last executing test programs: 52.355315834s ago: executing program 3 (id=142): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f00000004c0), 0x802, 0x0) mq_open(&(0x7f0000000000)='\x00', 0xf4e08cbd1c690303, 0x0, &(0x7f0000000040)={0x8001, 0xc351, 0x5, 0x8}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x1d, 0x4, &(0x7f00000001c0)=ANY=[@ANYBLOB="1802000002000000000000001100000085000000ae00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x27}, 0x94) fsopen(&(0x7f0000000240)='tracefs\x00', 0x1) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x28100, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_NMI(r3, 0xae9a) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000340)={[0x0, 0x100000000, 0x0, 0x7e, 0x100000, 0x0, 0x2004c8, 0x8000000, 0x0, 0x1, 0x7, 0x0, 0x5, 0xa, 0x2, 0xffffffffffffffff], 0x0, 0x200}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) mount$9p_virtio(&(0x7f0000000400), &(0x7f0000000440)='./file0\x00', &(0x7f0000000480), 0x0, 0x0) symlink(&(0x7f0000000780)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/../file0\x00', &(0x7f00000008c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') chdir(&(0x7f0000000500)='./file0\x00') r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r4, &(0x7f0000000580)=ANY=[], 0x3261e) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r4, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r4, 0xc018937b, &(0x7f0000000b40)={{0x1, 0x1, 0x18, r0, {0xee01, 0xffffffffffffffff}}, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/../file0\x00'}) lstat(&(0x7f0000000c80)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000d80)={0x0, 0x0, 0x0, 0x0, 0x0}) getresuid(&(0x7f0000000e00), &(0x7f0000000e40)=0x0, &(0x7f0000000e80)) mount$nfs4(&(0x7f0000000580)='/dev/bsg/2:0:0:0\x00', &(0x7f00000005c0)='./file0\x00', &(0x7f0000000600), 0x1241008, &(0x7f0000000ec0)={[{'$%L,'}, {}, {'}'}, {}, {'.]-\\['}], [{@fsmagic={'fsmagic', 0x3d, 0x4}}, {@pcr={'pcr', 0x3d, 0x14}}, {@appraise_type}, {@uid_eq={'uid', 0x3d, r5}}, {@uid_lt={'uid<', r6}}, {@fowner_gt={'fowner>', r7}}, {@subj_role}, {@audit}, {@subj_role={'subj_role', 0x3d, '/dev/uhid\x00'}}, {@mask={'mask', 0x3d, 'MAY_WRITE'}}]}) ioctl$int_in(r4, 0x5421, 0x0) openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) epoll_pwait2(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000640)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x14, 0x3, 0x1b1c, 0xc10, 0x0, 0x0, "05010900a101150026ff007508951009008102c0"}}, 0x12c) r8 = openat$bsg(0xffffff9c, &(0x7f0000000080)='/dev/bsg/2:0:0:0\x00', 0x44002, 0x0) ioctl$SG_GET_KEEP_ORPHAN(r8, 0x2288, &(0x7f00000000c0)) 51.230054999s ago: executing program 3 (id=151): mkdirat(0xffffffffffffff9c, &(0x7f0000001380)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f00000013c0), &(0x7f0000001400)='./file0\x00', &(0x7f0000001440), 0x2210088, 0x0) chdir(&(0x7f0000001500)='./file0\x00') r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001540)='blkio.throttle.io_service_bytes\x00', 0x275a, 0x0) mount$bind(&(0x7f0000001580)='./file0\x00', &(0x7f00000015c0)='./file0\x00', 0x0, 0x3125819, 0x0) umount2(&(0x7f0000000080)='./file0\x00', 0xb) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0xfffffffffffffefe) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r0, 0xc018937b, &(0x7f0000000140)={{0x1, 0x1, 0x18, r0, {0xee01}}, './file0\x00'}) r3 = getuid() getresuid(&(0x7f0000000180), &(0x7f00000001c0)=0x0, &(0x7f0000000200)) lsetxattr$system_posix_acl(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='system.posix_acl_access\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="02000000010005000000000002000000", @ANYRES32=r2, @ANYBLOB="02000700", @ANYRES32, @ANYBLOB="02000500", @ANYRES32=r3, @ANYBLOB="02000000", @ANYRES32=0xee01, @ANYBLOB="02000400", @ANYRES32=r4, @ANYBLOB="040008001000002500000000000000000000000000002000"], 0x4c, 0x1) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r5 = socket$kcm(0x10, 0x2, 0x4) sendmsg$inet(r5, &(0x7f0000001940)={0x0, 0x0, &(0x7f0000001980)=[{&(0x7f00000019c0)="5c00000012006b000040017ea608601602f3650400010008000000000002009ee517c356a7b0251e616859ad3a78a76e807c857e21bea297bff435cf01c937e786a6d0bdc7fcf50e4509c5cc68b7ed9c232d786c3500000000000074", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x16) r6 = userfaultfd(0x801) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f00000002c0)={0xaa, 0x280}) ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f0000000300)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_WRITEPROTECT(r6, 0xc018aa06, &(0x7f0000001480)={{&(0x7f000040a000/0x800000)=nil, 0x800000}, 0x1}) mprotect(&(0x7f000060f000/0x3000)=nil, 0x3000, 0x1) r7 = openat$dm_control(0xffffffffffffff9c, &(0x7f00000014c0), 0x883, 0x0) ioctl$DM_DEV_CREATE(r7, 0xc138fd03, &(0x7f0000001600)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, {'syz', 0x0, '1\x00'}}}) ioctl$DM_TABLE_LOAD(r7, 0xc138fd09, &(0x7f0000001740)={0x4, 0x0, 0x0, 0x1a0, 0x138, 0x1, 0x0, 0x0, 0x0, 0x0, @by_dev={r8}, [@thin_pool={0x0, 0x1808, 0x0, 0x68, 'thin-pool\x00', {@ram={'/dev/ram', 0x0}, 0x20, @ram={'/dev/ram', 0x1}, 0x20, '1024', 0x20, 0xe, ' 1 ignore_discard'}}]}) ioctl$F2FS_IOC_FLUSH_DEVICE(r7, 0x4008f50a, &(0x7f0000001900)={0x9, 0x182fc6cc}) write$UHID_INPUT(r0, &(0x7f0000000340)={0x8, {"85f08091933d55266e07e799aa0cc421388242df2a3c6b631b65b1c061edd2aa108c3528fe9b0bb3a53ab1200f5d01a68a4acdec8fee09648222f908c1fedc3000342e6139de28366c13509306d00ebcc67497181ac916db98af9d366b76e427d9ab5bb68095f0fb246df32b8af0783653136f8a04c03690312125b2ded6a24fda8685340c575ead69519e3583f89d467ec232d6a1ffd0463ba4e23cbae5dae6654b5547b5458f02ac307729e57b09e134f68be44f88d62517b230b066f6315b5fb80206397bbff8cbc2a36e01c2e7b3aadb03bd3dd5288a69a991d9c674717e3abba7167280b2db3b1b8502afa4f3f296c532510c9d2dd79bb5eeb25adb5edddbdd069c09d14d15c2e7e1e2bb22e97d6992236d2273c8bb95536f7118d007965008b125c7daac2814e6bbe1adbfa3572ad0b7ad5c26c8014118d8374ca9f285779dfee7715a403908146a74de61b3853914c89f444c12e7a38bdd46c4ed36eb806ea598f44d1dec9eff9e2476f43802211f0762b66673b45d236b2391ce322e30fb9c69fe0d514dc1f8b6e3979c1205fd5224b07d18a44fec4f6f1a6f65158bc1adcc295bf2dd7dea107f59d7e03c61fe5822292e45968956b931bdc4d6445ff1631e0b98e4b4448774dd4b9cd53a45896fdb3f03702778741ae2b45a25bf9a23fc02fb97a630f132bf9def6c6d4a7baeb62972f1a814f6f2377bcfc78e2e86368c138510a04cedf7175af8c2033aae7413e3ace8c71ab9a0af1ca7042011a6ed028e205648535dabf3b2f85196ae18d36b839e3cd54ae4933ad529888fdac7bb8a70c72bc0fc81ba06506f2d5bc7686e219bbe5283959cbef9950e071cb6d9f341fc624a5110341f26cebd7100599a06e61f66fae120c7fc2b34c6221200eba75bd1277114671a3fa8f058b27fd897b052f4a52afcea814df526181c75c4497210a2b85b7b26601561e78735387cf123654b0295d1d60556956b36d96dd038866c4b4db31ebdcddd6929bbc2850cd4901389e6ea6e86041e0efa1111c2fb0e6df6364cb95659f506d5c7e63fb67c8116577d15e4a4b1fc4c27de2e52586cb1f52be9c3601f5066549de8bdc3ec07d1a84caf1961323ec2487a37b751aeabafcd647ce2dae5d9499c0f969467e6cabad198669ac96bd1488954eff0854ee0c83d7b596d273625bdb16270782321071fda5d980ded78ffa9dc2b56037d7cbf942547f48a5131f1991f6c17ae1ed5120ca6878f98e68e7997a9a2b70be640a70a34adb80de286c669bb5f092e4e3a15a83217e03d02a4054f34af3a65ff6b36f395b76a0579cffafd5d3bb0e704c935caecf3a7ab756c23fd60c9fe3f4fb2be7504f5bae22b116ff1588dcf02b327d31bf0488dba8af5b33ccf2d7d87f43bbc48fcd4f191ad6af9313ad38b8b2967cbfabd6651bc1f6ce5abb4a2f1413194f96b26d7d6edc4e013fba549075c97eef508af5ca7873664b058b7bcf455a8a04b591d29fab6366c844bb75576bac2d52323e747303d00a5736c9812922b0e17bcec9135550736b54cf6407d61e22e62d7bb75f62935b665acf33e75f688c36ef416f1b890d0f0c8ad1df00e02ec45967834d5649c8e7143978622fa3704672970b7993a87e97d3d926a14265647bc8b8c9e6f83e29572608d24b42c2635ef4abbd0af83a10e99c90d7471cf6e8ce99507f5ec2bc572212fa9ee3f5a9dfa3815fe55f0bbb119acce062ae37f2ff921707abba139bcddf42bfd174d29b540161b4113c4e1a13f3a628c638ec4d3a884dfbc093e23ec0d0671b46b41dc8b42d950c8615ba5ee87f49b5d0910ffa4871207995001920db05a95199967f097ba7b55bbd271d818690c4238406b40a3dfc42fa56a67173b53a96b543326c56738b6d043195934018696f5ab49347e5148a78f2d1369a71afab8330273d46ecfba4ee05802a5385649851db949dbfb39e290941641c50b1ac20fb3102754a760b097f464ddb0b83f8168badfa71db6621dcf22fb081e3403f3bac5c7e65905aca52885c807f8ddab18bb2f12ef952c50483c0e251968bc70ff0d42a638ca744dea4c7ebb4fea777cf663bb4f1505ed79730c45bc86e488a13f924377a8e2ee6670a02ca52874ae1c42a35d55b9765757047b2cc3742aa51fa3e43fb2c113c92ad213bad252c1a82966dd016f12a7f1c3900c0f1ab455035163f31899bdd30f3ff43ad17d9e45bb7438c1c986712736f24be14f71ab1bfe92a25ec07f086ee8c7971b8077a13e58a8e8bea39c8e06b251909f02cb0080abf020f27ca160eb26c082dda1fa54ea4094dfdbcb2fa7bddccb67a844e8075f4cc08dad35757006d051e183dced336bc0c2502f93ffc87dca622286ba174c24e1f53f27dc2777baafe170348b0e8d3e743b3aa906bc0764bbe7da08ff403efe2212627d6748c2ce5bb513b7312517d1f88c61c7ba5f9647cd619281c5b390b48606ee39fb4171103df2e09d7cfd56c06c721f7c24ad8cce383623fc2dcb73f7b1b3b86df1b42490815513681aafbf7e871b4b9686efae6c45ecfca60a640a6f071dfd31f9437c3d03086164b48c1ed802986864bfe0d49bdd7709662262368dbc3ecc05eb240ecc41904c76d78ab5c52b66af5a720fdd6a92f52be0676427a56e32e5bc5085b25f90add28a76f2fce6f8f0ef74f4658098549646bd63175adf77b5cdcf102946554ba6136cbc83c6268ee40318f3c9d4718025688b35d2265bf60bf889ff629f7834586ef46eab7a9176337536bb6001e676546b987f36b1fe4baea02fa76fb4830aebba9c14d8e2b43ea77ef887e5a26448f4086fa819a25e27725ac10298851c8bc45f2ce4430b07917ade5ea8c434c3f2576effbeb521173736e5c9557450643068b0c0fb132a7e99de6ca292246a9937fa7d7e06e59cf59ce5b9f8426a9049931146af40a8a1256ba373a88d09dc00cdf4453cc6ba78572bf3e1f2352a978cdbad60220cb8ac37d7f614a306492a4b5eee9244b0ca84b6cf2e23013bfb1cb92bf6d126fe550e58c19f84e7a4081437b75b31b2b9fb658dcd8ba077962e0f3359721a148d4fefe5c97941ca9688cb85adf38fd10f5811cdd8e074a21abfc9541c71465b08d7321281b68ed52bfab789b9c83849c09d52376d419b1e7ba367603236e119cdf4a7b7cf9d81f2229601deace53cea2f14a05f7fa0ca04b39e31c6453e332f4bd0915c0e09e28f4d1125c390c6ff0833a04b6fc37855e65de90333e505b9eb66e0068607000000fb7b8b215dbdc9787b5baa724cfa71ee6745b41e203de8b7794757ac328ec5567540b951b50530c3d4ee34705ea1c66fd6591e88561083e86d48c45ef3b83a3029319d8f3d8e65ce14c1dc3cb92d0a7dbeb609a8d2793928caa079f0fbbb2bc90b9fb4000000f4032041d14c5bca00e99b3027ec3a50c4957199cf016a4594069af8659df0973f20ffb15dbc265ac5b8a2203e90b114a3e9441e357c60ce0b550a7fe66fc34f5702ac8e8992a22e89194c1df69e81a9b7ad3d2634ea8c0388588192fd47d8e803b10044d558617fb2921b69eb4d85c051f86ef63a2f4382b9becd870fb2ecadca6902712b88680792e2f2ec89591cfebb6db3ad31c2a339af10465fcf7988519d382218df52261234f26a6f66ad0d1859de505d0fe819caf2f8d30aa9fd1228ac91d11ca67f1f8d50c8eefa5c441514321507dff6c6ea3cff6f340a1c11e0c40f419e8e60fc94d8828fa47a96cdf7ee4f61e23f40751b25cf9ca1295041a350f83f0e679515d6b4b46e2c9ce8999e07f835abc1663cefcf728df37831f4e17f8c8a4feaf1fbf44c38c9313284404a50ba4cd8abe835b33bfecb02cd6c9d7f435853b4c8d505ab83cf46512739116694765658bae64b3127152d216055aef9b25c70a8a3b302752d7b1e8791c657b9f3fc9001ef299fd1a349491ae6ee9940149160507fc4130fb825d47d97dc2c243209d2403583ac3ef6ddbedcaa76432255487c0a06e59e043e572ab3aec002afea6b6a2dc9cfaeefa70557886c4d12924a0388f2f1bc8e89e4cfa69705d1ef3c4658f8616278b588011d9dd914beec0b151d65b6524fba3e3f235d58373e021699b07622a51504eade747e0b2f9cf38bc167cabc8cb18c708d1337e25648707e8c0872876514c7a49c0b2aaee5ed9e9ecfcbcc23e032c4deb63e48e7120188056468fad31448e4b46e7d62fbcfc1c2cfb01fcf0db5e8a162bdb9bd820c763f17b96c23f32db9d1c1d74ddbe657b4f9595a9796982a0742153111b15e484d8ffebe47ce0a78a41e470a341616ec2eb6eef813fb415fab50fa965bec6a5977a0ade4fed67f86fc24e11b0e2f5364079f7c7c35b560cac726dbc80f29dbd248f7ecda0286a23ef172a28c96d9bdb1f598eab31c6baf0321312da23920c074b9d2d2e442717f2c21001142a39c2da6b8bd9d06b05a6a8deae1bd1be4108a636ddbebc682d113e715f2f3ee506abc28b1c654b3d2d28e02f73b171ed0deed71c2f90e31a0b728cc75cb576385e7418b545b992b1dd98e2ee53355f464f9250a2a03b3d1e4d2ac1aa71d01de2573530324e14d15a507883411ddbd37be21dc929db9b11f11010e4d2a04c7325a5ae6d24d19900ff97a8a89438f8676457a78cff05201528f4358fe67f61288bf042a8f3c2e0f8b4997b8fb74996b80d465489b2d7807a945eba72a945e8cf8625dbad6f6f6e30537b29e558ca8a8b0625f578c766d34f2d28d704715f94df1f6318a308042aa494baa295640679f1eab1e6a8308af8ce6441d5ad8a2f3d477eb5307af0dfae66444a8f1434030b8361621340ad3dcefa6d8f090ed3929d89ad9c0ba01a6903033428dd8f98619304b1803187d2a6130bf1e009b5eb0e7e21c75594b3b8470f310a1f1247f3c07e36d3572923e0de3f73518d0369a25fcd4e65d243b7eab91063a7bfd8bc8ac9e39fbbb32b5c9517886287a18eacd8dbfda9b91db693cb12e42cba5988280e09e51e72b91a0f360656d8f21cc1eb3248ac345ad51d1a6172b18419277851dab01e028c7e8e2cf34095efd28267852a08fccf61c45b5e46930160daf50282be058274e7ff58c48b60b86d0c8cc886ab8778a2a2b5fa2557ad7bf7f01f2175523ce758871d334c20a9839f7a89fe2867c06289c8a2f6456ac7e4fbadee53ac41aee68214bc76669853baa4f58255b39ba581414f2e8c4b49303f8936a33bae5cbc96b29a5c724d5b50e1614144c2acd03bd90de891c3d36ce040d57543682ecbfcae66c4153c337c3a5d01896524c8e0c27e9a08919821ca27bbfe3fc9ba24a823aeec8d4ad8ef8a65c585bee4dcf1acaa3da501a8c11a23b2e22920c1ad0129a038b31fe16c2abc80589dbf7c37211afc5d1a6dbb08bc5fe8a692060069fcbcdcba7c523d3c424aa3b050056387e0e51bcde9e5f850abf62d2c2101c3a2786a0cb94932877a09cb6b64aa61da8cab3b423e7adc4c4700418a65e87225710e1691f6d9cb2eb63cce5b605ce0a4a89cf519767e00845397c5e381141a0ed8a89b01064b495ec8d1e2da37433bf1597d919a69610d2ad26bdf6fca8de422bb2cb80d0516206e8194ee51445a3dcb5dee33c0c310b4751e68e58bebda2fb586985a5a5b06456756f44e6dbfef4bb99ca732f00fb9ea35775f7419681bfbe6f43dc7c4650c13b63d93c1d490bf0173f287a4309531f13ecb1a775d0bd881a00", 0x1000}}, 0x1006) 50.915755096s ago: executing program 2 (id=154): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f00000004c0), 0x802, 0x0) mq_open(&(0x7f0000000000)='\x00', 0xf4e08cbd1c690303, 0x0, &(0x7f0000000040)={0x8001, 0xc351, 0x5, 0x8}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x1d, 0x4, &(0x7f00000001c0)=ANY=[@ANYBLOB="1802000002000000000000001100000085000000ae00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x27}, 0x94) fsopen(&(0x7f0000000240)='tracefs\x00', 0x1) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x28100, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_NMI(r3, 0xae9a) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000340)={[0x0, 0x100000000, 0x0, 0x7e, 0x100000, 0x0, 0x2004c8, 0x8000000, 0x0, 0x1, 0x7, 0x0, 0x5, 0xa, 0x2, 0xffffffffffffffff], 0x0, 0x200}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) mount$9p_virtio(&(0x7f0000000400), &(0x7f0000000440)='./file0\x00', &(0x7f0000000480), 0x0, 0x0) symlink(&(0x7f0000000780)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/../file0\x00', &(0x7f00000008c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') chdir(&(0x7f0000000500)='./file0\x00') r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r4, &(0x7f0000000580)=ANY=[], 0x3261e) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r4, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r4, 0xc018937b, &(0x7f0000000b40)={{0x1, 0x1, 0x18, r0, {0xee01, 0xffffffffffffffff}}, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/../file0\x00'}) lstat(&(0x7f0000000c80)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000d80)={0x0, 0x0, 0x0, 0x0, 0x0}) getresuid(&(0x7f0000000e00), &(0x7f0000000e40)=0x0, &(0x7f0000000e80)) mount$nfs4(&(0x7f0000000580)='/dev/bsg/2:0:0:0\x00', &(0x7f00000005c0)='./file0\x00', &(0x7f0000000600), 0x1241008, &(0x7f0000000ec0)={[{'$%L,'}, {}, {'}'}, {}, {'.]-\\['}], [{@fsmagic={'fsmagic', 0x3d, 0x4}}, {@pcr={'pcr', 0x3d, 0x14}}, {@appraise_type}, {@uid_eq={'uid', 0x3d, r5}}, {@uid_lt={'uid<', r6}}, {@fowner_gt={'fowner>', r7}}, {@subj_role}, {@audit}, {@subj_role={'subj_role', 0x3d, '/dev/uhid\x00'}}, {@mask={'mask', 0x3d, 'MAY_WRITE'}}]}) ioctl$int_in(r4, 0x5421, 0x0) openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) epoll_pwait2(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000640)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x14, 0x3, 0x1b1c, 0xc10, 0x0, 0x0, "05010900a101150026ff007508951009008102c0"}}, 0x12c) r8 = openat$bsg(0xffffff9c, &(0x7f0000000080)='/dev/bsg/2:0:0:0\x00', 0x44002, 0x0) ioctl$SG_GET_KEEP_ORPHAN(r8, 0x2288, &(0x7f00000000c0)) 50.657639921s ago: executing program 3 (id=158): ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000240)={0x53, 0xd8, 0xfffc, {0x20, 0x1}, {0x46, 0x2}, @ramp={0x3, 0x10, {0x6, 0x7fff, 0x1ff, 0xe4}}}) r0 = socket(0x40000000015, 0x5, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) sendmsg(r0, &(0x7f00000000c0)={&(0x7f0000000100)=@in={0x2, 0x0, @rand_addr=0x64010100}, 0x80, 0x0, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="100000001401"], 0x10}, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000000), 0x1, 0x8c2b01) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0e00000004000000080000000608000000000000", @ANYRES32, @ANYBLOB="10e9f9ffffffffa1ffff0000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00\x00\x00\x00@\x00'/28], 0x50) write$char_usb(r1, &(0x7f0000000040)="e2", 0x12d8) 50.57956337s ago: executing program 32 (id=158): ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000240)={0x53, 0xd8, 0xfffc, {0x20, 0x1}, {0x46, 0x2}, @ramp={0x3, 0x10, {0x6, 0x7fff, 0x1ff, 0xe4}}}) r0 = socket(0x40000000015, 0x5, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) sendmsg(r0, &(0x7f00000000c0)={&(0x7f0000000100)=@in={0x2, 0x0, @rand_addr=0x64010100}, 0x80, 0x0, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="100000001401"], 0x10}, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000000), 0x1, 0x8c2b01) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0e00000004000000080000000608000000000000", @ANYRES32, @ANYBLOB="10e9f9ffffffffa1ffff0000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00\x00\x00\x00@\x00'/28], 0x50) write$char_usb(r1, &(0x7f0000000040)="e2", 0x12d8) 50.545765855s ago: executing program 2 (id=159): r0 = socket$inet6(0xa, 0x3, 0x2f) getsockopt$inet6_mtu(r0, 0x29, 0x17, 0x0, &(0x7f0000000000)) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000400)={'vcan0\x00', 0x0}) socket$can_bcm(0x1d, 0x2, 0x2) socket$can_bcm(0x1d, 0x2, 0x2) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000440)=@newtfilter={0x24, 0x11, 0x111, 0x70bd27, 0x100000, {0x0, 0x0, 0x74, r2, {0x6, 0xc}, {0x5, 0x10}, {0xd, 0x3}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x4010}, 0xc4) 50.267503378s ago: executing program 2 (id=160): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000400), 0x90080, 0x0) r1 = socket$inet_smc(0x2b, 0x1, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000100)={0x2, 0x4e21, @broadcast}, 0x10) connect$inet(r2, &(0x7f0000000140)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) sendto$inet(r2, &(0x7f0000000180), 0xffffffffffffff94, 0x0, 0x0, 0x0) r3 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000200)={'lo\x00', 0x0}) syz_clone(0x4820000, 0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=@newqdisc={0x60, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r5, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0xea, 0x2, 0x0, 0x1, 0x1009, 0x7c}, {0x3, 0x2, 0x0, 0x401, 0x8001}, 0x0, 0x5, 0x10000000}}, @TCA_TBF_BURST={0x8, 0x6, 0x8057}]}}]}, 0x60}}, 0x44080) sendmsg$nl_route_sched(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000480)=@newqdisc={0x4c, 0x24, 0xd0f, 0x170bd2b, 0x25dfdbff, {0x60, 0x0, 0x0, r5, {}, {0xe, 0xa}, {0xf, 0x1}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x1c, 0x2, [@TCA_CAKE_MEMORY={0x8, 0xa, 0x9}, @TCA_CAKE_RAW={0x8, 0xc, 0x1}, @TCA_CAKE_DIFFSERV_MODE={0x8, 0x3, 0x3}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x48045}, 0x0) recvfrom$inet(r2, 0x0, 0x0, 0x720, 0x0, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_NEWSET={0x4c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x8}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x4}, @NFTA_SET_DATA_LEN={0x8, 0x7, 0x1, 0x0, 0x4}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x94}}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000006c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWSETELEM={0x4c, 0xc, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x20, 0x3, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x8, 0x1, "11223344"}]}, @NFTA_SET_ELEM_DATA={0xc, 0x2, 0x0, 0x1, [@NFTA_DATA_VALUE={0x8, 0x1, "55667788"}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x74}}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000007c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @lookup={{0xb}, @val={0x18, 0x2, 0x0, 0x1, [@NFTA_LOOKUP_SET={0x9, 0x1, 'syz1\x00'}, @NFTA_LOOKUP_SREG={0x8, 0x2, 0x1, 0x0, 0x1}]}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x80}}, 0x0) shutdown(r2, 0x0) r7 = openat$panthor(0xffffff9c, &(0x7f0000000840), 0x2, 0x0) ioctl$DRM_IOCTL_MODE_LIST_LESSEES(r7, 0xc01064c7, &(0x7f00000008c0)={0x4, 0x0, &(0x7f0000000880)=[0x0, 0x0, 0x0, 0x0]}) pipe2$9p(&(0x7f0000000080), 0x80000) ioctl$int_in(r1, 0x5421, &(0x7f0000000000)=0x100000001) connect$inet(r1, &(0x7f0000000040)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x4}}, 0x10) close(r1) r8 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_XEN_HVM_CONFIG(r8, 0x4038ae7a, &(0x7f0000000440)={0x80, 0x40000105, 0x0, 0x0}) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x1) ioctl$KVM_RUN(r9, 0xae80, 0x0) 50.01525739s ago: executing program 2 (id=161): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f00000004c0), 0x802, 0x0) mq_open(&(0x7f0000000000)='\x00', 0xf4e08cbd1c690303, 0x0, &(0x7f0000000040)={0x8001, 0xc351, 0x5, 0x8}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x1d, 0x4, &(0x7f00000001c0)=ANY=[@ANYBLOB="1802000002000000000000001100000085000000ae00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x27}, 0x94) fsopen(&(0x7f0000000240)='tracefs\x00', 0x1) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x28100, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_NMI(r3, 0xae9a) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000340)={[0x0, 0x100000000, 0x0, 0x7e, 0x100000, 0x0, 0x2004c8, 0x8000000, 0x0, 0x1, 0x7, 0x0, 0x5, 0xa, 0x2, 0xffffffffffffffff], 0x0, 0x200}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) mount$9p_virtio(&(0x7f0000000400), &(0x7f0000000440)='./file0\x00', &(0x7f0000000480), 0x0, 0x0) symlink(&(0x7f0000000780)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/../file0\x00', &(0x7f00000008c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') chdir(&(0x7f0000000500)='./file0\x00') r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r4, &(0x7f0000000580)=ANY=[], 0x3261e) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r4, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r4, 0xc018937b, &(0x7f0000000b40)={{0x1, 0x1, 0x18, r0, {0xee01, 0xffffffffffffffff}}, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/../file0\x00'}) lstat(&(0x7f0000000c80)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000d80)={0x0, 0x0, 0x0, 0x0, 0x0}) getresuid(&(0x7f0000000e00), &(0x7f0000000e40)=0x0, &(0x7f0000000e80)) mount$nfs4(&(0x7f0000000580)='/dev/bsg/2:0:0:0\x00', &(0x7f00000005c0)='./file0\x00', &(0x7f0000000600), 0x1241008, &(0x7f0000000ec0)={[{'$%L,'}, {}, {'}'}, {}, {'.]-\\['}], [{@fsmagic={'fsmagic', 0x3d, 0x4}}, {@pcr={'pcr', 0x3d, 0x14}}, {@appraise_type}, {@uid_eq={'uid', 0x3d, r5}}, {@uid_lt={'uid<', r6}}, {@fowner_gt={'fowner>', r7}}, {@subj_role}, {@audit}, {@subj_role={'subj_role', 0x3d, '/dev/uhid\x00'}}, {@mask={'mask', 0x3d, 'MAY_WRITE'}}]}) ioctl$int_in(r4, 0x5421, 0x0) openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) epoll_pwait2(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000640)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x14, 0x3, 0x1b1c, 0xc10, 0x0, 0x0, "05010900a101150026ff007508951009008102c0"}}, 0x12c) r8 = openat$bsg(0xffffff9c, &(0x7f0000000080)='/dev/bsg/2:0:0:0\x00', 0x44002, 0x0) ioctl$SG_GET_KEEP_ORPHAN(r8, 0x2288, &(0x7f00000000c0)) 48.849229041s ago: executing program 2 (id=167): mkdirat(0xffffffffffffff9c, &(0x7f0000001380)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f00000013c0), &(0x7f0000001400)='./file0\x00', &(0x7f0000001440), 0x2210088, 0x0) chdir(&(0x7f0000001500)='./file0\x00') r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001540)='blkio.throttle.io_service_bytes\x00', 0x275a, 0x0) mount$bind(&(0x7f0000001580)='./file0\x00', &(0x7f00000015c0)='./file0\x00', 0x0, 0x3125819, 0x0) umount2(&(0x7f0000000080)='./file0\x00', 0xb) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0xfffffffffffffefe) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r0, 0xc018937b, &(0x7f0000000140)={{0x1, 0x1, 0x18, r0, {0xee01}}, './file0\x00'}) r3 = getuid() getresuid(&(0x7f0000000180), &(0x7f00000001c0)=0x0, &(0x7f0000000200)) lsetxattr$system_posix_acl(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='system.posix_acl_access\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="02000000010005000000000002000000", @ANYRES32=r2, @ANYBLOB="02000700", @ANYRES32, @ANYBLOB="02000500", @ANYRES32=r3, @ANYBLOB="02000000", @ANYRES32=0xee01, @ANYBLOB="02000400", @ANYRES32=r4, @ANYBLOB="040008001000002500000000000000000000000000002000"], 0x4c, 0x1) 47.727363792s ago: executing program 2 (id=171): r0 = mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0f00000000000002f6ffffff09"], 0x50) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xa2f01, 0x0) r2 = openat$binderfs(0xffffff9c, &(0x7f0000000140)='./binderfs/custom0\x00', 0xc00, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, 0x0) sched_setaffinity(r3, 0x8, &(0x7f0000000180)=0x2) ioctl$BINDER_GET_FROZEN_INFO(r2, 0xc00c620f, &(0x7f00000001c0)={r3}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=ANY=[@ANYRES8=r4, @ANYRES32=0x0, @ANYRES32=r4, @ANYRES16=r1, @ANYRES32=r4, @ANYRES32=r3, @ANYRES8=r4, @ANYRESHEX=r0], 0x7c}, 0x1, 0x0, 0x0, 0x2400c0c4}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000a00)={{0x14}, [@NFT_MSG_NEWRULE={0x68, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x3c, 0x4, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @dynset={{0xb}, @void}}, {0x28, 0x1, 0x0, 0x1, @nat={{0x8}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_NAT_FAMILY={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_NAT_REG_ADDR_MAX={0x8, 0x4, 0x1, 0x0, 0xf}, @NFTA_NAT_REG_ADDR_MIN={0x8, 0x3, 0x1, 0x0, 0x3}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x90}, 0x1, 0x0, 0x0, 0x5}, 0x0) r5 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r5, &(0x7f0000000440), 0x10) read(r5, &(0x7f0000000480)=""/135, 0x87) sendmsg$can_bcm(r5, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=ANY=[@ANYBLOB, @ANYRES64=0x0, @ANYRES64=0x2710], 0x48}}, 0x0) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000600)={0x1, &(0x7f0000000640)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r6, 0xffffffffffffffff, 0x0) sendmsg$NFT_MSG_GETSETELEM(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000840)=ANY=[@ANYBLOB="400000000d0a010800000000000000220a00000109000200064f659f991428e173797a31000000000900010073510fee240000000110050001001e050000b854f3c89540e4f6e9a03760395fb40f8128a598a2c9b171c40453ed8f878a350abb727a609133dbe9889e548458d8cf5ed3ad86ef4bdad020a57c91b66a4100000000"], 0x40}, 0x1, 0x0, 0x0, 0x4000805}, 0x8000) sendmsg$NL80211_CMD_GET_MPP(0xffffffffffffffff, &(0x7f0000000b00)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000b80)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="22042dbd7000fddbdf256b00000084764f6b8d2a90931d0f0eac40af0126aef25624c177b7fd9aa3580c91ad5f5852b946c6db0e6999018bc636eaf764d9aeb9a2b48c2603bb85206e6b3fb72ebf62312c3cff6435fc29f8e6a41529a44575bbf7ed65ad3deed5b0f853fcb85d43e6b3d368fafe2e804fea764ece0999ff800b0d6c882129e4fb724017b0edc424f83f94ea3d"], 0x14}, 0x1, 0x0, 0x0, 0x24048880}, 0x20044040) 47.688626259s ago: executing program 33 (id=171): r0 = mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0f00000000000002f6ffffff09"], 0x50) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xa2f01, 0x0) r2 = openat$binderfs(0xffffff9c, &(0x7f0000000140)='./binderfs/custom0\x00', 0xc00, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, 0x0) sched_setaffinity(r3, 0x8, &(0x7f0000000180)=0x2) ioctl$BINDER_GET_FROZEN_INFO(r2, 0xc00c620f, &(0x7f00000001c0)={r3}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=ANY=[@ANYRES8=r4, @ANYRES32=0x0, @ANYRES32=r4, @ANYRES16=r1, @ANYRES32=r4, @ANYRES32=r3, @ANYRES8=r4, @ANYRESHEX=r0], 0x7c}, 0x1, 0x0, 0x0, 0x2400c0c4}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000a00)={{0x14}, [@NFT_MSG_NEWRULE={0x68, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x3c, 0x4, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @dynset={{0xb}, @void}}, {0x28, 0x1, 0x0, 0x1, @nat={{0x8}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_NAT_FAMILY={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_NAT_REG_ADDR_MAX={0x8, 0x4, 0x1, 0x0, 0xf}, @NFTA_NAT_REG_ADDR_MIN={0x8, 0x3, 0x1, 0x0, 0x3}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x90}, 0x1, 0x0, 0x0, 0x5}, 0x0) r5 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r5, &(0x7f0000000440), 0x10) read(r5, &(0x7f0000000480)=""/135, 0x87) sendmsg$can_bcm(r5, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=ANY=[@ANYBLOB, @ANYRES64=0x0, @ANYRES64=0x2710], 0x48}}, 0x0) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000600)={0x1, &(0x7f0000000640)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r6, 0xffffffffffffffff, 0x0) sendmsg$NFT_MSG_GETSETELEM(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000840)=ANY=[@ANYBLOB="400000000d0a010800000000000000220a00000109000200064f659f991428e173797a31000000000900010073510fee240000000110050001001e050000b854f3c89540e4f6e9a03760395fb40f8128a598a2c9b171c40453ed8f878a350abb727a609133dbe9889e548458d8cf5ed3ad86ef4bdad020a57c91b66a4100000000"], 0x40}, 0x1, 0x0, 0x0, 0x4000805}, 0x8000) sendmsg$NL80211_CMD_GET_MPP(0xffffffffffffffff, &(0x7f0000000b00)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000b80)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="22042dbd7000fddbdf256b00000084764f6b8d2a90931d0f0eac40af0126aef25624c177b7fd9aa3580c91ad5f5852b946c6db0e6999018bc636eaf764d9aeb9a2b48c2603bb85206e6b3fb72ebf62312c3cff6435fc29f8e6a41529a44575bbf7ed65ad3deed5b0f853fcb85d43e6b3d368fafe2e804fea764ece0999ff800b0d6c882129e4fb724017b0edc424f83f94ea3d"], 0x14}, 0x1, 0x0, 0x0, 0x24048880}, 0x20044040) 45.424521962s ago: executing program 0 (id=182): r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000180)={0x1, 0x0, [{0x40000023, 0x0, 0x4}]}) ioctl$KVM_CAP_HYPERV_ENFORCE_CPUID(r2, 0x4068aea3, &(0x7f0000000440)) socket(0x15, 0x5, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f00000001c0)={0x2, 0x0, @rand_addr=0x64010102}, 0x10) recvmmsg(0xffffffffffffffff, &(0x7f0000000280)=[{{0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x40}], 0x1, 0x60010000, 0x0) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000340)={0x2, 0x0, @loopback}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080), 0x488982, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syslog(0x3, &(0x7f0000000000)=""/112, 0x70) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x15, 0xffffffffffffffff, 0xa58ab000) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff, 0x2c, 0x0, @val=@kprobe_multi=@syms={0x0, 0x0, 0x0}}, 0x40) timer_create(0x6, &(0x7f0000000240)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) r5 = openat$sndseq(0xffffff9c, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r5, 0xc0a45320, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r4, 0x1, 0x0, 0x0) r6 = syz_open_dev$cec(&(0x7f0000000000), 0xffffffffffffffff, 0x761081) ioctl$CEC_DQEVENT(r6, 0xc0506107, 0x0) ioctl$XFS_IOC_COMMIT_RANGE(r3, 0x40585883, &(0x7f0000000100)={r2, 0x0, 0xfffffffffffffff0, 0x9, 0x7, 0x8, [0x5, 0x5, 0x6051, 0x2, 0x7, 0x5]}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) bpf$MAP_DELETE_BATCH(0x1b, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x2d2}, 0x38) 43.698527033s ago: executing program 0 (id=186): bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000600)={0x1, 0x0}, 0x8) r1 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000640)=r0, 0x4) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000), &(0x7f0000000040)=0x4) add_key$user(&(0x7f0000000080), &(0x7f00000000c0), &(0x7f0000000100), 0xc9, 0xfffffffffffffffd) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./mnt\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./proc\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0) mount(&(0x7f0000000240), &(0x7f0000000280)='./mnt\x00', &(0x7f00000002c0)='ecryptfs\x00', 0x0, &(0x7f0000000300)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000680)={r1}, 0x8) read(r2, &(0x7f00000006c0)=""/185, 0xb9) 43.596468833s ago: executing program 0 (id=187): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0xb, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYRES32, @ANYBLOB="0100"/18, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/24], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1b, 0xc, &(0x7f0000000900)=@framed={{0x18, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x0, 0xffffffff}, [@ringbuf_output={{0x18, 0x5, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x80000000}, {0x3, 0x3, 0x3, 0xa, 0x5}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x1e}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, &(0x7f0000000100)={0x0, 'erspan0\x00', {0x1}, 0x26}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./file2\x00', 0x86) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0xa, &(0x7f0000000080)=ANY=[], &(0x7f0000000040)='syzkaller\x00', 0x2, 0x0, 0x0, 0x41100, 0xc}, 0x94) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(r4, &(0x7f00000007c0)={&(0x7f0000000400), 0xc, &(0x7f0000000780)={&(0x7f00000006c0)={0xb8, 0x0, 0x8, 0x70bd2a, 0x25dfdbfc, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0x400}, {0x6, 0x11, 0x5}}, {{@pci={{0x8}, {0x11}}, {0x8}}, {0x8, 0xb, 0xffff}, {0x6, 0x11, 0xd}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}, {0x8}, {0x6, 0x11, 0x1000}}]}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x40) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) symlink(0x0, &(0x7f0000000300)='./file0/file0\x00') r5 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) ioctl$COMEDI_DEVCONFIG(r5, 0x40946400, &(0x7f0000000600)={'c6xdigio\x00', [0x7c, 0x1f, 0x0, 0xc, 0x10, 0x4, 0x100002, 0x7, 0x5, 0x100, 0x4, 0x1, 0x1, 0x20003, 0x7ff, 0x8, 0x83, 0x8, 0x1010003, 0x0, 0x18, 0x0, 0x3, 0xffffffff, 0xb, 0xfffffff9, 0x38, 0xc, 0x10000006, 0x664, 0xfffffff8]}) ioctl$COMEDI_INSNLIST(r5, 0x8008640b, &(0x7f00000edb40)={0x1, &(0x7f00000ed9c0)=[{0xe000003, 0xf, &(0x7f00000016c0)=[0xe6, 0x3, 0x2, 0x7, 0x0, 0x2, 0xbd, 0x4, 0x1, 0xa3c, 0x8000, 0x4005, 0x3, 0x8001, 0xb7], 0xa145, 0x7}]}) 42.640950915s ago: executing program 0 (id=194): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f00000004c0), 0x802, 0x0) mq_open(&(0x7f0000000000)='\x00', 0xf4e08cbd1c690303, 0x0, &(0x7f0000000040)={0x8001, 0xc351, 0x5, 0x8}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x1d, 0x4, &(0x7f00000001c0)=ANY=[@ANYBLOB="1802000002000000000000001100000085000000ae00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x27}, 0x94) fsopen(&(0x7f0000000240)='tracefs\x00', 0x1) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x28100, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_NMI(r3, 0xae9a) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000340)={[0x0, 0x100000000, 0x0, 0x7e, 0x100000, 0x0, 0x2004c8, 0x8000000, 0x0, 0x1, 0x7, 0x0, 0x5, 0xa, 0x2, 0xffffffffffffffff], 0x0, 0x200}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) mount$9p_virtio(&(0x7f0000000400), &(0x7f0000000440)='./file0\x00', &(0x7f0000000480), 0x0, 0x0) symlink(&(0x7f0000000780)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/../file0\x00', &(0x7f00000008c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') chdir(&(0x7f0000000500)='./file0\x00') r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r4, &(0x7f0000000580)=ANY=[], 0x3261e) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r4, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r4, 0xc018937b, &(0x7f0000000b40)={{0x1, 0x1, 0x18, r0, {0xee01, 0xffffffffffffffff}}, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/../file0\x00'}) lstat(&(0x7f0000000c80)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000d80)={0x0, 0x0, 0x0, 0x0, 0x0}) getresuid(&(0x7f0000000e00), &(0x7f0000000e40)=0x0, &(0x7f0000000e80)) mount$nfs4(&(0x7f0000000580)='/dev/bsg/2:0:0:0\x00', &(0x7f00000005c0)='./file0\x00', &(0x7f0000000600), 0x1241008, &(0x7f0000000ec0)={[{'$%L,'}, {}, {'}'}, {}, {'.]