last executing test programs: 14.691898887s ago: executing program 3 (id=4): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) bind$unix(r0, 0x0, 0x0) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = socket$can_j1939(0x1d, 0x2, 0x7) r3 = getpgrp(r1) ioctl$sock_SIOCSPGRP(r2, 0x8902, &(0x7f0000000000)=r3) ptrace(0x10, r1) arch_prctl$ARCH_REQ_XCOMP_GUEST_PERM(0x1025, 0x80000000009) ptrace$setregs(0xd, r1, 0x0, &(0x7f00000003c0)="18607651149d7b10b4024fbbdc08899b8f589df2dbb5d7a8d1b36cfab675cb3976ee8100e2878c9cfa178cac130eb046eda93df39ed4b41924dc225ad4028dd63defb87d698be5c749450b350a789dcfc6b2d6a696b5026d1e52f19274566d1da0f353dd65e330ebf71c5e823f2753c5fd76724828ef31b353e71805205c3dceb44cc4c7b3664e29fb") r4 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/clear_refs\x00', 0x1, 0x0) syz_usb_connect(0x1, 0x2d, &(0x7f0000000340)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b0001000000010904010001faf40d00090582239f"], 0x0) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x800000000000) writev(r5, &(0x7f00000002c0)=[{&(0x7f0000000180)="846cb78afbe02da52bdb47", 0xb}], 0x1) write$sysctl(r4, &(0x7f0000000180)='5\x00', 0x2) r6 = socket(0x400000000010, 0x3, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0xb, 0x0, 0x0) ioctl$sock_SIOCETHTOOL(r6, 0x89f0, &(0x7f0000001440)={'ip6_vti0\x00', &(0x7f0000000000)=@ethtool_wolinfo={0x5, 0x0, 0x102, "0000000400"}}) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, 0x0, 0x4c050) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r9 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r9, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r8, &(0x7f0000000080)=ANY=[@ANYBLOB="034886dd010000000000140000006000000003082f00fe88a43de1a400000000000000007d01ff020000000000000000000000000001"], 0xfdef) ptrace$getregset(0x4205, r1, 0x2, &(0x7f0000000180)={0x0, 0x6c00}) 13.944836183s ago: executing program 0 (id=1): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000006c0)=ANY=[@ANYBLOB="1201000000000040c41090ea80000000000109022400010000000009040000010300000009210000000122070009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000000c0)={0x2c, &(0x7f0000000100)={0x0, 0xc, 0x8, {0x8, 0x0, "392cdaab4a73"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = syz_open_dev$hidraw(&(0x7f0000000280), 0x82, 0x2) close(0x3) preadv(r1, &(0x7f0000000080)=[{&(0x7f0000000000)=""/103, 0x67}], 0x1, 0x3, 0xe1e) write$hidraw(r1, 0x0, 0x8) 13.895166864s ago: executing program 1 (id=2): r0 = syz_usb_connect$lan78xx(0x6, 0x3f, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000000)={0x34, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_ABS_SETUP(r1, 0x401c5504, &(0x7f0000000340)={0x400000100002f, {0x0, 0x0, 0x0, 0x0, 0x1}}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000940)={0x34, &(0x7f0000000680)={0x0, 0x30}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000240)={0x34, &(0x7f0000000200)={0x40, 0x15}, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="1201000013906c08e90f01db9be9010203010902120001000000000904"], 0x0) syz_usb_control_io$printer(r2, 0x0, 0x0) socket(0x18, 0x3, 0x5) syz_open_dev$evdev(&(0x7f00000000c0), 0x40, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000f40)={0x84, &(0x7f0000000740)={0x40, 0x17}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000980)={0x84, &(0x7f0000000e80)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000ac0)={0x84, &(0x7f0000000380)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000100)={@dev, 0x0, 0x1, 0x0, 0xa}, 0x0) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) ioctl$FS_IOC_GETFSLABEL(r3, 0x400452c8, &(0x7f0000000100)) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_open_dev$vcsu(&(0x7f0000000100), 0x3d3e6f95, 0x200080) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000500)={0x34, &(0x7f0000000300)={0x20, 0x7}, 0x0, 0x0, 0x0, 0x0, 0x0}) 9.785817095s ago: executing program 0 (id=10): r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="f7", @ANYRESDEC], 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_ep_write(r0, 0x81, 0x8, &(0x7f0000000080)="00012c615bc20000") read$char_usb(r1, 0x0, 0x0) syz_usb_disconnect(r0) r2 = openat$comedi(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/comedi4\x00', 0x101040, 0x0) ioctl$COMEDI_DEVINFO(r2, 0x80b06401, &(0x7f0000001580)) 9.147083633s ago: executing program 3 (id=12): r0 = socket$inet6(0xa, 0x1, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000000)={0x500, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="020300090a0000000000000004000000030006000000000002000000ac1414000000000000000000020001000000000000000002fffffffb030005000000000002"], 0x50}}, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000180)={{{@in=@private, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@local, 0x0, 0x6c}, 0x0, @in6=@loopback, 0x0, 0x0, 0x0, 0x4}}, 0xe8) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x80fe, 0x0, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c) 8.915488912s ago: executing program 1 (id=13): setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007fd, 0x0, 0x0) r0 = syz_open_dev$vim2m(&(0x7f0000000080), 0x6, 0x2) ioctl$vim2m_VIDIOC_ENUM_FRAMESIZES(r0, 0xc02c564a, &(0x7f0000000000)) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000003c0)={'wlan0\x00'}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(0xffffffffffffffff, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, 0x0, 0x0) mq_notify(0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0xffffe000) r1 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_QUEUEPAIR_DETACH(r1, 0x7aa, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000680)={0x14, 0x1e, 0x21, 0x70bd2d, 0x0, {0x7}}, 0x14}, 0x1, 0x0, 0x0, 0x4014}, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4, 0x0, 0x0, 0x2) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000), 0x80800, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000002880), r3) r5 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r5, 0x0, 0xc8, 0x0, 0x0) syz_genetlink_get_family_id$devlink(&(0x7f0000000200), r3) sendmsg$MPTCP_PM_CMD_SUBFLOW_CREATE(r3, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000002980)={&(0x7f00000028c0)={0x14, r4, 0x1, 0x70bd28, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x20048010}, 0x80c0) ioctl$F2FS_IOC_FLUSH_DEVICE(r1, 0x4008f50a, &(0x7f00000001c0)={0x800, 0x2}) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r3, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="000225bd7000fbdbdf2505000000"], 0x14}, 0x1, 0x0, 0x0, 0x20008008}, 0x4040080) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r6, 0x84, 0x14, &(0x7f0000000140), &(0x7f0000000180)=0x4) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x66) 8.373554055s ago: executing program 2 (id=14): r0 = socket$kcm(0x10, 0x2, 0x4) keyctl$chown(0x4, 0x0, 0x0, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) (async) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000140), 0xffffffffffffffff) (async) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000140), 0xffffffffffffffff) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000180), &(0x7f00000001c0)=0x4) (async) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000180)=0x0, &(0x7f00000001c0)=0x4) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000280)={'syztnl0\x00', &(0x7f0000000200)={'ip6_vti0\x00', 0x0, 0x4, 0x1, 0x7, 0x3, 0x4, @remote, @local, 0x0, 0x7, 0x5, 0xffc00000}}) sendmsg$ETHTOOL_MSG_DEBUG_SET(r2, &(0x7f0000000880)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000840)={&(0x7f0000000480)={0x3c0, r3, 0x8, 0x70bd25, 0x25dfdbfb, {}, [@ETHTOOL_A_DEBUG_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bridge\x00'}]}, @ETHTOOL_A_DEBUG_HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}, @ETHTOOL_A_DEBUG_MSGMASK={0x4}, @ETHTOOL_A_DEBUG_MSGMASK={0x264, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_MASK={0x22, 0x5, "dda2e558a568543ffaea6a493ec6011af53fe7f08cb59d77defac4b3d61b"}, @ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_VALUE={0x74, 0x4, "73e3a94bf71e149a15cdb5def41459031e861687e92c6ddbb9b751a065081d06037f9c69ae340d99eed97bd716724dea87a33694f5715279e617453984142fe15b69c122ce5a17cb515a88b3ae73d8f5ada765fcf20afab67f2e351302bb71f0c4643b06f400400190e6e4b5162975c4"}, @ETHTOOL_A_BITSET_VALUE={0x59, 0x4, "3d7ead1e5917da11c58b1d9589316b546f1f3a28ad7492ad3232957434b74bfeb4f9cdf6dcfaa3d737b25c26a62fcfadc72b1dcbe5932443fd6eb555b060ac5360035c46eb2e7c5a81e575722c4f9824b7aa3290d7"}, @ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_BITS={0x20, 0x3, 0x0, 0x1, [{0x8, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x9, 0x2, '$\\@\'\x00'}]}]}, @ETHTOOL_A_BITSET_BITS={0x140, 0x3, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0xb, 0x2, '\'(\xf1#*%\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x15, 0x2, '/dev/dlm-control\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x5}, @ETHTOOL_A_BITSET_BIT_NAME={0x5, 0x2, '\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0x5, 0x2, '\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x8001}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x6c, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x5}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x15, 0x2, '/dev/dlm-control\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8}, @ETHTOOL_A_BITSET_BIT_NAME={0x15, 0x2, '/dev/dlm-control\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0xe, 0x2, '\x8a-](].