] __warn+0x334/0x4c0 [ 541.817324][ T4345] ? gid_table_release_one+0x346/0x4d0 [ 541.822794][ T4345] ? gid_table_release_one+0x346/0x4d0 [ 541.828264][ T4345] report_bug+0x2be/0x4f0 [ 541.832597][ T4345] ? gid_table_release_one+0x346/0x4d0 [ 541.838061][ T4345] ? gid_table_release_one+0x346/0x4d0 [ 541.843527][ T4345] ? gid_table_release_one+0x348/0x4d0 [ 541.848992][ T4345] handle_bug+0x84/0x160 [ 541.853244][ T4345] exc_invalid_op+0x1a/0x50 [ 541.857763][ T4345] asm_exc_invalid_op+0x1a/0x20 [ 541.862626][ T4345] RIP: 0010:gid_table_release_one+0x346/0x4d0 [ 541.868703][ T4345] Code: e8 03 48 b9 00 00 00 00 00 fc ff df 0f b6 04 08 84 c0 75 3d 41 8b 0e 48 c7 c7 60 87 92 8c 4c 89 e6 44 89 fa e8 7b 0c f8 f8 90 <0f> 0b 90 90 e9 e3 fe ff ff 44 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c [ 541.888314][ T4345] RSP: 0018:ffffc9000db2f928 EFLAGS: 00010246 [ 541.894388][ T4345] RAX: 8185935f8a017600 RBX: ffff888030e184d8 RCX: ffff8880327d0000 [ 541.902368][ T4345] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002 [ 541.910431][ T4345] RBP: 1ffff110061c309b R08: ffffc9000db2f647 R09: 1ffff92001b65ec8 [ 541.918417][ T4345] R10: dffffc0000000000 R11: fffff52001b65ec9 R12: ffff88805b4c85e0 [ 541.926395][ T4345] R13: ffff888030e18400 R14: ffff88814ce71500 R15: 0000000000000002 [ 541.934383][ T4345] ? gid_table_release_one+0x345/0x4d0 [ 541.939861][ T4345] ib_device_release+0xd2/0x1c0 [ 541.944718][ T4345] ? __pfx_ib_device_release+0x10/0x10 [ 541.950182][ T4345] device_release+0x99/0x1c0 [ 541.954781][ T4345] kobject_put+0x22b/0x480 [ 541.959210][ T4345] ? process_scheduled_works+0x9ef/0x17b0 [ 541.964948][ T4345] process_scheduled_works+0xae1/0x17b0 [ 541.970518][ T4345] ? __pfx_process_scheduled_works+0x10/0x10 [ 541.976527][ T4345] worker_thread+0x8a0/0xda0 [ 541.981132][ T4345] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 541.987466][ T4345] ? __kthread_parkme+0x7b/0x200 [ 541.992420][ T4345] kthread+0x70e/0x8a0 [ 541.996506][ T4345] ? __pfx_worker_thread+0x10/0x10 [ 542.001628][ T4345] ? __pfx_kthread+0x10/0x10 [ 542.006230][ T4345] ? _raw_spin_unlock_irq+0x23/0x50 [ 542.011442][ T4345] ? lockdep_hardirqs_on+0x9c/0x150 [ 542.016645][ T4345] ? __pfx_kthread+0x10/0x10 [ 542.021252][ T4345] ret_from_fork+0x3fc/0x770 [ 542.025849][ T4345] ? __pfx_ret_from_fork+0x10/0x10 [ 542.030972][ T4345] ? __switch_to_asm+0x39/0x70 [ 542.035737][ T4345] ? __switch_to_asm+0x33/0x70 [ 542.040505][ T4345] ? __pfx_kthread+0x10/0x10 [ 542.045111][ T4345] ret_from_fork_asm+0x1a/0x30 [ 542.049883][ T4345] [ 542.053254][ T4345] Kernel Offset: disabled [ 542.057585][ T4345] Rebooting in 86400 seconds..