-\\['}], [{@fsmagic={'fsmagic', 0x3d, 0x4}}, {@pcr={'pcr', 0x3d, 0x14}}, {@appraise_type}, {@uid_eq={'uid', 0x3d, r5}}, {@uid_lt={'uid<', r6}}, {@fowner_gt={'fowner>', r7}}, {@subj_role}, {@audit}, {@subj_role={'subj_role', 0x3d, '/dev/uhid\x00'}}, {@mask={'mask', 0x3d, 'MAY_WRITE'}}]}) ioctl$int_in(r4, 0x5421, 0x0) openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) epoll_pwait2(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000640)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x14, 0x3, 0x1b1c, 0xc10, 0x0, 0x0, "05010900a101150026ff007508951009008102c0"}}, 0x12c) ioctl$SG_GET_KEEP_ORPHAN(0xffffffffffffffff, 0x2288, &(0x7f00000000c0)) write$UHID_INPUT2(r0, &(0x7f0000000a80)=ANY=[@ANYBLOB="0c0000001300d4977745264d5d6353421a79461b7d957d37ecb40e0f143aa952244c1d4a1c605a01d0a57fe9ab13b1b31927366301f2dd9b558ef764d1f72fe0ea6db6edd098b2d6584fd53809ba62c1c67402629584eaf0fe6f5b87d3539470453609360854069ef282902851955560c3be20f3f759c9acefb567b1e44c9ed3deb510ecb0bc"], 0x19) 41.436876866s ago: executing program 0 (id=198): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000001ac0)={0x0, 0xf5ff, &(0x7f0000001b00)={&(0x7f0000001b40)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a14000000020a09000000000000006cb70000000014000000110001000300"/59], 0x3c}}, 0x0) 40.86761403s ago: executing program 0 (id=204): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file1\x00', 0x0, 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB, @ANYBLOB, @ANYRESDEC=0x0, @ANYRESDEC=0x0]) close(r0) r1 = syz_open_dev$vim2m(0x0, 0x7, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r1, 0xc0cc5605, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000b00)=ANY=[@ANYBLOB="380000004800010029bd7000ffdbdf250a008000", @ANYRES32=0x0, @ANYBLOB="f9ffffff08000200ffffffff140001000000000000000001acce57869d24c913673246f71c6ba0598591f1ccaee0c60bc7ccedea50acb8e2dd0cee131964daa2a2b362b3273b3b25a99482b0a940420d8927f358a4fd02855284935e56424ae9230b191bc4c5b8f586ad1f561a6f3f72462754ed23b2b0662877"], 0x38}}, 0x0) add_key$fscrypt_v1(&(0x7f0000000000), &(0x7f0000000040)={'fscrypt:', @desc4}, &(0x7f0000000100)={0x0, "de442bfc7910e10ac69ac014b0fa7807b11d2c99ed1f40d47a6edb3367b5cc888e1fd5102ae2d3d05f251f8d49025ceab4152b6e6d87cd6088e97a9d06d29143"}, 0x48, 0xffffffffffffffff) syz_open_dev$tty1(0xc, 0x4, 0x1) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_io_uring_setup(0x36b8, &(0x7f0000000540)={0x0, 0xe27d, 0xc00, 0x5, 0x92}, &(0x7f0000000100), &(0x7f0000000340), 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000005c0)=@newqdisc={0x34, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x12}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x4}}]}, 0x34}}, 0x0) r6 = syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$TCSETAW(r6, 0x5407, &(0x7f0000000400)={0x0, 0xf, 0xb, 0x1000, 0x3, "5acf05007c9b74df"}) write$UHID_INPUT(r6, &(0x7f0000000bc0)={0x9, {"a2e3ad21ed0d09f90e3d090987f70e06d038e7ff7fc6e5539b0d5b0e8b099b3f36006c090890e0878f0e1ac6e7f89b334d959b3a9a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31070d074a0936cd3b78130daa61d8e8040000005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0a6193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000400000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617679314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec230911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918c91243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac5a4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4b333bd5bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3be3b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ce0700c7e658828163e2d25c4aa348561f927eff7f3aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f05004b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d486046b2c0e2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee6157eb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de225727aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d78749a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29c60acebdbe8ddbd75c2f998d8a57f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95ff80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8870b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513007000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae8489d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60299473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d946a2daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810300000000000000a12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf000000800000000007b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae0e797e8bd1f4108b7807fb36207685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ad50dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b9048017848416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1db44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b00f1000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de9c0587c2cb5fe36d7d3e5db21b013b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cf4b23329072e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06810002000000000000957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f3e90d5943dbc10360a1a49700d1dfbf66d69f6fbafe1e83cdde8bb0d872a02238926407a4eddd5d0fc5a752f900000000000000100", 0x35e}}, 0x1006) syz_genetlink_get_family_id$team(0x0, r4) setsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(0xffffffffffffffff, 0x84, 0x8, &(0x7f0000000780)=0xfffffff8, 0x4) syz_ublk_setup_queues(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0) getpgrp(0x0) syz_open_procfs(0x0, &(0x7f0000000240)='mounts\x00') 40.786325597s ago: executing program 34 (id=204): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file1\x00', 0x0, 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB, @ANYBLOB, @ANYRESDEC=0x0, @ANYRESDEC=0x0]) close(r0) r1 = syz_open_dev$vim2m(0x0, 0x7, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r1, 0xc0cc5605, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000b00)=ANY=[@ANYBLOB="380000004800010029bd7000ffdbdf250a008000", @ANYRES32=0x0, @ANYBLOB="f9ffffff08000200ffffffff140001000000000000000001acce57869d24c913673246f71c6ba0598591f1ccaee0c60bc7ccedea50acb8e2dd0cee131964daa2a2b362b3273b3b25a99482b0a940420d8927f358a4fd02855284935e56424ae9230b191bc4c5b8f586ad1f561a6f3f72462754ed23b2b0662877"], 0x38}}, 0x0) add_key$fscrypt_v1(&(0x7f0000000000), &(0x7f0000000040)={'fscrypt:', @desc4}, &(0x7f0000000100)={0x0, "de442bfc7910e10ac69ac014b0fa7807b11d2c99ed1f40d47a6edb3367b5cc888e1fd5102ae2d3d05f251f8d49025ceab4152b6e6d87cd6088e97a9d06d29143"}, 0x48, 0xffffffffffffffff) syz_open_dev$tty1(0xc, 0x4, 0x1) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_io_uring_setup(0x36b8, &(0x7f0000000540)={0x0, 0xe27d, 0xc00, 0x5, 0x92}, &(0x7f0000000100), &(0x7f0000000340), 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000005c0)=@newqdisc={0x34, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x12}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x4}}]}, 0x34}}, 0x0) r6 = syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$TCSETAW(r6, 0x5407, &(0x7f0000000400)={0x0, 0xf, 0xb, 0x1000, 0x3, "5acf05007c9b74df"}) write$UHID_INPUT(r6, &(0x7f0000000bc0)={0x9, {"a2e3ad21ed0d09f90e3d090987f70e06d038e7ff7fc6e5539b0d5b0e8b099b3f36006c090890e0878f0e1ac6e7f89b334d959b3a9a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31070d074a0936cd3b78130daa61d8e8040000005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0a6193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000400000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617679314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec230911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918c91243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac5a4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4b333bd5bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3be3b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ce0700c7e658828163e2d25c4aa348561f927eff7f3aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f05004b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d486046b2c0e2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee6157eb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de225727aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d78749a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29c60acebdbe8ddbd75c2f998d8a57f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95ff80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8870b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513007000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae8489d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60299473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d946a2daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810300000000000000a12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf000000800000000007b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae0e797e8bd1f4108b7807fb36207685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ad50dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b9048017848416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1db44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b00f1000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de9c0587c2cb5fe36d7d3e5db21b013b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cf4b23329072e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06810002000000000000957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f3e90d5943dbc10360a1a49700d1dfbf66d69f6fbafe1e83cdde8bb0d872a02238926407a4eddd5d0fc5a752f900000000000000100", 0x35e}}, 0x1006) syz_genetlink_get_family_id$team(0x0, r4) setsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(0xffffffffffffffff, 0x84, 0x8, &(0x7f0000000780)=0xfffffff8, 0x4) syz_ublk_setup_queues(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0) getpgrp(0x0) syz_open_procfs(0x0, &(0x7f0000000240)='mounts\x00') 35.942462225s ago: executing program 5 (id=231): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller1\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=@newtfilter={0x80, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0xb, 0x7}, {0xfff1, 0xffff}, {0x300}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4c, 0x2, [@TCA_MATCHALL_ACT={0x48, 0x2, [@m_ct={0x44, 0x1, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x0, 0x0, 0x6}}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x80}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000380)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f00000024c0)=ANY=[@ANYBLOB="00000800000003000078ac1414bbffffffff1200"], 0x2a) 35.784495678s ago: executing program 5 (id=234): r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x80000000, 0x7]}, 0x8, 0x80800) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000180), 0x4000000004882, 0x0) io_setup(0x1, &(0x7f00000001c0)=0x0) io_submit(r2, 0xf3, &(0x7f0000000200)=[&(0x7f0000000240)={0x3a0012fb, 0x2759, 0x1f, 0x1, 0x0, r1, &(0x7f0000000280)="98", 0x3e8000072a, 0x1000000, 0x0, 0x10}]) socket$packet(0x11, 0x3, 0x300) ioctl$SOUND_MIXER_READ_RECSRC(r0, 0x80044dff, &(0x7f0000000080)) openat$vimc0(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000300)='./sys\x00', &(0x7f0000000340)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/class/graphics/fbcon/rotate_all\x00', 0x1, 0x0) write(r3, &(0x7f00000003c0)="321f07b6", 0x4) syz_emit_ethernet(0x29, &(0x7f0000000040)={@local, @remote, @void, {@x25={0x805, {0x2, 0x5, 0x1, "45543c55395a821d2380e9f196d3ddf026f048381e25ebfb"}}}}, 0x0) 35.425685152s ago: executing program 5 (id=238): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0xf, 0x8031, r0, 0x4000) r1 = syz_open_dev$hidraw(&(0x7f00000004c0), 0x0, 0x14a042) sendfile(r1, r0, 0x0, 0x10) r2 = socket$pppl2tp(0x18, 0x1, 0x1) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='loginuid\x00') exit(0x3) r3 = syz_open_procfs(0x0, &(0x7f0000000040)='net/netfilter\x00') preadv(r3, &(0x7f0000000400)=[{&(0x7f0000000500)=""/205, 0xcd}], 0x1, 0x5c, 0x25c) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, 0x0, 0x0) connect$pppl2tp(r2, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000640), 0xffffffffffffffff) r5 = dup3(r1, r2, 0x80000) symlinkat(&(0x7f0000000440)='.\x00', 0xffffffffffffff9c, &(0x7f0000000480)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./file1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000680)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000006c0)='./bus\x00', &(0x7f0000000700), 0x0, &(0x7f0000000740)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f0000000780)='./bus\x00') mkdirat(0xffffffffffffff9c, &(0x7f00000007c0)='./file7\x00', 0x1ac) renameat2(0xffffffffffffff9c, &(0x7f0000000800)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000840)='./file7/file0\x00', 0x0) symlinkat(&(0x7f0000000880)='.\x00', 0xffffffffffffff9c, &(0x7f00000008c0)='./file0\x00') renameat2(0xffffffffffffff9c, &(0x7f0000000900)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000940)='./file7/file0\x00', 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000980)='./file7/file0\x00', 0x101000, 0x0) read$msr(r5, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000140)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000380)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="01002ebd7000fedbdf251200000008000300", @ANYRES32=r8, @ANYBLOB="0c0099000000000021000000000a0000000600be000000000006001000a6000000"], 0x40}, 0x1, 0x0, 0x0, 0x20008084}, 0x0) 34.483819712s ago: executing program 5 (id=247): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f00000004c0), 0x802, 0x0) mq_open(&(0x7f0000000000)='\x00', 0xf4e08cbd1c690303, 0x0, &(0x7f0000000040)={0x8001, 0xc351, 0x5, 0x8}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x1d, 0x4, &(0x7f00000001c0)=ANY=[@ANYBLOB="1802000002000000000000001100000085000000ae00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x27}, 0x94) fsopen(&(0x7f0000000240)='tracefs\x00', 0x1) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x28100, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_NMI(r3, 0xae9a) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000340)={[0x0, 0x100000000, 0x0, 0x7e, 0x100000, 0x0, 0x2004c8, 0x8000000, 0x0, 0x1, 0x7, 0x0, 0x5, 0xa, 0x2, 0xffffffffffffffff], 0x0, 0x200}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) mount$9p_virtio(&(0x7f0000000400), &(0x7f0000000440)='./file0\x00', &(0x7f0000000480), 0x0, 0x0) symlink(&(0x7f0000000780)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/../file0\x00', &(0x7f00000008c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') chdir(&(0x7f0000000500)='./file0\x00') r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r4, &(0x7f0000000580)=ANY=[], 0x3261e) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r4, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r4, 0xc018937b, &(0x7f0000000b40)={{0x1, 0x1, 0x18, r0, {0xee01, 0xffffffffffffffff}}, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/../file0\x00'}) lstat(&(0x7f0000000c80)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000d80)={0x0, 0x0, 0x0, 0x0, 0x0}) getresuid(&(0x7f0000000e00), &(0x7f0000000e40)=0x0, &(0x7f0000000e80)) mount$nfs4(&(0x7f0000000580)='/dev/bsg/2:0:0:0\x00', &(0x7f00000005c0)='./file0\x00', &(0x7f0000000600), 0x1241008, &(0x7f0000000ec0)={[{'$%L,'}, {}, {'}'}, {}, {'.]-\\['}], [{@fsmagic={'fsmagic', 0x3d, 0x4}}, {@pcr={'pcr', 0x3d, 0x14}}, {@appraise_type}, {@uid_eq={'uid', 0x3d, r5}}, {@uid_lt={'uid<', r6}}, {@fowner_gt={'fowner>', r7}}, {@subj_role}, {@audit}, {@subj_role={'subj_role', 0x3d, '/dev/uhid\x00'}}, {@mask={'mask', 0x3d, 'MAY_WRITE'}}]}) ioctl$int_in(r4, 0x5421, 0x0) openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) epoll_pwait2(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r8 = openat$bsg(0xffffff9c, &(0x7f0000000080)='/dev/bsg/2:0:0:0\x00', 0x44002, 0x0) ioctl$SG_GET_KEEP_ORPHAN(r8, 0x2288, &(0x7f00000000c0)) write$UHID_INPUT2(r0, &(0x7f0000000a80)=ANY=[@ANYBLOB="0c0000001300d4977745264d5d6353421a79461b7d957d37ecb40e0f143aa952244c1d4a1c605a01d0a57fe9ab13b1b31927366301f2dd9b558ef764d1f72fe0ea6db6edd098b2d6584fd53809ba62c1c67402629584eaf0fe6f5b87d3539470453609360854069ef282902851955560c3be20f3f759c9acefb567b1e44c9ed3deb510ecb0bc"], 0x19) 33.48722773s ago: executing program 5 (id=254): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0xb, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) syz_emit_ethernet(0x0, 0x0, 0x0) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYRES32, @ANYBLOB="0100"/18, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/24], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1b, 0xc, &(0x7f0000000900)=@framed={{0x18, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x0, 0xffffffff}, [@ringbuf_output={{0x18, 0x5, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x80000000}, {0x3, 0x3, 0x3, 0xa, 0x5}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x1e}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, &(0x7f0000000100)={0x0, 'erspan0\x00', {0x1}, 0x26}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./file2\x00', 0x86) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0xa, &(0x7f0000000080)=ANY=[], &(0x7f0000000040)='syzkaller\x00', 0x2, 0x0, 0x0, 0x41100, 0xc}, 0x94) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(r4, &(0x7f00000007c0)={&(0x7f0000000400), 0xc, &(0x7f0000000780)={&(0x7f00000006c0)={0xb8, 0x0, 0x8, 0x70bd2a, 0x25dfdbfc, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0x400}, {0x6, 0x11, 0x5}}, {{@pci={{0x8}, {0x11}}, {0x8}}, {0x8, 0xb, 0xffff}, {0x6, 0x11, 0xd}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}, {0x8}, {0x6, 0x11, 0x1000}}]}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x40) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) symlink(0x0, &(0x7f0000000300)='./file0/file0\x00') r5 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) ioctl$COMEDI_DEVCONFIG(r5, 0x40946400, &(0x7f0000000600)={'c6xdigio\x00', [0x7c, 0x1f, 0x0, 0xc, 0x10, 0x4, 0x100002, 0x7, 0x5, 0x100, 0x4, 0x1, 0x1, 0x20003, 0x7ff, 0x8, 0x83, 0x8, 0x1010003, 0x0, 0x18, 0x0, 0x3, 0xffffffff, 0xb, 0xfffffff9, 0x38, 0xc, 0x10000006, 0x664, 0xfffffff8]}) ioctl$COMEDI_INSNLIST(r5, 0x8008640b, &(0x7f00000edb40)={0x1, &(0x7f00000ed9c0)=[{0xe000003, 0xf, &(0x7f00000016c0)=[0xe6, 0x3, 0x2, 0x7, 0x0, 0x2, 0xbd, 0x4, 0x1, 0xa3c, 0x8000, 0x4005, 0x3, 0x8001, 0xb7], 0xa145, 0x7}]}) 33.135760715s ago: executing program 5 (id=256): r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000200), 0x8502, 0x0) write$sndseq(r0, &(0x7f0000000480)=[{0x6, 0x0, 0x0, 0x0, @time={0x0, 0x1}, {0x4}, {}, @note={0x6, 0x3, 0xaf, 0x1, 0xc}}, {0x0, 0x0, 0x0, 0x1, @tick=0x103, {}, {}, @raw32={[0x0, 0xfffffffd]}}, {0x0, 0xcf, 0x0, 0x0, @tick=0x1, {0x0, 0x1}, {0x6}, @raw8={"272be5806cd46d7b9ff797a0"}}, {0x0, 0xff, 0x20, 0x0, @tick=0x1000, {}, {}, @result={0xbac, 0x28}}], 0x70) r1 = gettid() syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) syz_usb_control_io$rtl8150(0xffffffffffffffff, &(0x7f0000000540)={0x14, 0x0, 0x0}, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) syz_usb_control_io$rtl8150(0xffffffffffffffff, &(0x7f00000001c0)={0xc, &(0x7f00000000c0)={0x20, 0x22, 0x4d, {0x4d, 0xc, "e7f0936ab00139f9c817a803c3f5649819100e3e2ae819266a73c086b96cc1d627719280063551c956ccac7e6e6afaf9e1c930f78e60044710d0aeeb4e90aac8d8c0535a93e6c96dbdd4e0"}}, &(0x7f0000000140)={0x0, 0x3, 0x10, @string={0xfffffffffffffeb5, 0x3, "00dd8719bb5f348c65512e6ae720"}}}, &(0x7f0000000440)={0x18, &(0x7f0000000240)={0x40, 0x17, 0x7e, "b8ee4987c80bfc117e2e8dbb1508184c8ec4a85575de2562068ded06d766c000064ccd8426eff0cfd50ab664919073309835bdf86bee040796f8ccfd572850edc9e1ed73d28d8a568eb0e943b5dd6947ebc590377aabf4f44624e39e10323a3074f3e35462a49fed638593b2a40899b68ddf64778654a632d2d1debde382"}, &(0x7f0000000300)={0x0, 0xa, 0x1, 0x2}, &(0x7f0000000380)={0x0, 0x8, 0x1, 0xb6}, &(0x7f0000000180)={0xc0, 0x5, 0x6, "81990500eb00"}, &(0x7f0000000400)={0x40, 0x5, 0x6, "ccd2638a9ad7"}}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000640), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r2, &(0x7f0000000680)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000700)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010025bd7000fcdbdf2503000000180001801400020073797a5f74756e00000000000000000005000200030000000500050003000000050003"], 0x44}, 0x1, 0x0, 0x0, 0x20009085}, 0x40040c4) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) socket$kcm(0x2, 0xa, 0x2) setrlimit(0x0, &(0x7f0000000500)={0xf5, 0xffffffff}) write$tun(r4, &(0x7f0000005d40)=ANY=[@ANYBLOB="000086dd00000100000000000000600000001b012c00fe8000000000000000000000000000aaff0200000000"], 0x1b37) r5 = openat$comedi(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/comedi3\x00', 0x0, 0x0) ioctl$COMEDI_DEVCONFIG(r5, 0x40946400, 0x0) ioctl$COMEDI_DEVCONFIG(r5, 0x40946400, &(0x7f0000000580)={'rti802\x00', [0x100, 0x2, 0x2, 0x10, 0x0, 0x5, 0x0, 0x1ff, 0x80008, 0x0, 0x7, 0x1, 0x7, 0x2, 0x0, 0xfffffffd, 0xfffffffe, 0x7, 0x8, 0x80000003, 0x489, 0x4, 0xfffffffd, 0x20001e58, 0xffffffff, 0xf39e, 0x3, 0x8, 0x6, 0x2, 0xfffffff4]}) socket$packet(0x11, 0x3, 0x300) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r6, 0x84, 0x6b, &(0x7f0000000340)=[@in6={0xa, 0x4e24, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x3}], 0x1c) recvmsg(r6, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x2) setsockopt(r6, 0x84, 0x7f, &(0x7f0000000040)="020000000980ffff", 0x8) 32.906904922s ago: executing program 35 (id=256): r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000200), 0x8502, 0x0) write$sndseq(r0, &(0x7f0000000480)=[{0x6, 0x0, 0x0, 0x0, @time={0x0, 0x1}, {0x4}, {}, @note={0x6, 0x3, 0xaf, 0x1, 0xc}}, {0x0, 0x0, 0x0, 0x1, @tick=0x103, {}, {}, @raw32={[0x0, 0xfffffffd]}}, {0x0, 0xcf, 0x0, 0x0, @tick=0x1, {0x0, 0x1}, {0x6}, @raw8={"272be5806cd46d7b9ff797a0"}}, {0x0, 0xff, 0x20, 0x0, @tick=0x1000, {}, {}, @result={0xbac, 0x28}}], 0x70) r1 = gettid() syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) syz_usb_control_io$rtl8150(0xffffffffffffffff, &(0x7f0000000540)={0x14, 0x0, 0x0}, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) syz_usb_control_io$rtl8150(0xffffffffffffffff, &(0x7f00000001c0)={0xc, &(0x7f00000000c0)={0x20, 0x22, 0x4d, {0x4d, 0xc, "e7f0936ab00139f9c817a803c3f5649819100e3e2ae819266a73c086b96cc1d627719280063551c956ccac7e6e6afaf9e1c930f78e60044710d0aeeb4e90aac8d8c0535a93e6c96dbdd4e0"}}, &(0x7f0000000140)={0x0, 0x3, 0x10, @string={0xfffffffffffffeb5, 0x3, "00dd8719bb5f348c65512e6ae720"}}}, &(0x7f0000000440)={0x18, &(0x7f0000000240)={0x40, 0x17, 0x7e, "b8ee4987c80bfc117e2e8dbb1508184c8ec4a85575de2562068ded06d766c000064ccd8426eff0cfd50ab664919073309835bdf86bee040796f8ccfd572850edc9e1ed73d28d8a568eb0e943b5dd6947ebc590377aabf4f44624e39e10323a3074f3e35462a49fed638593b2a40899b68ddf64778654a632d2d1debde382"}, &(0x7f0000000300)={0x0, 0xa, 0x1, 0x2}, &(0x7f0000000380)={0x0, 0x8, 0x1, 0xb6}, &(0x7f0000000180)={0xc0, 0x5, 0x6, "81990500eb00"}, &(0x7f0000000400)={0x40, 0x5, 0x6, "ccd2638a9ad7"}}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000640), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r2, &(0x7f0000000680)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000700)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010025bd7000fcdbdf2503000000180001801400020073797a5f74756e00000000000000000005000200030000000500050003000000050003"], 0x44}, 0x1, 0x0, 0x0, 0x20009085}, 0x40040c4) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) socket$kcm(0x2, 0xa, 0x2) setrlimit(0x0, &(0x7f0000000500)={0xf5, 0xffffffff}) write$tun(r4, &(0x7f0000005d40)=ANY=[@ANYBLOB="000086dd00000100000000000000600000001b012c00fe8000000000000000000000000000aaff0200000000"], 0x1b37) r5 = openat$comedi(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/comedi3\x00', 0x0, 0x0) ioctl$COMEDI_DEVCONFIG(r5, 0x40946400, 0x0) ioctl$COMEDI_DEVCONFIG(r5, 0x40946400, &(0x7f0000000580)={'rti802\x00', [0x100, 0x2, 0x2, 0x10, 0x0, 0x5, 0x0, 0x1ff, 0x80008, 0x0, 0x7, 0x1, 0x7, 0x2, 0x0, 0xfffffffd, 0xfffffffe, 0x7, 0x8, 0x80000003, 0x489, 0x4, 0xfffffffd, 0x20001e58, 0xffffffff, 0xf39e, 0x3, 0x8, 0x6, 0x2, 0xfffffff4]}) socket$packet(0x11, 0x3, 0x300) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r6, 0x84, 0x6b, &(0x7f0000000340)=[@in6={0xa, 0x4e24, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x3}], 0x1c) recvmsg(r6, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x2) setsockopt(r6, 0x84, 0x7f, &(0x7f0000000040)="020000000980ffff", 0x8) 30.646293875s ago: executing program 1 (id=273): r0 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) r1 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=@gettfilter={0x23, 0x2e, 0x205, 0x70bd2c, 0x25dfdafd, {0x0, 0x0, 0x0, 0x0, {0xc, 0xffe8}, {0xf, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x200008c1}, 0x4041080) pipe2(&(0x7f0000000300)={0x0, 0x0}, 0x0) r3 = socket$kcm(0xf, 0x3, 0x2) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)=@allocspi={0xf8, 0x16, 0x1, 0x70bd2b, 0x25dfdbfd, {{{@in=@initdev={0xac, 0x1e, 0x1, 0x0}, @in6=@mcast1, 0x4e23, 0x200, 0x4e20, 0x0, 0xcae7388a885de62c, 0xe0, 0x20, 0x3b}, {@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4d3, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x21}}, {0x9, 0x100000001, 0x6, 0x2, 0x1, 0x7, 0xc0d, 0x9}, {0xffffffff7fffffff, 0x0, 0x8000000000000, 0x2}, {0x7, 0x2000000, 0x488}, 0x70bd26, 0x3505, 0x2, 0x86fa708a8da4f410, 0x6, 0x82}, 0x0, 0xe}}, 0xf8}, 0x1, 0x0, 0x0, 0x4}, 0x4040888) sendmsg$inet(r3, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000540)="020b070102000000e4a17c455b3a89e0", 0x10}], 0x1}, 0x0) r5 = socket$kcm(0xf, 0x3, 0x2) sendmsg$inet(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000600)="020b0700fc670000e4a17c45c8d260c9", 0x33fe0}], 0x1}, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x3, 0x21, &(0x7f0000000700)=ANY=[@ANYBLOB="620af0ff7f000001620af4ff7f000001620af8ff30394e20bfa200000000000007020000f0ffffffb70300000c000000b7040000ffffffffb70500000000000085000000630000001500150000000000bf06000000000000620ad8ff45002800620adcff00000000620ae0ff40060000620ae4ff7f000001620ae8ff7f000001620ac0ff30394e20620ac4ff01000000620ac8ff00000000620accff50020010620ad0ff00000000bf61000000000000bfa200000000000007020000d8ffffffb703000014000000bfa400000000000007040000c0ffffffb705000014000000850000006e000000bf610000000000008500000056000000b7000000000000009500000000000000"], &(0x7f0000000840)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x5a}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000880)={r6, 0x0, 0x22, 0x0, &(0x7f0000000900)="00000000000000000000000008004500002800000000400600007f0000017f000001", 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) sendmsg$inet(r3, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f00000009c0)="020a030002000000e4a17c45c8d260c9", 0x10}], 0x1}, 0x0) r7 = socket$kcm(0xf, 0x3, 0x2) sendmsg$inet(r7, &(0x7f0000000a00)={0x0, 0x0, &(0x7f0000000a40)=[{&(0x7f0000000a80)="020a030002000000e4a17c45c8d260c9", 0x10}], 0x1}, 0x0) close_range(r2, 0xffffffffffffffff, 0x0) write(r0, &(0x7f0000000ac0)='transport=fc,traddr=nn-0x3333333333333333:pn-0x4444444444444444,host_traddr=nn-0x1111111111111111:pn-0x2222222222222222,nqn=nqn.2014-08.org.nvmexpress.discovery,reconnect_delay=1', 0xb2) syz_create_resource$futex(&(0x7f0000000000)=0x2) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000080), r9) sendmsg$IEEE802154_LLSEC_DEL_KEY(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)={0x38, r10, 0x1, 0x70bd26, 0x25dfdbfd, {}, [@IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x2}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x101}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x81}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x38}, 0x1, 0x0, 0x0, 0x40}, 0x24040000) r11 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000180), 0x483, 0x0) ioctl$RTC_UIE_ON(r11, 0x7003) ioctl$RTC_SET_TIME(r11, 0x4024700a, &(0x7f00000001c0)={0x24, 0x36, 0x6, 0x13, 0xa, 0x1000ff, 0x2, 0x3d}) r12 = syz_create_resource$futex(&(0x7f0000000040)=0x2) prctl$PR_CAP_AMBIENT(0x2f, 0x4, 0x0) futex(r12, 0x8c, 0x1, 0x0, 0x0, 0x0) futex(r12, 0xa, 0x1, 0x0, r12, 0x2) 29.219627751s ago: executing program 1 (id=275): r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x80000000, 0x7]}, 0x8, 0x80800) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000180), 0x4000000004882, 0x0) io_setup(0x1, &(0x7f00000001c0)=0x0) io_submit(r2, 0xf3, &(0x7f0000000200)=[&(0x7f0000000240)={0x3a0012fb, 0x2759, 0x1f, 0x1, 0x0, r1, &(0x7f0000000280)="98", 0x3e8000072a, 0x1000000, 0x0, 0x10}]) socket$packet(0x11, 0x3, 0x300) ioctl$SOUND_MIXER_READ_RECSRC(r0, 0x80044dff, &(0x7f0000000080)) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000300)='./sys\x00', &(0x7f0000000340)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/class/graphics/fbcon/rotate_all\x00', 0x1, 0x0) write(r3, &(0x7f00000003c0)="321f07b6", 0x4) syz_emit_ethernet(0x29, &(0x7f0000000040)={@local, @remote, @void, {@x25={0x805, {0x2, 0x5, 0x1, "45543c55395a821d2380e9f196d3ddf026f048381e25ebfb"}}}}, 0x0) 28.595355274s ago: executing program 1 (id=278): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) syz_emit_ethernet(0x0, 0x0, 0x0) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYRES32, @ANYBLOB="0100"/18, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/24], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1b, 0xc, &(0x7f0000000900)=@framed={{0x18, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x0, 0xffffffff}, [@ringbuf_output={{0x18, 0x5, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x80000000}, {0x3, 0x3, 0x3, 0xa, 0x5}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x1e}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, &(0x7f0000000100)={0x0, 'erspan0\x00', {0x1}, 0x26}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./file2\x00', 0x86) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0xa, &(0x7f0000000080)=ANY=[], &(0x7f0000000040)='syzkaller\x00', 0x2, 0x0, 0x0, 0x41100, 0xc}, 0x94) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(r4, &(0x7f00000007c0)={&(0x7f0000000400), 0xc, &(0x7f0000000780)={&(0x7f00000006c0)={0xb8, 0x0, 0x8, 0x70bd2a, 0x25dfdbfc, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0x400}, {0x6, 0x11, 0x5}}, {{@pci={{0x8}, {0x11}}, {0x8}}, {0x8, 0xb, 0xffff}, {0x6, 0x11, 0xd}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}, {0x8}, {0x6, 0x11, 0x1000}}]}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x40) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) symlink(0x0, &(0x7f0000000300)='./file0/file0\x00') r5 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) ioctl$COMEDI_DEVCONFIG(r5, 0x40946400, &(0x7f0000000600)={'c6xdigio\x00', [0x7c, 0x1f, 0x0, 0xc, 0x10, 0x4, 0x100002, 0x7, 0x5, 0x100, 0x4, 0x1, 0x1, 0x20003, 0x7ff, 0x8, 0x83, 0x8, 0x1010003, 0x0, 0x18, 0x0, 0x3, 0xffffffff, 0xb, 0xfffffff9, 0x38, 0xc, 0x10000006, 0x664, 0xfffffff8]}) ioctl$COMEDI_INSNLIST(r5, 0x8008640b, &(0x7f00000edb40)={0x1, &(0x7f00000ed9c0)=[{0xe000003, 0xf, &(0x7f00000016c0)=[0xe6, 0x3, 0x2, 0x7, 0x0, 0x2, 0xbd, 0x4, 0x1, 0xa3c, 0x8000, 0x4005, 0x3, 0x8001, 0xb7], 0xa145, 0x7}]}) 27.665994106s ago: executing program 1 (id=281): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f00000004c0), 0x802, 0x0) mq_open(&(0x7f0000000000)='\x00', 0xf4e08cbd1c690303, 0x0, &(0x7f0000000040)={0x8001, 0xc351, 0x5, 0x8}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x1d, 0x4, &(0x7f00000001c0)=ANY=[@ANYBLOB="1802000002000000000000001100000085000000ae00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x27}, 0x94) fsopen(&(0x7f0000000240)='tracefs\x00', 0x1) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x28100, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_NMI(r3, 0xae9a) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000340)={[0x0, 0x100000000, 0x0, 0x7e, 0x100000, 0x0, 0x2004c8, 0x8000000, 0x0, 0x1, 0x7, 0x0, 0x5, 0xa, 0x2, 0xffffffffffffffff], 0x0, 0x200}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) mount$9p_virtio(&(0x7f0000000400), &(0x7f0000000440)='./file0\x00', &(0x7f0000000480), 0x0, 0x0) symlink(&(0x7f0000000780)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/../file0\x00', &(0x7f00000008c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') chdir(&(0x7f0000000500)='./file0\x00') r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r4, &(0x7f0000000580)=ANY=[], 0x3261e) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r4, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r4, 0xc018937b, &(0x7f0000000b40)={{0x1, 0x1, 0x18, r0, {0xee01, 0xffffffffffffffff}}, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/../file0\x00'}) lstat(&(0x7f0000000c80)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000d80)={0x0, 0x0, 0x0, 0x0, 0x0}) getresuid(&(0x7f0000000e00), &(0x7f0000000e40)=0x0, &(0x7f0000000e80)) mount$nfs4(&(0x7f0000000580)='/dev/bsg/2:0:0:0\x00', &(0x7f00000005c0)='./file0\x00', &(0x7f0000000600), 0x1241008, &(0x7f0000000ec0)={[{'$%L,'}, {}, {'}'}, {}, {'.]