{+\'\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x200}]}, {0x50, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0x14, 0x2, ',@)%${$%%){+\x9d},\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x24}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x15, 0x2, '/dev/dlm-control\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x3ff}]}]}]}, @ETHTOOL_A_DEBUG_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}, @ETHTOOL_A_DEBUG_MSGMASK={0x100, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x98, 0x3, 0x0, 0x1, [{0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x1004}, @ETHTOOL_A_BITSET_BIT_NAME={0x12, 0x2, '.@[-}[@-[!.\'\xe2\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x7}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x44, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x15, 0x2, '/dev/vhost-vsock\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x1}, @ETHTOOL_A_BITSET_BIT_NAME={0x15, 0x2, '/dev/dlm-control\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x8, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x1}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x5}]}]}, @ETHTOOL_A_BITSET_BITS={0x5c, 0x3, 0x0, 0x1, [{0x48, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x15, 0x2, '/dev/vhost-vsock\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0x6, 0x2, '!\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x98}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x6}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xfffffff9}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x8}]}, {0x10, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xe}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}]}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0xc}]}, @ETHTOOL_A_DEBUG_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}]}]}, 0x3c0}, 0x1, 0x0, 0x0, 0x4000000}, 0x8800) r6 = eventfd(0x0) ioctl$VHOST_SET_VRING_KICK(r1, 0x4008af20, &(0x7f0000000040)={0x1, r6}) r7 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000), 0x8502, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f00000000c0)={0x5, &(0x7f0000000100)=[{0x5, 0x6, 0xf2, 0x12}, {0x8, 0xef, 0x2, 0xf867}, {0xf123, 0x85, 0x7, 0x6}, {0x7cd, 0x40, 0x83, 0xe6db}, {0x81, 0x4, 0x3, 0x80000000}]}) (async) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f00000000c0)={0x5, &(0x7f0000000100)=[{0x5, 0x6, 0xf2, 0x12}, {0x8, 0xef, 0x2, 0xf867}, {0xf123, 0x85, 0x7, 0x6}, {0x7cd, 0x40, 0x83, 0xe6db}, {0x81, 0x4, 0x3, 0x80000000}]}) write$sndseq(r7, &(0x7f0000001380)=[{0x6, 0x0, 0x0, 0x0, @tick, {0x4}, {}, @raw32={[0x7, 0x7ff, 0x4]}}, {0x0, 0x0, 0x0, 0x0, @time={0xffff, 0xa5}, {}, {}, @connect={{0x2, 0x1}, {0x3}}}, {0x0, 0x0, 0x0, 0x0, @time={0x2, 0x2}, {0x0, 0x8}, {}, @control}, {0x0, 0x0, 0x0, 0x0, @time, {0x0, 0xfe}, {}, @connect={{}, {0x0, 0x5}}}], 0x70) sendmsg$kcm(r0, &(0x7f00000019c0)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f00000003c0)="89000000120081ae08060cdc030000007f1be3f74001000000e2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec00120c00014009080c00000006009bbc7a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947ee2b49e33538afa8af92347514f0b56a20ff27fff", 0x89}], 0x1}, 0x0) 7.936446204s ago: executing program 3 (id=15): r0 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000340)={0x0, 0x0, 0x100, 0x2, 0x1e5}, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0, &(0x7f00000000c0)=0x0) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000980)=@IORING_OP_MSG_RING={0x28, 0x40, 0x0, r0, 0x1, 0x0, 0x0, 0x1, 0x1}) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f00000003c0)={0x2e, 0x5, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0xeffd, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000200)=@any_dev={0x4, 0xd74, 0x0, 0x0, 0x1000, 0x68ba, 0x0, 0x0, 0x10}}}, 0x0) 7.312071301s ago: executing program 3 (id=16): r0 = syz_usb_connect(0x2, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000059770c40c009030243d3000000010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000640)={0x1c, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, &(0x7f0000000380)={0x14, &(0x7f0000000080)={0x40, 0x7, 0x58, {0x58, 0x1, "bc8cbd1a223a5acac5891ca09af3e765ad496c07b25f0ab2f7066fd7649ab930695b90d4a5fad9b923286aa64b6252913871242f9db69fcfeddc16a656047473730447d8835aaea072424aaa7d91f9d2cad0e6c8f6e3"}}, &(0x7f0000000280)={0x0, 0x3, 0xb9, @string={0xb9, 0x3, "b88814029634de589a7a7811aab8818c916f1a649b6bec8b71f7522eaacb292fbf4e7b2fbdb9c29d0bae094f5a30042805ef0104e4048e2a124f15af70a891394b74aebe79c1e3ca6c2a4a01fc7fc88374156e965d5243396bf6d4077fcf53767c0a77b26d6d40279a40a6bb78c2701f11318e92ef9061d0f3866167b8a0c0553b2f83ef8a2e97c843640bdbe1ff58cf9f352320669e4ce2a181986c3750a07df331c079a55edbd75275fe43e81cb6b9de1e90550b73d2"}}}, &(0x7f00000007c0)={0x44, &(0x7f0000000440)={0x20, 0x31, 0x86, "f6553b3af91125a3a15e7df924a23dc16aa3a601af469566cdc468579b1305c048db5d62fabc021de3dbd6868761fb36cfd18200d71a329d84110c8814663e4300d3c4f930cc184f3db813c204a09467772180edfae839bf52b69b02d346cbea45200676665f7263c4e7c3a07f1d1687f00e7d9071d6e9dd480061c1dbbe26067164d0c0f558"}, &(0x7f0000000580)={0x0, 0xa, 0x1, 0x1}, &(0x7f00000005c0)={0x0, 0x8, 0x1, 0x7}, &(0x7f0000000600)={0x20, 0x81, 0x1, "c2"}, &(0x7f0000000680)={0x20, 0x82, 0x1, "99"}, &(0x7f00000006c0)={0x20, 0x83, 0x1, "1d"}, &(0x7f0000000700)=ANY=[@ANYBLOB="208b04000000b764b2cb"], &(0x7f0000000780)={0x20, 0x85, 0x3, "7e5ff9"}}) ioctl$BLKCLOSEZONE(0xffffffffffffffff, 0x40101287, &(0x7f0000000340)={0x5, 0x1}) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000740)={0x2c, &(0x7f0000000540)={0x40, 0x5, 0x33, "9a31d2afe80f4c7a8b2be6b03128feabc873c9695ff34f39601a7a93419931f3d70645ffae91a3a9f39c1271368584f5721e96"}, 0x0, 0x0, 0x0, 0x0}) 7.147806815s ago: executing program 2 (id=17): r0 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f00000000c0)={0x0, 0x89, 0x20}, &(0x7f0000000140)=0xc) getsockopt$inet_sctp_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f0000000200)={r1, 0x8}, &(0x7f0000000340)=0x8) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000180)={r2, 0x3ff}, 0xc) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) r4 = dup(r3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000006, 0x28011, r4, 0x0) r5 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r5, 0x11b, 0x4, &(0x7f0000000340)={&(0x7f0000000000)=""/62, 0x328000, 0x800, 0x9, 0x3}, 0x20) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x100002, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_CAP_MAX_VCPU_ID(r8, 0x4068aea3, &(0x7f0000000000)) sendmsg$nl_generic(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000980)={0x24, 0x2d, 0xb, 0x70bd27, 0x0, {0x8}, [@typed={0x4, 0x3}, @nested={0x9, 0x1, 0x0, 0x1, [@generic="c24f7fef1c"]}]}, 0x24}, 0x1, 0x0, 0x0, 0x240040c1}, 0x8000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) r9 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_MCAST(r9, &(0x7f0000000240)={0x16, 0x98, 0xfa00, {0x0, 0x3, 0xffffffffffffffff, 0x30, 0x3, @ib={0x1b, 0x9, 0x516f, {"59b2fbde010100000000000000e78380"}, 0xbffffffffffffffc, 0xfffffffffffffffb, 0x1}}}, 0xa0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000000000/0x1000)=nil, 0x1000, 0x0) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000050000000900010073797a300000000078000000030a01030000000000000000050000000900010073797a300000000008000740000000001c0008800c00024000000000000000000c00014000000000000000000900030073797a3200000000280004800800024000000000140003007465616d5f736c6176655f3000000000080001"], 0xd4}}, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) r11 = socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r11, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r11, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r12, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r13, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) r14 = socket$nl_generic(0x10, 0x3, 0x10) r15 = syz_genetlink_get_family_id$devlink(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_GET(r14, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000000)={0x14, r15, 0x303, 0x2000, 0x0, {0x13}}, 0x14}}, 0x0) sendmsg$DEVLINK_CMD_PORT_GET(r11, &(0x7f00000004c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000480)={&(0x7f00000003c0)={0x84, r15, 0x300, 0x70bd29, 0x25dfdbfb, {}, [{{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x2}}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x2}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}}]}, 0x84}, 0x1, 0x0, 0x0, 0x40}, 0x1) socket$kcm(0x10, 0x2, 0x0) 6.645019314s ago: executing program 0 (id=18): mkdir(&(0x7f0000001a80)='./file0\x00', 0x1cb) (async, rerun: 32) mount$9p_rdma(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x10000, &(0x7f0000000180)={'trans=rdma,', {'port', 0x3d, 0x4e24}, 0x2c, {[{@rq}]}}) (async, rerun: 32) r0 = socket$inet6(0xa, 0x5, 0x0) bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) r1 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r1, &(0x7f0000000140)=@in4={0x21, 0x4, 0x2, 0x10, {0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x3d}}}, 0x24) sendmmsg(r1, &(0x7f0000000180)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18, 0xe000}, 0x5}], 0x1, 0x0) (async, rerun: 32) recvmmsg$unix(r1, &(0x7f0000000080)=[{{0x0, 0x0, 0x0}}], 0x1, 0x100, 0x0) (async, rerun: 32) syz_usb_connect$uac1(0x0, 0xac, &(0x7f00000000c0)=ANY=[@ANYBLOB="12015001000000106b1d010140000102030109029a00030100e0000904000000010100000a24010000000201020c240200000000000e0000000524050000082404030f8bf8ae0c240701050000c80975f9070d24070101000005cf1f0000050924030000000001"], 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r2, 0x84, 0x7c, &(0x7f0000000240)={0x0, 0x5f8e, 0x7ff}, 0x8) (async) connect$inet6(r0, &(0x7f0000000300)={0xa, 0x4e22, 0x1, @private1, 0x5}, 0x1c) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = syz_genetlink_get_family_id$gtp(&(0x7f0000000400), 0xffffffffffffffff) (async, rerun: 64) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) (rerun: 