-\\['}], [{@fsmagic={'fsmagic', 0x3d, 0x4}}, {@pcr={'pcr', 0x3d, 0x14}}, {@appraise_type}, {@uid_eq={'uid', 0x3d, r5}}, {@uid_lt={'uid<', r6}}, {@fowner_gt={'fowner>', r7}}, {@subj_role}, {@audit}, {@subj_role={'subj_role', 0x3d, '/dev/uhid\x00'}}, {@mask={'mask', 0x3d, 'MAY_WRITE'}}]}) ioctl$int_in(r4, 0x5421, 0x0) openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000640)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x14, 0x3, 0x1b1c, 0xc10, 0x0, 0x0, "05010900a101150026ff007508951009008102c0"}}, 0x12c) r8 = openat$bsg(0xffffff9c, &(0x7f0000000080)='/dev/bsg/2:0:0:0\x00', 0x44002, 0x0) ioctl$SG_GET_KEEP_ORPHAN(r8, 0x2288, &(0x7f00000000c0)) write$UHID_INPUT2(r0, &(0x7f0000000a80)=ANY=[@ANYBLOB="0c0000001300d4977745264d5d6353421a79461b7d957d37ecb40e0f143aa952244c1d4a1c605a01d0a57fe9ab13b1b31927366301f2dd9b558ef764d1f72fe0ea6db6edd098b2d6584fd53809ba62c1c67402629584eaf0fe6f5b87d3539470453609360854069ef282902851955560c3be20f3f759c9acefb567b1e44c9ed3deb510ecb0bc"], 0x19) 25.801241194s ago: executing program 1 (id=289): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) syz_emit_ethernet(0x0, 0x0, 0x0) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYRES32, @ANYBLOB="0100"/18, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/24], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1b, 0xc, &(0x7f0000000900)=@framed={{0x18, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x0, 0xffffffff}, [@ringbuf_output={{0x18, 0x5, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x80000000}, {0x3, 0x3, 0x3, 0xa, 0x5}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x1e}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, &(0x7f0000000100)={0x0, 'erspan0\x00', {0x1}, 0x26}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./file2\x00', 0x86) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0xa, &(0x7f0000000080)=ANY=[], &(0x7f0000000040)='syzkaller\x00', 0x2, 0x0, 0x0, 0x41100, 0xc}, 0x94) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(r4, &(0x7f00000007c0)={&(0x7f0000000400), 0xc, &(0x7f0000000780)={&(0x7f00000006c0)={0xb8, 0x0, 0x8, 0x70bd2a, 0x25dfdbfc, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0x400}, {0x6, 0x11, 0x5}}, {{@pci={{0x8}, {0x11}}, {0x8}}, {0x8, 0xb, 0xffff}, {0x6, 0x11, 0xd}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}, {0x8}, {0x6, 0x11, 0x1000}}]}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x40) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) symlink(0x0, &(0x7f0000000300)='./file0/file0\x00') r5 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) ioctl$COMEDI_DEVCONFIG(r5, 0x40946400, &(0x7f0000000600)={'c6xdigio\x00', [0x7c, 0x1f, 0x0, 0xc, 0x10, 0x4, 0x100002, 0x7, 0x5, 0x100, 0x4, 0x1, 0x1, 0x20003, 0x7ff, 0x8, 0x83, 0x8, 0x1010003, 0x0, 0x18, 0x0, 0x3, 0xffffffff, 0xb, 0xfffffff9, 0x38, 0xc, 0x10000006, 0x664, 0xfffffff8]}) ioctl$COMEDI_INSNLIST(r5, 0x8008640b, &(0x7f00000edb40)={0x1, &(0x7f00000ed9c0)=[{0xe000003, 0xf, &(0x7f00000016c0)=[0xe6, 0x3, 0x2, 0x7, 0x0, 0x2, 0xbd, 0x4, 0x1, 0xa3c, 0x8000, 0x4005, 0x3, 0x8001, 0xb7], 0xa145, 0x7}]}) 25.322857228s ago: executing program 1 (id=299): close(0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4008001}, 0x80) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_open_dev$sndmidi(&(0x7f0000000000), 0x101, 0x204200) mknodat(0xffffffffffffff9c, 0x0, 0x81c0, 0x0) socket$inet6(0xa, 0x800000000000002, 0x0) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) r3 = socket$nl_generic(0x10, 0x3, 0x10) mkdir(&(0x7f00000000c0)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000300)='ocfs2\x00', 0x2, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r4 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) syz_open_dev$usbmon(&(0x7f0000000340), 0x0, 0x0) ppoll(&(0x7f00000003c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/devices/0000:00:1d.0/remove\x00', 0x1, 0x0) write(r5, &(0x7f0000000440)='1', 0x1) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r3) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES32=r1, @ANYBLOB="796100000000000000017e00000008000300", @ANYRES32=0x0, @ANYBLOB="0c009900fdffffff6b000000"], 0x28}, 0x1, 0x0, 0x0, 0x44001}, 0x4020000) syz_open_procfs(0x0, &(0x7f0000000080)='net/anycast6\x00') 25.278466753s ago: executing program 36 (id=299): close(0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4008001}, 0x80) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_open_dev$sndmidi(&(0x7f0000000000), 0x101, 0x204200) mknodat(0xffffffffffffff9c, 0x0, 0x81c0, 0x0) socket$inet6(0xa, 0x800000000000002, 0x0) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) r3 = socket$nl_generic(0x10, 0x3, 0x10) mkdir(&(0x7f00000000c0)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000300)='ocfs2\x00', 0x2, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r4 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) syz_open_dev$usbmon(&(0x7f0000000340), 0x0, 0x0) ppoll(&(0x7f00000003c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/devices/0000:00:1d.0/remove\x00', 0x1, 0x0) write(r5, &(0x7f0000000440)='1', 0x1) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r3) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES32=r1, @ANYBLOB="796100000000000000017e00000008000300", @ANYRES32=0x0, @ANYBLOB="0c009900fdffffff6b000000"], 0x28}, 0x1, 0x0, 0x0, 0x44001}, 0x4020000) syz_open_procfs(0x0, &(0x7f0000000080)='net/anycast6\x00') 24.551372561s ago: executing program 7 (id=309): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0xb, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) munmap(&(0x7f0000583000/0x4000)=nil, 0x4000) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000300), 0x1) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r3, 0xc08c5332, &(0x7f00000005c0)={0x1, 0x0, 0x0, 'queue1\x00'}) write$sndseq(r3, &(0x7f0000000680)=[{0x84, 0x77, 0x0, 0x0, @tick=0xfd, {}, {}, @raw32}], 0xffc8) 23.456641222s ago: executing program 7 (id=317): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f00000002c0)={0x6, @loopback, 0x15, 0x0, 'wlc\x00', 0x0, 0x0, 0x29}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="1e0000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x3, 0xc, &(0x7f0000000300)=ANY=[@ANYRES16=0x0, @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005700000095"], 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x20, 0xc, 0x0, &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r3, 0x1, 0x32, &(0x7f00000007c0)=r2, 0x4) sendmsg$inet(r4, &(0x7f0000000800)={0x0, 0x0, 0x0}, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f0000000580)={{0x6, @loopback, 0x15, 0x2, 'rr\x00', 0x0, 0x4, 0x10000}, {@multicast2, 0x15, 0x2000, 0x1, 0x0, 0x5}}, 0x44) syz_genetlink_get_family_id$nfc(&(0x7f0000000040), r0) r5 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000640), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r5, 0x40345410, &(0x7f0000000680)={{0x0, 0x3, 0x400}}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r5, 0x40505412, &(0x7f0000000740)={0x1, 0xfffffffb, 0x80, 0x0, 0x6}) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_xfrm(0x10, 0x3, 0x6) r6 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='blkio.throttle.io_service_bytes_recursive\x00', 0x26e1, 0x0) close(r6) socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0xfffffffffffffd97, 0x0}, 0x2400bf64) ioctl$SIOCSIFHWADDR(r6, 0x8b32, 0x0) setresuid(0x0, 0xee00, 0x0) r7 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) tkill(r7, 0x2) r8 = socket$inet_sctp(0x2, 0x1, 0x84) ioctl$DRM_IOCTL_MODE_GETPROPERTY(r6, 0xc04064aa, &(0x7f0000000c00)={&(0x7f00000000c0)=[0x0, 0x0, 0x0], &(0x7f0000000840)=[{}, {}, {}, {}, {}], 0x0, 0x0, '\x00', 0x3, 0x5}) ioctl$SNDRV_TIMER_IOCTL_START(0xffffffffffffffff, 0x54a0) setsockopt$inet_int(r8, 0x0, 0x24, 0xffffffffffffffff, 0x4e) ioctl$vim2m_VIDIOC_S_CTRL(0xffffffffffffffff, 0xc008561c, &(0x7f0000000500)={0xf0f080, 0x6}) 23.33703499s ago: executing program 7 (id=318): r0 = add_key$keyring(&(0x7f0000000180), &(0x7f00000001c0)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) (async, rerun: 32) r1 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000340), 0x151140, 0x0) (rerun: 32) ioctl$SW_SYNC_IOC_CREATE_FENCE(r1, 0xc0285700, &(0x7f0000000380)={0x1000, "340b7832ceefd131b8e6498c25f58fad9987ffe93bbabd18cf501922de974a27"}) ioctl$SW_SYNC_IOC_CREATE_FENCE(r1, 0xc0285700, &(0x7f00000003c0)={0x1000, "744975536099deee5c2b4d6ff5cbd4bed4d5c822a31867654eb8d2981804168b"}) (async, rerun: 32) pipe2(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4800) (async, rerun: 32) r3 = add_key$fscrypt_v1(&(0x7f0000000240), &(0x7f0000000400)={'fscrypt:', @desc1}, &(0x7f00000002c0)={0x0, "a1c5b2430b720a9817759457192f43a5bbc58c5eb814d980e72377f688a69bd771c0bbca7aa27466f82299a9291df1a73567a0c636ffde3f16a2defce0a3c644", 0x10}, 0x48, r0) keyctl$KEYCTL_WATCH_KEY(0x20, r3, r2, 0x20) (async) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r4, &(0x7f0000000000)={0x2, 0x1bd, @loopback}, 0x10) listen(r4, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./cifs\x00', 0x0) mount(&(0x7f0000000080)=@filename='\\\\127.0.0.1\\share\x00', &(0x7f00000000c0)='./cifs\x00', &(0x7f0000000100)='cifs\x00', 0x0, &(0x7f0000000140)='vers=1.0,user=root,pass=root\x00') (async) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f000002f9c0)={0x1, &(0x7f0000000280)=[{0x7, 0x81, 0x6, 0xb7c0000}]}) (async) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) (async) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000600), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) (async, rerun: 64) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) (async, rerun: 64) r8 = gettid() timer_create(0x2, &(0x7f0000000680)={0x0, 0x21, 0x800000000004, @tid=r8}, &(0x7f00000006c0)) (async) timer_settime(0x0, 0x0, &(0x7f0000000700)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) (async) clock_nanosleep(0x2, 0x0, &(0x7f0000000740)={0x0, 0x989680}, 0x0) (async) ioctl$KVM_RUN(r7, 0xae80, 0x0) (async) ioctl$KVM_RUN(r7, 0xae80, 0x0) syz_io_uring_setup(0xf44, 0x0, 0x0, 0x0, &(0x7f0000000780)=0x0) syz_io_uring_submit(0x0, 0x0, r9, &(0x7f00000007c0)=@IORING_OP_PIPE={0x3e, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, {0x0, 0x0, 0x3}}) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000e, 0x20c44fb6edc09a38, 0xffffffffffffffff, 0x0) (async) syz_open_procfs(0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000840)='./binderfs/binder0\x00', 0x0, 0x0) 22.235935209s ago: executing program 7 (id=320): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f00000004c0), 0x802, 0x0) mq_open(&(0x7f0000000000)='\x00', 0xf4e08cbd1c690303, 0x0, &(0x7f0000000040)={0x8001, 0xc351, 0x5, 0x8}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x1d, 0x4, &(0x7f00000001c0)=ANY=[@ANYBLOB="1802000002000000000000001100000085000000ae00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x27}, 0x94) fsopen(&(0x7f0000000240)='tracefs\x00', 0x1) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x28100, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_NMI(r3, 0xae9a) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000340)={[0x0, 0x100000000, 0x0, 0x7e, 0x100000, 0x0, 0x2004c8, 0x8000000, 0x0, 0x1, 0x7, 0x0, 0x5, 0xa, 0x2, 0xffffffffffffffff], 0x0, 0x200}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) mount$9p_virtio(&(0x7f0000000400), &(0x7f0000000440)='./file0\x00', &(0x7f0000000480), 0x0, 0x0) symlink(&(0x7f0000000780)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/../file0\x00', &(0x7f00000008c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') chdir(&(0x7f0000000500)='./file0\x00') r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r4, &(0x7f0000000580)=ANY=[], 0x3261e) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r4, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r4, 0xc018937b, &(0x7f0000000b40)={{0x1, 0x1, 0x18, r0, {0xee01, 0xffffffffffffffff}}, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/../file0\x00'}) lstat(&(0x7f0000000c80)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000d80)={0x0, 0x0, 0x0, 0x0, 0x0}) getresuid(&(0x7f0000000e00), &(0x7f0000000e40)=0x0, &(0x7f0000000e80)) mount$nfs4(&(0x7f0000000580)='/dev/bsg/2:0:0:0\x00', &(0x7f00000005c0)='./file0\x00', &(0x7f0000000600), 0x1241008, &(0x7f0000000ec0)={[{'$%L,'}, {}, {'}'}, {}, {'.]-\\['}], [{@fsmagic={'fsmagic', 0x3d, 0x4}}, {@pcr={'pcr', 0x3d, 0x14}}, {@appraise_type}, {@uid_eq={'uid', 0x3d, r5}}, {@uid_lt={'uid<', r6}}, {@fowner_gt={'fowner>', r7}}, {@subj_role}, {@audit}, {@subj_role={'subj_role', 0x3d, '/dev/uhid\x00'}}, {@mask={'mask', 0x3d, 'MAY_WRITE'}}]}) ioctl$int_in(r4, 0x5421, 0x0) epoll_pwait2(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000640)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x14, 0x3, 0x1b1c, 0xc10, 0x0, 0x0, "05010900a101150026ff007508951009008102c0"}}, 0x12c) r8 = openat$bsg(0xffffff9c, &(0x7f0000000080)='/dev/bsg/2:0:0:0\x00', 0x44002, 0x0) ioctl$SG_GET_KEEP_ORPHAN(r8, 0x2288, &(0x7f00000000c0)) write$UHID_INPUT2(r0, &(0x7f0000000a80)=ANY=[@ANYBLOB="0c0000001300d4977745264d5d6353421a79461b7d957d37ecb40e0f143aa952244c1d4a1c605a01d0a57fe9ab13b1b31927366301f2dd9b558ef764d1f72fe0ea6db6edd098b2d6584fd53809ba62c1c67402629584eaf0fe6f5b87d3539470453609360854069ef282902851955560c3be20f3f759c9acefb567b1e44c9ed3deb510ecb0bc"], 0x19) 21.299741002s ago: executing program 7 (id=324): syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = gettid() timer_create(0x7, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) clock_nanosleep(0x0, 0x0, &(0x7f0000000180)={0x77359400}, &(0x7f0000000380)) futex_waitv(&(0x7f0000001080)=[{0x3, &(0x7f0000001040)=0x3, 0x82}], 0x1, 0x0, 0x0, 0x1) unshare(0x24020400) memfd_create(&(0x7f0000000140)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xcda\x9b\x11X\x0e\xa1\xcf\x1a\x98S7\xc9\x00'/47, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000005580)=""/102392, 0x18ff8) bind$unix(0xffffffffffffffff, &(0x7f0000000300)=@file={0x1, './proc/1/root/var/run/gssproxy.sock\x00'}, 0x30) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd\x00', 0x1ff) r2 = syz_genetlink_get_family_id$batadv(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_BLA_CLAIM(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x3c, r2, 0x100, 0x70bd2b, 0x25dfdbfb, {}, [@BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_ISOLATION_MARK={0x8}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0xd}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40040000}, 0x10) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000040)={@cgroup=r3, 0x2f, 0x0, 0x0, &(0x7f0000000080)=[0x0], 0x1, 0x0, 0x0, 0x0, 0x0}, 0x40) readv(0xffffffffffffffff, &(0x7f0000000200)=[{&(0x7f0000000140)=""/33, 0x21}], 0x1) 20.796191307s ago: executing program 7 (id=331): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) add_key(&(0x7f0000000040)='id_resolver\x00', &(0x7f0000002300)={'syz', 0x1}, &(0x7f0000002340)="0f6644cf60b5b0f9131bd0810fe457c8e9445d9218bca020e93a6791c729f0d4a9490904a780ecc461e887", 0x2b, 0xfffffffffffffffa) syz_emit_ethernet(0x3e, &(0x7f0000000180)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa86dd606410a60008000000000002000000000000ffffac1414bbff020000000000000000000000000001223427d5c9a46b9feb680d5fdf85b861de975a5f4848ef6c8cc11a4f651665316fc742bc66b96f1bfe893561d72b41579d6c84fb08bb184ea7da4a6e89065e40ee5300b6c77734d7712e30f83c5234aefad843516d4bfed18c85bbc4ba0d8942da4aba60e7501c6d5c92a7f81e8407a330b5b13757704cbc26bca72bc5700c01c5c5687d4903f4e26fa413ca33fef3dcd95160fa32057d6d22f8be2f767c41f10c1c38b80daf405429d32d812c39633cae8b5abb2e32189d6a108c416d941c7689f0782cd7d7103a5d252284f028f19f09b1dd6636d5b859ee4d"], 0x0) (async) syz_emit_ethernet(0x3e, &(0x7f0000000180)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa86dd606410a60008000000000002000000000000ffffac1414bbff020000000000000000000000000001223427d5c9a46b9feb680d5fdf85b861de975a5f4848ef6c8cc11a4f651665316fc742bc66b96f1bfe893561d72b41579d6c84fb08bb184ea7da4a6e89065e40ee5300b6c77734d7712e30f83c5234aefad843516d4bfed18c85bbc4ba0d8942da4aba60e7501c6d5c92a7f81e8407a330b5b13757704cbc26bca72bc5700c01c5c5687d4903f4e26fa413ca33fef3dcd95160fa32057d6d22f8be2f767c41f10c1c38b80daf405429d32d812c39633cae8b5abb2e32189d6a108c416d941c7689f0782cd7d7103a5d252284f028f19f09b1dd6636d5b859ee4d"], 0x0) mount(0x0, &(0x7f00000000c0)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = open$dir(&(0x7f0000000080)='./sys\x00', 0x4b00, 0x0) r1 = openat(r0, &(0x7f0000000140)='./sys/bus/pci/devices/0000:00:02.0/config\x00', 0x101002, 0x0) read$FUSE(r1, &(0x7f00000002c0)={0x2020}, 0xbad) (async) read$FUSE(r1, &(0x7f00000002c0)={0x2020}, 0xbad) 20.688475506s ago: executing program 37 (id=331): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) add_key(&(0x7f0000000040)='id_resolver\x00', &(0x7f0000002300)={'syz', 0x1}, &(0x7f0000002340)="0f6644cf60b5b0f9131bd0810fe457c8e9445d9218bca020e93a6791c729f0d4a9490904a780ecc461e887", 0x2b, 0xfffffffffffffffa) syz_emit_ethernet(0x3e, &(0x7f0000000180)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa86dd606410a60008000000000002000000000000ffffac1414bbff020000000000000000000000000001223427d5c9a46b9feb680d5fdf85b861de975a5f4848ef6c8cc11a4f651665316fc742bc66b96f1bfe893561d72b41579d6c84fb08bb184ea7da4a6e89065e40ee5300b6c77734d7712e30f83c5234aefad843516d4bfed18c85bbc4ba0d8942da4aba60e7501c6d5c92a7f81e8407a330b5b13757704cbc26bca72bc5700c01c5c5687d4903f4e26fa413ca33fef3dcd95160fa32057d6d22f8be2f767c41f10c1c38b80daf405429d32d812c39633cae8b5abb2e32189d6a108c416d941c7689f0782cd7d7103a5d252284f028f19f09b1dd6636d5b859ee4d"], 0x0) (async) syz_emit_ethernet(0x3e, &(0x7f0000000180)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa86dd606410a60008000000000002000000000000ffffac1414bbff020000000000000000000000000001223427d5c9a46b9feb680d5fdf85b861de975a5f4848ef6c8cc11a4f651665316fc742bc66b96f1bfe893561d72b41579d6c84fb08bb184ea7da4a6e89065e40ee5300b6c77734d7712e30f83c5234aefad843516d4bfed18c85bbc4ba0d8942da4aba60e7501c6d5c92a7f81e8407a330b5b13757704cbc26bca72bc5700c01c5c5687d4903f4e26fa413ca33fef3dcd95160fa32057d6d22f8be2f767c41f10c1c38b80daf405429d32d812c39633cae8b5abb2e32189d6a108c416d941c7689f0782cd7d7103a5d252284f028f19f09b1dd6636d5b859ee4d"], 0x0) mount(0x0, &(0x7f00000000c0)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = open$dir(&(0x7f0000000080)='./sys\x00', 0x4b00, 0x0) r1 = openat(r0, &(0x7f0000000140)='./sys/bus/pci/devices/0000:00:02.0/config\x00', 0x101002, 0x0) read$FUSE(r1, &(0x7f00000002c0)={0x2020}, 0xbad) (async) read$FUSE(r1, &(0x7f00000002c0)={0x2020}, 0xbad) 10.093581961s ago: executing program 9 (id=403): mkdirat(0xffffffffffffff9c, &(0x7f0000001380)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f00000013c0), &(0x7f0000001400)='./file0\x00', &(0x7f0000001440), 0x2210088, 0x0) chdir(&(0x7f0000001500)='./file0\x00') openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001540)='blkio.throttle.io_service_bytes\x00', 0x275a, 0x0) umount2(&(0x7f0000000080)='./file0\x00', 0xb) lsetxattr$system_posix_acl(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='system.posix_acl_access\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="02000000010005000000000002000000", @ANYRES32, @ANYBLOB="02000700", @ANYRES32, @ANYBLOB="02000500", @ANYRES32, @ANYBLOB="02000000", @ANYRES32=0xee01, @ANYBLOB="02000400", @ANYRES32, @ANYBLOB="040008001000002500000000000000000000000000002000"], 0x4c, 0x1) 10.089708402s ago: executing program 9 (id=405): syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = gettid() timer_create(0x7, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) futex_waitv(&(0x7f0000001080)=[{0x3, &(0x7f0000001040)=0x3, 0x82}], 0x1, 0x0, 0x0, 0x1) unshare(0x24020400) r1 = memfd_create(&(0x7f0000000140)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xcda\x9b\x11X\x0e\xa1\xcf\x1a\x98S7\xc9\x00'/47, 0x2) fcntl$addseals(r1, 0x409, 0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000140)={0x6, 0x88}, 0x0) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl(r2, 0x890c, &(0x7f0000000240)="000000010000000000000000000000000f0000006c6170623000"/39) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000dfffffffe6ffffffffffffff00"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x1f, 0x18, &(0x7f0000000780)=ANY=[], &(0x7f00000007c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000800)={r3}, 0xc) r4 = landlock_create_ruleset(&(0x7f0000000840)={0xc8e8, 0xd, 0x1, 0x0, 0x5, 0x1}, 0x30, 0x0) landlock_restrict_self(r4, 0x0) r5 = socket$inet(0x2, 0x5, 0x0) getsockopt$ARPT_SO_GET_ENTRIES(r5, 0x0, 0x50, 0x0, &(0x7f0000000880)=0x600) keyctl$KEYCTL_WATCH_KEY(0x20, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet6(r6, &(0x7f00000008c0)={0x0, 0x0, 0x0}, 0x10) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0xa, 0xe, &(0x7f00000009c0)=ANY=[@ANYBLOB="bf16000000000000b70100003b0204007b1ae0ff00000000b7010000000000007b1ae8ff000000007b1af0ff00000000bf61000000000000b702000001000000bfa300000000000007030000e0ffffffb7040000180000008500000049000000b70000000000000095"], &(0x7f0000000a40)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0xc, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x94) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000b00)=ANY=[@ANYBLOB="48000000100001060100000000000000000000000000000000000000000000001000030073797a6b616c6c65723020001800128008000100767266000c00028008000100e8"], 0x48}}, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) read$FUSE(0xffffffffffffffff, &(0x7f00000010c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_IOCTL(r7, &(0x7f0000003100)={0x20, 0x0, r9, {0x9, 0x4, 0x4, 0x3}}, 0x20) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000003140)={r7, 0x0, 0xe, 0x0, &(0x7f00000031c0)="5254ff12340000000000000000dd", 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 9.058495032s ago: executing program 9 (id=415): r0 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_open_dev$usbfs(&(0x7f0000000100), 0xa, 0x412000) ioctl$USBDEVFS_SETCONFIGURATION(r2, 0x80045505, &(0x7f0000000240)=0x5) setsockopt$sock_int(r1, 0x1, 0x54, &(0x7f0000000080)=0x1, 0x4) close(0x3) recvmmsg(r1, &(0x7f00000000c0)=[{{0x0, 0x0, 0x0}, 0x75800000}], 0x1, 0x40010020, 0x0) preadv(r0, &(0x7f0000000140)=[{0x0, 0x2000}, {&(0x7f0000000180)=""/84, 0x54}], 0x2, 0x4, 0x8008) ioctl$DRM_IOCTL_WAIT_VBLANK(r0, 0xc018643a, &(0x7f0000000200)={0x4000000, 0x5, 0x3}) 8.04659439s ago: executing program 9 (id=426): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f00000004c0), 0x802, 0x0) mq_open(&(0x7f0000000000)='\x00', 0xf4e08cbd1c690303, 0x0, &(0x7f0000000040)={0x8001, 0xc351, 0x5, 0x8}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x1d, 0x4, &(0x7f00000001c0)=ANY=[@ANYBLOB="1802000002000000000000001100000085000000ae00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x27}, 0x94) fsopen(&(0x7f0000000240)='tracefs\x00', 0x1) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x28100, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_NMI(r3, 0xae9a) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000340)={[0x0, 0x100000000, 0x0, 0x7e, 0x100000, 0x0, 0x2004c8, 0x8000000, 0x0, 0x1, 0x7, 0x0, 0x5, 0xa, 0x2, 0xffffffffffffffff], 0x0, 0x200}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) mount$9p_virtio(&(0x7f0000000400), &(0x7f0000000440)='./file0\x00', &(0x7f0000000480), 0x0, 0x0) symlink(&(0x7f0000000780)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/../file0\x00', &(0x7f00000008c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') chdir(&(0x7f0000000500)='./file0\x00') r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r4, &(0x7f0000000580)=ANY=[], 0x3261e) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r4, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r4, 0xc018937b, &(0x7f0000000b40)={{0x1, 0x1, 0x18, r0, {0xee01, 0xffffffffffffffff}}, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/../file0\x00'}) lstat(&(0x7f0000000c80)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000d80)={0x0, 0x0, 0x0, 0x0, 0x0}) getresuid(&(0x7f0000000e00), &(0x7f0000000e40)=0x0, &(0x7f0000000e80)) mount$nfs4(&(0x7f0000000580)='/dev/bsg/2:0:0:0\x00', &(0x7f00000005c0)='./file0\x00', &(0x7f0000000600), 0x1241008, &(0x7f0000000ec0)={[{'$%L,'}, {}, {'}'}, {}, {'.]-\\['}], [{@fsmagic={'fsmagic', 0x3d, 0x4}}, {@pcr={'pcr', 0x3d, 0x14}}, {@appraise_type}, {@uid_eq={'uid', 0x3d, r5}}, {@uid_lt={'uid<', r6}}, {@fowner_gt={'fowner>', r7}}, {@subj_role}, {@audit}, {@subj_role={'subj_role', 0x3d, '/dev/uhid\x00'}}, {@mask={'mask', 0x3d, 'MAY_WRITE'}}]}) ioctl$int_in(r4, 0x5421, 0x0) openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000640)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x14, 0x3, 0x1b1c, 0xc10, 0x0, 0x0, "05010900a101150026ff007508951009008102c0"}}, 0x12c) r8 = openat$bsg(0xffffff9c, &(0x7f0000000080)='/dev/bsg/2:0:0:0\x00', 0x44002, 0x0) ioctl$SG_GET_KEEP_ORPHAN(r8, 0x2288, &(0x7f00000000c0)) write$UHID_INPUT2(r0, &(0x7f0000000a80)=ANY=[@ANYBLOB="0c0000001300d4977745264d5d6353421a79461b7d957d37ecb40e0f143aa952244c1d4a1c605a01d0a57fe9ab13b1b31927366301f2dd9b558ef764d1f72fe0ea6db6edd098b2d6584fd53809ba62c1c67402629584eaf0fe6f5b87d3539470453609360854069ef282902851955560c3be20f3f759c9acefb567b1e44c9ed3deb510ecb0bc"], 0x19) 6.811757026s ago: executing program 9 (id=433): pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r2 = socket(0x2b, 0x80801, 0x1) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e23, 0x3ff, @ipv4={'\x00', '\xff\xff', @empty}, 0xfffffffe}, 0x1c) read$alg(r2, &(0x7f0000000200)=""/4099, 0x1003) close(r0) mount$9p_fd(0x0, &(0x7f0000000140)='.\x00', &(0x7f0000000180), 0x121484b, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) socket$inet6_sctp(0xa, 0x1, 0x84) syz_genetlink_get_family_id$nl80211(&(0x7f0000001240), r2) 6.527200616s ago: executing program 9 (id=434): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) write$tun(r0, &(0x7f00000024c0)=ANY=[@ANYBLOB="00000800000003000078ac1414bbffffffff1200"], 0x2a) 6.446229896s ago: executing program 38 (id=434): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) write$tun(r0, &(0x7f00000024c0)=ANY=[@ANYBLOB="00000800000003000078ac1414bbffffffff1200"], 0x2a) 3.12368897s ago: executing program 4 (id=457): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap$dontunmap(&(0x7f00003a2000/0x3000)=nil, 0x3000, 0x3000, 0x7, &(0x7f0000491000/0x1000)=nil) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x103201, 0x0) write$P9_RSTATu(r0, 0x0, 0x0) syz_clone(0x20220000, &(0x7f0000001c00), 0x0, 0x0, 0x0, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) 3.055080983s ago: executing program 8 (id=459): r0 = socket(0x10, 0x3, 0x0) socket$inet(0x2, 0x2, 0x1) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x3, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000440)=ANY=[], 0x3344}, 0x1, 0x0, 0x0, 0x4011}, 0xc000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000740)=@newqdisc={0x43c, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r5, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x410, 0x2, [@TCA_TBF_PTAB={0x404, 0x3, [0x77, 0xe679, 0x9, 0x8, 0x8000, 0x80, 0x6, 0xffff, 0x9, 0x71, 0x8, 0x2, 0x4f, 0xffff, 0x8, 0x6, 0x7, 0x3, 0x8, 0x1, 0x101, 0xfffff001, 0x3, 0xb1f, 0x3, 0xfffffffb, 0x7, 0x2, 0x5, 0xfffffffc, 0x1, 0xd60, 0x8, 0x3, 0x6, 0xfffffffd, 0x68, 0x5, 0xd, 0x7, 0x1, 0x4, 0x6, 0x7, 0x1, 0xff, 0x4, 0x1ff, 0x5, 0x28f, 0x9, 0x6, 0x8, 0x101, 0x3, 0x1075e3e5, 0x6, 0x8, 0x5, 0x2, 0xb040, 0x8001, 0xfffffff9, 0x9, 0x9, 0x4, 0x8, 0x101, 0x81, 0x2c, 0x6, 0x2, 0x1, 0x8, 0x0, 0x2a6b, 0x80, 0x8, 0x9, 0x1, 0x4, 0x9, 0x2, 0x3, 0x8, 0x2000, 0x7fffffff, 0x3, 0x8001, 0x3, 0xeced, 0x4, 0x40, 0x1ff, 0x3, 0x4, 0xa6dc, 0x2, 0x0, 0x3, 0x1, 0xa, 0x17dbddd6, 0x3f34, 0xf, 0x8aa, 0x9, 0xd4, 0x695634ad, 0x3, 0x7fff, 0xffff8000, 0xd, 0x80000001, 0x3ff, 0x8, 0x2, 0xe61b, 0x8ac, 0x7f1, 0x5, 0x7, 0x2, 0x4, 0x38, 0x1, 0x8, 0xd, 0x8, 0x4, 0x401, 0x7f, 0x1, 0x1, 0x15cea206, 0xfffffff9, 0x4, 0xb, 0x4, 0xfffff9d7, 0x800, 0x3, 0x0, 0xf, 0x6, 0x9, 0xc40f, 0x5, 0x5, 0xffff241c, 0x101, 0x80000000, 0x7, 0xfffffffe, 0xe4, 0x4, 0x8, 0x6, 0x3ff8000, 0x67, 0x5, 0x402, 0x6, 0x10006, 0x28, 0x0, 0x81, 0x9, 0x2, 0x6, 0x6, 0xfffffffc, 0x1, 0x800, 0x2, 0x98, 0x8010, 0x3, 0x0, 0x401, 0x6, 0x3, 0x6, 0xa6, 0x23, 0x6, 0x10000ff, 0x800, 0xffff, 0x73af00ca, 0x80, 0x0, 0x80008, 0x8, 0x8, 0x2, 0x2, 0xf, 0x800, 0x6, 0x8, 0xc, 0x5, 0xb172, 0x8, 0x10001, 0x0, 0x7, 0x101, 0x4, 0xdfb, 0x9, 0x6, 0x1, 0x7, 0x800, 0x8, 0x4, 0x2, 0x1, 0x7fffffff, 0xa5, 0x2, 0x0, 0x9, 0x10001, 0x5, 0x9, 0xb, 0x7, 0x3, 0x75, 0x8000, 0xffffffff, 0x0, 0x9, 0x9, 0x6, 0x7, 0xe, 0x0, 0xfffffff2, 0x7fff, 0x1, 0x4, 0x8, 0x9, 0x0, 0xe53, 0x400, 0x101, 0x4, 0x2f8f, 0x30000, 0x4, 0xc]}, @TCA_TBF_BURST={0x8, 0x6, 0x8057}]}}]}, 0x43c}}, 0x44080) pipe(&(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./cgroup.cpu/memory.force_empty\x00', 0x2, 0x0) write(r7, &(0x7f0000000480)="b8", 0x1) vmsplice(r6, &(0x7f0000000600)=[{&(0x7f0000000640)="86", 0x1}], 0x1, 0x8) read$usbfs(r6, &(0x7f0000000680)=""/120, 0x78) r8 = dup3(r2, r1, 0x0) ioctl$SNDCTL_DSP_SPEED(r8, 0xc0045002, &(0x7f0000000700)=0xe43) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x68, 0x24, 0xd0f, 0x170bd2b, 0x25dfdbff, {0x60, 0x0, 0x0, r5, {0xa}, {0xe, 0xa}, {0xf, 0x1}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x38, 0x2, [@TCA_CAKE_BASE_RATE64={0xc, 0x2, 0x2}, @TCA_CAKE_RAW={0x8, 0xc, 0x1}, @TCA_CAKE_RTT={0x8, 0x7, 0x6}, @TCA_CAKE_NAT={0x8, 0xb, 0x1}, @TCA_CAKE_MPU={0x8, 0xe, 0xb1}, @TCA_CAKE_INGRESS={0x8}]}}]}, 0x68}, 0x1, 0x0, 0x0, 0x48045}, 0x0) setsockopt$MRT_FLUSH(r0, 0x0, 0xd4, &(0x7f0000000340)=0x1, 0x4) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) unlink(&(0x7f00000002c0)='./file0\x00') mmap(&(0x7f00005ee000/0x3000)=nil, 0x3000, 0x1000000, 0x4000010, 0xffffffffffffffff, 0x0) r9 = syz_open_dev$vim2m(&(0x7f0000000000), 0xe74, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r9, 0xc0145608, &(0x7f0000000040)={0x1, 0x2, 0x1}) ioctl$vim2m_VIDIOC_EXPBUF(r9, 0xc0405610, &(0x7f0000000080)={0x2}) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r10 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$SO_TIMESTAMPING(r10, 0x1, 0x25, &(0x7f0000000500), &(0x7f0000000580)=0x4) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0401273, &(0x7f00000004c0)={'\x00', 0x7, 0x6, 0xfffffff8, 0xa, 0x6, 0x0}) sched_setscheduler(r11, 0x2, &(0x7f0000000540)=0x3fe) ftruncate(0xffffffffffffffff, 0x6) 2.866318049s ago: executing program 4 (id=461): r0 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) rseq(&(0x7f0000000380)={0x0, 0x0, 0x0, 0x1}, 0x20, 0x0, 0x0) nanosleep(&(0x7f00000004c0)={0x0, 0x5f5e100}, 0x0) nanosleep(&(0x7f0000000500)={0x0, 0x5f5e100}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)={0x0, 0x3938700}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000440)=@newqdisc={0x60, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r2, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x4, 0x2, 0x0, 0x0, 0x7, 0x8}, {0x12, 0x3, 0x0, 0x1, 0x1, 0xbfff8000}, 0xa5, 0x4, 0x10000000}}, @TCA_TBF_BURST={0x8, 0x6, 0x8057}]}}]}, 0x60}}, 0x44080) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0xb, '\x00', r2, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) syz_emit_ethernet(0xa5, &(0x7f00000003c0)=ANY=[@ANYBLOB="ffffffffff3f54aaaaaaaaaa08004f04009700680000ff069078e000000100000000940a9b40f51983638a38890f746401010200000000ac1414aa", @ANYRES32=0x41424344, @ANYRES32=0x41424344], 0x0) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) syz_open_dev$video4linux(&(0x7f0000000040), 0x8e3, 0x88800) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) munmap(&(0x7f0000583000/0x4000)=nil, 0x4000) sched_setaffinity(r3, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000300), 0x1) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r6, 0xc08c5332, &(0x7f00000005c0)={0x1, 0x0, 0x0, 'queue1\x00'}) write$sndseq(r6, &(0x7f0000000680)=[{0x84, 0x77, 0x0, 0x0, @tick, {}, {}, @raw32}], 0xffc8) 2.723793692s ago: executing program 8 (id=462): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000400), 0x90080, 0x0) r1 = socket$inet_smc(0x2b, 0x1, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000100)={0x2, 0x4e21, @broadcast}, 0x10) connect$inet(r2, &(0x7f0000000140)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) sendto$inet(r2, &(0x7f0000000180), 0xffffffffffffff94, 0x0, 0x0, 0x0) r3 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000200)={'lo\x00', 0x0}) syz_clone(0x4820000, 0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=@newqdisc={0x60, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r5, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0xea, 0x2, 0x0, 0x1, 0x1009, 0x7c}, {0x3, 0x2, 0x0, 0x401, 0x8001}, 0x0, 0x5, 0x10000000}}, @TCA_TBF_BURST={0x8, 0x6, 0x8057}]}}]}, 0x60}}, 0x44080) sendmsg$nl_route_sched(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000480)=@newqdisc={0x4c, 0x24, 0xd0f, 0x170bd2b, 0x25dfdbff, {0x60, 0x0, 0x0, r5, {}, {0xe, 0xa}, {0xf, 0x1}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x1c, 0x2, [@TCA_CAKE_MEMORY={0x8, 0xa, 0x9}, @TCA_CAKE_RAW={0x8, 0xc, 0x1}, @TCA_CAKE_DIFFSERV_MODE={0x8, 0x3, 0x3}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x48045}, 0x0) recvfrom$inet(r2, 0x0, 0x0, 0x720, 0x0, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x14, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWSET={0x4c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x8}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x4}, @NFTA_SET_DATA_LEN={0x8, 0x7, 0x1, 0x0, 0x4}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xb4}}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000006c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWSETELEM={0x4c, 0xc, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x20, 0x3, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x8, 0x1, "11223344"}]}, @NFTA_SET_ELEM_DATA={0xc, 0x2, 0x0, 0x1, [@NFTA_DATA_VALUE={0x8, 0x1, "55667788"}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x74}}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000007c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @lookup={{0xb}, @val={0x18, 0x2, 0x0, 0x1, [@NFTA_LOOKUP_SET={0x9, 0x1, 'syz1\x00'}, @NFTA_LOOKUP_SREG={0x8, 0x2, 0x1, 0x0, 0x1}]}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x80}}, 0x0) shutdown(r2, 0x0) r7 = openat$panthor(0xffffff9c, &(0x7f0000000840), 0x2, 0x0) ioctl$DRM_IOCTL_MODE_LIST_LESSEES(r7, 0xc01064c7, &(0x7f00000008c0)={0x4, 0x0, &(0x7f0000000880)=[0x0, 0x0, 0x0, 0x0]}) pipe2$9p(&(0x7f0000000080), 0x80000) ioctl$int_in(r1, 0x5421, &(0x7f0000000000)=0x100000001) connect$inet(r1, &(0x7f0000000040)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x4}}, 0x10) close(r1) r8 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_XEN_HVM_CONFIG(r8, 0x4038ae7a, &(0x7f0000000440)={0x80, 0x40000105, 0x0, 0x0}) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x1) ioctl$KVM_RUN(r9, 0xae80, 0x0) 2.455696951s ago: executing program 8 (id=463): pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r2 = socket(0x2b, 0x80801, 0x1) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e23, 0x3ff, @ipv4={'\x00', '\xff\xff', @empty}, 0xfffffffe}, 0x1c) read$alg(r2, &(0x7f0000000200)=""/4099, 0x1003) close(r0) mount$9p_fd(0x0, &(0x7f0000000140)='.\x00', &(0x7f0000000180), 0x121484b, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) socket$inet6_sctp(0xa, 0x1, 0x84) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001240), r2) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000001280)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_CQM(r2, &(0x7f0000001440)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001400)={&(0x7f00000012c0)={0x130, r3, 0x200, 0x70bd2a, 0x25dfdbff, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_CQM={0x34, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_TXE_INTVL={0x8, 0x7, 0x302}, @NL80211_ATTR_CQM_TXE_PKTS={0x8, 0x6, 0x1040000}, @NL80211_ATTR_CQM_RSSI_THOLD={0x18, 0x1, [0xff, 0x3, 0x101, 0x8, 0x6]}, @NL80211_ATTR_CQM_TXE_RATE={0x8, 0x5, 0x36}]}, @NL80211_ATTR_CQM={0x74, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_TXE_PKTS={0x8, 0x6, 0xfffffff8}, @NL80211_ATTR_CQM_RSSI_LEVEL={0x8}, @NL80211_ATTR_CQM_TXE_PKTS={0x8, 0x6, 0x7fffffff}, @NL80211_ATTR_CQM_TXE_INTVL={0x8, 0x7, 0x323}, @NL80211_ATTR_CQM_TXE_INTVL={0x8, 0x7, 0x407}, @NL80211_ATTR_CQM_RSSI_THOLD={0x28, 0x1, [0x4f8e, 0x3, 0x0, 0x5, 0x3, 0x6, 0x283f, 0x3, 0x3]}, @NL80211_ATTR_CQM_TXE_INTVL={0x8, 0x7, 0x21f}, @NL80211_ATTR_CQM_RSSI_HYST={0x8, 0x2, 0x9}, @NL80211_ATTR_CQM_TXE_PKTS={0x8, 0x6, 0xfdb38ac}, @NL80211_ATTR_CQM_RSSI_LEVEL={0x8, 0x9, 0x4}]}, @NL80211_ATTR_CQM={0x34, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT={0x8, 0x3, 0x200}, @NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT={0x8, 0x3, 0x1}, @NL80211_ATTR_CQM_RSSI_LEVEL={0x8, 0x9, 0x33}, @NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT={0x8, 0x3, 0x9}, @NL80211_ATTR_CQM_RSSI_LEVEL={0x8, 0x9, 0x4b5}, @NL80211_ATTR_CQM_RSSI_HYST={0x8, 0x2, 0x1}]}, @NL80211_ATTR_CQM={0x14, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_LEVEL={0x8, 0x9, 0x81}, @NL80211_ATTR_CQM_TXE_RATE={0x8, 0x5, 0x39}]}, @NL80211_ATTR_CQM={0x24, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_LEVEL={0x8, 0x9, 0x1}, @NL80211_ATTR_CQM_RSSI_THOLD={0x18, 0x1, [0xa6, 0xb, 0x100, 0xd3a1, 0x9]}]}]}, 0x130}}, 0x88000) 2.387261078s ago: executing program 8 (id=464): mkdirat(0xffffffffffffff9c, &(0x7f0000001380)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f00000013c0), &(0x7f0000001400)='./file0\x00', &(0x7f0000001440), 0x2210088, 0x0) chdir(0x0) mount$bind(&(0x7f0000001580)='./file0\x00', &(0x7f00000015c0)='./file0\x00', 0x0, 0x3125819, 0x0) umount2(&(0x7f0000000080)='./file0\x00', 0xb) lsetxattr$system_posix_acl(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='system.posix_acl_access\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="02000000010005000000000002000000", @ANYRES32, @ANYBLOB="02000700", @ANYRES32, @ANYBLOB="02000500", @ANYRES32, @ANYBLOB="02000000", @ANYRES32=0xee01, @ANYBLOB="02000400", @ANYRES32, @ANYBLOB="040008001000002500000000000000000000000000002000"], 0x4c, 0x1) 2.307137173s ago: executing program 8 (id=465): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000402609333340000000000109022400010000000009040000010301000009210000000122010009058103"], 0x0) io_uring_setup(0x524, &(0x7f00000007c0)={0x0, 0x3cb1, 0x800, 0xa, 0x20002f7}) r1 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) bind$bt_hci(r1, &(0x7f0000000840)={0x27}, 0x62) r2 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) bind$bt_hci(r2, &(0x7f0000000880)={0x27}, 0x62) syz_usb_connect(0x3, 0x2d, 0x0, 0x0) syz_usb_connect$cdc_ecm(0x1, 0x5f, &(0x7f0000000040)={{0x12, 0x1, 0x310, 0x2, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x4d, 0x1, 0x1, 0x4, 0x10, 0x8, "", [{{0x9, 0x4, 0x0, 0x2, 0x3, 0x2, 0x6, 0x0, 0x9, {{0x7, 0x24, 0x6, 0x0, 0x0, "301a"}, {0x5, 0x24, 0x0, 0xfff9}, {0xd, 0x24, 0xf, 0x1, 0x0, 0x80, 0x8, 0x4}, [@network_terminal={0x7, 0x24, 0xa, 0x5, 0x4, 0x9, 0x4}]}, {[{{0x9, 0x5, 0x81, 0x3, 0x8, 0x4, 0xb, 0x6}}], {{0x9, 0x5, 0x82, 0x2, 0x3ff, 0x1, 0x5, 0xa0}}, {{0x9, 0x5, 0x3, 0x2, 0x40, 0x9, 0x81, 0x6}}}}}]}}]}}, &(0x7f0000000240)={0xa, &(0x7f00000000c0)={0xa, 0x6, 0x200, 0xe, 0xfc, 0xff, 0x10}, 0xfd, &(0x7f0000000100)={0x5, 0xf, 0xfd, 0x6, [@ss_container_id={0x14, 0x10, 0x4, 0x9, "5e1289b24815e898437d97e8f98b1123"}, @ss_container_id={0x14, 0x10, 0x4, 0x0, "a79d30ce4b41de011f2893331fda6dc4"}, @generic={0xa1, 0x10, 0xb, "5ad40dec045744f0b9f2a8ecb33111470d0c82718565d3605530b8a1f27ccdb0ed7638f5e7c1a8ea91640c32c36ebddca6935979b2a3bc423e94705d8b3674da83c363bd5afab3e7d42aef8fa96f6ad99ef21257f7593a7a860d0fda8e587fde866f2da6657816f2e159a37abc0241046920ca40e061b8f340edf326f93f95e156fc1077bbe8c8b982290609e21a045167720e9f147a4d6f8cdd288f53e4"}, @ssp_cap={0x10, 0x10, 0xa, 0x40, 0x1, 0x800, 0xf, 0x7, [0xc0]}, @ss_container_id={0x14, 0x10, 0x4, 0x2, "322b3c1e7d04bd3d72723a4521312a9c"}, @wireless={0xb, 0x10, 0x1, 0xc, 0x10, 0x1, 0x80, 0x800, 0x1}]}, 0x1, [{0x4, &(0x7f0000000200)=@lang_id={0x4, 0x3, 0x820}}]}) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f0000000280)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x8}}, './file0\x00'}) writev(r3, &(0x7f0000000780)=[{&(0x7f00000002c0)="92ccc9e86376e31689d1157657ff931064d1f664596eea07be8995177a2082680e5757b63e11a594a68d57df2f37b937443b99bd684d3dda11c3c8bb6e9436003c5501849cd96a040870981d41199bb63b9aa16715e6b8f62c961e0da535a94d449bd34db281f794ddfd6402148024e73b0d79cca2a98b6143021e621a2a9bbf76af3f380cb7e628439df2b2c3c27365c7293e7053972c228a8c49fe936cdd6469e25169cce141bde1361b12306c8fb9cd1d33ff", 0xb4}, {&(0x7f0000000380)="4768496e7d80894b60281c806fbeab75ad6b78fa099159e98d338c7abde99f93d53c21a372f615c6b4ce31dc29c632a7001ac5955d52b9592de065a4a5a2e1d397af162d5ac380ecce07894e46355b96d11f6edf4ad06d65218ef5a42a716d1f8ab4b99f60b73500b338f804163fc6333c2cf3c063a4f23add3c1b445c0d82015f874e790a11407ec643c6ad1e233bae930ac965bb373c4423", 0x99}, {&(0x7f0000000440)="e94644c4fc6914a25b8cfef642499413530bd129f68a9cf3a9441a102d10a8582e476669ccbecd8d0d717f5ac2da4e647125dc24126f52dcacbb9908212ea356a5b022aac881e618afb4", 0x4a}, {&(0x7f00000004c0)="86926a1fd10c8a6c0f7db2423e284e346079590c51959ac3e7e740fe2d35bef62bdbbc47792690262590d9c2626841cc423d245f4bce6a0d49b434d98e88ab90b2652e36ccf7c59821cbedf822980bdb21f757a43999616aaef0cf960c85e4954b5e6a62e314530dddd14758f6cbe68eac751f0540732836a2ee500408b9fb68c949c031baee1c738d226e5690bdee203a0814d09e9e8efc673b4833ddbb7ec93b71025050414a6376d20b101f80357f6241e7201cb2dd858a5c0ec2fc5cf0d7f03f5cae5f295b4ecd7e8af95b200e5b143ff96dc2f6d8e78020b46d", 0xdc}, {&(0x7f00000005c0)="1e85685e963fedfa0f5916adbc452bb69ffe730cccbe63b735d5380d4b40f29945773028f27f1b27b238190459c950ba027627fa7f058a03b6032d8b5878e77593cf34c70c8e492978c04bea557f511cfa04a4a75ff10588d32843f3f3ecfd27b87c8176301731f7aeab3b67f79b01ed73baf1d682cdf81a50256bca806500fd74bd72", 0x83}, {&(0x7f0000000680)="7a5743a1ca0200039b3eb2b37e5d43827c5bbc574c4fc7e2412c0eaa2ce5ddb1b52193ae9cf8e25df2472ef54307aad14dc359953194646c5671bd521732db02459ea9c2fd989aed37e85f2edf16a43123d9fa79a42dce900c4e3d08b0881c7bb384fcf369a7de2f617e7ecd956ace1b7eb310086cdf422f5cd4475318553833f53305da4084", 0x86}, {&(0x7f0000000740)="a4c039c9", 0x4}], 0x7) 2.301473338s ago: executing program 3 (id=435): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21}, &(0x7f0000000300)=0x0) fsopen(0x0, 0x1) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r1 = socket(0x10, 0x3, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x4}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) r2 = syz_create_resource$futex(&(0x7f0000000000)=0x1) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x2200, 0x0) ioctl$KVM_CHECK_EXTENSION(r3, 0xae03, 0x38) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r1) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r5) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000200)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000440)=ANY=[@ANYBLOB="1c0085d5703b4e158f308ec92ac3eff3ee31bc6f2f12f283a760df189bde5bcb868f45e63043cd576251db8d92f213cf1f054add9a333afb41813c02bc00be383bc04a2e7ab0c86ab61ab503c946c2652cdf28ba8f2561dfdbfcdb1c92e5975d69b79cd94505e92b7d44bb2f319c84ba2a515ca2f91f51db519d522fa26a5a31c734b6eb1549701a6efc", @ANYRES16=r6, @ANYBLOB="01002abd7000ffdbdf257900000008000300", @ANYRES32=r7, @ANYBLOB], 0x1c}}, 0x20000000) sendmsg$NL80211_CMD_RADAR_DETECT(r3, &(0x7f00000003c0)={&(0x7f0000000140), 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x3c, r4, 0x1, 0x70bd2a, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xc}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x1}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x2}]}, 0x3c}, 0x1, 0x0, 0x0, 0x1}, 0x0) r8 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000880), r8) getsockname$packet(r8, &(0x7f00000008c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000900)=0x14) sendmsg$nl_route(r8, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000980)={&(0x7f00000009c0)=@newlink={0x40, 0x10, 0x439, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r9, 0x9901, 0x49a41}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @sit={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x8, 0x3, @remote}, @IFLA_IPTUN_TTL={0x5}]}}}]}, 0x40}}, 0x0) sendto$packet(0xffffffffffffffff, &(0x7f0000000a00)="05d936277c6f5422007f83477ca1b278e3e4018a34e7bfd3de1a00ad6762646c95c716727eb53bcc", 0x28, 0x40880, &(0x7f0000000a40)={0x11, 0x86dd, r9, 0x1, 0x4, 0x6, @local}, 0x14) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000c00)={'gre0\x00', &(0x7f0000000a80)={'syztnl0\x00', 0x0, 0x0, 0x20, 0x3, 0x8, {{0x4a, 0x4, 0x1, 0x17, 0x128, 0x67, 0x0, 0x0, 0x2f, 0x0, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@timestamp_addr={0x44, 0x1c, 0x94, 0x1, 0x9, [{@private=0xa010100, 0x6}, {@dev={0xac, 0x14, 0x14, 0x35}, 0x5}, {@rand_addr=0x64010100, 0x7}]}, @cipso={0x86, 0x43, 0x0, [{0x7, 0x6, "33e81753"}, {0x7, 0x5, "0d2bfa"}, {0x2, 0x3, '0'}, {0x6, 0x5, "3ea016"}, {0x1, 0x7, "955b73fef9"}, {0x2, 0x2}, {0x5, 0x12, "c60d6525e87330290e798753c77b8aa6"}, {0x2, 0xf, "9b3bb486e3c34fbb39a73dfe78"}]}, @generic={0x88, 0x7, "492e11e5f6"}, @generic={0x83, 0xa, "6d80fa547473ccbd"}, @cipso={0x86, 0x3e, 0x3, [{0x7, 0x10, "377fe8423b571e3185eed836d1b8"}, {0x6, 0xc, "a017b37fe8c3b8da32e0"}, {0x6, 0xa, "df99130fced4fe71"}, {0x5, 0x12, "438959156462ed2a22d583c738c3237f"}]}, @ra={0x94, 0x4}, @timestamp_prespec={0x44, 0x2c, 0xc6, 0x3, 0x7, [{@multicast1, 0x7}, {@multicast1, 0x1}, {@dev={0xac, 0x14, 0x14, 0x3a}, 0x4}, {@broadcast, 0x2}, {@multicast2, 0xa}]}, @timestamp_prespec={0x44, 0x14, 0xa9, 0x3, 0x4, [{@initdev={0xac, 0x1e, 0x1, 0x0}, 0x9}, {@local, 0x101}]}, @rr={0x7, 0x1f, 0xd9, [@rand_addr=0x64010100, @broadcast, @broadcast, @broadcast, @broadcast, @multicast1, @broadcast]}, @end]}}}}}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r1, 0x89f8, &(0x7f0000000c80)={'erspan0\x00', &(0x7f0000000c40)={'gre0\x00', 0x0, 0x40, 0x40, 0x3, 0xb16c, {{0x7, 0x4, 0x0, 0x20, 0x1c, 0x64, 0x0, 0x7, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, {[@generic={0x89, 0x7, "27b8100765"}]}}}}}) sendmsg$ETHTOOL_MSG_FEATURES_SET(r5, &(0x7f0000001280)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001240)={&(0x7f0000000cc0)={0x554, 0x0, 0x800, 0x70bd29, 0x25dfdbff, {}, [@ETHTOOL_A_FEATURES_HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}, @ETHTOOL_A_FEATURES_HEADER={0x44, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bridge\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}, @ETHTOOL_A_FEATURES_HEADER={0x84, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'virt_wifi0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'tunl0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @ETHTOOL_A_FEATURES_WANTED={0x204, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_VALUE={0x80, 0x4, "d0987cd5d0b72be5765b90caa1d4d3ebbbcc93f0ac50f6388c5a1c227c128e664a838949ad33d503c37729ce07cb102070cf03b2eeff36b74f86298c8e49e91dc444250ff33fb6ef6daf47e80cb50a8a5f2480da6f147cad8575fdfbe555f31825b42b9a94ab66b86d19e5fdb5d61847f817417c6a368b258f812b26"}, @ETHTOOL_A_BITSET_MASK={0x5, 0x5, 'r'}, @ETHTOOL_A_BITSET_MASK={0x45, 0x5, "8096cf06b610a41c732cb54043402c31d9e8ae86f772660b47209b27d4113e2508ce445ab341352f352d0dfa74dcb9331bb68ec3ede50ac0b645e9221983ef6f01"}, @ETHTOOL_A_BITSET_BITS={0x68, 0x3, 0x0, 0x1, [{0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0x5, 0x2, '\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x3}, @ETHTOOL_A_BITSET_BIT_NAME={0xd, 0x2, '/dev/kvm\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x3}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xffffffff}]}, {0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x1}, @ETHTOOL_A_BITSET_BIT_NAME={0xa, 0x2, 'wlan0\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0x6, 0x2, '^\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x7fffffff}]}]}, @ETHTOOL_A_BITSET_VALUE={0xc5, 0x4, "2ae52862bea3249830e59d3007c626e91a4123e974ca9703ba0c8e6f37147d47626ecd97edf3a3140ff262edd76e5a922d48deb5bac4b09789602b098ca025f9b322b45e48495bb50d3091dbb3c3120a09f80177c44fec9479bd3cc00c88d82a75902de3638a782e95afef2169c7f82747f1513a9c753c31f4504b49f08113e2eb62fee7dbb2bdb72c2c4598509d48949e89641a49e370eb08967202e9b7d557af57262944297cb49f858279c86d4f56ee61f68e8d4a43ee6af9b467fdcc8c063b"}]}, @ETHTOOL_A_FEATURES_WANTED={0x168, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_BITS={0x160, 0x3, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xfffff028}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x8}]}, {0x44, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xb}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x7}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xfffffffe}, @ETHTOOL_A_BITSET_BIT_NAME={0xc, 0x2, '$*-(+-.\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x80000001}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x1}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x7, 0x2, '%+\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x9d}, @ETHTOOL_A_BITSET_BIT_NAME={0xa, 0x2, 'wlan0\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x24, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0xa, 0x2, 'wlan0\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x8000}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x10000}]}, {0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x6}, @ETHTOOL_A_BITSET_BIT_NAME={0x6, 0x2, '[\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x5, 0x2, '\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0x6, 0x2, '}\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0xc, 0x2, 'nl80211\x00'}]}, {0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0xd, 0x2, '/%@*#%[(\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x5, 0x2, '\x00'}]}, {0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0xa, 0x2, 'wlan0\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0xc, 0x2, 'nl80211\x00'}]}, {0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0xd, 0x2, '/dev/kvm\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x40}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x1}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}]}]}, @ETHTOOL_A_FEATURES_HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macsec0\x00'}]}, @ETHTOOL_A_FEATURES_HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team_slave_1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @ETHTOOL_A_FEATURES_HEADER={0x68, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'tunl0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_hsr\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6_vti0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @ETHTOOL_A_FEATURES_HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_macvtap\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r10}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r11}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}]}, 0x554}, 0x1, 0x0, 0x0, 0x20008001}, 0x40840) r12 = syz_create_resource$futex(&(0x7f0000000080)=0x1) futex(r12, 0x6, 0x1, 0x0, 0x0, 0x1) futex(r2, 0x5, 0x1, 0x0, r12, 0x3000020) futex(r12, 0x8, 0x2, 0x0, 0x0, 0x1) 2.075573758s ago: executing program 6 (id=466): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) r1 = syz_create_resource$futex(&(0x7f0000000280)=0x1) futex(r1, 0x9, 0x4000, 0x0, 0x0, 0x400000) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r2, &(0x7f0000000000)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x240}, 0xe) r3 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, 0x0, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1400000000000a14000000090a01010000000000000000030000092c000000020a01140000000000000000000000010900010073797a31000000000900010073797a3000000000280000000c0a81040000000000000000050000797a30000000000800038004000080140000001100010000000000000000000709000a"], 0x90}}, 0x40800) ioctl$sock_bt_hidp_HIDPCONNADD(r3, 0x400448c8, &(0x7f0000000040)={r2, r2, 0x3e4c, 0x1, &(0x7f0000000100)='C', 0x24, 0x9, 0x15c2, 0x8000, 0x5, 0x3, 0x4, 'syz0\x00'}) rt_sigqueueinfo(0x0, 0x32, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000340)={0x5}) 1.994492711s ago: executing program 6 (id=467): r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r1, &(0x7f0000000000)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000040)={r0, r1, 0x7, 0x0, 0x0, 0x7, 0x9, 0x7, 0x9, 0x1, 0x1, 0x6, 'syz1\x00'}) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, 0x0, 0x0) r3 = openat$cdrom(0xffffffffffffff9c, 0x0, 0x100, 0x0) ioctl$CDROMEJECT(r3, 0x5309) syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f00000003c0)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) 1.927407852s ago: executing program 4 (id=468): r0 = fsopen(&(0x7f0000000000)='fuseblk\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000040)='j\x95\'\x8aC\x16\xca\\', &(0x7f0000000080)='\xe6usek\v\xf6u%\x9b\x00\x00\xad\xeb\x00\x00\x00\x00\x01\x80\x00\x00\xcf\x9b\x9f\b\xb6\xfe\xc8\xda~-\x83w\xf9Z\xd2\xcb\xcdF\xd0#N7\x17\xfc\x1e\xf1\x97\xffxi\xe0KE}]\x8e\xca\xe3+\xc8\x98\x03\x91\x88(\bn\x7f\x0e\x85\xa5\xb4\n?^\xc9\xef\xe0Q\x01\xb6\xa5\x81t\x06\xda\x95\x935\xf1\x18\xac\x00\xf0\xff\xff\x80\x1a\xa1\x06\xfd\x01\x00\x00\x00\x0f\xf8\xe3\x8a\x1f\x9c\xf3\xc5\x1f\xf9\xbf?\xc1\rv\xd3j\r6\x7f\x00'/141, 0x0) read(r0, 0x0, 0xfffffea1) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000340)={0x1, &(0x7f0000000380)=[{0x6, 0x5, 0x87, 0x7ffc0201}]}) rseq(&(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1}, 0x20, 0x0, 0x0) r1 = syz_io_uring_setup(0xf03, &(0x7f0000000140)={0x0, 0x595f, 0x10000, 0x3, 0x3a3}, &(0x7f00000001c0)=0x0, &(0x7f0000000200)=0x0, &(0x7f0000000240)=0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000400)={0x26, 'aead\x00', 0x0, 0x0, 'ccm(aes)\x00'}, 0x58) r6 = accept4(r5, 0x0, 0x0, 0x800) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write$cgroup_subtree(r8, &(0x7f00000004c0)=ANY=[], 0x48) splice(r7, 0x0, r6, 0x0, 0x4, 0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_NOP={0x0, 0x8, 0x0, r1, 0x2, 0x600, 0xfffffffe, 0x1, 0x1, {0xfffb}}) openat(r0, &(0x7f0000000300)='./file0\x00', 0x10000, 0x100) io_uring_enter(r1, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) pwritev(0xffffffffffffffff, 0x0, 0x0, 0xfffffff8, 0x7) 1.926932735s ago: executing program 6 (id=469): r0 = syz_open_dev$dri(&(0x7f0000000000), 0x1ff, 0x0) ioctl$DRM_IOCTL_WAIT_VBLANK(r0, 0xc018643a, &(0x7f0000000140)={0x1}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000180)={0xa, 0x4e22, 0x0, @loopback}, 0x58) listen(r1, 0x5) r2 = syz_open_dev$loop(&(0x7f00000014c0), 0x4, 0x2) ioctl$LOOP_CONFIGURE(r2, 0x4c0a, &(0x7f0000001540)={0xffffffffffffffff, 0x9, {0x0, 0x0, 0x0, 0xbb, 0x1b99, 0x0, 0x3, 0x4, 0x13, "b7f8ada941fbfa24b230324b3122fe227031c9fb2622e97099e554942542690fb0219cbefea4d3a5c75b831367cbd848f5a1b04aff3568c826ed63af1057abf6", "e5774ce57e1395c66549c09e1a753713979872f8b081a61f3a2ce683ee7b6ead66b72f1365216f05a2ea09d6cd61fc85ebf757186da4d22874517bf0100dd87b", "8cbcf6468f994f1274302174ba4d9ee37a68f48b1ba174b75fe8178e0debfa0a", [0x80000000, 0xffffffffffffff4e]}}) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x6770c000) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x202, 0x0) ioctl$TCSETS(r3, 0x40045431, &(0x7f0000000dc0)={0x0, 0x3, 0x1000002, 0x0, 0x5, "d52c2000000102000300ecffffff0100"}) openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0301, 0x0) r4 = syz_open_dev$sndctrl(&(0x7f0000000240), 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r4, 0xc2c45512, &(0x7f0000000340)={{0x3, 0x0, 0x0, 0x1000000, 'syz0\x00'}, 0x0, [0x0, 0xffffffff, 0xffff, 0x0, 0x1000000, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x200080, 0x4000, 0x3, 0x0, 0xfffffffc, 0x0, 0x5, 0x0, 0x0, 0x0, 0x1fb, 0x0, 0xffffffff, 0xfffffffe, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x20, 0x0, 0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffdffc7, 0x8, 0xffff, 0x3, 0x401, 0x5, 0x3, 0x2, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x65, 0x80000001, 0x0, 0x0, 0x5, 0xf1e9, 0x0, 0x0, 0x2147, 0x0, 0x0, 0x0, 0x7, 0x0, 0x3, 0x4, 0x0, 0x0, 0x0, 0x1ff, 0xfffffffc, 0x0, 0x0, 0x7, 0x0, 0xffffffff, 0x5, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x800, 0x1, 0x0, 0x0, 0x0, 0x4000000, 0x0, 0x0, 0x0, 0x200040]}) r5 = syz_open_dev$dri(&(0x7f00000001c0), 0x1, 0x0) preadv(r5, &(0x7f0000000280)=[{0x0}, {&(0x7f0000000640)=""/96, 0x60}], 0x2, 0x4, 0x8008) ioctl$DRM_IOCTL_WAIT_VBLANK(r5, 0xc018643a, &(0x7f00000006c0)={0x4000000, 0x5, 0x3}) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x40001, 0x0) ioctl$BLKZEROOUT(r6, 0x127f, &(0x7f0000000240)={0x600, 0x1000000}) r7 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f00000000c0)={'ipvlan0\x00', 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.swap.events\x00', 0x275a, 0x0) setsockopt$sock_attach_bpf(r9, 0x1, 0x2a, &(0x7f0000000100)=r10, 0x4) r11 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r11, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r8, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc, 0x1], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) sendmsg$nl_route_sched(r11, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xfffbffff, {0x0, 0x0, 0x0, r8, {0x0, 0xd}, {0x7, 0xffff}, {0xc, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x1c, 0x2, [@TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x8001}]}]}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8, 0x5, 0x7}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40005}, 0x8010) setsockopt$MRT6_PIM(r11, 0x29, 0xcf, &(0x7f00000000c0), 0x4) 1.866556703s ago: executing program 4 (id=470): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000400), 0x90080, 0x0) r1 = socket$inet_smc(0x2b, 0x1, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000100)={0x2, 0x4e21, @broadcast}, 0x10) connect$inet(r2, &(0x7f0000000140)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) sendto$inet(r2, &(0x7f0000000180), 0xffffffffffffff94, 0x0, 0x0, 0x0) r3 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000200)={'lo\x00', 0x0}) syz_clone(0x4820000, 0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=@newqdisc={0x60, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r5, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0xea, 0x2, 0x0, 0x1, 0x1009, 0x7c}, {0x3, 0x2, 0x0, 0x401, 0x8001}, 0x0, 0x5, 0x10000000}}, @TCA_TBF_BURST={0x8, 0x6, 0x8057}]}}]}, 0x60}}, 0x44080) sendmsg$nl_route_sched(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000480)=@newqdisc={0x4c, 0x24, 0xd0f, 0x170bd2b, 0x25dfdbff, {0x60, 0x0, 0x0, r5, {}, {0xe, 0xa}, {0xf, 0x1}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x1c, 0x2, [@TCA_CAKE_MEMORY={0x8, 0xa, 0x9}, @TCA_CAKE_RAW={0x8, 0xc, 0x1}, @TCA_CAKE_DIFFSERV_MODE={0x8, 0x3, 0x3}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x48045}, 0x0) recvfrom$inet(r2, 0x0, 0x0, 0x720, 0x0, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x14, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWSET={0x4c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x8}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x4}, @NFTA_SET_DATA_LEN={0x8, 0x7, 0x1, 0x0, 0x4}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xb4}}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000006c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWSETELEM={0x4c, 0xc, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x20, 0x3, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x8, 0x1, "11223344"}]}, @NFTA_SET_ELEM_DATA={0xc, 0x2, 0x0, 0x1, [@NFTA_DATA_VALUE={0x8, 0x1, "55667788"}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x74}}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000007c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @lookup={{0xb}, @val={0x18, 0x2, 0x0, 0x1, [@NFTA_LOOKUP_SET={0x9, 0x1, 'syz1\x00'}, @NFTA_LOOKUP_SREG={0x8, 0x2, 0x1, 0x0, 0x1}]}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x80}}, 0x0) shutdown(r2, 0x0) r7 = openat$panthor(0xffffff9c, &(0x7f0000000840), 0x2, 0x0) ioctl$DRM_IOCTL_MODE_LIST_LESSEES(r7, 0xc01064c7, &(0x7f00000008c0)={0x4, 0x0, &(0x7f0000000880)=[0x0, 0x0, 0x0, 0x0]}) pipe2$9p(&(0x7f0000000080), 0x80000) ioctl$int_in(r1, 0x5421, &(0x7f0000000000)=0x100000001) connect$inet(r1, &(0x7f0000000040)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x4}}, 0x10) close(r1) r8 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_XEN_HVM_CONFIG(r8, 0x4038ae7a, &(0x7f0000000440)={0x80, 0x40000105, 0x0, 0x0}) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x1) ioctl$KVM_RUN(r9, 0xae80, 0x0) 1.662443638s ago: executing program 3 (id=471): pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r2 = socket(0x2b, 0x80801, 0x1) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e23, 0x3ff, @ipv4={'\x00', '\xff\xff', @empty}, 0xfffffffe}, 0x1c) read$alg(r2, &(0x7f0000000200)=""/4099, 0x1003) close(r0) mount$9p_fd(0x0, &(0x7f0000000140)='.