64) bind$unix(r5, &(0x7f0000000040)=@file={0x0, './file0\x00'}, 0x6e) sendmsg$GTP_CMD_GETPDP(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x1c, r4, 0x1, 0x0, 0x0, {}, [@GTPA_VERSION={0x8}]}, 0x1c}}, 0x0) setsockopt$SO_BINDTODEVICE_wg(r0, 0x1, 0x19, &(0x7f0000000200)='wg0\x00', 0x4) (async) r6 = socket$inet6(0xa, 0x5, 0x0) (async, rerun: 32) r7 = socket$inet_icmp_raw(0x2, 0x3, 0x1) (async, rerun: 32) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x81, 0xffffffff}) (async) r8 = syz_open_dev$sg(&(0x7f0000000200), 0x0, 0x401) ioctl$SG_IO(r8, 0x2285, &(0x7f0000000100)={0x53, 0xffffffffffffffff, 0x6, 0xfd, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000640)="9efe7be3907c", 0x0, 0xfffffffb, 0x5dbcc8c695e4f439, 0xffffffff, 0x0}) (async) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r9, &(0x7f0000000980)={0x0, 0x0, &(0x7f0000000940)={&(0x7f0000000880)={0x24, 0x4, 0x8, 0x101, 0x0, 0x0, {0xa}, [@CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x886c}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x20044004}, 0x0) (async) setsockopt$SO_ATTACH_FILTER(r7, 0x1, 0x4c, &(0x7f000002eff0)={0x0, 0x0}, 0x10) getdents64(0xffffffffffffffff, &(0x7f00000001c0)=""/51, 0x33) (async, rerun: 64) bind$inet6(r6, &(0x7f0000000140)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x41}}}, 0x1c) (rerun: 64) connect$inet6(r6, &(0x7f0000000300)={0xa, 0x4e22, 0x2, @private1, 0x5}, 0x1c) 6.049490393s ago: executing program 1 (id=19): unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$nl_audit(0x10, 0x3, 0x9) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x40241, 0x0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) syz_open_dev$ublk_chdev(&(0x7f0000000040), 0x0, 0x200) sched_rr_get_interval(0x0, 0x0) socket$inet(0x2, 0x3, 0x2) close_range(r1, 0xffffffffffffffff, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f00000003c0)=ANY=[@ANYBLOB="12010000d3ccb510b1134200292b0102030109021b0001fc00000009040f0001e711e10009058317ff"], 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="000086dd0203050009000a004000683739ed005029fffe8000000000000000000000000000aaff020000000000000000000000000001"], 0xfdef) 5.179379879s ago: executing program 0 (id=20): ioctl$UFFDIO_CONTINUE(0xffffffffffffffff, 0xc020aa08, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) ioctl$sock_SIOCSIFVLAN_SET_VLAN_NAME_TYPE_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000100)={0x6, 'syzkaller1\x00', {0x2}, 0x105}) r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x42202) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x7f}) write$sndseq(r0, &(0x7f0000000000)=[{0x84, 0x77, 0x0, 0x0, @tick=0x717565, {}, {}, @raw32}], 0xffc8) 4.933824903s ago: executing program 2 (id=21): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f00000017c0), r0) sendmsg$NLBL_CALIPSO_C_LIST(r0, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000001880)={&(0x7f0000001800)={0x1c, r1, 0x7ce7e4ef5851f55f, 0x70bd2b, 0x25dfdbfc, {}, [@NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x3}]}, 0x1c}, 0x1, 0x0, 0x4000000000000000, 0x4}, 0x0) 4.793721683s ago: executing program 2 (id=22): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) sendmmsg$inet(r0, &(0x7f0000001b00)=[{{0x0, 0x0, &(0x7f0000001680)=[{0x0}, {&(0x7f0000000640)="f2b4e4f180ec3860b99bb254602fb717f9437cd2547fce2306325491a0ec68779f10729ed1f62f6e2c132ca90d49aa95a1ed03f8c6b4f274bf080197a2f4c0fad41128ae51096ffcba1b5266add485ebbd308420c601f47062eb3fcbbb91207f65d852dd8966f195f9c9300b939bb8395eedebf432e9f4518e838779a8d8c8283797a2116396f1fcef6cad72ccc5f1784bdfdebd04af58f57424c27be084c48079913780d2c30a94a2f7891b3ca75cbb149caf8a22e187fe16721bc163e4471b50b796a4680a200cba9a912b578afda68a732ccb9f6e086e680bc21de5988055a4b1f1c5450afd33288da6819fcbeb30ab8c28cad8594d7b5c6bb6b1897bcb8238f4c166249c45267e64ad1601d57dbb5c4bc807719c13b1978dac89a91c58c46332f597177ac6d8404aad1a6ab02cdf0623814b3e36d4daf52273bddd84e14d86eb673334357e4a0d053a6d0725c37ad09f982b8e7c04fe136d34349958a6c61fecbf61c021be1c381867f55266d4d35050c8729f8c3c760a24ef98ceb6181b35c7c66d59b485d545652a6377393bf6bee54a7d6b3309a17954643a077add125bf2a8cfdc0cc58d94ec39c4ba2df86554c625f09c0c340618fbc5f77cba9a189f0ef47e6dc57ac0449ba0713ed40418169b81a9c22ddbe97b5994f92d7fcc369d52c5c90aa57fbd06b3149acb7722f979a947861e16865516b5d510e2d53084f80b28bfddafec63a84117ebfd4500eb78e095818345bb5d436d815fe93d21b85d86ee2f94e6377393b43ab999b10fe15754baa05012eb8f4fef67b39c3d50260e38dea1d3c982e6a6c3e4f346674eeba27e4a215c7d0a66b8ccdaeb694cf8b62eb5911917c7dcbd9ac6c295635170a00a9cbf14e18f45c54f8daa08e2bade74e4c3ef9969cefa698a37cefce1794bba0939c08c214c2845dd47fdcd5737340f08e6949c86da2fc3bcccba120f8d669b43e0126ed1d17c2778d3b8f456dbad5e3ea6a3af578ea12ed04807599334f3f8058b03276861170944cb14494a07fd3bb0b8ace43fb42aca5629cb60bf1ff818157b10c978629bf4e1c82ef41e90f89b8ab0291a4a28ab294c9fd011b73f914421a7964ba165ad02d6c4037acf446050a20e84fe8ca45176f7d599d8eae6e3ac2c89528e9e9d54a07e56d11f521906b392481a00ab4d46141df670067f876dfcb23602b7fa2045df525d756d6e12ea87df64e46ebea1a389cb65e2dcc1e7075502f7bc03b52b78744a474f6cb1bc16d3d3ff33d78ea868850ffca814b80e9ae598660e2dd03da9f08bfef4ab81c3c6d2a5706cf4c29f96364a18b404f31bb104afa11222188ad94331f100546ab65385870241d39090edb540e0c80a5b2baffdae0619423b9404ac52c0e1d50fac5029c0cbf85cdbee365c6e6f2f8b8386febb21fa3517184955a31ebb64d3db9c32530abd4becd63ef02fe01a8de92217f54c62afa1c6277f2fc32412964dcb51573153162603111b25f19e7735414fd45d76eb24b8472c678ecdcf8ccec658b71d81fff1525c331d5a5a5492f19d9675137f5cdacf381631a35cc9f20652dcaf0c6508dbf5e066e784ee20694872b26ffe636775e668b379ffe7f74cc5cb19e3a064dcf12751e9ed9e0c288400e81dc09d6d288da084e97a38b77476b044520934a81d7707e2f7532350b36ff13b13d0ae6950ef91c872cd064e0224041e50ecd2e0ba40ba2ae9f5487409f38664a5da575d2247162263d6553c43eae8aac53aa093c19da0821136fd8fe421bcc34e5b66596281581aa9043314a36b3c86c3b89506a2b597bcf2470d1270d8ce7460413875331d2c1dbd53666802980fe4c4cf7533f2055ef854c9ae000c2b6c2982bf4a5cbc573d8e6528246abdb2c080494c100d2e9808f7fc5632e4f69bec8ee651cf32fd0fbbcbbfcf123c238287102d8e119e3086f41a61c15bf0fc9a03be916df42e0d9e27974513e95ab224e418b713bfa171ec74720c05eff7bc9025afb2fd90ccee2e7fc5ee3d8e1d63f9a45302237430b6438e4bd12f8e55ade57d2fccbf05e7df1f2e01033c3376ad28dd604efd578ecd355e4f6a1556d2b4e500c5065841d4d876437055626992bb595f3720bbae2a5d551ea5cacb5b6439ebffa0b9601f38f9d0cb71bfbb26898ed9cc3e87152d0bcacf751aba3f3a7e2c58702fa275bd45a7b4d8af47cc8b3e03702c382bb4c7bf7875f1bcadab08a648cba36a0f74cd233a0b489a8d597601c0ee017bd5d2e80b28b4b4197d9c8493d9ec3e44064708310864af204152fa50a05a6ec72b18a4daf049fc9109affef256b16caa2723da734ed24d1b9991857f0392e7cf0fe89e484433a238b26a0587d2e86533ec1489abc52934a1da9ad2bf838b577e66d07f8fbe418bb2e34898e2b055973ac916a3d00a857ca47d758c5748b43759dfd9250ec3d5ff94e9872a54dff59b8fcf4c60bf04b49d12c96afd4e1e79b11aa9a6bd1dc5ffc82c5df36f9117bc417cf8be29d7b8fdd9081f0282d0dae92f51a9ee093caf01b2c2c5e30bdaf97f14df0e357e7efa5b97e8e7c08e3da33076c11b7456778562dec2a48f40943289d5d2138212e9078f97549302e84b90317669a5af078ec1db8e5ad08ae95a227db150d73b2c4b8c80cf5d1eb0b028ff167301fc9c4dabe79f20a2684e646a296ececf09638ed8f71c66b9e46f18018b669531799d57cd79adcba1e4479192ab6fbc698e5a455ba082c10761d7d4c33a9368ae80fc22b843ce2130f70c7fc95a70193dcf36027c9e790c4a81f584bc653765c4c9dab4d357ff9fdd66d86688f14c72c8c7d40732acea6c45a8d2e2dd78c30d52a38feed2ac7926aa17b861b9df442864173972ab4b44c5b66aeb10d28bbb0f44a06ceedf1a4648ab38ae5830b55819fc10afd6e85cde03b5fff859b803d6e063dc66c44cb359ab02fe3e934323a4f67c195d492fedc9d234250e22fbed91c1f68ec1ad6f3f2635621fee67", 0x847}], 0x2, &(0x7f00000016c0)}}], 0x1, 0x2090) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0xdfa, 0x4) sendto$inet(r0, &(0x7f0000000580)="17", 0x59a, 0x10008095, 0x0, 0x58ff) getsockopt$inet_mptcp_buf(r0, 0x11c, 0x3, &(0x7f0000000140)=""/102, 0x0) 3.862683287s ago: executing program 3 (id=23): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = socket$rxrpc(0x21, 0x2, 0xa) bind$rxrpc(r2, &(0x7f0000000140)=@in4={0x21, 0x3, 0x2, 0x10, {0x2, 0x0, @local}}, 0x24) bind$rxrpc(r2, &(0x7f0000000000)=@in6={0x21, 0x3, 0x2, 0x1c, {0xa, 0x4e24, 0x5, @loopback, 0x8}}, 0x24) sendto$l2tp6(r1, 0x0, 0x0, 0x8010, &(0x7f0000000180)={0xa, 0x0, 0x184c, @mcast2, 0x8}, 0x20) connect$bt_l2cap(r0, &(0x7f0000000380)={0x1f, 0x4}, 0xe) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x2b18094, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000140)='./file1\x00') r4 = open(&(0x7f0000000000)='.\x00', 0x80000, 0x12d) ioctl$AUTOFS_IOC_PROTOSUBVER(r4, 0xc0049364, &(0x7f0000000180)) setsockopt$inet6_tcp_int(r3, 0x6, 0x2, &(0x7f0000000180)=0xdf9, 0x4) setsockopt$inet6_tcp_int(r3, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r5, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x7ff}], 0x2c) sendto$inet6(r5, &(0x7f0000000a40)='\x00', 0x1, 0x0, &(0x7f0000000140)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c) setsockopt$inet_sctp6_SCTP_EVENTS(r5, 0x84, 0xb, &(0x7f0000000100)={0x7, 0x84, 0x2, 0x5, 0x5, 0xf2, 0x0, 0x0, 0xfa, 0x2, 0x3, 0x6, 0x2, 0x2}, 0xe) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r5, 0x84, 0x20, 0x0, 0x0) recvmmsg(r5, &(0x7f0000000840)=[{{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000300)=""/174, 0xae}], 0x1}, 0x6}], 0x1, 0x140, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r6, 0x1, 0x1a, &(0x7f0000000000)={0x4, &(0x7f0000000080)=[{0x35, 0x0, 0x2, 0x400}, {0x6, 0x73, 0x9, 0xfffffff6}, {0x34, 0x9, 0x8, 0x1372}, {0x6, 0x2, 0x4, 0xd3a4}]}, 0x10) sendto$inet6(r3, &(0x7f0000000000)="bf", 0x1, 0x20040045, &(0x7f0000000140)={0xa, 0x4001, 0xfffb, @loopback, 0xfffffffd}, 0x1c) getsockopt$bt_BT_CHANNEL_POLICY(r0, 0x112, 0x4, 0x0, &(0x7f0000000080)) 3.547907279s ago: executing program 2 (id=24): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_usb_connect(0x4, 0x4f, &(0x7f0000000580)=ANY=[@ANYBLOB="12010003a8cb29404e0f00023aa90100000109023d0001090600ff090418cc039bb2fe1c0921d000060122ed0609059a024000060e4d07250104f8ab0a09050110ff0305810909050910ff03090708"], 0x0) syz_open_dev$swradio(&(0x7f0000000140), 0x0, 0x2) openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000500)='status\x00') read$FUSE(r4, &(0x7f0000001180)={0x2020}, 0x2020) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000000)={'vxcan1\x00', 0x0}) setsockopt$RDS_GET_MR_FOR_DEST(r4, 0x114, 0x7, &(0x7f0000000340)={@can={0x1d, r5}, {&(0x7f0000000180)=""/231, 0xe7}, &(0x7f0000000280), 0xc}, 0xa0) socket$kcm(0x2, 0xa, 0x2) socket$tipc(0x1e, 0x2, 0x0) r6 = socket$tipc(0x1e, 0x5, 0x0) r7 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r8 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r8, 0x1, 0xf, &(0x7f0000000040)=0x80000004, 0x4) setsockopt$SO_ATTACH_FILTER(r6, 0x1, 0x33, &(0x7f0000000640)={0x1, &(0x7f0000000680)=[{0x6, 0x0, 0x0, 0x3f2}]}, 0x10) listen(r8, 0x0) close_range(r7, 0xffffffffffffffff, 0x0) socket$tipc(0x1e, 0x5, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000009a40)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000010000040900010073797a30000000002c000000030a01080000000000000000010000000900030073797a32000000000900010073797a300000000050000000060a010400000000000000000100000008000b40000000000900010073797a30000000002800048024000180090001006d6574610000000014000280080001400000001208000240000000", @ANYRES16=r9], 0xc4}}, 0x0) 3.2365975s ago: executing program 0 (id=25): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000001c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_DISCONNECT(r1, &(0x7f00000005c0)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000580)={&(0x7f0000000500)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYBLOB="040027bd7000fbdbdf253000000008000300", @ANYRES32=r2, @ANYBLOB="4ccd930000060089b5b594f63600"/32], 0x50}, 0x1, 0x0, 0x0, 0x2}, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r3, 0x107, 0xa, &(0x7f0000000440)=0x2, 0x4) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000003180)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x801, 0xf84, 0x3}, 0x1c) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r4, &(0x7f00000001c0)={0x2, 0xffff, @local}, 0x10) connect$inet(r4, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r4, &(0x7f0000007fc0), 0x2d, 0x0) r5 = socket(0xa, 0x2400000001, 0x0) getsockopt$inet6_buf(r5, 0x29, 0x10000000000030, &(0x7f0000034000)=""/144, 0x0) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000880)=ANY=[], 0x40}, 0x1, 0x0, 0x0, 0x24004854}, 0x24000) syslog(0x9, 0x0, 0x0) r6 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r6, &(0x7f0000000080)={0xa, 0x0, 0x0, @mcast2, 0x2}, 0x1c) recvmsg(r6, &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000740)=""/223, 0xdf}, 0x10000) syz_genetlink_get_family_id$ipvs(&(0x7f0000000200), r0) sendmsg$IPVS_CMD_SET_SERVICE(r1, &(0x7f0000000440)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x80}, 0x8000) syslog(0x9, &(0x7f00000000c0)=""/145, 0x91) openat(0xffffffffffffff9c, &(0x7f0000000380)='./file0\x00', 0x409c2, 0xa4) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="280000001e00210000070000180000000700000073000000000000000a000200"], 0x28}}, 0x0) 2.092918127s ago: executing program 3 (id=26): r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000240), 0x8202, 0x0) read$FUSE(r0, &(0x7f0000004880)={0x2020, 0x0, 0x0}, 0x2020) r2 = landlock_create_ruleset(&(0x7f0000000040)={0x6b13, 0x0, 0x3}, 0x18, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) pipe2(&(0x7f00000001c0)={0xffffffffffffffff}, 0x80000) pipe2(&(0x7f0000000240)={0x0, 0x0}, 0x4080) splice(r4, 0x0, r5, 0x0, 0xd1af, 0x8) write$FUSE_INIT(r0, &(0x7f0000000040)={0x50, 0x0, r1, {0x7, 0x29, 0x5, 0x200c920, 0x4, 0x20, 0x2, 0x4d, 0x0, 0x0, 0x1}}, 0x50) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB='d\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100ffffffff0000000001000000050007000000000008000900000000101400200000000000000000000000ffff0000000008000a000000000014001f00000000000000000000000000000000000600020000100000"], 0x64}, 0x1, 0x620b}, 0x0) r7 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000140), 0x4000000004002, 0x0) r8 = dup(r7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r8, 0x2d6fc000) r9 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000140)='/dev/comedi4\x00', 0x20002, 0x0) poll(&(0x7f0000000200)=[{r9, 0x8}], 0x1, 0x2) syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x801) r10 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$nbd(&(0x7f0000000200), r10) sendmsg$NBD_CMD_CONNECT(r10, &(0x7f00000027c0)={0x0, 0x0, &(0x7f0000002780)={&(0x7f00000000c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r11, @ANYRESOCT=r11, @ANYBLOB="14"], 0x3c}, 0x1, 0x0, 0x0, 0x4000004}, 0x4cc43) r12 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r12, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r12, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @local}]}, &(0x7f0000000240)=0x10) setsockopt$inet_sctp6_SCTP_AUTH_DEACTIVATE_KEY(r12, 0x84, 0x23, &(0x7f0000000100)={r13, 0x100}, 0x8) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x17) r14 = syz_open_dev$swradio(&(0x7f0000000000), 0x1, 0x2) r15 = socket$nl_generic(0x10, 0x3, 0x10) r16 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), r15) sendmsg$TIPC_NL_PEER_REMOVE(r15, &(0x7f0000000f80)={0x0, 0x0, &(0x7f0000000f40)={&(0x7f00000001c0)=ANY=[@ANYBLOB='H\x00\x00\x00', @ANYRES16=r16, @ANYBLOB="01000000000000000000140000000400038004000180040009802800078008000100a6ae210006000100ef0200000c000400e5fdb73200"], 0x48}, 0x1, 0x0, 0x0, 0x20024011}, 0x4048804) ioctl$VIDIOC_ENUM_FREQ_BANDS(r14, 0xc0405665, &(0x7f0000000100)={0x0, 0x5, 0x8, 0x8}) landlock_restrict_self(r2, 0x9) 2.024965213s ago: executing program 1 (id=27): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) bind$unix(r0, 0x0, 0x0) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = socket$can_j1939(0x1d, 0x2, 0x7) r3 = getpgrp(r1) ioctl$sock_SIOCSPGRP(r2, 0x8902, &(0x7f0000000000)=r3) ptrace(0x10, r1) arch_prctl$ARCH_REQ_XCOMP_GUEST_PERM(0x1025, 0x80000000009) ptrace$setregs(0xd, r1, 0x0, &(0x7f00000003c0)="18607651149d7b10b4024fbbdc08899b8f589df2dbb5d7a8d1b36cfab675cb3976ee8100e2878c9cfa178cac130eb046eda93df39ed4b41924dc225ad4028dd63defb87d698be5c749450b350a789dcfc6b2d6a696b5026d1e52f19274566d1da0f353dd65e330ebf71c5e823f2753c5fd76724828ef31b353e71805205c3dceb44cc4c7b3664e29fb") openat$sysctl(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/clear_refs\x00', 0x1, 0x0) syz_usb_connect(0x1, 0x2d, &(0x7f0000000340)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b0001000000010904010001faf40d00090582239f"], 0x0) r4 = syz_open_dev$char_usb(0xc, 0xb4, 0x800000000000) writev(r4, &(0x7f00000002c0)=[{&(0x7f0000000180)="846cb78afbe02da52bdb47", 0xb}], 0x1) 442.047447ms ago: executing program 0 (id=28): syz_emit_vhci(&(0x7f0000000140)=ANY=[@ANYBLOB="03c900d9c7f4ac36fc55c085d3f50600005ed01b000000000000300040e87d343a572532a3a594d553a31b515b0fc95e8ef06e02a177350119b9fa25509bee73b043b0055937b644377180485eeac4d3087e5d29c5eb64ed6f04355cf8c7ffce92cf092694827d4da0481b686f5578798b9c8e026dbaeca390af7252078b0172948333ebcacc870d5c2fb3a707b0f8df5082a9fb8046cbb5134bf221080000000000000006ff61048039db7d7bbe95a5cc38f19a453f20c17ec86f79785382e85fe38a14af3e8ca5d6ab05b39471b5a8fd3bd86e2486323d82e7543111587b204bb284f236911724cee36e659e7502d02db3d2c804cd2f51fb60baaab630e126d10105f4da264876a6f7c5b295e2c7f5f224a26c1480ec39b44db4a83cdf9c190cb37ca6522b260b842f35d16a7e99dcabacff0d3410931ecfd6cc5e26f3000000000000000000"], 0xdd) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(des3_ede)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r2 = accept4(r1, 0x0, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000000400)=[{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe1a}], 0x1, &(0x7f0000000380)=[@op={0x18}], 0x18}], 0x4924924924924b9, 0x0) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x20000253) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYRESDEC, @ANYRES16=0x0, @ANYRES64=r0], 0xf) socket$nl_generic(0x10, 0x3, 0x10) 104.332796ms ago: executing program 2 (id=29): syz_usb_connect(0x2, 0x36, &(0x7f0000000c80)=ANY=[@ANYBLOB="12010102e98a9940720c0c003d0e0102030109022400010103c00409045db9029793eb0b090502"], &(0x7f00000016c0)={0x0, 0x0, 0x0, 0x0}) mount$overlay(0x0, 0x0, 0x0, 0x200800, &(0x7f0000000080)={[{@workdir={'workdir', 0x3d, './bus'}}]}) syz_emit_vhci(&(0x7f0000000080)=ANY=[@ANYBLOB="040e06f40908"], 0xa) r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$inet6_int(r0, 0x29, 0x48, &(0x7f0000000000)=0x2, 0x4) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0b01, 0x0) r2 = syz_clone(0x0, 0x0, 0x1d, 0x0, 0x0, 0x0) syz_open_procfs(r2, &(0x7f0000000040)='stat\x00') capset(&(0x7f0000000040)={0x20071026, r2}, &(0x7f0000000080)={0x6, 0xe, 0x2, 0x83, 0xffffffff, 0x40}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) syz_emit_vhci(&(0x7f00000000c0)=@HCI_SCODATA_PKT={0x3, {0xc9, 0x60}, "0cf9544f4d8360a584c3b51bdc314abe992ee63e88c8b8690fd150bf6ba3bec149fc6a317a70dfa15e2b5f2ab2a18e5e39e9d91c68258259755e876a042e1186972d3bb1e4b8ce82c78dc0c83e137d95733af2e3428e16370ae63cb2987b732a"}, 0x64) 0s ago: executing program 1 (id=30): r0 = syz_open_procfs$userns(0x0, &(0x7f0000000000)) fchown(r0, 0x0, 0xee00) (fail_nth: 4) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.21' (ED25519) to the list of known hosts. [ 87.251636][ T2051] cfg80211: failed to load regulatory.db [ 90.124269][ T5600] cgroup: Unknown subsys name 'net' [ 90.357655][ T5600] cgroup: Unknown subsys name 'cpuset' [ 90.418546][ T5600] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 92.496911][ T5600] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 96.331183][ T5622] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 96.344847][ T5622] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 96.354040][ T5626] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 96.369927][ T5624] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 96.397175][ T5626] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 96.404292][ T5626] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 96.405840][ T5629] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 96.409859][ T5629] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 96.411671][ T5629] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 96.412869][ T5629] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 96.413740][ T5629] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 96.415222][ T5629] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 96.426256][ T4929] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 96.433132][ T5622] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 96.435847][ T5622] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 96.440969][ T5622] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 96.456492][ T5622] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 96.459082][ T5622] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 96.494366][ T5622] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 96.495173][ T5622] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 98.520401][ T5622] Bluetooth: hci3: command tx timeout [ 98.520561][ T5622] Bluetooth: hci0: command tx timeout [ 98.520643][ T5622] Bluetooth: hci2: command tx timeout [ 98.598142][ T4929] Bluetooth: hci1: command tx timeout [ 98.733709][ T5618] bridge0: port 1(bridge_slave_0) entered blocking state [ 98.735127][ T5618] bridge0: port 1(bridge_slave_0) entered disabled state [ 98.735360][ T5618] bridge_slave_0: entered allmulticast mode [ 98.738216][ T5618] bridge_slave_0: entered promiscuous mode [ 98.794862][ T5618] bridge0: port 2(bridge_slave_1) entered blocking state [ 98.795256][ T5618] bridge0: port 2(bridge_slave_1) entered disabled state [ 98.795762][ T5618] bridge_slave_1: entered allmulticast mode [ 98.798221][ T5618] bridge_slave_1: entered promiscuous mode [ 98.956994][ T5621] bridge0: port 1(bridge_slave_0) entered blocking state [ 98.957203][ T5621] bridge0: port 1(bridge_slave_0) entered disabled state [ 98.957561][ T5621] bridge_slave_0: entered allmulticast mode [ 98.965191][ T5621] bridge_slave_0: entered promiscuous mode [ 98.971212][ T5619] bridge0: port 1(bridge_slave_0) entered blocking state [ 98.971554][ T5619] bridge0: port 1(bridge_slave_0) entered disabled state [ 98.972261][ T5619] bridge_slave_0: entered allmulticast mode [ 98.975812][ T5619] bridge_slave_0: entered promiscuous mode [ 98.992004][ T5618] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 99.028271][ T5621] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.028631][ T5621] bridge0: port 2(bridge_slave_1) entered disabled state [ 99.030423][ T5621] bridge_slave_1: entered allmulticast mode [ 99.032766][ T5621] bridge_slave_1: entered promiscuous mode [ 99.034054][ T5619] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.034259][ T5619] bridge0: port 2(bridge_slave_1) entered disabled state [ 99.034459][ T5619] bridge_slave_1: entered allmulticast mode [ 99.036611][ T5619] bridge_slave_1: entered promiscuous mode [ 99.043427][ T5618] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 99.099557][ T5620] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.099920][ T5620] bridge0: port 1(bridge_slave_0) entered disabled state [ 99.100214][ T5620] bridge_slave_0: entered allmulticast mode [ 99.103770][ T5620] bridge_slave_0: entered promiscuous mode [ 99.169066][ T5620] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.169309][ T5620] bridge0: port 2(bridge_slave_1) entered disabled state [ 99.169560][ T5620] bridge_slave_1: entered allmulticast mode [ 99.171766][ T5620] bridge_slave_1: entered promiscuous mode [ 99.260610][ T5621] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 99.266297][ T5619] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 99.272221][ T5618] team0: Port device team_slave_0 added [ 99.304418][ T5621] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 99.307486][ T5618] team0: Port device team_slave_1 added [ 99.327277][ T5619] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 99.343523][ T5620] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 99.413446][ T5620] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 99.492981][ T5621] team0: Port device team_slave_0 added [ 99.495312][ T5618] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 99.495325][ T5618] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 99.495342][ T5618] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 99.512209][ T5619] team0: Port device team_slave_0 added [ 99.548261][ T5621] team0: Port device team_slave_1 added [ 99.550638][ T5618] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 99.550653][ T5618] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 99.550678][ T5618] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 99.561151][ T5619] team0: Port device team_slave_1 added [ 99.567563][ T5620] team0: Port device team_slave_0 added [ 99.656713][ T5620] team0: Port device team_slave_1 added [ 99.710610][ T5621] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 99.710625][ T5621] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 99.710643][ T5621] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 99.714044][ T5619] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 99.714057][ T5619] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 99.714073][ T5619] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 99.746156][ T5621] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 99.746177][ T5621] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 99.746203][ T5621] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 99.776319][ T5619] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 99.776339][ T5619] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 99.776366][ T5619] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 99.780495][ T5620] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 99.780512][ T5620] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 99.780538][ T5620] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 99.842308][ T5620] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 99.842330][ T5620] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 99.842357][ T5620] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 99.865370][ T5618] hsr_slave_0: entered promiscuous mode [ 99.870921][ T5618] hsr_slave_1: entered promiscuous mode [ 100.064602][ T5621] hsr_slave_0: entered promiscuous mode [ 100.066035][ T5621] hsr_slave_1: entered promiscuous mode [ 100.067575][ T5621] debugfs: 'hsr0' already exists in 'hsr' [ 100.067673][ T5621] Cannot create hsr debugfs directory [ 100.099222][ T5619] hsr_slave_0: entered promiscuous mode [ 100.100937][ T5619] hsr_slave_1: entered promiscuous mode [ 100.102096][ T5619] debugfs: 'hsr0' already exists in 'hsr' [ 100.102122][ T5619] Cannot create hsr debugfs directory [ 100.577372][ T5620] hsr_slave_0: entered promiscuous mode [ 100.580225][ T5620] hsr_slave_1: entered promiscuous mode [ 100.582031][ T5620] debugfs: 'hsr0' already exists in 'hsr' [ 100.582056][ T5620] Cannot create hsr debugfs directory [ 100.598033][ T4929] Bluetooth: hci2: command tx timeout [ 100.598071][ T4929] Bluetooth: hci0: command tx timeout [ 100.598093][ T4929] Bluetooth: hci3: command tx timeout [ 100.688191][ T4929] Bluetooth: hci1: command tx timeout [ 101.352995][ T5618] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 101.405895][ T5618] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 101.413479][ T5618] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 101.454326][ T5618] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 101.471040][ T5618] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 101.516674][ T5618] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 101.541989][ T5618] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 101.584801][ T5618] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 101.712540][ T5619] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 101.756607][ T5619] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 101.763796][ T5619] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 101.782251][ T5619] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 101.786375][ T5619] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 101.826872][ T5619] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 101.872557][ T5619] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 101.915727][ T5619] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 102.064991][ T5620] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 102.095338][ T5620] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 102.102539][ T5620] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 102.153703][ T5620] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 102.158030][ T5620] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 102.191711][ T5620] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 102.240978][ T5620] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 102.271947][ T5620] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 102.417454][ T5621] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 102.464732][ T5621] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 102.478300][ T5621] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 102.513471][ T5621] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 102.532162][ T5621] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 102.564719][ T5621] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 102.576252][ T5621] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 102.615850][ T5621] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 102.678178][ T5622] Bluetooth: hci3: command tx timeout [ 102.678213][ T5622] Bluetooth: hci2: command tx timeout [ 102.678356][ T4929] Bluetooth: hci0: command tx timeout [ 102.770109][ T4929] Bluetooth: hci1: command tx timeout [ 102.785316][ T5618] 8021q: adding VLAN 0 to HW filter on device bond0 [ 102.904473][ T5619] 8021q: adding VLAN 0 to HW filter on device bond0 [ 102.941440][ T5618] 8021q: adding VLAN 0 to HW filter on device team0 [ 102.992934][ T4660] bridge0: port 1(bridge_slave_0) entered blocking state [ 102.993132][ T4660] bridge0: port 1(bridge_slave_0) entered forwarding state [ 103.050330][ T4660] bridge0: port 2(bridge_slave_1) entered blocking state [ 103.050675][ T4660] bridge0: port 2(bridge_slave_1) entered forwarding state [ 103.080908][ T5619] 8021q: adding VLAN 0 to HW filter on device team0 [ 103.134751][ T1514] bridge0: port 1(bridge_slave_0) entered blocking state [ 103.135303][ T1514] bridge0: port 1(bridge_slave_0) entered forwarding state [ 103.173164][ T5620] 8021q: adding VLAN 0 to HW filter on device bond0 [ 103.197199][ T1514] bridge0: port 2(bridge_slave_1) entered blocking state [ 103.197346][ T1514] bridge0: port 2(bridge_slave_1) entered forwarding state [ 103.304827][ T5620] 8021q: adding VLAN 0 to HW filter on device team0 [ 103.357337][ T5621] 8021q: adding VLAN 0 to HW filter on device bond0 [ 103.412369][ T1514] bridge0: port 1(bridge_slave_0) entered blocking state [ 103.412536][ T1514] bridge0: port 1(bridge_slave_0) entered forwarding state [ 103.475636][ T1514] bridge0: port 2(bridge_slave_1) entered blocking state [ 103.475806][ T1514] bridge0: port 2(bridge_slave_1) entered forwarding state [ 103.604036][ T5621] 8021q: adding VLAN 0 to HW filter on device team0 [ 103.693041][ T67] bridge0: port 1(bridge_slave_0) entered blocking state [ 103.693313][ T67] bridge0: port 1(bridge_slave_0) entered forwarding state [ 103.798645][ T1514] bridge0: port 2(bridge_slave_1) entered blocking state [ 103.798980][ T1514] bridge0: port 2(bridge_slave_1) entered forwarding state [ 104.773683][ T4929] Bluetooth: hci0: command tx timeout [ 104.773728][ T4929] Bluetooth: hci2: command tx timeout [ 104.773752][ T4929] Bluetooth: hci3: command tx timeout [ 104.839581][ T60] Bluetooth: hci1: command tx timeout [ 105.314313][ T5618] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 105.357059][ T5619] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 105.690221][ T5620] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 105.830153][ T5621] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 105.851481][ T5619] veth0_vlan: entered promiscuous mode [ 105.864979][ T5618] veth0_vlan: entered promiscuous mode [ 105.931982][ T5619] veth1_vlan: entered promiscuous mode [ 105.951466][ T5618] veth1_vlan: entered promiscuous mode [ 106.102702][ T5620] veth0_vlan: entered promiscuous mode [ 106.174085][ T5621] veth0_vlan: entered promiscuous mode [ 106.179647][ T5620] veth1_vlan: entered promiscuous mode [ 106.208916][ T5619] veth0_macvtap: entered promiscuous mode [ 106.234242][ T5618] veth0_macvtap: entered promiscuous mode [ 106.264989][ T5619] veth1_macvtap: entered promiscuous mode [ 106.283053][ T5618] veth1_macvtap: entered promiscuous mode [ 106.291458][ T5621] veth1_vlan: entered promiscuous mode [ 106.378949][ T5619] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 106.459302][ T5618] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 106.485060][ T5619] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 106.507727][ T5620] veth0_macvtap: entered promiscuous mode [ 106.519075][ T5618] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 106.557499][ T4660] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.564298][ T5620] veth1_macvtap: entered promiscuous mode [ 106.593145][ T4660] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.615417][ T4660] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.636887][ T4660] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.665140][ T4660] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.677704][ T5621] veth0_macvtap: entered promiscuous mode [ 106.691608][ T4660] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.752851][ T4660] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.777419][ T4660] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.853706][ T5621] veth1_macvtap: entered promiscuous mode [ 106.905959][ T5620] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 107.101418][ T5620] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 107.334243][ T4660] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.352491][ T5621] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 107.360929][ T4660] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.394790][ T4660] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.409105][ T4660] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.420712][ T5621] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 107.537451][ T100] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.584092][ T100] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.596212][ T4660] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 107.596238][ T4660] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 107.640551][ T100] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.705759][ T100] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.760676][ T100] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 107.760706][ T100] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 108.023304][ T1514] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 108.023330][ T1514] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 108.292572][ T1222] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 108.292604][ T1222] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 108.564342][ T100] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 108.564370][ T100] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 108.752533][ T72] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 108.752561][ T72] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 108.921286][ T67] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 108.921314][ T67] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 109.239981][ T100] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 109.240011][ T100] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 110.699312][ T5346] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 110.736393][ T5718] usb 4-1: new low-speed USB device number 2 using dummy_hcd [ 110.942440][ T5760] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 111.020141][ T5718] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 111.020178][ T5718] usb 4-1: config 0 has no interface number 0 [ 111.020234][ T5718] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 111.020269][ T5718] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 111.020318][ T5718] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 111.020347][ T5718] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 111.057492][ T5346] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 111.057543][ T5346] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 111.057585][ T5346] usb 1-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 111.057610][ T5346] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 111.170957][ T5760] usb 2-1: Using ep0 maxpacket: 8 [ 111.218555][ T5760] usb 2-1: New USB device found, idVendor=0fe9, idProduct=db01, bcdDevice=e9.9b [ 111.218592][ T5760] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 111.218616][ T5760] usb 2-1: Product: syz [ 111.218631][ T5760] usb 2-1: Manufacturer: syz [ 111.218645][ T5760] usb 2-1: SerialNumber: syz [ 111.304317][ T5780] FAULT_INJECTION: forcing a failure. [ 111.304317][ T5780] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 111.304370][ T5780] CPU: 1 UID: 0 PID: 5780 Comm: syz.2.5 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 111.304392][ T5780] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 111.304403][ T5780] Call Trace: [ 111.304410][ T5780] [ 111.304417][ T5780] dump_stack_lvl+0xe8/0x150 [ 111.304448][ T5780] should_fail_ex+0x46b/0x600 [ 111.304482][ T5780] _copy_from_iter+0x1d3/0x1670 [ 111.304508][ T5780] ? trace_kmem_cache_alloc+0x29/0xe0 [ 111.304529][ T5780] ? __alloc_skb+0x27d/0x7d0 [ 111.304554][ T5780] ? __pfx__copy_from_iter+0x10/0x10 [ 111.304570][ T5780] ? kmem_cache_alloc_node_noprof+0x27c/0x6e0 [ 111.304591][ T5780] ? __alloc_skb+0x27d/0x7d0 [ 111.304620][ T5780] ? netlink_sendmsg+0x650/0xb40 [ 111.304637][ T5780] ? skb_put+0x11b/0x210 [ 111.304665][ T5780] netlink_sendmsg+0x6c0/0xb40 [ 111.304691][ T5780] ? __pfx_netlink_sendmsg+0x10/0x10 [ 111.304711][ T5780] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 111.304737][ T5780] ? aa_sock_msg_perm+0x122/0x200 [ 111.304759][ T5780] ? __pfx_netlink_sendmsg+0x10/0x10 [ 111.304775][ T5780] sock_sendmsg_nosec+0x13a/0x180 [ 111.304799][ T5780] ____sys_sendmsg+0x55c/0x870 [ 111.304831][ T5780] ? __pfx_____sys_sendmsg+0x10/0x10 [ 111.304866][ T5780] ? import_iovec+0x73/0xa0 [ 111.304891][ T5780] ___sys_sendmsg+0x2a5/0x360 [ 111.304918][ T5780] ? __lock_acquire+0x6b5/0x2d10 [ 111.304943][ T5780] ? __pfx____sys_sendmsg+0x10/0x10 [ 111.305001][ T5780] ? __fget_files+0x2a/0x420 [ 111.305021][ T5780] ? __fget_files+0x3a6/0x420 [ 111.305050][ T5780] __x64_sys_sendmsg+0x1c3/0x2a0 [ 111.305079][ T5780] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 111.305116][ T5780] ? __pfx_ksys_write+0x10/0x10 [ 111.305150][ T5780] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 111.305170][ T5780] do_syscall_64+0x174/0x580 [ 111.305197][ T5780] ? trace_irq_disable+0x3b/0x140 [ 111.305220][ T5780] ? clear_bhb_loop+0x40/0x90 [ 111.305242][ T5780] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 111.305259][ T5780] RIP: 0033:0x7f225db5ce59 [ 111.305278][ T5780] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 111.305293][ T5780] RSP: 002b:00007f225bdae028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 111.305315][ T5780] RAX: ffffffffffffffda RBX: 00007f225ddd5fa0 RCX: 00007f225db5ce59 [ 111.305337][ T5780] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000005 [ 111.305349][ T5780] RBP: 00007f225bdae090 R08: 0000000000000000 R09: 0000000000000000 [ 111.305361][ T5780] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 111.305372][ T5780] R13: 00007f225ddd6038 R14: 00007f225ddd5fa0 R15: 00007fff99be1e18 [ 111.305400][ T5780] [ 111.644814][ T60] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:201' [ 111.644852][ T60] CPU: 1 UID: 0 PID: 60 Comm: kworker/u9:0 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 111.644884][ T60] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 111.644898][ T60] Workqueue: hci0 hci_rx_work [ 111.644936][ T60] Call Trace: [ 111.644946][ T60] [ 111.644956][ T60] dump_stack_lvl+0xe8/0x150 [ 111.644991][ T60] sysfs_create_dir_ns+0x271/0x2a0 [ 111.645019][ T60] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 111.645052][ T60] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 111.645080][ T60] ? rt_spin_unlock+0x160/0x200 [ 111.645120][ T60] kobject_add_internal+0x631/0xd10 [ 111.645156][ T60] kobject_add+0x163/0x240 [ 111.645185][ T60] ? __pfx_kobject_add+0x10/0x10 [ 111.645216][ T60] ? get_device_parent+0x370/0x3a0 [ 111.645249][ T60] device_add+0x408/0xb90 [ 111.645288][ T60] hci_conn_add_sysfs+0xd5/0x210 [ 111.645323][ T60] le_conn_complete_evt+0x10e6/0x16b0 [ 111.645358][ T60] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 111.645380][ T60] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 111.645413][ T60] ? lockdep_hardirqs_on+0x7a/0x110 [ 111.645444][ T60] ? skb_pull_data+0xfb/0x200 [ 111.645475][ T60] hci_le_conn_complete_evt+0x187/0x470 [ 111.645520][ T60] hci_event_packet+0x659/0xef0 [ 111.645558][ T60] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 111.645583][ T60] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 111.645615][ T60] ? __pfx_hci_event_packet+0x10/0x10 [ 111.645639][ T60] ? rt_spin_unlock+0x14f/0x200 [ 111.645670][ T60] ? hci_send_to_monitor+0xe2/0x590 [ 111.645695][ T60] hci_rx_work+0x3ee/0x1040 [ 111.645748][ T60] ? process_one_work+0x8be/0x1630 [ 111.645782][ T60] process_one_work+0x98b/0x1630 [ 111.645834][ T60] ? __pfx_process_one_work+0x10/0x10 [ 111.645860][ T60] ? do_raw_spin_lock+0x12b/0x2f0 [ 111.645902][ T60] worker_thread+0xb49/0x1140 [ 111.645961][ T60] kthread+0x388/0x470 [ 111.645987][ T60] ? __pfx_worker_thread+0x10/0x10 [ 111.646017][ T60] ? __pfx_kthread+0x10/0x10 [ 111.646042][ T60] ret_from_fork+0x514/0xb70 [ 111.646072][ T60] ? __pfx_ret_from_fork+0x10/0x10 [ 111.646097][ T60] ? __switch_to+0xc79/0x1410 [ 111.646124][ T60] ? __pfx_kthread+0x10/0x10 [ 111.646152][ T60] ret_from_fork_asm+0x1a/0x30 [ 111.646199][ T60] [ 111.646290][ T60] kobject: kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 111.646343][ T60] Bluetooth: hci0: failed to register connection device [ 111.654694][ T60] Bluetooth: hci0: SCO packet for unknown connection handle 1 [ 112.001496][ T5718] usb 4-1: config 0 descriptor?? [ 112.014569][ T5765] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 112.059470][ T5346] usb 1-1: config 0 descriptor?? [ 112.103194][ T5760] usb 2-1: config 0 descriptor?? [ 112.223098][ T5760] dvb-usb: found a 'DViCO FusionHDTV DVB-T USB (LGZ201)' in warm state. [ 112.253214][ T5760] dvb-usb: bulk message failed: -22 (2/0) [ 112.618220][ T5765] syz.3.4 uses obsolete (PF_INET,SOCK_PACKET) [ 112.723070][ T5718] iowarrior 4-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 112.800981][ T5760] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 112.806370][ T5760] dvbdev: DVB: registering new adapter (DViCO FusionHDTV DVB-T USB (LGZ201)) [ 112.806475][ T5760] usb 2-1: media controller created [ 112.910553][ T5346] cp2112 0003:10C4:EA90.0001: unknown main item tag 0x0 [ 113.116690][ T5760] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 113.158123][ T5346] cp2112 0003:10C4:EA90.0001: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.0-1/input0 [ 113.285026][ T5346] cp2112 0003:10C4:EA90.0001: error requesting version [ 113.287379][ T5793] Invalid source name [ 113.287400][ T5793] UBIFS error (pid: 5793): cannot open "/dev/sg0", error -22 [ 113.417002][ T5346] cp2112 0003:10C4:EA90.0001: probe with driver cp2112 failed with error -71 [ 113.543629][ T5760] dvb-usb: bulk message failed: -22 (1/0) [ 113.630808][ T5346] usb 1-1: USB disconnect, device number 2 [ 113.769458][ T5760] DVB: Unable to find symbol mt352_attach() [ 113.769480][ T5760] dvb-usb: no frontend was attached by 'DViCO FusionHDTV DVB-T USB (LGZ201)' [ 114.188777][ T5760] rc_core: IR keymap rc-dvico-portable not found [ 114.188805][ T5760] Registered IR keymap rc-empty [ 114.229694][ T5794] fido_id[5794]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/report_descriptor': No such file or directory [ 114.259049][ T5760] rc rc0: DViCO FusionHDTV DVB-T USB (LGZ201) as /devices/platform/dummy_hcd.1/usb2/2-1/rc/rc0 [ 114.350604][ T5760] input: DViCO FusionHDTV DVB-T USB (LGZ201) as /devices/platform/dummy_hcd.1/usb2/2-1/rc/rc0/input6 [ 114.432202][ T5760] dvb-usb: schedule remote query interval to 100 msecs. [ 114.432234][ T5760] dvb-usb: DViCO FusionHDTV DVB-T USB (LGZ201) successfully initialized and connected. [ 114.483289][ T5760] usb 2-1: USB disconnect, device number 2 [ 114.540524][ T5778] dvb-usb: bulk message failed: -22 (1/0) [ 114.635761][ T5698] usb 4-1: USB disconnect, device number 2 [ 114.682280][ T5346] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 114.900016][ T5346] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 114.900056][ T5346] usb 1-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 114.900081][ T5346] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 114.900137][ T5346] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 114.900166][ T5346] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 114.903051][ T5346] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 114.903089][ T5346] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 114.903112][ T5346] usb 1-1: Product: syz [ 114.903128][ T5346] usb 1-1: Manufacturer: syz [ 115.824070][ T5346] cdc_wdm 1-1:1.0: skipping garbage [ 115.824098][ T5346] cdc_wdm 1-1:1.0: skipping garbage [ 115.890887][ T5346] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 115.890916][ T5346] cdc_wdm 1-1:1.0: Unknown control protocol [ 116.132683][ T5760] dvb-usb: DViCO FusionHDTV DVB-T USB (LGZ201) successfully deinitialized and disconnected. [ 116.348288][ T5346] usb 1-1: USB disconnect, device number 3 [ 116.891656][ T5825] sctp: [Deprecated]: syz.1.13 (pid 5825) Use of int in max_burst socket option. [ 116.891656][ T5825] Use struct sctp_assoc_value instead [ 116.920314][ T5826] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 116.921248][ T5718] usb 4-1: new full-speed USB device number 3 using dummy_hcd [ 116.983094][ T5824] netlink: 'syz.2.17': attribute type 1 has an invalid length. [ 117.092855][ T5718] usb 4-1: New USB device found, idVendor=09c0, idProduct=0203, bcdDevice=d3.43 [ 117.092893][ T5718] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 117.151013][ T5718] usb 4-1: config 0 descriptor?? [ 117.216920][ T5718] dvb-usb: found a 'Genpix SkyWalker-1 DVB-S receiver' in warm state. [ 117.382935][ T5718] gp8psk: usb in 128 operation failed. [ 117.383809][ T5718] gp8psk: usb in 137 operation failed. [ 117.383828][ T5718] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 117.383875][ T5718] dvb-usb: Genpix SkyWalker-1 DVB-S receiver error while loading driver (-19) [ 117.751109][ T5718] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 117.931128][ T5718] usb 1-1: Using ep0 maxpacket: 16 [ 117.994490][ T5718] usb 1-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 117.994525][ T5718] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 117.994548][ T5718] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 118.013288][ T5718] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 118.013323][ T5718] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 118.013343][ T5718] usb 1-1: Product: syz [ 118.013357][ T5718] usb 1-1: Manufacturer: syz [ 118.013371][ T5718] usb 1-1: SerialNumber: syz [ 118.166030][ T5718] usb 1-1: 0:2 : does not exist [ 118.887738][ T5718] usb 1-1: USB disconnect, device number 4 [ 119.409790][ T5698] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 119.587925][ T5698] usb 2-1: Using ep0 maxpacket: 16 [ 119.628407][ T5698] usb 2-1: config 252 has an invalid interface number: 15 but max is 0 [ 119.628441][ T5698] usb 2-1: config 252 has no interface number 0 [ 119.628488][ T5698] usb 2-1: config 252 interface 15 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 119.632670][ T5698] usb 2-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=2b.29 [ 119.632709][ T5698] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 119.632728][ T5698] usb 2-1: Product: syz [ 119.632743][ T5698] usb 2-1: Manufacturer: syz [ 119.632760][ T5698] usb 2-1: SerialNumber: syz [ 119.895824][ T5719] usb 4-1: USB disconnect, device number 3 [ 120.092987][ T5698] usb 2-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 120.667735][ T5776] udevd[5776]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 121.199763][ T67] usb 2-1: Failed to submit usb control message: -110 [ 121.203367][ T67] usb 2-1: unable to send the bmi data to the device: -110 [ 121.203399][ T67] usb 2-1: unable to get target info from device [ 121.203416][ T67] usb 2-1: could not get target info (-110) [ 121.203688][ T67] usb 2-1: could not probe fw (-110) [ 121.296187][ T5867] af_packet: tpacket_rcv: packet too big, clamped from 42 to 4294967286. macoff=82 [ 121.428109][ T5346] usb 2-1: USB disconnect, device number 3 [ 121.937392][ T5872] netlink: 8 bytes leftover after parsing attributes in process `syz.3.26'. [ 122.399313][ T5872] netlink: 'syz.3.26': attribute type 1 has an invalid length. [ 122.475823][ T5346] usb 2-1: new low-speed USB device number 4 using dummy_hcd [ 122.763378][ T5346] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 122.763415][ T5346] usb 2-1: config 0 has no interface number 0 [ 122.763467][ T5346] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 122.763500][ T5346] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 122.763558][ T5346] usb 2-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 122.763585][ T5346] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 122.885347][ T5346] usb 2-1: config 0 descriptor?? [ 122.886600][ T5874] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 122.925461][ T5346] iowarrior 2-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 123.167112][ C0] iowarrior 2-1:0.1: iowarrior_callback - usb_submit_urb failed with result -1 [ 123.187269][ T822] usb 2-1: USB disconnect, device number 4 [ 123.943397][ T5883] FAULT_INJ[ 123.943397][ T5883] FAULT_INJECTION: forcing a failure. [ 123.943397][ T5883] name failslab, interval 1, probability 0, space 0, times 1 [ 123.943438][ T5883] CPU: 0 UID: 0 PID: 5883 Comm: syz.1.30 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 123.943462][ T5883] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 123.943484][ T5883] Call Trace: [ 123.943493][ T5883] [ 123.943502][ T5883] dump_stack_lvl+0xe8/0x150 [ 123.943539][ T5883] should_fail_ex+0x46b/0x600 [ 123.943578][ T5883] should_failslab+0xa8/0x100 [ 123.943608][ T5883] __kmalloc_noprof+0xdf/0x7b0 [ 123.943635][ T5883] ? tomoyo_encode+0x28b/0x550 [ 123.943666][ T5883] tomoyo_encode+0x28b/0x550 [ 123.943695][ T5883] tomoyo_realpath_from_path+0x58d/0x5d0 [ 123.943724][ T5883] ? tomoyo_domain+0xd7/0x130 [ 123.943755][ T5883] ? tomoyo_path_number_perm+0x219/0x630 [ 123.943788][ T5883] tomoyo_path_number_perm+0x246/0x630 [ 123.943816][ T5883] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 123.943847][ T5883] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 123.943923][ T5883] ? __pfx_from_kgid+0x10/0x10 [ 123.943964][ T5883] security_path_chown+0x139/0x340 [ 123.943995][ T5883] chown_common+0x40c/0x6c0 [ 123.944030][ T5883] ? __pfx_chown_common+0x10/0x10 [ 123.944073][ T5883] ? mnt_get_write_access+0x262/0x2d0 [ 123.944111][ T5883] ? mnt_want_write_file+0x17e/0x210 [ 123.944146][ T5883] ksys_fchown+0xe9/0x160 [ 123.944169][ T5883] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 123.944194][ T5883] __x64_sys_fchown+0x7a/0x90 [ 123.944220][ T5883] do_syscall_64+0x174/0x580 [ 123.944252][ T5883] ? trace_irq_disable+0x3b/0x140 [ 123.944277][ T5883] ? clear_bhb_loop+0x40/0x90 [ 123.944306][ T5883] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 123.944328][ T5883] RIP: 0033:0x7f55318dce59 [ 123.944350][ T5883] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 123.944368][ T5883] RSP: 002b:00007f552fb2e028 EFLAGS: 00000246 ORIG_RAX: 000000000000005d [ 123.944393][ T5883] RAX: ffffffffffffffda RBX: 00007f5531b55fa0 RCX: 00007f55318dce59 [ 123.944409][ T5883] RDX: 000000000000ee00 RSI: 0000000000000000 RDI: 0000000000000003 [ 123.944423][ T5883] RBP: 00007f552fb2e090 R08: 0000000000000000 R09: 0000000000000000 [ 123.944436][ T5883] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 123.944449][ T5883] R13: 00007f5531b56038 R14: 00007f5531b55fa0 R15: 00007ffc5ae2d618 [ 123.944492][ T5883] [ 123.946019][ T5883] ERROR: Out of memory at tomoyo_realpath_from_path. [ 123.948120][ T5718] ================================================================== [ 123.948134][ T5718] BUG: KASAN: vmalloc-out-of-bounds in __list_del_entry_valid_or_report+0xb5/0x190 [ 123.948179][ T5718] Read of size 8 at addr ffffc9000f341008 by task kworker/0:4/5718 [ 123.948195][ T5718] [ 123.948207][ T5718] CPU: 0 UID: 0 PID: 5718 Comm: kworker/0:4 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 123.948230][ T5718] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 123.948243][ T5718] Workqueue: usb_hub_wq hub_event [ 123.948266][ T5718] Call Trace: [ 123.948275][ T5718] [ 123.948283][ T5718] dump_stack_lvl+0xe8/0x150 [ 123.948307][ T5718] print_address_description+0x55/0x1e0 [ 123.948332][ T5718] ? __list_del_entry_valid_or_report+0xb5/0x190 [ 123.948360][ T5718] print_report+0x58/0x70 [ 123.948383][ T5718] kasan_report+0x117/0x150 [ 123.948409][ T5718] ? __list_del_entry_valid_or_report+0xb5/0x190 [ 123.948441][ T5718] __list_del_entry_valid_or_report+0xb5/0x190 [ 123.948471][ T5718] kcov_remote_start+0x2af/0x710 [ 123.948501][ T5718] hub_event+0x150/0x4f60 [ 123.948522][ T5718] ? __lock_acquire+0x6b5/0x2d10 [ 123.948545][ T5718] ? look_up_lock_class+0x57/0x110 [ 123.948575][ T5718] ? __lock_acquire+0x6b5/0x2d10 [ 123.948603][ T5718] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 123.948622][ T5718] ? __pfx_hub_event+0x10/0x10 [ 123.948640][ T5718] ? process_one_work+0x8be/0x1630 [ 123.948671][ T5718] ? process_one_work+0x8be/0x1630 [ 123.948694][ T5718] process_one_work+0x98b/0x1630 [ 123.948726][ T5718] ? __pfx_process_one_work+0x10/0x10 [ 123.948750][ T5718] ? do_raw_spin_lock+0x12b/0x2f0 [ 123.948774][ T5718] worker_thread+0xb49/0x1140 [ 123.948803][ T5718] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 123.948836][ T5718] kthread+0x388/0x470 [ 123.948856][ T5718] ? __pfx_worker_thread+0x10/0x10 [ 123.948882][ T5718] ? __pfx_kthread+0x10/0x10 [ 123.948903][ T5718] ret_from_fork+0x514/0xb70 [ 123.948927][ T5718] ? __pfx_ret_from_fork+0x10/0x10 [ 123.948948][ T5718] ? __switch_to+0xc79/0x1410 [ 123.948967][ T5718] ? __pfx_kthread+0x10/0x10 [ 123.948988][ T5718] ret_from_fork_asm+0x1a/0x30 [ 123.949017][ T5718] [ 123.949024][ T5718] [ 123.949029][ T5718] The buggy address belongs to a vmalloc virtual mapping [ 123.949047][ T5718] Memory state around the buggy address: [ 123.949057][ T5718] ffffc9000f340f00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 123.949070][ T5718] ffffc9000f340f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 123.949082][ T5718] >ffffc9000f341000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 123.949091][ T5718] ^ [ 123.949100][ T5718] ffffc9000f341080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 123.949112][ T5718] ffffc9000f341100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 123.949122][ T5718] ================================================================== [ 123.949146][ T5718] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 123.949159][ T5718] CPU: 0 UID: 0 PID: 5718 Comm: kworker/0:4 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 123.949181][ T5718] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 123.949192][ T5718] Workqueue: usb_hub_wq hub_event [ 123.949209][ T5718] Call Trace: [ 123.949215][ T5718] [ 123.949222][ T5718] vpanic+0x56c/0xa60 [ 123.949248][ T5718] ? rcu_is_watching+0x15/0xb0 [ 123.949274][ T5718] ? __pfx_vpanic+0x10/0x10 [ 123.949308][ T5718] panic+0xc5/0xd0 [ 123.949333][ T5718] ? __pfx_panic+0x10/0x10 [ 123.949359][ T5718] ? __list_del_entry_valid_or_report+0xb5/0x190 [ 123.949392][ T5718] ? __list_del_entry_valid_or_report+0xb5/0x190 [ 123.949421][ T5718] check_panic_on_warn+0x89/0xb0 [ 123.949445][ T5718] ? __list_del_entry_valid_or_report+0xb5/0x190 [ 123.949473][ T5718] end_report+0x73/0x170 [ 123.949503][ T5718] ? __list_del_entry_valid_or_report+0xb5/0x190 [ 123.949530][ T5718] kasan_report+0x128/0x150 [ 123.949553][ T5718] ? __list_del_entry_valid_or_report+0xb5/0x190 [ 123.949585][ T5718] __list_del_entry_valid_or_report+0xb5/0x190 [ 123.949614][ T5718] kcov_remote_start+0x2af/0x710 [ 123.949634][ T5718] hub_event+0x150/0x4f60 [ 123.949655][ T5718] ? __lock_acquire+0x6b5/0x2d10 [ 123.949676][ T5718] ? look_up_lock_class+0x57/0x110 [ 123.949706][ T5718] ? __lock_acquire+0x6b5/0x2d10 [ 123.949733][ T5718] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 123.949752][ T5718] ? __pfx_hub_event+0x10/0x10 [ 123.949769][ T5718] ? process_one_work+0x8be/0x1630 [ 123.949798][ T5718] ? process_one_work+0x8be/0x1630 [ 123.949822][ T5718] process_one_work+0x98b/0x1630 [ 123.949853][ T5718] ? __pfx_process_one_work+0x10/0x10 [ 123.949877][ T5718] ? do_raw_spin_lock+0x12b/0x2f0 [ 123.949906][ T5718] worker_thread+0xb49/0x1140 [ 123.949935][ T5718] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 123.949966][ T5718] kthread+0x388/0x470 [ 123.949985][ T5718] ? __pfx_worker_thread+0x10/0x10 [ 123.950010][ T5718] ? __pfx_kthread+0x10/0x10 [ 123.950030][ T5718] ret_from_fork+0x514/0xb70 [ 123.950053][ T5718] ? __pfx_ret_from_fork+0x10/0x10 [ 123.950074][ T5718] ? __switch_to+0xc79/0x1410 [ 123.950092][ T5718] ? __pfx_kthread+0x10/0x10 [ 123.950111][ T5718] ret_from_fork_asm+0x1a/0x30 [ 123.950140][ T5718] [ 123.950620][ T5718] Kernel Offset: disabled