\x00', &(0x7f0000000180), 0x121484b, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) syz_genetlink_get_family_id$nl80211(&(0x7f0000001240), r2) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000001280)={'wlan1\x00'}) getsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000000000), &(0x7f0000000040)=0x4) 1.586926105s ago: executing program 4 (id=472): mkdirat(0xffffffffffffff9c, &(0x7f0000001380)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f00000013c0), &(0x7f0000001400)='./file0\x00', &(0x7f0000001440), 0x2210088, 0x0) chdir(0x0) mount$bind(&(0x7f0000001580)='./file0\x00', &(0x7f00000015c0)='./file0\x00', 0x0, 0x3125819, 0x0) umount2(&(0x7f0000000080)='./file0\x00', 0xb) lsetxattr$system_posix_acl(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='system.posix_acl_access\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="02000000010005000000000002000000", @ANYRES32, @ANYBLOB="02000700", @ANYRES32, @ANYBLOB="02000500", @ANYRES32, @ANYBLOB="02000000", @ANYRES32=0xee01, @ANYBLOB="02000400", @ANYRES32, @ANYBLOB="040008001000002500000000000000000000000000002000"], 0x4c, 0x1) 1.586384373s ago: executing program 6 (id=473): r0 = socket$inet_sctp(0x2, 0x5, 0x84) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x4) fchmodat(r1, &(0x7f0000000040)='./file0\x00', 0x10) setsockopt$IP_VS_SO_SET_EDITDEST(r0, 0x0, 0x489, &(0x7f0000000380)={{0x84, @multicast1, 0x4e20, 0x3, 'ovf\x00', 0x0, 0x60000000, 0xc}, {@rand_addr=0x64010102, 0x4e23, 0x2000, 0x8, 0x48001}}, 0x44) 1.584756948s ago: executing program 3 (id=474): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000006c0)=ANY=[@ANYBLOB="b80800002c0001002bbd30005823a475624f94434ae8000000000000000000000000000000000001fe80000000000000000040000000000f000000000000000065d1f5fc1a4e48084bc656385c1a37a7b7dbd4d3c9a10c96033810cd", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000003c00000000000000ffffffffffffffff000000000020000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008010000000000000001010000"], 0xb8}}, 0x0) r0 = socket$inet(0xa, 0x801, 0x84) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000440)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@struct]}}, 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0xd, 0x3, &(0x7f0000000940)=@framed, &(0x7f0000000980)='GPL\x00', 0x5, 0x1f6, &(0x7f00000009c0)=""/168, 0x0, 0x0, '\x00', 0x0, @sock_ops, r1, 0x8, 0x0, 0x0, 0x18, &(0x7f0000000a80), 0x1}, 0x6d) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x1, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) r3 = io_uring_setup(0x2e08, &(0x7f00000001c0)={0x0, 0x5acf, 0x40, 0xffffffff}) io_uring_register$IORING_REGISTER_BUFFERS(r3, 0x0, &(0x7f0000000240)=[{&(0x7f0000001700)=""/4095, 0xfff}], 0x1) r4 = userfaultfd(0x80001) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000000c0)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)=ANY=[@ANYBLOB="280000001c0001042bfb68000000000000000000", @ANYRES32=r6, @ANYBLOB="8000f6050a0002000180c2000002"], 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x4040040) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000180)={0xaa, 0x1a5}) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) ioctl$UFFDIO_COPY(r4, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000}) connect$inet(r0, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r0, 0x8) r7 = accept4(r0, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r7, 0x84, 0x1f, &(0x7f0000000580)={0x0, @in={{0x2, 0x4e24, @empty}}, 0x7b, 0x983a}, 0x90) openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/ptp/ptp0/n_vclocks\x00', 0x2, 0x0) 1.51697533s ago: executing program 4 (id=475): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x41100, 0xb, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) syz_emit_ethernet(0x0, 0x0, 0x0) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYRES32, @ANYBLOB="0100"/18, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/24], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1b, 0xc, &(0x7f0000000900)=@framed={{0x18, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x0, 0xffffffff}, [@ringbuf_output={{0x18, 0x5, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x80000000}, {0x3, 0x3, 0x3, 0xa, 0x5}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x1e}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, &(0x7f0000000100)={0x0, 'erspan0\x00', {0x1}, 0x26}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./file2\x00', 0x86) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0xa, &(0x7f0000000080)=ANY=[], &(0x7f0000000040)='syzkaller\x00', 0x2, 0x0, 0x0, 0x41100, 0xc}, 0x94) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(r4, &(0x7f00000007c0)={&(0x7f0000000400), 0xc, &(0x7f0000000780)={&(0x7f00000006c0)={0xb8, 0x0, 0x8, 0x70bd2a, 0x25dfdbfc, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0x400}, {0x6, 0x11, 0x5}}, {{@pci={{0x8}, {0x11}}, {0x8}}, {0x8, 0xb, 0xffff}, {0x6, 0x11, 0xd}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}, {0x8}, {0x6, 0x11, 0x1000}}]}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x40) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) symlink(0x0, &(0x7f0000000300)='./file0/file0\x00') r5 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) ioctl$COMEDI_DEVCONFIG(r5, 0x40946400, &(0x7f0000000600)={'c6xdigio\x00', [0x7c, 0x1f, 0x0, 0xc, 0x10, 0x4, 0x100002, 0x7, 0x5, 0x100, 0x4, 0x1, 0x1, 0x20003, 0x7ff, 0x8, 0x83, 0x8, 0x1010003, 0x0, 0x18, 0x0, 0x3, 0xffffffff, 0xb, 0xfffffff9, 0x38, 0xc, 0x10000006, 0x664, 0xfffffff8]}) ioctl$COMEDI_INSNLIST(r5, 0x8008640b, &(0x7f00000edb40)={0x1, &(0x7f00000ed9c0)=[{0xe000003, 0xf, &(0x7f00000016c0)=[0xe6, 0x3, 0x2, 0x7, 0x0, 0x2, 0xbd, 0x4, 0x1, 0xa3c, 0x8000, 0x4005, 0x3, 0x8001, 0xb7], 0xa145, 0x7}]}) 1.516718594s ago: executing program 6 (id=476): syz_usb_connect$hid(0x1, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$binfmt_format(0xffffffffffffff9c, 0x0, 0x2, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg$unix(0xffffffffffffffff, 0x0, 0x11) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) mount(0x0, &(0x7f0000000140)='./sys\x00', &(0x7f0000000180)='sysfs\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000240)=""/100, 0x64) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="6000000002060300000000000000000007000000140007800500150002000000080012400000000414000300686173683a69702c706f72742c697000050005000200000005000400050000000900020073797a310000000005000100"], 0x60}, 0x1, 0x0, 0x0, 0x810}, 0x20004000) sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)={0x5c, 0x9, 0x6, 0x3, 0x0, 0x0, {0xa}, [@IPSET_ATTR_DATA={0x34, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}, @IPSET_ATTR_IP2={0xc, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x5064}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x6}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20004894}, 0x20004000) syz_usb_connect(0x3, 0x101, &(0x7f0000000400)={{0x12, 0x1, 0xd076e307c59a3f0b, 0xad, 0x2, 0xab, 0x40, 0x1b80, 0xe400, 0xdc3a, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xef, 0x1, 0x3, 0x2, 0xf0, 0x1, "", [{{0x9, 0x4, 0xb5, 0x2, 0x3, 0x1f, 0xb5, 0x68, 0x8, [@uac_as={[@format_type_ii_discrete={0xd, 0x24, 0x2, 0x2, 0x7, 0xd628, 0x19, "e2f4512f"}]}], [{{0x9, 0x5, 0x4, 0x1, 0x8, 0x5, 0x8b, 0x6}}, {{0x9, 0x5, 0x80, 0x1, 0x8, 0xfd, 0xfb, 0x5, [@uac_iso={0x7, 0x25, 0x1, 0x4, 0x4, 0x5}]}}, {{0x9, 0x5, 0xe, 0x10, 0x10, 0x9, 0x9, 0x1, [@generic={0xa7, 0x11, "ea1d1c2e1b2afd50836cb7f909780fed2ceaed689da97f2b29c9c42a236989d1f9134f40f8cd4d830d5165c05f18fca247b13725b332da247bd39a062f0cb0891373a9e258d59a14c13b27369679034edba8192934c215468ca750a74d3a2d53d0cb5a1c437d5c6f73ab3115de9d3dcb5b80f616f8f1b57d17ddf1ea70486cf0bd128d82b733dbd4bc84567c29a310ad019560ab5d6240fb99966f7941f4a6a9e50133c6c4"}, @uac_iso={0x7, 0x25, 0x1, 0x8, 0x8, 0xfff7}]}}]}}]}}]}}, &(0x7f0000000840)={0xa, &(0x7f0000000540)={0xa, 0x6, 0x201, 0x8, 0xff, 0x4, 0x0, 0x7}, 0xc, &(0x7f0000000580)={0x5, 0xf, 0xc, 0x1, [@ext_cap={0x7, 0x10, 0x2, 0x12, 0x6, 0x7, 0xf0}]}, 0x3, [{0xb0, &(0x7f00000005c0)=@string={0xb0, 0x3, "04b874a4addfa91fd9c0c71cb3176b1864a682e559189efd24e0daf91111a166370eab3e46cbc901c9ca0b41433cecdaf01c636b3b291097e37bb397a0f68b6d092e40c6dce784df40ec38f753fe540c1d2c335ffdb020c9e72fbac72077f8323644cc8042312b6de5d210eb6f00935dcc29b3c0ead7a6490f7c9982a07f972eae9baad351743d3b2ff3625a01a0b50a52e9456eaff12e1b8960a96f9848d3bad4749c7513aa6209357ee7461b7a"}}, {0xa2, &(0x7f0000000680)=@string={0xa2, 0x3, "a7a1250fdfe81eec543637ba24cd6f5bdea5567fe4cf54aab905603f50bdcbeacd970a03e823aabca4ecbe8881f662aeb15f8946115fde8b6060c1ef04f8d8d2a7ce71ca9e1a24b518ee08b2fba1359649b6692c7299ecb3ea9b55593d3291893bf2e6ab093667a2ef8ad78f203e7b710d74a1ad4f0cea1066e53521aaebbc787d1180d529ee66535bccdaf6751cc8d8959b923fc5487de7e48a37e4b37316d9"}}, {0xf8, &(0x7f0000000740)=@string={0xf8, 0x3, "266ac3029a45517a772f17517c2ccc4bc738b3267f1a8171422470b76eaaced5ec11fcdab09a24fde69d22c70f2acf7497938aeae761dfaf2b50e35c0a76277015536e35f508cfc1bbdbfcb918924903b69d22e597cede4cbe2250448f3cde241f7b0b8f97c2c7924eb3085501be688c3c579197864b15586299cadbd4bc4f719a4d6b88abf0d188bdad88fd5a1ac237c4f76741fa68e82c92a36343110ae7a9515a7822cfd902e4aba2bed3db95351982ca697ee2d1e8a58df9e3727540b2d626aa99b595bb0bc1f36cd9f5d04637614082726b26dc7d2e968a37e703fb6873a8f6cee6f6f6c96ee59bdf780045b10b19aae193890c"}}]}) 891.270193ms ago: executing program 8 (id=477): r0 = openat$ttynull(0xffffffffffffff9c, &(0x7f00000000c0), 0x88002, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000240)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000540)=ANY=[@ANYBLOB="4c00000010000d042dbd7000f8dbdf2500000000", @ANYRES32=r3, @ANYRES8], 0x4c}, 0x1, 0x0, 0x0, 0x400e8c0}, 0x8000) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0xd) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_percpu\x00', 0x275a, 0x0) fcntl$lock(r4, 0x6, &(0x7f0000000000)={0x0, 0x0, 0x8}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x2da, &(0x7f00000005c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3d}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x8001, 0x0) ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f0000000080)={0x2, 0x0, [{0x10, 0x0, 0x4}, {0x10, 0x0, 0x8}]}) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r6 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r6, 0x0, 0x40, &(0x7f0000002800)=@nat={'nat\x00', 0x670, 0x5, 0x324, 0x2d4, 0x0, 0xffffffff, 0x0, 0x0, 0x378, 0x378, 0xffffffff, 0x378, 0x378, 0x5, 0x0, {[{{@uncond, 0x0, 0x70, 0xa4, 0x48}, @MASQUERADE={0x34, 'MASQUERADE\x00', 0x0, {0x1, {0x0, @rand_addr=0x64010101, @loopback, @gre_key=0x3, @port=0x4e22}}}}, {{@uncond, 0x0, 0x70, 0xa4}, @DNAT0={0x34, 'DNAT\x00', 0x0, {0x1, {0x1b, @initdev={0xac, 0x1e, 0x0, 0x0}, @local, @port=0x4e20, @icmp_id=0x65}}}}, {{@ip={@loopback, @private=0xa010102, 0xff, 0x0, 'veth0_to_batadv\x00', 'batadv_slave_1\x00', {}, {}, 0x0, 0x3, 0x4}, 0x0, 0x70, 0xa4}, @MASQUERADE={0x34, 'MASQUERADE\x00', 0x0, {0x1, {0x2, @loopback, @remote, @icmp_id=0x67, @gre_key=0xe63e}}}}, {{@uncond, 0x0, 0x70, 0xa4}, @DNAT0={0x34, 'DNAT\x00', 0x0, {0x1, {0x10, @rand_addr, @multicast2, @port=0x4e23, @icmp_id}}}}], {{'\x00', 0x0, 0x70, 0x94}, {0x24}}}}, 0x380) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r7 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r7, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r8 = socket$inet_icmp(0x2, 0x2, 0x1) ioctl$sock_SIOCADDRT(r8, 0x890b, &(0x7f0000000440)={0x0, @l2tp={0x2, 0x0, @private=0xa010100, 0x3, 0xfdfd}, @nl=@unspec, @isdn={0x22, 0x2, 0x7, 0xfe, 0x9}, 0xa55c, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000500)='ip6_vti0\x00', 0x7, 0x2000004, 0x3}) ioctl$XFS_IOC_GETBMAP(r4, 0xc0205826, &(0x7f0000000980)={0x5, 0x1d7, 0x6e, 0x0, 0x4}) connect$rxrpc(0xffffffffffffffff, &(0x7f0000000100)=@in4={0x21, 0x80, 0x2, 0x10, {0x2, 0x8003, @multicast2}}, 0x24) sendmmsg(0xffffffffffffffff, &(0x7f0000000180)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1000000010010000"], 0x10, 0xe000}, 0x5}], 0x1, 0x0) r9 = open(&(0x7f0000000040)='./bus\x00', 0x143142, 0x80) ftruncate(r9, 0x2007ffb) sendfile(r0, r9, 0x0, 0x1000000201002) 0s ago: executing program 6 (id=478): socket$packet(0x11, 0x2, 0x300) socket$packet(0x11, 0x2, 0x300) (async) socket$packet(0x11, 0x2, 0x300) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0xc, 0x2, &(0x7f00000008c0)=ANY=[@ANYBLOB="850000002600000095"], &(0x7f0000000640)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0xc, 0x2, &(0x7f00000008c0)=ANY=[@ANYBLOB="850000002600000095"], &(0x7f0000000640)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$rxrpc(0x21, 0x2, 0x2) (async) r0 = socket$rxrpc(0x21, 0x2, 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./sys\x00', &(0x7f0000000100)='omfs\x00', 0x0, 0x0) (async) mount(0x0, &(0x7f00000000c0)='./sys\x00', &(0x7f0000000100)='omfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/kernel/printk\x00', 0x1, 0x0) write(r1, &(0x7f0000000180)='0 0 0 0\n', 0x8) close(r1) (async) close(r1) openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/kernel/panic_on_warn\x00', 0x1, 0x0) (async) r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/kernel/panic_on_warn\x00', 0x1, 0x0) write(r2, &(0x7f0000000200)='0\n\x00', 0x2) close(r2) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./sys\x00', 0x1ff) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000280)='./sys\x00', &(0x7f00000002c0)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/module/kernel/parameters/panic_on_warn\x00', 0x1, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/module/phram/parameters/phram\x00', 0x1, 0x0) write(r3, &(0x7f0000000380)='test,0x8000000000000000,0x1000\x00', 0x1e) close(r3) r4 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r4, &(0x7f0000000000)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e20, @empty}}, 0x24) (async) bind$rxrpc(r4, &(0x7f0000000000)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e20, @empty}}, 0x24) bind$rxrpc(r0, 0x0, 0x0) (async) bind$rxrpc(r0, 0x0, 0x0) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r6, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r6, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x64, &(0x7f00000003c0)=[@in={0x2, 0x4e22, @rand_addr=0x64010103}, @in6={0xa, 0x4e22, 0x9c, @private1={0xfc, 0x1, '\x00', 0x1}, 0x6}, @in6={0xa, 0x4e22, 0x9, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x5}, @in6={0xa, 0x4e22, 0x6, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x4}]}, &(0x7f0000000440)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r6, 0x84, 0x7a, &(0x7f0000000480)={r7, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000540)=0x84) dup(r5) dup(r5) (async) r8 = dup(r5) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r8, 0x84, 0x9, &(0x7f0000000580)={0x0, @in6={{0xa, 0x4e22, 0xf, @private1, 0x1}}, 0x9, 0xbffc, 0xe652, 0x2, 0x24, 0x8, 0xff}, 0x9c) kernel console output (not intermixed with test programs): policy elements [ 67.747845][ T6317] netlink: 8 bytes leftover after parsing attributes in process `syz.1.122'. [ 68.511564][ T6321] netlink: 32 bytes leftover after parsing attributes in process `syz.0.123'. [ 68.809237][ T50] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 68.969886][ T50] usb 5-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 68.970840][ T50] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 68.970864][ T50] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 68.970895][ T50] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 68.982898][ T50] usb 5-1: config 0 descriptor?? [ 69.429704][ T50] usbhid 5-1:0.0: can't add hid device: -71 [ 69.429793][ T50] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 70.169543][ T50] usb 5-1: USB disconnect, device number 2 [ 70.574697][ T6348] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 70.926822][ T1435] ieee802154 phy0 wpan0: encryption failed: -22 [ 70.927114][ T1435] ieee802154 phy1 wpan1: encryption failed: -22 [ 70.927135][ T63] cfg80211: failed to load regulatory.db [ 71.601806][ T6365] xt_policy: too many policy elements [ 73.228192][ T6389] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 73.596846][ T29] corsair-cpro 0003:1B1C:0C10.0002: hidraw1: USB HID v0.00 Device [syz0] on syz0 [ 73.991959][ T29] corsair-cpro 0003:1B1C:0C10.0002: probe with driver corsair-cpro failed with error -110 [ 74.218151][ T6411] netlink: 8 bytes leftover after parsing attributes in process `syz.1.147'. [ 74.505178][ T6418] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 74.953052][ T5826] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 75.008288][ T5826] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 75.083540][ T5826] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 75.143676][ T5826] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 75.243378][ T5094] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 75.244012][ T5094] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 75.244751][ T5094] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 75.246151][ T5094] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 75.247816][ T5094] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 75.336187][ T6445] netlink: 4 bytes leftover after parsing attributes in process `syz.2.159'. [ 75.352307][ T5826] bridge_slave_1: left allmulticast mode [ 75.352350][ T5826] bridge_slave_1: left promiscuous mode [ 75.353057][ T5826] bridge0: port 2(bridge_slave_1) entered disabled state [ 75.358860][ T5826] bridge_slave_0: left allmulticast mode [ 75.358879][ T5826] bridge_slave_0: left promiscuous mode [ 75.362741][ T5826] bridge0: port 1(bridge_slave_0) entered disabled state [ 75.498406][ T5826] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 75.504216][ T5826] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 75.506015][ T5826] bond0 (unregistering): Released all slaves [ 75.555675][ T6457] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 75.558054][ T5447] 8021q: adding VLAN 0 to HW filter on device eth2 [ 75.682396][ T6439] rxe_eth0 speed is unknown, defaulting to 1000 [ 75.757470][ T5447] 8021q: adding VLAN 0 to HW filter on device eth3 [ 76.044037][ T6484] i2c i2c-0: new_device: Instantiated device rt1719 at 0x49 [ 76.045804][ T6484] wusb3801 0-0004: supply vbus not found, using dummy regulator [ 76.076679][ T10] corsair-cpro 0003:1B1C:0C10.0003: hidraw1: USB HID v0.00 Device [syz0] on syz0 [ 76.088415][ T5826] hsr_slave_0: left promiscuous mode [ 76.116749][ T6484] i2c i2c-0: new_device: Instantiated device wusb3801 at 0x04 [ 76.138881][ T5826] hsr_slave_1: left promiscuous mode [ 76.141618][ T5826] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 76.141646][ T5826] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 76.143376][ T5826] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 76.143391][ T5826] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 76.153602][ T5826] veth1_macvtap: left promiscuous mode [ 76.154076][ T5826] veth0_macvtap: left promiscuous mode [ 76.154247][ T5826] veth1_vlan: left promiscuous mode [ 76.154364][ T5826] veth0_vlan: left promiscuous mode [ 76.426961][ T10] corsair-cpro 0003:1B1C:0C10.0003: probe with driver corsair-cpro failed with error -110 [ 76.608836][ T5826] team0 (unregistering): Port device team_slave_1 removed [ 76.701117][ T5826] team0 (unregistering): Port device team_slave_0 removed [ 76.834561][ T5447] 8021q: adding VLAN 0 to HW filter on device eth4 [ 77.329968][ T5737] Bluetooth: hci0: command tx timeout [ 77.432451][ T6511] 9pnet_virtio: no channels available for device syz [ 77.543931][ T5447] 8021q: adding VLAN 0 to HW filter on device eth5 [ 77.696597][ T6439] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.696668][ T6439] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.696723][ T6439] bridge_slave_0: entered allmulticast mode [ 77.697391][ T6439] bridge_slave_0: entered promiscuous mode [ 77.709643][ T6439] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.709755][ T6439] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.709842][ T6439] bridge_slave_1: entered allmulticast mode [ 77.710880][ T6439] bridge_slave_1: entered promiscuous mode [ 77.743086][ T6439] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 77.745310][ T6439] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 77.748883][ T6521] FAULT_INJECTION: forcing a failure. [ 77.748883][ T6521] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 77.748922][ T6521] CPU: 0 UID: 0 PID: 6521 Comm: syz.1.170 Not tainted syzkaller #0 PREEMPT(full) [ 77.748942][ T6521] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 77.748953][ T6521] Call Trace: [ 77.748960][ T6521] [ 77.748967][ T6521] dump_stack_lvl+0x100/0x190 [ 77.749021][ T6521] should_fail_ex.cold+0x5/0xa [ 77.749061][ T6521] _copy_from_iter+0x1f4/0x1690 [ 77.749122][ T6521] ? __asan_memset+0x23/0x50 [ 77.749145][ T6521] ? __pfx__copy_from_iter+0x10/0x10 [ 77.749164][ T6521] ? __pfx___alloc_skb+0x10/0x10 [ 77.749224][ T6521] ? is_bpf_text_address+0x94/0x1a0 [ 77.749260][ T6521] netlink_sendmsg+0x8f5/0x10c0 [ 77.749290][ T6521] ? __pfx_netlink_sendmsg+0x10/0x10 [ 77.749322][ T6521] ? apparmor_socket_sendmsg+0x165/0x280 [ 77.749345][ T6521] ? ____sys_sendmsg+0xa4d/0xbe0 [ 77.749365][ T6521] ____sys_sendmsg+0xa4d/0xbe0 [ 77.749384][ T6521] ? __pfx_netlink_sendmsg+0x10/0x10 [ 77.749410][ T6521] ? __pfx_____sys_sendmsg+0x10/0x10 [ 77.749439][ T6521] ___sys_sendmsg+0x190/0x1e0 [ 77.749461][ T6521] ? __pfx____sys_sendmsg+0x10/0x10 [ 77.749493][ T6521] ? find_held_lock+0x2b/0x80 [ 77.749528][ T6521] __sys_sendmsg+0x160/0x210 [ 77.749555][ T6521] ? __pfx___sys_sendmsg+0x10/0x10 [ 77.749596][ T6521] __do_fast_syscall_32+0x14b/0x8c0 [ 77.749633][ T6521] ? lockdep_hardirqs_on+0x7d/0x110 [ 77.749658][ T6521] do_fast_syscall_32+0x32/0x70 [ 77.749680][ T6521] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 77.749702][ T6521] RIP: 0023:0xf7f92fbc [ 77.749717][ T6521] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 77.749734][ T6521] RSP: 002b:00000000f544650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 77.749762][ T6521] RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 00000000800002c0 [ 77.749772][ T6521] RDX: 0000000000000004 RSI: 0000000000000000 RDI: 0000000000000000 [ 77.749782][ T6521] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 77.749792][ T6521] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 77.749802][ T6521] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 77.749825][ T6521] [ 77.769350][ T6439] team0: Port device team_slave_0 added [ 77.774498][ T6439] team0: Port device team_slave_1 added [ 77.805545][ T6439] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 77.805559][ T6439] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 77.805578][ T6439] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 77.810153][ T6439] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 77.810174][ T6439] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 77.810196][ T6439] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 77.882425][ T6439] hsr_slave_0: entered promiscuous mode [ 77.882843][ T6439] hsr_slave_1: entered promiscuous mode [ 77.883162][ T6439] debugfs: 'hsr0' already exists in 'hsr' [ 77.883178][ T6439] Cannot create hsr debugfs directory [ 77.915999][ T5826] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 78.011782][ T5826] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 78.050935][ T6439] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 78.054102][ T6439] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 78.054600][ T6533] all: renamed from bridge_slave_1 (while UP) [ 78.058849][ T6439] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 78.066403][ T6439] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 78.068800][ T6439] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 78.075904][ T6439] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 78.076624][ T6439] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 78.083448][ T6439] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 78.102343][ T5826] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 78.109370][ T5094] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 78.113106][ T5094] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 78.114212][ T5094] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 78.114996][ T5094] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 78.115375][ T5094] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 78.171996][ T5826] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 78.202963][ T6439] 8021q: adding VLAN 0 to HW filter on device bond0 [ 78.217257][ T6439] 8021q: adding VLAN 0 to HW filter on device team0 [ 78.227223][ T332] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.227296][ T332] bridge0: port 1(bridge_slave_0) entered forwarding state [ 78.243387][ T332] bridge0: port 2(bridge_slave_1) entered blocking state [ 78.243459][ T332] bridge0: port 2(bridge_slave_1) entered forwarding state [ 78.338239][ T5826] bridge_slave_1: left allmulticast mode [ 78.338315][ T5826] bridge_slave_1: left promiscuous mode [ 78.339789][ T5826] bridge0: port 2(bridge_slave_1) entered disabled state [ 78.351202][ T5826] bridge_slave_0: left allmulticast mode [ 78.351224][ T5826] bridge_slave_0: left promiscuous mode [ 78.351434][ T5826] bridge0: port 1(bridge_slave_0) entered disabled state [ 78.475811][ T5826] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 78.478249][ T5826] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 78.484116][ T5826] bond0 (unregistering): Released all slaves [ 78.552534][ T6536] rxe_eth0 speed is unknown, defaulting to 1000 [ 78.644874][ T6572] netlink: 20 bytes leftover after parsing attributes in process `syz.0.175'. [ 78.661811][ T6575] FAULT_INJECTION: forcing a failure. [ 78.661811][ T6575] name failslab, interval 1, probability 0, space 0, times 1 [ 78.661838][ T6575] CPU: 1 UID: 0 PID: 6575 Comm: syz.1.174 Not tainted syzkaller #0 PREEMPT(full) [ 78.661857][ T6575] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 78.661867][ T6575] Call Trace: [ 78.661872][ T6575] [ 78.661879][ T6575] dump_stack_lvl+0x100/0x190 [ 78.661906][ T6575] should_fail_ex.cold+0x5/0xa [ 78.661928][ T6575] ? __pfx_switchdev_port_obj_del_deferred+0x10/0x10 [ 78.661965][ T6575] should_failslab+0xc2/0x120 [ 78.661990][ T6575] __kmalloc_noprof+0xfc/0x840 [ 78.662011][ T6575] ? kfree_skbmem+0x19a/0x210 [ 78.662031][ T6575] ? switchdev_deferred_enqueue+0x3e/0x2d0 [ 78.662054][ T6575] ? __pfx_switchdev_port_obj_del_deferred+0x10/0x10 [ 78.662075][ T6575] switchdev_deferred_enqueue+0x3e/0x2d0 [ 78.662098][ T6575] switchdev_port_obj_del+0xf3/0x150 [ 78.662119][ T6575] br_switchdev_mdb_notify+0x23a/0x570 [ 78.662152][ T6575] ? __pfx_br_switchdev_mdb_notify+0x10/0x10 [ 78.662176][ T6575] ? __dev_queue_xmit+0x1c25/0x4a40 [ 78.662203][ T6575] ? __lock_acquire+0x5c0/0x1f40 [ 78.662228][ T6575] __br_mdb_notify+0x5c4/0x830 [ 78.662255][ T6575] __br_multicast_del_pg+0x231/0x1ce0 [ 78.662274][ T6575] ? do_raw_spin_lock+0x128/0x260 [ 78.662299][ T6575] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 78.662328][ T6575] br_mdb_del_bulk+0x650/0xae0 [ 78.662356][ T6575] ? __pfx_br_mdb_del_bulk+0x10/0x10 [ 78.662387][ T6575] ? __nla_parse+0x40/0x60 [ 78.662406][ T6575] ? __pfx_br_mdb_del_bulk+0x10/0x10 [ 78.662429][ T6575] rtnl_mdb_del+0x2f1/0x650 [ 78.662446][ T6575] ? __pfx_rtnl_mdb_del+0x10/0x10 [ 78.662467][ T6575] ? __pfx_rtnl_mdb_del+0x10/0x10 [ 78.662483][ T6575] rtnetlink_rcv_msg+0x3c9/0xe90 [ 78.662503][ T6575] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 78.662527][ T6575] ? ref_tracker_free+0x37e/0x6c0 [ 78.662554][ T6575] netlink_rcv_skb+0x159/0x420 [ 78.662578][ T6575] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 78.662596][ T6575] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 78.662627][ T6575] ? netlink_deliver_tap+0x1ae/0xcc0 [ 78.662653][ T6575] netlink_unicast+0x65f/0x950 [ 78.662679][ T6575] ? __pfx_netlink_unicast+0x10/0x10 [ 78.662709][ T6575] netlink_sendmsg+0x9ac/0x10c0 [ 78.662736][ T6575] ? __pfx_netlink_sendmsg+0x10/0x10 [ 78.662765][ T6575] ? apparmor_socket_sendmsg+0x165/0x280 [ 78.662787][ T6575] ? ____sys_sendmsg+0xa4d/0xbe0 [ 78.662805][ T6575] ____sys_sendmsg+0xa4d/0xbe0 [ 78.662823][ T6575] ? __pfx_netlink_sendmsg+0x10/0x10 [ 78.662848][ T6575] ? __pfx_____sys_sendmsg+0x10/0x10 [ 78.662878][ T6575] ___sys_sendmsg+0x190/0x1e0 [ 78.662900][ T6575] ? __pfx____sys_sendmsg+0x10/0x10 [ 78.662931][ T6575] ? find_held_lock+0x2b/0x80 [ 78.662963][ T6575] __sys_sendmsg+0x160/0x210 [ 78.662988][ T6575] ? __pfx___sys_sendmsg+0x10/0x10 [ 78.663025][ T6575] __do_fast_syscall_32+0x14b/0x8c0 [ 78.663047][ T6575] ? lockdep_hardirqs_on+0x7d/0x110 [ 78.663070][ T6575] do_fast_syscall_32+0x32/0x70 [ 78.663091][ T6575] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 78.663113][ T6575] RIP: 0023:0xf7f92fbc [ 78.663128][ T6575] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 78.663147][ T6575] RSP: 002b:00000000f544650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 78.663164][ T6575] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000080 [ 78.663174][ T6575] RDX: 0000000020000150 RSI: 0000000000000000 RDI: 0000000000000000 [ 78.663183][ T6575] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 78.663192][ T6575] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 78.663202][ T6575] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 78.663223][ T6575] [ 78.693221][ T5447] 8021q: adding VLAN 0 to HW filter on device eth6 [ 78.926360][ T6439] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 78.984735][ T5447] 8021q: adding VLAN 0 to HW filter on device eth7 [ 79.145900][ T6439] veth0_vlan: entered promiscuous mode [ 79.183467][ T6439] veth1_vlan: entered promiscuous mode [ 79.232774][ T6439] veth0_macvtap: entered promiscuous mode [ 79.300341][ T5826] hsr_slave_0: left promiscuous mode [ 79.301283][ T5826] hsr_slave_1: left promiscuous mode [ 79.301993][ T5826] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 79.302009][ T5826] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 79.303366][ T5826] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 79.303380][ T5826] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 79.329507][ T5826] veth1_macvtap: left promiscuous mode [ 79.329588][ T5826] veth0_macvtap: left promiscuous mode [ 79.329741][ T5826] veth1_vlan: left promiscuous mode [ 79.337804][ T5826] veth0_vlan: left promiscuous mode [ 79.399307][ T5737] Bluetooth: hci0: command tx timeout [ 79.542589][ T5826] team0 (unregistering): Port device team_slave_1 removed [ 79.547367][ T5826] team0 (unregistering): Port device team_slave_0 removed [ 79.636995][ T5447] 8021q: adding VLAN 0 to HW filter on device eth8 [ 79.637961][ T6439] veth1_macvtap: entered promiscuous mode [ 79.694784][ T6536] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.694877][ T6536] bridge0: port 1(bridge_slave_0) entered disabled state [ 79.694934][ T6536] bridge_slave_0: entered allmulticast mode [ 79.695591][ T6536] bridge_slave_0: entered promiscuous mode [ 79.724172][ T6536] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.724250][ T6536] bridge0: port 2(bridge_slave_1) entered disabled state [ 79.724354][ T6536] bridge_slave_1: entered allmulticast mode [ 79.727738][ T6536] bridge_slave_1: entered promiscuous mode [ 79.759099][ T6439] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 79.768901][ T6439] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 79.777599][ T6536] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 79.786697][ T6536] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 79.825252][ T6536] team0: Port device team_slave_0 added [ 79.846266][ T6536] team0: Port device team_slave_1 added [ 79.895636][ T5447] 8021q: adding VLAN 0 to HW filter on device eth9 [ 79.903654][ T6616] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 79.913427][ T6536] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 79.913437][ T6536] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 79.913450][ T6536] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 79.914962][ T6536] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 79.914971][ T6536] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 79.914984][ T6536] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 79.999250][ T5782] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.040420][ T13] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.040845][ T13] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.041067][ T13] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.041135][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.041143][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.052256][ T6536] hsr_slave_0: entered promiscuous mode [ 80.056341][ T6536] hsr_slave_1: entered promiscuous mode [ 80.056900][ T6536] debugfs: 'hsr0' already exists in 'hsr' [ 80.056918][ T6536] Cannot create hsr debugfs directory [ 80.134040][ T5737] Bluetooth: hci3: command tx timeout [ 80.153575][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.153640][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.828572][ T6644] netlink: 8 bytes leftover after parsing attributes in process `syz.4.183'. [ 81.479517][ T5737] Bluetooth: hci0: command tx timeout [ 81.851656][ T6651] netlink: 20 bytes leftover after parsing attributes in process `syz.4.185'. [ 81.876892][ T6536] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 81.881402][ T6536] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 81.882158][ T6536] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 81.885661][ T6536] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 81.886565][ T6536] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 81.890851][ T6536] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 81.891702][ T6536] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 81.908837][ T6536] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 81.978916][ T6536] 8021q: adding VLAN 0 to HW filter on device bond0 [ 81.994410][ T6536] 8021q: adding VLAN 0 to HW filter on device team0 [ 81.999432][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.999517][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 82.005305][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.005390][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 82.051381][ T6659] ecryptfs_verify_version: Minor version number mismatch. Expected [4]; got [0] [ 82.051395][ T6659] Data structure version mismatch. Userspace tools must match eCryptfs kernel module with major version [0] and minor version [4] [ 82.051404][ T6659] Could not find valid key in user session keyring for sig specified in mount option: [syz] [ 82.051410][ T6659] One or more global auth toks could not properly register; rc = [-22] [ 82.051427][ T6659] Error validating options; rc = [-22] [ 82.199205][ T5737] Bluetooth: hci3: command tx timeout [ 82.330107][ T6536] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 82.662486][ T6691] bond0: entered promiscuous mode [ 82.662504][ T6691] bond_slave_0: entered promiscuous mode [ 82.662660][ T6691] bond_slave_1: entered promiscuous mode [ 82.662793][ T6691] bond0: entered allmulticast mode [ 82.662805][ T6691] bond_slave_0: entered allmulticast mode [ 82.662818][ T6691] bond_slave_1: entered allmulticast mode [ 82.674183][ T6691] netlink: 20 bytes leftover after parsing attributes in process `syz.4.189'. [ 82.677283][ T6536] veth0_vlan: entered promiscuous mode [ 82.678944][ T6678] jffs2: notice: (6678) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 82.694675][ T6536] veth1_vlan: entered promiscuous mode [ 82.718310][ T6536] veth0_macvtap: entered promiscuous mode [ 82.722964][ T6536] veth1_macvtap: entered promiscuous mode [ 82.735782][ T6536] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 82.746417][ T6536] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 82.799479][ T13] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.799767][ T13] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.799798][ T13] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.799825][ T13] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.827951][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.827970][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.849539][ T1678] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.849559][ T1678] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.909538][ T6698] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 83.237818][ T6718] FAULT_INJECTION: forcing a failure. [ 83.237818][ T6718] name failslab, interval 1, probability 0, space 0, times 0 [ 83.237847][ T6718] CPU: 3 UID: 0 PID: 6718 Comm: syz.1.193 Not tainted syzkaller #0 PREEMPT(full) [ 83.237867][ T6718] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 83.237877][ T6718] Call Trace: [ 83.237884][ T6718] [ 83.237891][ T6718] dump_stack_lvl+0x100/0x190 [ 83.237920][ T6718] should_fail_ex.cold+0x5/0xa [ 83.237941][ T6718] ? __netlink_lookup+0x692/0x950 [ 83.237968][ T6718] should_failslab+0xc2/0x120 [ 83.237995][ T6718] kmem_cache_alloc_noprof+0x92/0x6a0 [ 83.238020][ T6718] ? skb_clone+0x190/0x400 [ 83.238040][ T6718] skb_clone+0x190/0x400 [ 83.238058][ T6718] netlink_deliver_tap+0xaed/0xcc0 [ 83.238087][ T6718] netlink_unicast+0x6ff/0x950 [ 83.238114][ T6718] ? __pfx_netlink_unicast+0x10/0x10 [ 83.238165][ T6718] netlink_sendmsg+0x9ac/0x10c0 [ 83.238194][ T6718] ? __pfx_netlink_sendmsg+0x10/0x10 [ 83.238225][ T6718] ? apparmor_socket_sendmsg+0x165/0x280 [ 83.238249][ T6718] ? ____sys_sendmsg+0xa4d/0xbe0 [ 83.238270][ T6718] ____sys_sendmsg+0xa4d/0xbe0 [ 83.238289][ T6718] ? __pfx_netlink_sendmsg+0x10/0x10 [ 83.238316][ T6718] ? __pfx_____sys_sendmsg+0x10/0x10 [ 83.238349][ T6718] ___sys_sendmsg+0x190/0x1e0 [ 83.238373][ T6718] ? __pfx____sys_sendmsg+0x10/0x10 [ 83.238408][ T6718] ? find_held_lock+0x2b/0x80 [ 83.238444][ T6718] __sys_sendmsg+0x160/0x210 [ 83.238472][ T6718] ? __pfx___sys_sendmsg+0x10/0x10 [ 83.238514][ T6718] __do_fast_syscall_32+0x14b/0x8c0 [ 83.238538][ T6718] ? lockdep_hardirqs_on+0x7d/0x110 [ 83.238562][ T6718] do_fast_syscall_32+0x32/0x70 [ 83.238586][ T6718] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 83.238609][ T6718] RIP: 0023:0xf7f92fbc [ 83.238624][ T6718] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 83.238640][ T6718] RSP: 002b:00000000f544650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 83.238657][ T6718] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800006c0 [ 83.238668][ T6718] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 83.238683][ T6718] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 83.238693][ T6718] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 83.238702][ T6718] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 83.238726][ T6718] [ 83.245992][ T6718] bond0: entered promiscuous mode [ 83.246011][ T6718] bond_slave_0: entered promiscuous mode [ 83.246185][ T6718] bond_slave_1: entered promiscuous mode [ 83.347594][ T5841] corsair-cpro 0003:1B1C:0C10.0004: hidraw1: USB HID v0.00 Device [syz0] on syz0 [ 83.561215][ T5737] Bluetooth: hci0: command tx timeout [ 83.651361][ T5841] corsair-cpro 0003:1B1C:0C10.0004: probe with driver corsair-cpro failed with error -110 [ 84.065958][ T6730] Bluetooth: MGMT ver 1.23 [ 84.279123][ T5737] Bluetooth: hci3: command tx timeout [ 84.522116][ T6737] input: syz0 as /devices/virtual/input/input5 [ 84.568284][ T13] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 84.656931][ T13] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 84.752458][ T13] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 84.830831][ T13] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 84.883773][ T6746] hugetlbfs: syz.4.203 (6746): Using mlock ulimits for SHM_HUGETLB is obsolete [ 84.932585][ T13] bridge_slave_1: left allmulticast mode [ 84.932608][ T13] bridge_slave_1: left promiscuous mode [ 84.932804][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 84.934912][ T13] bridge_slave_0: left allmulticast mode [ 84.934929][ T13] bridge_slave_0: left promiscuous mode [ 84.935081][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 85.005922][ T5094] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 85.007831][ T5094] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 85.008502][ T5094] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 85.020014][ T5094] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 85.020569][ T5094] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 85.048748][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 85.058296][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 85.063763][ T13] bond0 (unregistering): Released all slaves [ 85.078704][ T6760] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 85.269175][ T5447] 8021q: adding VLAN 0 to HW filter on device eth10 [ 85.288602][ T6753] rxe_eth0 speed is unknown, defaulting to 1000 [ 85.611882][ T13] hsr_slave_0: left promiscuous mode [ 85.612510][ T13] hsr_slave_1: left promiscuous mode [ 85.613233][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 85.613245][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 85.614284][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 85.614294][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 85.618603][ T13] veth1_macvtap: left promiscuous mode [ 85.618655][ T13] veth0_macvtap: left promiscuous mode [ 85.620117][ T13] veth1_vlan: left promiscuous mode [ 85.620178][ T13] veth0_vlan: left promiscuous mode [ 85.838359][ T13] team0 (unregistering): Port device team_slave_1 removed [ 85.850389][ T13] team0 (unregistering): Port device team_slave_0 removed [ 86.018312][ T5447] 8021q: adding VLAN 0 to HW filter on device eth11 [ 86.186452][ T6794] syzkaller0: Number of in use tx queues changed invalidating tc mappings. Priority traffic classification disabled! [ 86.361191][ T5094] Bluetooth: hci3: command tx timeout [ 86.372682][ T6812] FAULT_INJECTION: forcing a failure. [ 86.372682][ T6812] name failslab, interval 1, probability 0, space 0, times 0 [ 86.372726][ T6812] CPU: 0 UID: 0 PID: 6812 Comm: syz.5.211 Not tainted syzkaller #0 PREEMPT(full) [ 86.372747][ T6812] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 86.372757][ T6812] Call Trace: [ 86.372763][ T6812] [ 86.372771][ T6812] dump_stack_lvl+0x100/0x190 [ 86.372801][ T6812] should_fail_ex.cold+0x5/0xa [ 86.372827][ T6812] should_failslab+0xc2/0x120 [ 86.372857][ T6812] __kmalloc_cache_noprof+0x91/0x6d0 [ 86.372879][ T6812] ? drm_atomic_helper_crtc_duplicate_state+0x72/0xd0 [ 86.372908][ T6812] drm_atomic_helper_crtc_duplicate_state+0x72/0xd0 [ 86.372927][ T6812] drm_atomic_get_crtc_state+0x1de/0x690 [ 86.372959][ T6812] drm_atomic_get_plane_state+0x4a3/0x7d0 [ 86.372989][ T6812] drm_client_modeset_commit_atomic+0x237/0x7e0 [ 86.373010][ T6812] ? rcu_is_watching+0x13/0xc0 [ 86.373033][ T6812] ? drm_client_modeset_commit_locked+0x4c/0x580 [ 86.373055][ T6812] ? __pfx_drm_client_modeset_commit_atomic+0x10/0x10 [ 86.373074][ T6812] ? drm_master_internal_acquire+0x21/0x80 [ 86.373091][ T6812] ? __mutex_lock+0x267/0x1c10 [ 86.373150][ T6812] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 86.373180][ T6812] drm_client_modeset_commit_locked+0x14d/0x580 [ 86.373215][ T6812] drm_fb_helper_pan_display+0x32d/0xa40 [ 86.373256][ T6812] fb_pan_display+0x195/0x820 [ 86.373280][ T6812] ? __pfx_drm_fb_helper_pan_display+0x10/0x10 [ 86.373310][ T6812] ud_update_start+0xd6/0x300 [ 86.373333][ T6812] fbcon_switch+0x1119/0x19f0 [ 86.373359][ T6812] ? __pfx_fbcon_switch+0x10/0x10 [ 86.373401][ T6812] ? __pfx_ud_cursor+0x10/0x10 [ 86.373420][ T6812] ? fbcon_cursor+0x24c/0x5e0 [ 86.373456][ T6812] csi_J+0x872/0xad0 [ 86.373476][ T6812] ? fbcon_putcs+0x3b2/0x480 [ 86.373500][ T6812] ? fbcon_putcs+0x19e/0x480 [ 86.373531][ T6812] csi_ECMA.constprop.0+0x51e/0x3b60 [ 86.373559][ T6812] ? find_held_lock+0x2b/0x80 [ 86.373580][ T6812] ? __pfx_csi_ECMA.constprop.0+0x10/0x10 [ 86.373617][ T6812] do_con_write+0x366b/0x4ae0 [ 86.373642][ T6812] ? trace_contention_end+0x126/0x160 [ 86.373670][ T6812] ? __mutex_lock+0x267/0x1c10 [ 86.373696][ T6812] ? n_tty_write+0x50e/0x1200 [ 86.373717][ T6812] ? __pfx___mutex_lock+0x10/0x10 [ 86.373742][ T6812] ? __pfx_do_con_write+0x10/0x10 [ 86.373770][ T6812] ? add_softcursor+0x220/0x290 [ 86.373798][ T6812] ? con_write+0x96/0xb0 [ 86.373827][ T6812] con_write+0x23/0xb0 [ 86.373850][ T6812] n_tty_write+0x440/0x1200 [ 86.373881][ T6812] ? __pfx_n_tty_write+0x10/0x10 [ 86.373897][ T6812] ? __kasan_kmalloc+0xaa/0xb0 [ 86.373923][ T6812] ? __pfx_woken_wake_function+0x10/0x10 [ 86.373951][ T6812] ? rcu_is_watching+0x13/0xc0 [ 86.373970][ T6812] ? file_tty_write.isra.0+0x6ed/0x8f0 [ 86.373995][ T6812] ? kfree+0x1e5/0x6d0 [ 86.374015][ T6812] ? __pfx_n_tty_write+0x10/0x10 [ 86.374035][ T6812] file_tty_write.isra.0+0x4ca/0x8f0 [ 86.374069][ T6812] vfs_write+0x6af/0x1050 [ 86.374093][ T6812] ? __pfx_tty_write+0x10/0x10 [ 86.374121][ T6812] ? __pfx_vfs_write+0x10/0x10 [ 86.374141][ T6812] ? find_held_lock+0x2b/0x80 [ 86.374179][ T6812] ksys_write+0x12a/0x250 [ 86.374202][ T6812] ? __pfx_ksys_write+0x10/0x10 [ 86.374239][ T6812] __do_fast_syscall_32+0x14b/0x8c0 [ 86.374262][ T6812] ? lockdep_hardirqs_on+0x7d/0x110 [ 86.374287][ T6812] do_fast_syscall_32+0x32/0x70 [ 86.374311][ T6812] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 86.374334][ T6812] RIP: 0023:0xf7f66fbc [ 86.374350][ T6812] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 86.374366][ T6812] RSP: 002b:00000000f541650c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 86.374384][ T6812] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000700 [ 86.374395][ T6812] RDX: 0000000000001006 RSI: 0000000000000000 RDI: 0000000000000000 [ 86.374405][ T6812] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 86.374415][ T6812] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 86.374425][ T6812] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 86.374452][ T6812] [ 86.498816][ T5447] 8021q: adding VLAN 0 to HW filter on device eth12 [ 86.534070][ T6753] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.534200][ T6753] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.534259][ T6753] bridge_slave_0: entered allmulticast mode [ 86.535037][ T6753] bridge_slave_0: entered promiscuous mode [ 86.537267][ T6753] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.537398][ T6753] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.537492][ T6753] bridge_slave_1: entered allmulticast mode [ 86.538723][ T6753] bridge_slave_1: entered promiscuous mode [ 86.563530][ T6753] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 86.565952][ T6753] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 86.585955][ T6753] team0: Port device team_slave_0 added [ 86.588009][ T6753] team0: Port device team_slave_1 added [ 86.611085][ T41] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 86.617128][ T6753] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 86.617144][ T6753] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 86.617163][ T6753] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 86.620542][ T6753] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 86.620554][ T6753] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 86.620573][ T6753] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 86.661154][ T6753] hsr_slave_0: entered promiscuous mode [ 86.661780][ T6753] hsr_slave_1: entered promiscuous mode [ 86.771574][ T41] usb 6-1: Using ep0 maxpacket: 8 [ 86.772901][ T41] usb 6-1: New USB device found, idVendor=07c0, idProduct=1505, bcdDevice=b8.c5 [ 86.776166][ T41] usb 6-1: config 0 has an invalid interface number: 186 but max is 0 [ 86.776189][ T41] usb 6-1: config 0 has no interface number 0 [ 86.776227][ T41] usb 6-1: config 0 interface 186 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 86.776246][ T41] usb 6-1: config 0 interface 186 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 86.776269][ T41] usb 6-1: config 0 interface 186 altsetting 0 has an endpoint descriptor with address 0x9A, changing to 0x8A [ 86.776292][ T41] usb 6-1: config 0 interface 186 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 86.776316][ T41] usb 6-1: config 0 interface 186 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 86.780678][ T41] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 86.780700][ T41] usb 6-1: Product: syz [ 86.780715][ T41] usb 6-1: Manufacturer: syz [ 86.780729][ T41] usb 6-1: SerialNumber: syz [ 86.788429][ T41] usb 6-1: config 0 descriptor?? [ 86.885603][ T5447] 8021q: adding VLAN 0 to HW filter on device eth13 [ 87.041900][ T6846] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 87.049777][ T41] iowarrior 6-1:0.186: IOWarrior product=0x1505, serial=42424242 interface=186 now attached to iowarrior0 [ 87.089113][ T5094] Bluetooth: hci1: command tx timeout [ 87.121339][ T6753] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 87.123182][ T6753] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 87.123737][ T6753] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 87.125311][ T6753] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 87.125839][ T6753] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 87.132256][ T6753] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 87.132756][ T6753] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 87.138379][ T6753] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 87.191894][ T6753] 8021q: adding VLAN 0 to HW filter on device bond0 [ 87.202362][ T6753] 8021q: adding VLAN 0 to HW filter on device team0 [ 87.207135][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.207187][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 87.210580][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.210623][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 87.213251][ T41] usb 6-1: USB disconnect, device number 2 [ 87.576453][ T6753] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 87.820290][ T6753] veth0_vlan: entered promiscuous mode [ 87.823938][ T6753] veth1_vlan: entered promiscuous mode [ 87.838046][ T6753] veth0_macvtap: entered promiscuous mode [ 87.849750][ T6753] veth1_macvtap: entered promiscuous mode [ 87.869543][ T6753] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 87.876244][ T6753] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 87.933889][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.933907][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 87.957665][ T1678] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.957682][ T1678] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 87.969523][ T12] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.969827][ T12] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.970227][ T12] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.970254][ T12] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.570763][ T6916] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 89.159499][ T5094] Bluetooth: hci1: command tx timeout [ 89.355194][ T6933] batman_adv: batadv0: Adding interface: syzkaller0 [ 89.355211][ T6933] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 89.355225][ T6933] batman_adv: batadv0: Interface activated: syzkaller0 [ 89.745252][ T6932] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 89.756511][ T6932] batman_adv: batadv0: Removing interface: syzkaller0 [ 89.845985][ T6943] TC_ACT_REPEAT abuse ? [ 89.922897][ T6952] netlink: 'syz.6.233': attribute type 3 has an invalid length. [ 90.018951][ T6958] FAULT_INJECTION: forcing a failure. [ 90.018951][ T6958] name failslab, interval 1, probability 0, space 0, times 0 [ 90.018998][ T6958] CPU: 2 UID: 0 PID: 6958 Comm: syz.1.235 Not tainted syzkaller #0 PREEMPT(full) [ 90.019019][ T6958] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 90.019031][ T6958] Call Trace: [ 90.019037][ T6958] [ 90.019044][ T6958] dump_stack_lvl+0x100/0x190 [ 90.019074][ T6958] should_fail_ex.cold+0x5/0xa [ 90.019099][ T6958] should_failslab+0xc2/0x120 [ 90.019128][ T6958] __kmalloc_node_track_caller_noprof+0xfa/0x870 [ 90.019154][ T6958] ? __do_sys_fsconfig+0x834/0xcb0 [ 90.019176][ T6958] ? smb3_parse_devname+0xfd/0x500 [ 90.019210][ T6958] kstrndup+0x64/0x120 [ 90.019232][ T6958] smb3_parse_devname+0xfd/0x500 [ 90.019263][ T6958] smb3_fs_context_parse_param+0x3f02/0x7740 [ 90.019292][ T6958] ? lock_acquire+0x1d1/0x380 [ 90.019319][ T6958] ? __pfx_smb3_fs_context_parse_param+0x10/0x10 [ 90.019346][ T6958] ? find_held_lock+0x2b/0x80 [ 90.019365][ T6958] ? __might_fault+0xc5/0x140 [ 90.019398][ T6958] ? __pfx_smb3_fs_context_parse_param+0x10/0x10 [ 90.019426][ T6958] ? vfs_parse_fs_param+0x200/0x3b0 [ 90.019444][ T6958] vfs_parse_fs_param+0x200/0x3b0 [ 90.019463][ T6958] __do_sys_fsconfig+0x617/0xcb0 [ 90.019487][ T6958] ? __pfx___do_sys_fsconfig+0x10/0x10 [ 90.019529][ T6958] __do_fast_syscall_32+0x14b/0x8c0 [ 90.019561][ T6958] do_fast_syscall_32+0x32/0x70 [ 90.019587][ T6958] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 90.019611][ T6958] RIP: 0023:0xf7f92fbc [ 90.019626][ T6958] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 90.019643][ T6958] RSP: 002b:00000000f544650c EFLAGS: 00000292 ORIG_RAX: 00000000000001af [ 90.019662][ T6958] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000000001 [ 90.019674][ T6958] RDX: 0000000080000480 RSI: 00000000800004c0 RDI: 0000000000000000 [ 90.019685][ T6958] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 90.019696][ T6958] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 90.019707][ T6958] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 90.019732][ T6958] [ 90.020716][ T6958] CIFS: VFS: Unable to allocate memory for devname [ 90.515434][ T6974] netlink: 24 bytes leftover after parsing attributes in process `syz.5.238'. [ 90.701227][ T6977] TC_ACT_REPEAT abuse ? [ 90.962256][ T6984] FAULT_INJECTION: forcing a failure. [ 90.962256][ T6984] name failslab, interval 1, probability 0, space 0, times 0 [ 90.962284][ T6984] CPU: 2 UID: 0 PID: 6984 Comm: syz.1.242 Not tainted syzkaller #0 PREEMPT(full) [ 90.962305][ T6984] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 90.962315][ T6984] Call Trace: [ 90.962322][ T6984] [ 90.962331][ T6984] dump_stack_lvl+0x100/0x190 [ 90.962362][ T6984] should_fail_ex.cold+0x5/0xa [ 90.962384][ T6984] should_failslab+0xc2/0x120 [ 90.962413][ T6984] kmem_cache_alloc_lru_noprof+0x8e/0x6a0 [ 90.962439][ T6984] ? __ia32_compat_sys_openat+0x12d/0x210 [ 90.962458][ T6984] ? __do_fast_syscall_32+0x14b/0x8c0 [ 90.962484][ T6984] ? __d_alloc+0x34/0xad0 [ 90.962514][ T6984] __d_alloc+0x34/0xad0 [ 90.962546][ T6984] __d_alloc_parallel+0x105/0x15e0 [ 90.962574][ T6984] ? lock_acquire+0x1d1/0x380 [ 90.962598][ T6984] ? __d_lookup+0x73/0x4a0 [ 90.962619][ T6984] ? __pfx___d_alloc_parallel+0x10/0x10 [ 90.962640][ T6984] ? __d_lookup+0x25c/0x4a0 [ 90.962665][ T6984] ? __d_lookup+0x266/0x4a0 [ 90.962701][ T6984] lookup_open+0x69a/0x1940 [ 90.962733][ T6984] path_openat+0xe75/0x23f0 [ 90.962764][ T6984] ? __pfx_path_openat+0x10/0x10 [ 90.962796][ T6984] do_file_open+0x20e/0x430 [ 90.962824][ T6984] ? __pfx_do_file_open+0x10/0x10 [ 90.962868][ T6984] ? _raw_spin_unlock+0x28/0x50 [ 90.962889][ T6984] ? alloc_fd+0x471/0x7a0 [ 90.962921][ T6984] do_sys_openat2+0x163/0x1d0 [ 90.962940][ T6984] ? __pfx_do_sys_openat2+0x10/0x10 [ 90.962959][ T6984] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 90.962991][ T6984] __ia32_compat_sys_openat+0x12d/0x210 [ 90.963011][ T6984] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 90.963041][ T6984] __do_fast_syscall_32+0x14b/0x8c0 [ 90.963068][ T6984] do_fast_syscall_32+0x32/0x70 [ 90.963092][ T6984] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 90.963114][ T6984] RIP: 0023:0xf7f92fbc [ 90.963130][ T6984] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 90.963144][ T6984] RSP: 002b:00000000f544650c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 90.963162][ T6984] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000240 [ 90.963173][ T6984] RDX: 000000000000275a RSI: 0000000000000000 RDI: 0000000000000000 [ 90.963183][ T6984] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 90.963194][ T6984] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 90.963206][ T6984] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 90.963232][ T6984] [ 90.965139][ T6985] mmap: syz.1.242 (6985) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 91.111036][ T42] audit: type=1326 audit(1792707626.259:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6991 comm="syz.1.245" exe="/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f92fd8 code=0x7ffc0000 [ 91.111209][ T42] audit: type=1326 audit(1792707626.269:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6991 comm="syz.1.245" exe="/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f92fd8 code=0x7ffc0000 [ 91.112937][ T42] audit: type=1326 audit(1792707626.269:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6991 comm="syz.1.245" exe="/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f92fd8 code=0x7ffc0000 [ 91.112975][ T42] audit: type=1326 audit(1792707626.269:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6991 comm="syz.1.245" exe="/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f92fd8 code=0x7ffc0000 [ 91.113010][ T42] audit: type=1326 audit(1792707626.269:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6991 comm="syz.1.245" exe="/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f92fd8 code=0x7ffc0000 [ 91.113048][ T42] audit: type=1326 audit(1792707626.269:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6991 comm="syz.1.245" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f92fbc code=0x7ffc0000 [ 91.113081][ T42] audit: type=1326 audit(1792707626.269:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6991 comm="syz.1.245" exe="/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f92fd8 code=0x7ffc0000 [ 91.113120][ T42] audit: type=1326 audit(1792707626.269:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6991 comm="syz.1.245" exe="/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f92fd8 code=0x7ffc0000 [ 91.113152][ T42] audit: type=1326 audit(1792707626.269:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6991 comm="syz.1.245" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f92fbc code=0x7ffc0000 [ 91.113466][ T42] audit: type=1326 audit(1792707626.269:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6991 comm="syz.1.245" exe="/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f92fd8 code=0x7ffc0000 [ 91.169680][ T5841] usb 11-1: new high-speed USB device number 2 using dummy_hcd [ 91.241099][ T5094] Bluetooth: hci1: command tx timeout [ 91.268748][ T6992] smpboot: CPU 1 is now offline [ 91.332999][ T5841] usb 11-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 91.333033][ T5841] usb 11-1: too many configurations: 9, using maximum allowed: 8 [ 91.334113][ T5841] usb 11-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 91.334149][ T5841] usb 11-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 91.334168][ T5841] usb 11-1: config 0 interface 0 has no altsetting 0 [ 91.335146][ T5841] usb 11-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 91.335209][ T5841] usb 11-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 91.335230][ T5841] usb 11-1: config 0 interface 0 has no altsetting 0 [ 91.336493][ T5841] usb 11-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 91.336527][ T5841] usb 11-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 91.336551][ T5841] usb 11-1: config 0 interface 0 has no altsetting 0 [ 91.338365][ T5841] usb 11-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 91.338387][ T5841] usb 11-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 91.338400][ T5841] usb 11-1: config 0 interface 0 has no altsetting 0 [ 91.339774][ T5841] usb 11-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 91.339795][ T5841] usb 11-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 91.339807][ T5841] usb 11-1: config 0 interface 0 has no altsetting 0 [ 91.340595][ T5841] usb 11-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 91.340615][ T5841] usb 11-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 91.340628][ T5841] usb 11-1: config 0 interface 0 has no altsetting 0 [ 91.341760][ T5841] usb 11-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 91.341795][ T5841] usb 11-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 91.341812][ T5841] usb 11-1: config 0 interface 0 has no altsetting 0 [ 91.343078][ T5841] usb 11-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 91.343111][ T5841] usb 11-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 91.343131][ T5841] usb 11-1: config 0 interface 0 has no altsetting 0 [ 91.345593][ T5841] usb 11-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 91.345612][ T5841] usb 11-1: Product: syz [ 91.345625][ T5841] usb 11-1: Manufacturer: syz [ 91.345637][ T5841] usb 11-1: SerialNumber: syz [ 91.355019][ T5841] usb 11-1: config 0 descriptor?? [ 91.379534][ T5841] yurex 11-1:0.0: USB YUREX device now attached to Yurex #0 [ 91.572352][ T5841] usb 11-1: USB disconnect, device number 2 [ 91.575899][ T5841] yurex 11-1:0.0: USB YUREX #0 now disconnected [ 91.828574][ T5841] hid-generic 1A03:BC90F5CD:D7B2B7.0005: hidraw1: HID v0.01 Mouse [syz1] on syz0 [ 91.864164][ T7013] fido_id[7013]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 92.256952][ T7029] overlayfs: refusing to follow metacopy origin for (/file1) [ 92.444285][ T12] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 92.533231][ T12] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 92.667465][ T12] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 92.728725][ T12] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 92.867477][ T12] bridge_slave_1: left allmulticast mode [ 92.867495][ T12] bridge_slave_1: left promiscuous mode [ 92.867614][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 92.871994][ T12] bridge_slave_0: left allmulticast mode [ 92.872008][ T12] bridge_slave_0: left promiscuous mode [ 92.872166][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 92.936218][ T7062] capability: warning: `syz.1.260' uses 32-bit capabilities (legacy support in use) [ 92.943734][ T5737] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 92.946392][ T5737] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 92.947178][ T5737] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 92.951804][ T5737] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 92.952219][ T5737] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 92.963529][ T7065] ceph: Unknown parameter 'port' [ 93.018952][ T7065] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 93.068373][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 93.074093][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 93.077357][ T12] bond0 (unregistering): Released all slaves [ 93.101142][ T5447] 8021q: adding VLAN 0 to HW filter on device eth14 [ 93.330619][ T5737] Bluetooth: hci1: command tx timeout [ 93.380927][ T7063] rxe_eth0 speed is unknown, defaulting to 1000 [ 93.397093][ T5447] 8021q: adding VLAN 0 to HW filter on device eth15 [ 93.757352][ T7095] block device autoloading is deprecated and will be removed. [ 93.758318][ T7080] random: crng reseeded on system resumption [ 93.878023][ T5447] 8021q: adding VLAN 0 to HW filter on device eth16 [ 94.009095][ T12] hsr_slave_0: left promiscuous mode [ 94.011022][ T12] hsr_slave_1: left promiscuous mode [ 94.017109][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 94.017127][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 94.018303][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 94.018317][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 94.042182][ T12] veth1_macvtap: left promiscuous mode [ 94.042226][ T12] veth0_macvtap: left promiscuous mode [ 94.042373][ T12] veth1_vlan: left promiscuous mode [ 94.042469][ T12] veth0_vlan: left promiscuous mode [ 94.095384][ T7116] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 94.368709][ T12] team0 (unregistering): Port device team_slave_1 removed [ 94.385475][ T12] team0 (unregistering): Port device team_slave_0 removed [ 94.851307][ T7063] bridge0: port 1(bridge_slave_0) entered blocking state [ 94.851394][ T7063] bridge0: port 1(bridge_slave_0) entered disabled state [ 94.852140][ T7063] bridge_slave_0: entered allmulticast mode [ 94.863983][ T7063] bridge_slave_0: entered promiscuous mode [ 94.867628][ T7063] bridge0: port 2(bridge_slave_1) entered blocking state [ 94.873643][ T7063] bridge0: port 2(bridge_slave_1) entered disabled state [ 94.873719][ T7063] bridge_slave_1: entered allmulticast mode [ 94.880491][ T7063] bridge_slave_1: entered promiscuous mode [ 94.965507][ T7063] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 94.979878][ T7063] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 95.009271][ T5737] Bluetooth: hci3: command tx timeout [ 95.027737][ T7063] team0: Port device team_slave_0 added [ 95.034143][ T7063] team0: Port device team_slave_1 added [ 95.070841][ T7063] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 95.070852][ T7063] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 95.070865][ T7063] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 95.089122][ T7063] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 95.089131][ T7063] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 95.089145][ T7063] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 95.120443][ T7142] netlink: 4 bytes leftover after parsing attributes in process `syz.1.273'. [ 95.143890][ T7063] hsr_slave_0: entered promiscuous mode [ 95.146625][ T7063] hsr_slave_1: entered promiscuous mode [ 95.146942][ T7063] debugfs: 'hsr0' already exists in 'hsr' [ 95.146954][ T7063] Cannot create hsr debugfs directory [ 95.236175][ T5447] 8021q: adding VLAN 0 to HW filter on device eth17 [ 95.376322][ T7063] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 95.625871][ T7150] Console: switching to colour dummy device 80x25 [ 95.662280][ T7063] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 95.914844][ T7063] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 95.924378][ T7063] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 95.925137][ T7063] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 95.965401][ T7063] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 95.967312][ T7063] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 96.005063][ T7063] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 96.099531][ T7063] 8021q: adding VLAN 0 to HW filter on device bond0 [ 96.122848][ T42] kauditd_printk_skb: 1285 callbacks suppressed [ 96.122955][ T42] audit: type=1326 audit(1792707631.259:1297): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7140 comm="syz.6.271" exe="/syz-executor" sig=0 arch=40000003 syscall=267 compat=1 ip=0xf71777ab code=0x7ffc0000 [ 96.123218][ T42] audit: type=1326 audit(1792707631.259:1298): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7140 comm="syz.6.271" exe="/syz-executor" sig=0 arch=40000003 syscall=267 compat=1 ip=0xf71777ab code=0x7ffc0000 [ 96.123869][ T42] audit: type=1326 audit(1792707631.259:1299): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7140 comm="syz.6.271" exe="/syz-executor" sig=0 arch=40000003 syscall=267 compat=1 ip=0xf71777ab code=0x7ffc0000 [ 96.123891][ T42] audit: type=1326 audit(1792707631.259:1300): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7140 comm="syz.6.271" exe="/syz-executor" sig=0 arch=40000003 syscall=267 compat=1 ip=0xf71777ab code=0x7ffc0000 [ 96.123985][ T42] audit: type=1326 audit(1792707631.259:1301): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7140 comm="syz.6.271" exe="/syz-executor" sig=0 arch=40000003 syscall=267 compat=1 ip=0xf71777ab code=0x7ffc0000 [ 96.124252][ T42] audit: type=1326 audit(1792707631.269:1302): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7140 comm="syz.6.271" exe="/syz-executor" sig=0 arch=40000003 syscall=267 compat=1 ip=0xf71777ab code=0x7ffc0000 [ 96.124352][ T42] audit: type=1326 audit(1792707631.269:1303): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7140 comm="syz.6.271" exe="/syz-executor" sig=0 arch=40000003 syscall=267 compat=1 ip=0xf71777ab code=0x7ffc0000 [ 96.124449][ T42] audit: type=1326 audit(1792707631.269:1304): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7140 comm="syz.6.271" exe="/syz-executor" sig=0 arch=40000003 syscall=267 compat=1 ip=0xf71777ab code=0x7ffc0000 [ 96.124564][ T42] audit: type=1326 audit(1792707631.269:1305): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7140 comm="syz.6.271" exe="/syz-executor" sig=0 arch=40000003 syscall=267 compat=1 ip=0xf71777ab code=0x7ffc0000 [ 96.124743][ T42] audit: type=1326 audit(1792707631.269:1306): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7140 comm="syz.6.271" exe="/syz-executor" sig=0 arch=40000003 syscall=267 compat=1 ip=0xf71777ab code=0x7ffc0000 [ 96.230393][ T7063] 8021q: adding VLAN 0 to HW filter on device team0 [ 96.238640][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 96.238730][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 96.254429][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 96.254522][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 97.084273][ T5737] Bluetooth: hci3: command tx timeout [ 97.113676][ T7184] netlink: 8 bytes leftover after parsing attributes in process `syz.4.277'. [ 97.113691][ T7184] netlink: 8 bytes leftover after parsing attributes in process `syz.4.277'. [ 97.399577][ T7172] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 97.437900][ T7063] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 97.569158][ T7172] usb 9-1: Using ep0 maxpacket: 32 [ 97.569661][ T7172] usb 9-1: New USB device found, idVendor=0458, idProduct=5011, bcdDevice= 0.00 [ 97.570515][ T7172] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 97.570530][ T7172] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 97.570541][ T7172] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 97.570559][ T7172] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 97.573169][ T7172] usb 9-1: config 0 descriptor?? [ 97.670392][ T7063] veth0_vlan: entered promiscuous mode [ 97.675198][ T7063] veth1_vlan: entered promiscuous mode [ 97.700845][ T7063] veth0_macvtap: entered promiscuous mode [ 97.704547][ T7063] veth1_macvtap: entered promiscuous mode [ 97.717628][ T7063] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 97.724568][ T7063] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 97.759400][ T5826] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.759440][ T5826] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.759468][ T5826] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.759496][ T5826] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.792507][ T1159] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 97.792520][ T1159] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 97.813182][ T1159] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 97.813194][ T1159] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 98.021173][ T7172] input: HID 0458:5011 as /devices/platform/dummy_hcd.4/usb9/9-1/9-1:0.0/0003:0458:5011.0006/input/input7 [ 98.084495][ T7172] input: HID 0458:5011 as /devices/platform/dummy_hcd.4/usb9/9-1/9-1:0.0/0003:0458:5011.0006/input/input8 [ 98.101888][ T7204] netlink: 'syz.7.280': attribute type 10 has an invalid length. [ 98.113426][ T7172] kye 0003:0458:5011.0006: input,hiddev0,hidraw1: USB HID v0.00 Mouse [HID 0458:5011] on usb-dummy_hcd.4-1/input0 [ 98.176003][ T7204] team0: Device wg2 is of different type [ 98.256676][ T7182] mmap: syz.4.277 (7182): VmData 37502976 exceed data ulimit 2. Update limits or use boot option ignore_rlimit_data. [ 98.303719][ T5735] usb 9-1: USB disconnect, device number 2 [ 98.399357][ T2314] corsair-cpro 0003:1B1C:0C10.0007: hidraw2: USB HID v0.00 Device [syz0] on syz0 [ 98.402848][ T2314] corsair-cpro 0003:1B1C:0C10.0007: probe with driver corsair-cpro failed with error -71 [ 98.546946][ T7226] jffs2: notice: (7226) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 98.867435][ T7231] fuse: Bad value for 'fd' [ 99.166264][ T5737] Bluetooth: hci3: command tx timeout [ 99.816190][ T7263] MTD: Couldn't look up '/dev/sg0': -15 [ 99.827127][ T7263] netlink: 32 bytes leftover after parsing attributes in process `syz.6.287'. [ 99.827747][ T7263] overlay: Unknown parameter 'smackfshat' [ 99.935395][ T7265] device-mapper: table: 248:2: thin-pool: Error opening metadata block device (-ENOENT) [ 99.935422][ T7265] device-mapper: ioctl: error adding target to table [ 99.936110][ T7265] netlink: 224 bytes leftover after parsing attributes in process `syz.7.288'. [ 100.177920][ T7277] mac80211_hwsim hwsim17 wlan0: entered promiscuous mode [ 100.512875][ T5094] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 100.514890][ T5094] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 100.516789][ T5094] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 100.517613][ T5094] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 100.518022][ T5094] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 100.809869][ T7304] rxe_eth0 speed is unknown, defaulting to 1000 [ 100.850397][ T7332] overlay: filesystem on ./bus is read-only [ 101.056147][ T7347] FAULT_INJECTION: forcing a failure. [ 101.056147][ T7347] name failslab, interval 1, probability 0, space 0, times 0 [ 101.056178][ T7347] CPU: 2 UID: 0 PID: 7347 Comm: syz.7.308 Not tainted syzkaller #0 PREEMPT(full) [ 101.056190][ T7347] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 101.056197][ T7347] Call Trace: [ 101.056201][ T7347] [ 101.056205][ T7347] dump_stack_lvl+0x100/0x190 [ 101.056232][ T7347] should_fail_ex.cold+0x5/0xa [ 101.056247][ T7347] should_failslab+0xc2/0x120 [ 101.056269][ T7347] kmem_cache_alloc_lru_noprof+0x8e/0x6a0 [ 101.056285][ T7347] ? alloc_inode+0x183/0x250 [ 101.056299][ T7347] alloc_inode+0x183/0x250 [ 101.056310][ T7347] iget_locked+0x1d4/0x6c0 [ 101.056323][ T7347] ? __pfx_iget_locked+0x10/0x10 [ 101.056334][ T7347] ? kernfs_root+0xee/0x2a0 [ 101.056349][ T7347] ? kernfs_root+0xee/0x2a0 [ 101.056372][ T7347] kernfs_get_inode+0x46/0x470 [ 101.056388][ T7347] kernfs_iop_lookup+0x1a7/0x2d0 [ 101.056400][ T7347] __lookup_slow+0x155/0x320 [ 101.056413][ T7347] lookup_slow+0x54/0x80 [ 101.056425][ T7347] link_path_walk+0x1381/0x1cc0 [ 101.056444][ T7347] path_openat+0x1a7/0x23f0 [ 101.056462][ T7347] ? __pfx_path_openat+0x10/0x10 [ 101.056481][ T7347] do_file_open+0x20e/0x430 [ 101.056498][ T7347] ? __pfx_do_file_open+0x10/0x10 [ 101.056529][ T7347] ? _raw_spin_unlock+0x28/0x50 [ 101.056552][ T7347] ? alloc_fd+0x471/0x7a0 [ 101.056571][ T7347] do_sys_openat2+0x163/0x1d0 [ 101.056582][ T7347] ? __pfx_do_sys_openat2+0x10/0x10 [ 101.056595][ T7347] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 101.056612][ T7347] __ia32_compat_sys_openat+0x12d/0x210 [ 101.056625][ T7347] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 101.056642][ T7347] __do_fast_syscall_32+0x14b/0x8c0 [ 101.056665][ T7347] ? lockdep_hardirqs_on+0x7d/0x110 [ 101.056680][ T7347] do_fast_syscall_32+0x32/0x70 [ 101.056695][ T7347] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 101.056709][ T7347] RIP: 0023:0xf7f14fbc [ 101.056718][ T7347] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 101.056728][ T7347] RSP: 002b:00000000f53c650c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 101.056748][ T7347] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000800000c0 [ 101.056755][ T7347] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 101.056761][ T7347] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 101.056767][ T7347] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 101.056773][ T7347] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 101.056787][ T7347] [ 101.092962][ T7304] bridge0: port 1(bridge_slave_0) entered blocking state [ 101.093042][ T7304] bridge0: port 1(bridge_slave_0) entered disabled state [ 101.093214][ T7304] bridge_slave_0: entered allmulticast mode [ 101.093962][ T7304] bridge_slave_0: entered promiscuous mode [ 101.096163][ T7304] bridge0: port 2(bridge_slave_1) entered blocking state [ 101.096238][ T7304] bridge0: port 2(bridge_slave_1) entered disabled state [ 101.096296][ T7304] bridge_slave_1: entered allmulticast mode [ 101.097209][ T7304] bridge_slave_1: entered promiscuous mode [ 101.112203][ T7304] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 101.113852][ T7304] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 101.129906][ T7304] team0: Port device team_slave_0 added [ 101.131451][ T7304] team0: Port device team_slave_1 added [ 101.145018][ T7304] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 101.145040][ T7304] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.145053][ T7304] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 101.146104][ T7304] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 101.146112][ T7304] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.146125][ T7304] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 101.167757][ T7304] hsr_slave_0: entered promiscuous mode [ 101.168295][ T7304] hsr_slave_1: entered promiscuous mode [ 101.168669][ T7304] debugfs: 'hsr0' already exists in 'hsr' [ 101.168681][ T7304] Cannot create hsr debugfs directory [ 101.240766][ T5737] Bluetooth: hci3: command tx timeout [ 101.305428][ T7304] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 101.405867][ T7304] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 101.418735][ T7304] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 101.437401][ T7304] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 101.438135][ T7304] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 101.779503][ T7304] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 101.783691][ T7304] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 101.875791][ T7304] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 101.943936][ T7304] bridge0: port 2(bridge_slave_1) entered blocking state [ 101.944038][ T7304] bridge0: port 2(bridge_slave_1) entered forwarding state [ 101.944781][ T7304] bridge0: port 1(bridge_slave_0) entered blocking state [ 101.944872][ T7304] bridge0: port 1(bridge_slave_0) entered forwarding state [ 102.015730][ T7304] 8021q: adding VLAN 0 to HW filter on device bond0 [ 102.028635][ T1678] bridge0: port 1(bridge_slave_0) entered disabled state [ 102.030932][ T7371] capability: warning: `syz.4.313' uses deprecated v2 capabilities in a way that may be insecure [ 102.037276][ T1678] bridge0: port 2(bridge_slave_1) entered disabled state [ 102.059346][ T7304] 8021q: adding VLAN 0 to HW filter on device team0 [ 102.065359][ T1678] bridge0: port 1(bridge_slave_0) entered blocking state [ 102.065447][ T1678] bridge0: port 1(bridge_slave_0) entered forwarding state [ 102.081273][ T332] bridge0: port 2(bridge_slave_1) entered blocking state [ 102.081403][ T332] bridge0: port 2(bridge_slave_1) entered forwarding state [ 102.163339][ T7378] warning: `syz.4.316' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 102.248694][ T36] IPVS: starting estimator thread 0... [ 102.339322][ T7386] IPVS: using max 21 ests per chain, 50400 per kthread [ 102.374761][ T7392] Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 102.374761][ T7392] [ 102.374936][ T7392] CIFS: VFS: Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 102.375128][ T7392] CIFS: Attempting to mount //127.0.0.1/share [ 102.518015][ T7304] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 102.599233][ T5737] Bluetooth: hci2: command tx timeout [ 102.669447][ T7304] veth0_vlan: entered promiscuous mode [ 102.673427][ T7304] veth1_vlan: entered promiscuous mode [ 102.689526][ T7304] veth0_macvtap: entered promiscuous mode [ 102.691613][ T7304] veth1_macvtap: entered promiscuous mode [ 102.698202][ T7304] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 102.706898][ T7304] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 102.980269][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 102.980286][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 102.995174][ T1159] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 102.995190][ T1159] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 103.006837][ T5826] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.007202][ T5826] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.008061][ T5826] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.008082][ T5826] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.048774][ T7415] input: syz1 as /devices/virtual/input/input9 [ 103.087655][ T7414] rxe_eth0 speed is unknown, defaulting to 1000 [ 103.118847][ T7418] netlink: 12 bytes leftover after parsing attributes in process `syz.6.319'. [ 103.118904][ T7418] netlink: 48 bytes leftover after parsing attributes in process `syz.6.319'. [ 103.202343][ T7392] CIFS: VFS: cifs_mount failed w/return code = -112 [ 103.685466][ T7172] corsair-cpro 0003:1B1C:0C10.0008: hidraw1: USB HID v0.00 Device [syz0] on syz0 [ 103.990806][ T7172] corsair-cpro 0003:1B1C:0C10.0008: probe with driver corsair-cpro failed with error -110 [ 104.361895][ T7434] netlink: 40 bytes leftover after parsing attributes in process `syz.6.323'. [ 104.367339][ T7434] netlink: 40 bytes leftover after parsing attributes in process `syz.6.323'. [ 104.462535][ T7445] netlink: 8 bytes leftover after parsing attributes in process `syz.6.326'. [ 104.464525][ T7445] --map-set only usable from mangle table [ 104.495060][ T7447] netlink: 'syz.6.327': attribute type 5 has an invalid length. [ 104.746677][ T7454] FAULT_INJECTION: forcing a failure. [ 104.746677][ T7454] name failslab, interval 1, probability 0, space 0, times 0 [ 104.746696][ T7454] CPU: 2 UID: 0 PID: 7454 Comm: syz.6.329 Not tainted syzkaller #0 PREEMPT(full) [ 104.746709][ T7454] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 104.746716][ T7454] Call Trace: [ 104.746719][ T7454] [ 104.746724][ T7454] dump_stack_lvl+0x100/0x190 [ 104.746743][ T7454] should_fail_ex.cold+0x5/0xa [ 104.746758][ T7454] should_failslab+0xc2/0x120 [ 104.746775][ T7454] __kmalloc_noprof+0xfc/0x840 [ 104.746789][ T7454] ? rcu_is_watching+0x13/0xc0 [ 104.746801][ T7454] ? tomoyo_realpath_from_path+0xb6/0x690 [ 104.746820][ T7454] tomoyo_realpath_from_path+0xb6/0x690 [ 104.746840][ T7454] tomoyo_path_number_perm+0x23c/0x580 [ 104.746853][ T7454] ? tomoyo_path_number_perm+0x22e/0x580 [ 104.746867][ T7454] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 104.746882][ T7454] ? get_pid_task+0x106/0x250 [ 104.746896][ T7454] ? __lock_acquire+0x5c0/0x1f40 [ 104.746917][ T7454] ? __fget_files+0x34/0x3d0 [ 104.746932][ T7454] ? find_held_lock+0x2b/0x80 [ 104.746943][ T7454] ? __fget_files+0x215/0x3d0 [ 104.746956][ T7454] ? hook_file_ioctl_common+0x140/0x440 [ 104.746970][ T7454] ? __fget_files+0x215/0x3d0 [ 104.746987][ T7454] ? __fget_files+0x21f/0x3d0 [ 104.747004][ T7454] security_file_ioctl_compat+0xd3/0x230 [ 104.747018][ T7454] __ia32_compat_sys_ioctl+0xc2/0x360 [ 104.747033][ T7454] __do_fast_syscall_32+0x14b/0x8c0 [ 104.747048][ T7454] ? lockdep_hardirqs_on+0x7d/0x110 [ 104.747063][ T7454] do_fast_syscall_32+0x32/0x70 [ 104.747078][ T7454] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 104.747094][ T7454] RIP: 0023:0xf7f84fbc [ 104.747103][ T7454] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 104.747113][ T7454] RSP: 002b:00000000f543650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 104.747124][ T7454] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00000000c0306201 [ 104.747131][ T7454] RDX: 0000000080000980 RSI: 0000000000000000 RDI: 0000000000000000 [ 104.747138][ T7454] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 104.747144][ T7454] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 104.747150][ T7454] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 104.747163][ T7454] [ 104.747168][ T7454] ERROR: Out of memory at tomoyo_realpath_from_path. [ 104.855815][ T36] rpcbind: server 127.0.0.1 not responding, timed out [ 104.895217][ T13] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 104.945108][ T42] kauditd_printk_skb: 578 callbacks suppressed [ 104.945122][ T42] audit: type=1326 audit(1792707640.099:1885): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7456 comm="syz.6.330" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7f84fbc code=0x0 [ 104.992791][ T13] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 105.062763][ T13] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 105.079833][ T5737] Bluetooth: hci2: command tx timeout [ 105.102425][ T5094] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 105.107972][ T5094] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 105.112025][ T5094] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 105.114963][ T5094] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 105.122435][ T5094] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 105.132233][ T13] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 105.236665][ T7469] rxe_eth0 speed is unknown, defaulting to 1000 [ 105.261258][ T13] bridge_slave_1: left allmulticast mode [ 105.261281][ T13] bridge_slave_1: left promiscuous mode [ 105.261448][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 105.273012][ T13] bridge_slave_0: left allmulticast mode [ 105.273033][ T13] bridge_slave_0: left promiscuous mode [ 105.273206][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 105.742016][ T7481] FAULT_INJECTION: forcing a failure. [ 105.742016][ T7481] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 105.742045][ T7481] CPU: 0 UID: 0 PID: 7481 Comm: syz.6.335 Not tainted syzkaller #0 PREEMPT(full) [ 105.742064][ T7481] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 105.742074][ T7481] Call Trace: [ 105.742081][ T7481] [ 105.742089][ T7481] dump_stack_lvl+0x100/0x190 [ 105.742119][ T7481] should_fail_ex.cold+0x5/0xa [ 105.742143][ T7481] _copy_from_user+0x2e/0xd0 [ 105.742164][ T7481] get_compat_msghdr+0xb3/0x480 [ 105.742196][ T7481] ? __pfx_get_compat_msghdr+0x10/0x10 [ 105.742218][ T7481] ? rcu_is_watching+0x13/0xc0 [ 105.742237][ T7481] ? ___sys_recvmsg+0x177/0x1a0 [ 105.742258][ T7481] ? kfree+0x1e5/0x6d0 [ 105.742281][ T7481] ___sys_recvmsg+0x193/0x1a0 [ 105.742304][ T7481] ? __pfx____sys_recvmsg+0x10/0x10 [ 105.742321][ T7481] ? lock_acquire+0x1d1/0x380 [ 105.742351][ T7481] ? __pfx___might_resched+0x10/0x10 [ 105.742379][ T7481] do_recvmmsg+0x548/0x750 [ 105.742404][ T7481] ? __pfx_do_recvmmsg+0x10/0x10 [ 105.742435][ T7481] ? find_held_lock+0x2b/0x80 [ 105.742452][ T7481] ? ksys_write+0x190/0x250 [ 105.742475][ T7481] ? ksys_write+0x190/0x250 [ 105.742507][ T7481] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 105.742534][ T7481] __sys_recvmmsg+0x21f/0x270 [ 105.742552][ T7481] ? __pfx___sys_recvmmsg+0x10/0x10 [ 105.742570][ T7481] ? __might_fault+0xc5/0x140 [ 105.742589][ T7481] ? __might_fault+0xc5/0x140 [ 105.742611][ T7481] __ia32_compat_sys_recvmmsg_time32+0xc4/0x160 [ 105.742634][ T7481] ? __might_fault+0x111/0x140 [ 105.742653][ T7481] __do_fast_syscall_32+0x14b/0x8c0 [ 105.742676][ T7481] ? lockdep_hardirqs_on+0x7d/0x110 [ 105.742700][ T7481] do_fast_syscall_32+0x32/0x70 [ 105.742724][ T7481] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 105.742746][ T7481] RIP: 0023:0xf7f84fbc [ 105.742760][ T7481] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 105.742777][ T7481] RSP: 002b:00000000f543650c EFLAGS: 00000292 ORIG_RAX: 0000000000000151 [ 105.742796][ T7481] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000740 [ 105.742807][ T7481] RDX: 00000000ffffff67 RSI: 0000000000000000 RDI: 0000000000000000 [ 105.742818][ T7481] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 105.742828][ T7481] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 105.742838][ T7481] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 105.742862][ T7481] [ 105.776172][ T7484] usb usb7: usbfs: process 7484 (syz.6.336) did not claim interface 0 before use [ 105.861480][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 105.863000][ T13] bond_slave_0: left promiscuous mode [ 105.864396][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 105.864815][ T13] bond_slave_1: left promiscuous mode [ 105.865456][ T13] bond0 (unregistering): Released all slaves [ 106.269470][ T5447] 8021q: adding VLAN 0 to HW filter on device eth18 [ 106.276572][ T7465] rxe_eth0 speed is unknown, defaulting to 1000 [ 106.331574][ T7510] usb usb7: usbfs: process 7510 (syz.4.339) did not claim interface 0 before use [ 106.336677][ T7510] FAULT_INJECTION: forcing a failure. [ 106.336677][ T7510] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 106.336695][ T7510] CPU: 2 UID: 0 PID: 7510 Comm: syz.4.339 Not tainted syzkaller #0 PREEMPT(full) [ 106.336708][ T7510] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 106.336715][ T7510] Call Trace: [ 106.336718][ T7510] [ 106.336723][ T7510] dump_stack_lvl+0x100/0x190 [ 106.336742][ T7510] should_fail_ex.cold+0x5/0xa [ 106.336757][ T7510] _copy_from_iter+0x1f4/0x1690 [ 106.336771][ T7510] ? __asan_memset+0x23/0x50 [ 106.336785][ T7510] ? __pfx__copy_from_iter+0x10/0x10 [ 106.336802][ T7510] ? __pfx___alloc_skb+0x10/0x10 [ 106.336826][ T7510] ? apparmor_capable+0x1d7/0x4d0 [ 106.336847][ T7510] netlink_sendmsg+0x8f5/0x10c0 [ 106.336866][ T7510] ? __pfx_netlink_sendmsg+0x10/0x10 [ 106.336892][ T7510] ? apparmor_socket_sendmsg+0x165/0x280 [ 106.336911][ T7510] ? ____sys_sendmsg+0xa4d/0xbe0 [ 106.336930][ T7510] ____sys_sendmsg+0xa4d/0xbe0 [ 106.336944][ T7510] ? __pfx_netlink_sendmsg+0x10/0x10 [ 106.336961][ T7510] ? __pfx_____sys_sendmsg+0x10/0x10 [ 106.336980][ T7510] ___sys_sendmsg+0x190/0x1e0 [ 106.336995][ T7510] ? __pfx____sys_sendmsg+0x10/0x10 [ 106.337020][ T7510] ? __lock_acquire+0x5c0/0x1f40 [ 106.337038][ T7510] __sys_sendmsg+0x160/0x210 [ 106.337055][ T7510] ? __pfx___sys_sendmsg+0x10/0x10 [ 106.337084][ T7510] __do_fast_syscall_32+0x14b/0x8c0 [ 106.337099][ T7510] ? lockdep_hardirqs_on+0x7d/0x110 [ 106.337114][ T7510] do_fast_syscall_32+0x32/0x70 [ 106.337129][ T7510] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 106.337143][ T7510] RIP: 0023:0xf73befbc [ 106.337153][ T7510] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 106.337163][ T7510] RSP: 002b:00000000f53d650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 106.337174][ T7510] RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 0000000080002840 [ 106.337181][ T7510] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 106.337187][ T7510] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 106.337193][ T7510] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 106.337200][ T7510] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 106.337213][ T7510] [ 106.691948][ T7172] usb 11-1: new high-speed USB device number 3 using dummy_hcd [ 106.796803][ T13] hsr_slave_0: left promiscuous mode [ 106.798575][ T13] hsr_slave_1: left promiscuous mode [ 106.802626][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 106.802642][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 106.811683][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 106.811702][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 106.817871][ T13] veth1_macvtap: left promiscuous mode [ 106.817933][ T13] veth0_macvtap: left promiscuous mode [ 106.818065][ T13] veth1_vlan: left promiscuous mode [ 106.818165][ T13] veth0_vlan: left promiscuous mode [ 106.869947][ T7172] usb 11-1: New USB device found, idVendor=258a, idProduct=0036, bcdDevice= 0.00 [ 106.871531][ T7172] usb 11-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 106.871561][ T7172] usb 11-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 106.871585][ T7172] usb 11-1: config 0 interface 0 has no altsetting 0 [ 106.871613][ T7172] usb 11-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 106.882500][ T7172] usb 11-1: config 0 descriptor?? [ 107.033354][ T13] team0 (unregistering): Port device team_slave_1 removed [ 107.050547][ T13] team0 (unregistering): Port device team_slave_0 removed [ 107.151445][ T5447] 8021q: adding VLAN 0 to HW filter on device eth19 [ 107.159644][ T5094] Bluetooth: hci3: command tx timeout [ 107.160430][ T5094] Bluetooth: hci2: command tx timeout [ 107.277856][ T7465] bridge0: port 1(bridge_slave_0) entered blocking state [ 107.277934][ T7465] bridge0: port 1(bridge_slave_0) entered disabled state [ 107.278038][ T7465] bridge_slave_0: entered allmulticast mode [ 107.278927][ T7465] bridge_slave_0: entered promiscuous mode [ 107.289437][ T7465] bridge0: port 2(bridge_slave_1) entered blocking state [ 107.289555][ T7465] bridge0: port 2(bridge_slave_1) entered disabled state [ 107.289612][ T7465] bridge_slave_1: entered allmulticast mode [ 107.290573][ T7465] bridge_slave_1: entered promiscuous mode [ 107.323304][ T7465] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 107.327476][ T7465] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 107.365799][ T7465] team0: Port device team_slave_0 added [ 107.367914][ T7465] team0: Port device team_slave_1 added [ 107.408195][ T7465] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 107.408211][ T7465] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 107.408231][ T7465] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 107.409908][ T7465] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 107.409916][ T7465] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 107.409930][ T7465] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 107.444502][ T7465] hsr_slave_0: entered promiscuous mode [ 107.444977][ T7465] hsr_slave_1: entered promiscuous mode [ 107.445262][ T7465] debugfs: 'hsr0' already exists in 'hsr' [ 107.445274][ T7465] Cannot create hsr debugfs directory [ 107.523385][ T12] netdevsim netdevsim7 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 107.605048][ T12] netdevsim netdevsim7 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 107.631997][ T7465] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 107.634760][ T7465] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 107.635531][ T7465] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 107.637855][ T7465] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 107.638554][ T7465] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 107.653260][ T7465] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 107.654128][ T7465] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 107.657547][ T7465] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 107.675807][ T12] netdevsim netdevsim7 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 107.708630][ T7465] bridge0: port 2(bridge_slave_1) entered blocking state [ 107.708683][ T7465] bridge0: port 2(bridge_slave_1) entered forwarding state [ 107.708789][ T7465] bridge0: port 1(bridge_slave_0) entered blocking state [ 107.708833][ T7465] bridge0: port 1(bridge_slave_0) entered forwarding state [ 107.751719][ T12] netdevsim netdevsim7 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 107.758034][ T5447] 8021q: adding VLAN 0 to HW filter on device eth20 [ 107.793379][ T7465] 8021q: adding VLAN 0 to HW filter on device bond0 [ 107.808626][ T36] bridge0: port 1(bridge_slave_0) entered disabled state [ 107.809761][ T36] bridge0: port 2(bridge_slave_1) entered disabled state [ 107.818295][ T7465] 8021q: adding VLAN 0 to HW filter on device team0 [ 107.831173][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 107.831218][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 107.852300][ T12] bridge_slave_1: left allmulticast mode [ 107.852316][ T12] bridge_slave_1: left promiscuous mode [ 107.852410][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 107.856699][ T12] bridge_slave_0: left allmulticast mode [ 107.856713][ T12] bridge_slave_0: left promiscuous mode [ 107.856810][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 107.967025][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 107.968922][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 107.973079][ T12] bond0 (unregistering): Released all slaves [ 107.977143][ T62] bridge0: port 2(bridge_slave_1) entered blocking state [ 107.977209][ T62] bridge0: port 2(bridge_slave_1) entered forwarding state [ 107.982518][ T5447] 8021q: adding VLAN 0 to HW filter on device eth21 [ 108.183415][ T7544] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 108.184863][ T7544] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 108.208218][ T7544] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 108.221968][ T7544] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 108.222019][ T7544] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 108.225282][ T7544] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 108.225987][ T7544] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 108.226030][ T7544] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 108.226776][ T7544] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 108.252640][ T7544] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 108.252700][ T7544] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 108.254931][ T7544] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 108.278364][ T7465] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 108.304723][ T5447] 8021q: adding VLAN 0 to HW filter on device eth22 [ 108.373721][ T7172] usbhid 11-1:0.0: can't add hid device: -71 [ 108.373777][ T7172] usbhid 11-1:0.0: probe with driver usbhid failed with error -71 [ 108.389082][ T7172] usb 11-1: USB disconnect, device number 3 [ 108.448052][ T12] hsr_slave_0: left promiscuous mode [ 108.453194][ T12] hsr_slave_1: left promiscuous mode [ 108.453614][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 108.453626][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 108.460363][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 108.460375][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 108.474164][ T12] veth1_macvtap: left promiscuous mode [ 108.474185][ T12] veth0_macvtap: left promiscuous mode [ 108.474239][ T12] veth1_vlan: left promiscuous mode [ 108.474254][ T12] veth0_vlan: left promiscuous mode [ 108.678368][ T12] team0 (unregistering): Port device team_slave_1 removed [ 108.691554][ T12] team0 (unregistering): Port device team_slave_0 removed [ 108.800564][ T7465] veth0_vlan: entered promiscuous mode [ 108.803589][ T7465] veth1_vlan: entered promiscuous mode [ 108.828169][ T7465] veth0_macvtap: entered promiscuous mode [ 108.835647][ T7465] veth1_macvtap: entered promiscuous mode [ 108.845245][ T7465] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 108.848424][ T7465] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 108.892458][ T62] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 108.892472][ T62] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 108.910392][ T5826] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.910537][ T5826] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.910556][ T5826] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.922251][ T62] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 108.922264][ T62] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 108.930374][ T5826] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.970574][ T12] IPVS: stop unused estimator thread 0... [ 109.062750][ T5447] 8021q: adding VLAN 0 to HW filter on device eth23 [ 109.137336][ T7650] Bluetooth: MGMT ver 1.23 [ 109.247195][ T5447] 8021q: adding VLAN 0 to HW filter on device eth24 [ 109.342572][ T7659] fuse: Bad value for 'fd' [ 109.343701][ T7659] Option 'XY^{&vDȔeh5^' to dns_resolver key: bad/missing value [ 109.429272][ T5447] 8021q: adding VLAN 0 to HW filter on device eth25 [ 109.479396][ T5094] Bluetooth: hci0: command 0x0c1a tx timeout [ 109.480521][ T5737] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 109.487775][ T2314] corsair-cpro 0003:1B1C:0C10.0009: hidraw1: USB HID v0.00 Device [syz0] on syz0 [ 109.581395][ T7680] cdrom: dropping to single frame dma [ 109.790881][ T2314] corsair-cpro 0003:1B1C:0C10.0009: probe with driver corsair-cpro failed with error -110 [ 110.191191][ T7708] overlay: filesystem on ./file0 not supported as upperdir [ 110.195537][ T7708] evm: overlay not supported [ 110.280338][ T5737] Bluetooth: hci3: command 0x040f tx timeout [ 110.280403][ T5737] Bluetooth: hci1: command 0x0c1a tx timeout [ 110.280405][ T5094] Bluetooth: hci2: command 0x0c1a tx timeout [ 110.733184][ T7723] xt_CT: No such helper "pptp" [ 110.733960][ T7723] netlink: 8 bytes leftover after parsing attributes in process `syz.9.366'. [ 110.733980][ T7723] netlink: 12 bytes leftover after parsing attributes in process `syz.9.366'. [ 110.744395][ T7723] netlink: 8 bytes leftover after parsing attributes in process `syz.9.366'. [ 110.744414][ T7723] netlink: 12 bytes leftover after parsing attributes in process `syz.9.366'. [ 110.749840][ T12] netdevsim netdevsim9 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 110.749866][ T12] netdevsim netdevsim9 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 110.749925][ T12] netdevsim netdevsim9 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 110.749944][ T12] netdevsim netdevsim9 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 110.874870][ T7729] netlink: 'syz.9.369': attribute type 10 has an invalid length. [ 110.960582][ T42] audit: type=1326 audit(1792707646.119:1886): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7730 comm="syz.6.370" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f84fbc code=0x7ffc0000 [ 110.960780][ T42] audit: type=1326 audit(1792707646.119:1887): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7730 comm="syz.6.370" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f84fbc code=0x7ffc0000 [ 110.961000][ T42] audit: type=1326 audit(1792707646.119:1888): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7730 comm="syz.6.370" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f84fbc code=0x7ffc0000 [ 110.961188][ T42] audit: type=1326 audit(1792707646.119:1889): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7730 comm="syz.6.370" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f84fbc code=0x7ffc0000 [ 110.961397][ T42] audit: type=1326 audit(1792707646.119:1890): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7730 comm="syz.6.370" exe="/syz-executor" sig=0 arch=40000003 syscall=4 compat=1 ip=0xf71777ab code=0x7ffc0000 [ 110.961608][ T5094] Bluetooth: hci1: unexpected event for opcode 0x2042 [ 110.961614][ T42] audit: type=1326 audit(1792707646.119:1891): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7730 comm="syz.6.370" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f84fbc code=0x7ffc0000 [ 110.961791][ T42] audit: type=1326 audit(1792707646.119:1892): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7730 comm="syz.6.370" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f84fbc code=0x7ffc0000 [ 110.962005][ T42] audit: type=1326 audit(1792707646.119:1893): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7730 comm="syz.6.370" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf7f84fbc code=0x7ffc0000 [ 111.006086][ T7729] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 111.045740][ T7729] pci 0000:00:01.0: BAR 0 [mem 0xfd000000-0xfdffffff pref] [ 111.047281][ T7729] pci 0000:00:01.0: BAR 2 [mem 0xfeaf6000-0xfeaf6fff] [ 111.051931][ T7729] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 111.059644][ T7729] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 111.083128][ T7729] pci 0000:00:01.0: Adding to iommu group 1 [ 111.094401][ T7729] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 111.094421][ T7729] pci 0000:00:01.0: vgaarb: bridge control possible [ 111.094435][ T7729] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 111.118838][ T7729] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 111.133135][ T7729] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff]: assigned [ 111.143965][ T7729] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 111.168532][ T7729] [drm] Found bochs VGA, ID 0xb0c5. [ 111.168547][ T7729] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81000000. [ 111.196823][ T7729] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 1 [ 111.333198][ T7736] rxe_eth0 speed is unknown, defaulting to 1000 [ 111.344360][ T7729] Console: switching to colour frame buffer device 160x50 [ 111.386091][ T7729] bochs-drm 0000:00:01.0: [drm] fb0: bochs-drmdrmfb frame buffer device [ 111.488747][ T42] audit: type=1326 audit(1792707646.639:1894): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7747 comm="syz.4.374" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73befbc code=0x7ffc0000 [ 111.500482][ T42] audit: type=1326 audit(1792707646.649:1895): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7747 comm="syz.4.374" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73befbc code=0x7ffc0000 [ 111.560296][ T5094] Bluetooth: hci0: command 0x0c1a tx timeout syzkaller syzkaller login: [ 112.028379][ T7760] rxe_eth0 speed is unknown, defaulting to 1000 [ 112.316815][ T7779] FAULT_INJECTION: forcing a failure. [ 112.316815][ T7779] name failslab, interval 1, probability 0, space 0, times 0 [ 112.316844][ T7779] CPU: 2 UID: 0 PID: 7779 Comm: syz.4.378 Not tainted syzkaller #0 PREEMPT(full) [ 112.316857][ T7779] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 112.316863][ T7779] Call Trace: [ 112.316868][ T7779] [ 112.316872][ T7779] dump_stack_lvl+0x100/0x190 [ 112.316934][ T7779] should_fail_ex.cold+0x5/0xa [ 112.316947][ T7779] ? asm_int80_emulation+0x1a/0x20 [ 112.316960][ T7779] should_failslab+0xc2/0x120 [ 112.317019][ T7779] __kmalloc_flags_noprof+0x122/0x8e0 [ 112.317034][ T7779] ? alloc_slab_obj_exts+0x6a/0x170 [ 112.317049][ T7779] alloc_slab_obj_exts+0x6a/0x170 [ 112.317061][ T7779] ? i915_bo_fbdev_prefer_stolen+0x60/0xc0 [ 112.317079][ T7779] __memcg_slab_post_alloc_hook+0x3fc/0x10c0 [ 112.317098][ T7779] ? kasan_save_track+0x14/0x30 [ 112.317114][ T7779] kmem_cache_alloc_noprof+0x4f5/0x6a0 [ 112.317128][ T7779] ? lock_acquire+0x1d1/0x380 [ 112.317143][ T7779] ? dst_alloc+0x99/0x1a0 [ 112.317179][ T7779] ? __pfx_ip6_dst_gc+0x10/0x10 [ 112.317195][ T7779] dst_alloc+0x99/0x1a0 [ 112.317213][ T7779] ip6_pol_route+0x9fd/0x1310 [ 112.317226][ T7779] ? __pfx_ip6_pol_route+0x10/0x10 [ 112.317238][ T7779] ? ip6t_do_table+0xbed/0x1c90 [ 112.317247][ T7779] ? __local_bh_enable_ip+0xa5/0x120 [ 112.317263][ T7779] ? ip6t_do_table+0xc1d/0x1c90 [ 112.317279][ T7779] ? __pfx_ip6_pol_route_input+0x10/0x10 [ 112.317291][ T7779] fib6_rule_lookup+0x537/0x720 [ 112.317309][ T7779] ? __pfx_fib6_rule_lookup+0x10/0x10 [ 112.317326][ T7779] ? __pfx_ip6t_do_table+0x10/0x10 [ 112.317338][ T7779] ? nf_nat_ipv6_fn+0xff/0x2d0 [ 112.317352][ T7779] ? __pfx_nf_nat_ipv6_fn+0x10/0x10 [ 112.317369][ T7779] ip6_route_input+0x662/0xc50 [ 112.317382][ T7779] ? __pfx_ip6_route_input+0x10/0x10 [ 112.317402][ T7779] ? nf_hook.constprop.0+0x2e3/0x750 [ 112.317414][ T7779] ? __pfx_ip6_rcv_finish+0x10/0x10 [ 112.317430][ T7779] ip6_rcv_finish_core.isra.0+0x1b1/0x1260 [ 112.317446][ T7779] ipv6_rcv+0x1e8/0x3d0 [ 112.317459][ T7779] ? __pfx_ipv6_rcv+0x10/0x10 [ 112.317472][ T7779] __netif_receive_skb_one_core+0x12d/0x1e0 [ 112.317489][ T7779] ? __pfx___netif_receive_skb_one_core+0x10/0x10 [ 112.317505][ T7779] ? lock_acquire+0x1d1/0x380 [ 112.317529][ T7779] __netif_receive_skb+0x1f/0x120 [ 112.317546][ T7779] netif_receive_skb+0x139/0x7d0 [ 112.317562][ T7779] ? __pfx_netif_receive_skb+0x10/0x10 [ 112.317583][ T7779] tun_rx_batched.isra.0+0x3f6/0x750 [ 112.317602][ T7779] ? __pfx_tun_rx_batched.isra.0+0x10/0x10 [ 112.317620][ T7779] ? tun_get_user+0x1dc9/0x3da0 [ 112.317640][ T7779] tun_get_user+0x1f05/0x3da0 [ 112.317661][ T7779] ? __lock_acquire+0x5c0/0x1f40 [ 112.317675][ T7779] ? __pfx_tun_get_user+0x10/0x10 [ 112.317691][ T7779] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 112.317713][ T7779] ? find_held_lock+0x2b/0x80 [ 112.317724][ T7779] ? tun_get+0x191/0x370 [ 112.317737][ T7779] ? tun_get+0x191/0x370 [ 112.317755][ T7779] tun_chr_write_iter+0xdc/0x200 [ 112.317772][ T7779] vfs_write+0x6af/0x1050 [ 112.317786][ T7779] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 112.317804][ T7779] ? __pfx_vfs_write+0x10/0x10 [ 112.317816][ T7779] ? find_held_lock+0x2b/0x80 [ 112.317835][ T7779] ksys_write+0x12a/0x250 [ 112.317849][ T7779] ? __pfx_ksys_write+0x10/0x10 [ 112.317866][ T7779] do_int80_emulation+0x166/0x650 [ 112.317917][ T7779] asm_int80_emulation+0x1a/0x20 [ 112.317929][ T7779] RIP: 0023:0xf71177ab [ 112.317940][ T7779] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 112.317950][ T7779] RSP: 002b:00000000f53d644c EFLAGS: 00000246 ORIG_RAX: 0000000000000004 [ 112.317969][ T7779] RAX: ffffffffffffffda RBX: 00000000000000c8 RCX: 0000000080001b00 [ 112.317976][ T7779] RDX: 000000000000004a RSI: 0000000000000000 RDI: 0000000000000000 [ 112.317982][ T7779] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 112.317989][ T7779] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 112.317996][ T7779] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 112.318010][ T7779] [ 112.359571][ T5094] Bluetooth: hci2: command 0x0c1a tx timeout [ 112.359597][ T5094] Bluetooth: hci3: command 0x040f tx timeout [ 112.665378][ T7793] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 113.538189][ T7820] netlink: 4 bytes leftover after parsing attributes in process `syz.4.383'. [ 113.634697][ T7817] nvme_fc: nvme_fc_create_ctrl: nn-0x3333333333333333:pn-0x4444444444444444 - nn-0x1111111111111111:pn-0x2222222222222222 combination not found [ 113.639289][ T5737] Bluetooth: hci0: command 0x0c1a tx timeout [ 113.724172][ T7801] random: crng reseeded on system resumption [ 113.848274][ T7812] fuse: Bad value for 'fd' [ 113.855075][ T7812] Option 'XY^{&vDȔeh5^' to dns_resolver key: bad/missing value [ 113.995664][ T7841] 9pnet_fd: Insufficient options for proto=fd [ 114.025631][ T5812] corsair-cpro 0003:1B1C:0C10.000A: hidraw1: USB HID v0.00 Device [syz0] on syz0 [ 114.032417][ T5812] corsair-cpro 0003:1B1C:0C10.000A: probe with driver corsair-cpro failed with error -71 [ 114.404068][ T7853] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 114.440388][ T5737] Bluetooth: hci3: command 0x040f tx timeout [ 114.440412][ T5737] Bluetooth: hci2: command 0x0c1a tx timeout [ 114.799290][ T7860] netlink: 4 bytes leftover after parsing attributes in process `syz.9.399'. [ 114.850233][ T7860] nvme_fc: nvme_fc_create_ctrl: nn-0x3333333333333333:pn-0x4444444444444444 - nn-0x1111111111111111:pn-0x2222222222222222 combination not found [ 114.943253][ T7864] jffs2: notice: (7864) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 115.090532][ T7872] random: crng reseeded on system resumption [ 115.389421][ T7865] overlay: filesystem on ./bus is read-only [ 115.720644][ T5094] Bluetooth: hci0: command 0x0c1a tx timeout [ 116.392515][ T7915] 9pnet_virtio: no channels available for device syz [ 116.519066][ T5094] Bluetooth: hci3: command 0x040f tx timeout [ 116.728213][ T7928] FAULT_INJECTION: forcing a failure. [ 116.728213][ T7928] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 116.728234][ T7928] CPU: 3 UID: 0 PID: 7928 Comm: syz.4.417 Not tainted syzkaller #0 PREEMPT(full) [ 116.728247][ T7928] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 116.728253][ T7928] Call Trace: [ 116.728257][ T7928] [ 116.728262][ T7928] dump_stack_lvl+0x100/0x190 [ 116.728281][ T7928] should_fail_ex.cold+0x5/0xa [ 116.728297][ T7928] _copy_to_user+0x32/0xd0 [ 116.728311][ T7928] simple_read_from_buffer+0xcb/0x170 [ 116.728328][ T7928] proc_fail_nth_read+0x1af/0x230 [ 116.728344][ T7928] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 116.728360][ T7928] ? rw_verify_area+0xce/0x6d0 [ 116.728372][ T7928] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 116.728387][ T7928] vfs_read+0x1e4/0xb40 [ 116.728401][ T7928] ? lock_acquire+0x1d1/0x380 [ 116.728415][ T7928] ? __fget_files+0x34/0x3d0 [ 116.728430][ T7928] ? __pfx_vfs_read+0x10/0x10 [ 116.728442][ T7928] ? find_held_lock+0x2b/0x80 [ 116.728453][ T7928] ? __fget_files+0x215/0x3d0 [ 116.728470][ T7928] ? __fget_files+0x21f/0x3d0 [ 116.728489][ T7928] ksys_read+0x12a/0x250 [ 116.728517][ T7928] ? __pfx_ksys_read+0x10/0x10 [ 116.728534][ T7928] do_int80_emulation+0x166/0x650 [ 116.728551][ T7928] asm_int80_emulation+0x1a/0x20 [ 116.728562][ T7928] RIP: 0023:0xf71177ab [ 116.728572][ T7928] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 116.728582][ T7928] RSP: 002b:00000000f53d64bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 116.728597][ T7928] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f53d65d0 [ 116.728604][ T7928] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 116.728610][ T7928] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 116.728616][ T7928] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 116.728623][ T7928] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 116.728637][ T7928] [ 116.874173][ T42] kauditd_printk_skb: 176 callbacks suppressed [ 116.874191][ T42] audit: type=1326 audit(1792707652.029:2072): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7941 comm="syz.4.421" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73befbc code=0x7ffc0000 [ 116.874233][ T42] audit: type=1326 audit(1792707652.029:2073): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7941 comm="syz.4.421" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73befbc code=0x7ffc0000 [ 116.874264][ T42] audit: type=1326 audit(1792707652.029:2074): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7941 comm="syz.4.421" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73befbc code=0x7ffc0000 [ 116.874903][ T42] audit: type=1326 audit(1792707652.029:2075): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7941 comm="syz.4.421" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73befbc code=0x7ffc0000 [ 116.874944][ T42] audit: type=1326 audit(1792707652.029:2076): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7941 comm="syz.4.421" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73befbc code=0x7ffc0000 [ 116.875023][ T42] audit: type=1326 audit(1792707652.029:2077): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7941 comm="syz.4.421" exe="/syz-executor" sig=0 arch=40000003 syscall=366 compat=1 ip=0xf73befbc code=0x7ffc0000 [ 116.875133][ T42] audit: type=1326 audit(1792707652.029:2078): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7941 comm="syz.4.421" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73befbc code=0x7ffc0000 [ 116.875172][ T42] audit: type=1326 audit(1792707652.029:2079): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7941 comm="syz.4.421" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73befbc code=0x7ffc0000 [ 116.875422][ T42] audit: type=1326 audit(1792707652.029:2080): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7941 comm="syz.4.421" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73befbc code=0x7ffc0000 [ 116.875923][ T42] audit: type=1326 audit(1792707652.029:2081): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7941 comm="syz.4.421" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73befbc code=0x7ffc0000 [ 116.965457][ T7943] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 117.072419][ T7946] process 'syz.4.421' launched '/dev/fd/7' with NULL argv: empty string added [ 117.102947][ T7948] netlink: 'syz.8.422': attribute type 3 has an invalid length. [ 117.240565][ T7946] Console: switching to colour dummy device 80x25 [ 117.852151][ T7962] netlink: 8 bytes leftover after parsing attributes in process `syz.6.428'. [ 118.176644][ T7972] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 118.262167][ T7736] corsair-cpro 0003:1B1C:0C10.000B: hidraw1: USB HID v0.00 Device [syz0] on syz0 [ 118.599093][ T5094] Bluetooth: hci3: command 0x040f tx timeout [ 118.601251][ T7736] corsair-cpro 0003:1B1C:0C10.000B: probe with driver corsair-cpro failed with error -110 [ 118.740735][ T7982] netlink: 24 bytes leftover after parsing attributes in process `syz.8.431'. [ 119.100302][ T5782] netdevsim netdevsim9 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 119.100325][ T5782] netdevsim netdevsim9 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 119.171780][ T5782] netdevsim netdevsim9 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 119.171804][ T5782] netdevsim netdevsim9 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 119.246458][ T5782] netdevsim netdevsim9 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 119.246480][ T5782] netdevsim netdevsim9 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 119.318798][ T5782] netdevsim netdevsim9 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 119.318821][ T5782] netdevsim netdevsim9 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 119.343043][ T5737] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 119.344143][ T5737] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 119.344621][ T5737] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 119.346535][ T5737] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 119.346830][ T5737] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 119.492955][ T5782] bridge_slave_1: left allmulticast mode [ 119.492977][ T5782] bridge_slave_1: left promiscuous mode [ 119.493195][ T5782] bridge0: port 2(bridge_slave_1) entered disabled state [ 119.503721][ T5782] bridge_slave_0: left allmulticast mode [ 119.503744][ T5782] bridge_slave_0: left promiscuous mode [ 119.504015][ T5782] bridge0: port 1(bridge_slave_0) entered disabled state [ 119.796114][ T5782] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 119.804167][ T5782] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 119.807512][ T5782] bond0 (unregistering): Released all slaves [ 119.815509][ T5447] 8021q: adding VLAN 0 to HW filter on device eth26 [ 119.821338][ T8015] bond0: entered promiscuous mode [ 119.821351][ T8015] bond_slave_0: entered promiscuous mode [ 119.821496][ T8015] bond_slave_1: entered promiscuous mode [ 119.821615][ T8015] bond0: entered allmulticast mode [ 119.821623][ T8015] bond_slave_0: entered allmulticast mode [ 119.821632][ T8015] bond_slave_1: entered allmulticast mode [ 119.842021][ T8015] netlink: 20 bytes leftover after parsing attributes in process `syz.6.439'. [ 119.956824][ T8025] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 120.037048][ T7988] rxe_eth0 speed is unknown, defaulting to 1000 [ 120.410988][ T8052] 9pnet_virtio: no channels available for device syz [ 121.101853][ T5782] hsr_slave_0: left promiscuous mode [ 121.104914][ T5782] hsr_slave_1: left promiscuous mode [ 121.107418][ T5782] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 121.107456][ T5782] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 121.118727][ T5782] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 121.118765][ T5782] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 121.154297][ T5782] veth1_macvtap: left promiscuous mode [ 121.154547][ T5782] veth0_macvtap: left promiscuous mode [ 121.155088][ T5782] veth1_vlan: left promiscuous mode [ 121.158036][ T5782] veth0_vlan: left promiscuous mode [ 121.384946][ T5782] team0 (unregistering): Port device team_slave_1 removed [ 121.395293][ T5782] team0 (unregistering): Port device team_slave_0 removed [ 121.409113][ T5737] Bluetooth: hci3: command tx timeout [ 121.541261][ T8074] tipc: Started in network mode [ 121.541274][ T8074] tipc: Node identity 4, cluster identity 4711 [ 121.541282][ T8074] tipc: Node number set to 4 [ 121.745085][ T8091] tmpfs: Bad value for 'mpol' [ 121.879494][ T42] kauditd_printk_skb: 1201 callbacks suppressed [ 121.879509][ T42] audit: type=1326 audit(1792707657.039:3283): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8069 comm="syz.8.446" exe="/syz-executor" sig=0 arch=40000003 syscall=267 compat=1 ip=0xf71077ab code=0x7ffc0000 [ 121.880855][ T42] audit: type=1326 audit(1792707657.039:3284): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8069 comm="syz.8.446" exe="/syz-executor" sig=0 arch=40000003 syscall=267 compat=1 ip=0xf71077ab code=0x7ffc0000 [ 121.883436][ T42] audit: type=1326 audit(1792707657.039:3285): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8069 comm="syz.8.446" exe="/syz-executor" sig=0 arch=40000003 syscall=267 compat=1 ip=0xf71077ab code=0x7ffc0000 [ 121.883506][ T42] audit: type=1326 audit(1792707657.039:3286): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8069 comm="syz.8.446" exe="/syz-executor" sig=0 arch=40000003 syscall=267 compat=1 ip=0xf71077ab code=0x7ffc0000 [ 121.884459][ T42] audit: type=1326 audit(1792707657.039:3287): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8069 comm="syz.8.446" exe="/syz-executor" sig=0 arch=40000003 syscall=267 compat=1 ip=0xf71077ab code=0x7ffc0000 [ 121.886503][ T42] audit: type=1326 audit(1792707657.039:3288): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8069 comm="syz.8.446" exe="/syz-executor" sig=0 arch=40000003 syscall=267 compat=1 ip=0xf71077ab code=0x7ffc0000 [ 121.887521][ T42] audit: type=1326 audit(1792707657.039:3289): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8069 comm="syz.8.446" exe="/syz-executor" sig=0 arch=40000003 syscall=267 compat=1 ip=0xf71077ab code=0x7ffc0000 [ 121.909241][ T42] audit: type=1326 audit(1792707657.039:3290): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8069 comm="syz.8.446" exe="/syz-executor" sig=0 arch=40000003 syscall=267 compat=1 ip=0xf71077ab code=0x7ffc0000 [ 121.909289][ T42] audit: type=1326 audit(1792707657.049:3291): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8069 comm="syz.8.446" exe="/syz-executor" sig=0 arch=40000003 syscall=267 compat=1 ip=0xf71077ab code=0x7ffc0000 [ 121.909322][ T42] audit: type=1326 audit(1792707657.049:3293): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8069 comm="syz.8.446" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73aefbc code=0x7ffc0000 [ 121.989687][ T7988] bridge0: port 1(bridge_slave_0) entered blocking state [ 121.989764][ T7988] bridge0: port 1(bridge_slave_0) entered disabled state [ 121.989888][ T7988] bridge_slave_0: entered allmulticast mode [ 121.991110][ T7988] bridge_slave_0: entered promiscuous mode [ 121.993060][ T7988] bridge0: port 2(bridge_slave_1) entered blocking state [ 121.993130][ T7988] bridge0: port 2(bridge_slave_1) entered disabled state [ 121.993192][ T7988] bridge_slave_1: entered allmulticast mode [ 122.001921][ T7988] bridge_slave_1: entered promiscuous mode [ 122.068418][ T7988] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 122.070979][ T7988] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 122.101798][ T7988] team0: Port device team_slave_0 added [ 122.105691][ T7988] team0: Port device team_slave_1 added [ 122.127647][ T7988] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 122.127658][ T7988] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 122.127673][ T7988] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 122.131012][ T7988] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 122.131021][ T7988] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 122.131035][ T7988] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 122.166974][ T7988] hsr_slave_0: entered promiscuous mode [ 122.167398][ T7988] hsr_slave_1: entered promiscuous mode [ 122.167715][ T7988] debugfs: 'hsr0' already exists in 'hsr' [ 122.167727][ T7988] Cannot create hsr debugfs directory [ 122.391007][ T8110] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 122.397308][ T8115] netlink: 20 bytes leftover after parsing attributes in process `syz.4.454'. [ 122.746880][ T7988] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 122.755068][ T7988] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 122.756054][ T7988] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 122.761116][ T7988] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 122.775174][ T7988] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 122.786377][ T7988] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 122.787375][ T7988] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 122.803828][ T7988] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 122.884632][ T7988] 8021q: adding VLAN 0 to HW filter on device bond0 [ 122.899633][ T7988] 8021q: adding VLAN 0 to HW filter on device team0 [ 122.904456][ T1678] bridge0: port 1(bridge_slave_0) entered blocking state [ 122.904501][ T1678] bridge0: port 1(bridge_slave_0) entered forwarding state [ 122.907889][ T1678] bridge0: port 2(bridge_slave_1) entered blocking state [ 122.907932][ T1678] bridge0: port 2(bridge_slave_1) entered forwarding state [ 122.995085][ T8152] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 123.123769][ T8171] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 123.161924][ T7988] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 123.187430][ T7988] veth0_vlan: entered promiscuous mode [ 123.197280][ T7988] veth1_vlan: entered promiscuous mode [ 123.205045][ T5447] 8021q: adding VLAN 0 to HW filter on device eth27 [ 123.228591][ T7988] veth0_macvtap: entered promiscuous mode [ 123.236327][ T7988] veth1_macvtap: entered promiscuous mode [ 123.253675][ T7988] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 123.260757][ T7988] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 123.280450][ T5826] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 123.280475][ T5826] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 123.280493][ T5826] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 123.280510][ T5826] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 123.345553][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 123.345571][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 123.376101][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 123.376115][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 123.479107][ T5737] Bluetooth: hci3: command tx timeout [ 123.482039][ T5447] 8021q: adding VLAN 0 to HW filter on device eth28 [ 123.646100][ T5802] hid-generic 0005:15C2:8000.000C: item fetching failed at offset 0/1 [ 123.648968][ T5802] hid-generic 0005:15C2:8000.000C: probe with driver hid-generic failed with error -22 [ 123.672924][ T5447] 8021q: adding VLAN 0 to HW filter on device eth29 [ 123.809111][ T9] usb 13-1: new high-speed USB device number 2 using dummy_hcd [ 123.969854][ T8224] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 123.973480][ T9] usb 13-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 123.975594][ T9] usb 13-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 123.975610][ T9] usb 13-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 123.975628][ T9] usb 13-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 123.989384][ T9] usb 13-1: config 0 descriptor?? [ 124.246280][ T8195] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 124.246537][ T8195] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 124.469409][ T7807] usb 11-1: new high-speed USB device number 4 using dummy_hcd [ 124.551575][ T9] usbhid 13-1:0.0: can't add hid device: -71 [ 124.551633][ T9] usbhid 13-1:0.0: probe with driver usbhid failed with error -71 [ 124.640806][ T7807] usb 11-1: New USB device found, idVendor=1b80, idProduct=e400, bcdDevice=dc.3a [ 124.641947][ T7807] usb 11-1: config 3 has an invalid interface number: 181 but max is 0 [ 124.641962][ T7807] usb 11-1: config 3 has no interface number 0 [ 124.641980][ T7807] usb 11-1: config 3 interface 181 altsetting 2 has an invalid descriptor for endpoint zero, skipping [ 124.641992][ T7807] usb 11-1: config 3 interface 181 has no altsetting 0 [ 124.643980][ T7807] usb 11-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 124.643993][ T7807] usb 11-1: Product: 樦˃䖚穑⽷儗ⱼ䯌㣇⚳᩿熁⑂띰ꩮ헎ᇬ骰ﴤ鷦윢⨏瓏鎗懧꿟倫峣瘊瀧匕㕮ࣵ쇏맼鈘͉鶶캗䳞⊾䑐㲏ⓞ笟輋슗鋇덎唈븁豨圼鞑䮆堕饢볔煏䶚衫裑궽ﶈᩚ㟂䅧棺⳨ꎒ䍣਑ꧧ婑≸ꊫ펾闛ᤵ쪂繩퇢ꗨ轢狣䁵횲ꨦ떙뮕섋泳䛐愷艀歲⹽誖ffi獨滉鯥磟䔀றꨙ鏡ಉ [ 124.644011][ T7807] usb 11-1: Manufacturer: ꆧ༥㙔먷촤孯ꗞ罖쿤꩔ֹ㽠뵐韍̊⏨벪袾깢徱䚉弑诞恠틘캧쩱᪞딤눈ꇻ阵뙉Ⱪ饲돬鯪奕㈽覑ꯦ㘉ꉧ諯迗㸠煻琍궡౏ცℵ碼ᅽ햀卦챛ᱵ鮕㾒䣅諤玳 [ 124.644025][ T7807] usb 11-1: SerialNumber: syz [ 124.727315][ T9] usb 13-1: USB disconnect, device number 2 [ 124.798807][ T8270] netlink: 44 bytes leftover after parsing attributes in process `syz.8.477'. [ 125.559139][ T5737] Bluetooth: hci3: command tx timeout [ 125.683385][ T7807] usb 11-1: USB disconnect, device number 4 [ 125.773963][ T8300] ioremap: invalid physical address 8000000000000000 [ 125.774033][ T8300] ------------[ cut here ]------------ [ 125.774040][ T8300] 1 [ 125.774045][ T8300] WARNING: arch/x86/mm/ioremap.c:206 at __ioremap_caller.isra.0.cold+0x59/0xa4, CPU#0: syz.6.478/8300 [ 125.784205][ T8300] Modules linked in: [ 125.785958][ T8300] CPU: 0 UID: 0 PID: 8300 Comm: syz.6.478 Not tainted syzkaller #0 PREEMPT(full) SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 125.789524][ T8300] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 125.793552][ T8300] RIP: 0010:__ioremap_caller.isra.0.cold+0x59/0xa4 [ 125.796087][ T8300] Code: 48 8b 34 24 48 c7 c7 00 2e ec 8b e8 2a 22 01 00 e9 1b 21 9a 00 e8 10 cb ea 00 4c 89 ee 48 c7 c7 60 2c ec 8b e8 11 22 01 00 90 <0f> 0b 90 e9 fb 20 9a 00 e8 f3 ca ea 00 41 0f b6 d7 4c 89 ee 48 c7 [ 125.803507][ T8300] RSP: 0018:ffffc900072478b8 EFLAGS: 00010286 [ 125.805964][ T8300] RAX: 0000000000000032 RBX: 1ffff92000e48f1b RCX: 0000000000000000 [ 125.809276][ T8300] RDX: 0000000000000032 RSI: ffffffff81e9d1c9 RDI: fffff52000e48f08 [ 125.812460][ T8300] RBP: 0000000000001000 R08: 0000000000000007 R09: 0000000000000000 [ 125.815529][ T8300] R10: 8000000000000000 R11: 0000000000000001 R12: 8000000000000fff [ 125.818707][ T8300] R13: 8000000000000000 R14: 0000000000000002 R15: 0000000000020000 [ 125.821888][ T8300] FS: 0000000000000000(0000) GS:ffff88809572f000(0063) knlGS:00000000f5436b40 [ 125.825507][ T8300] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 125.828173][ T8300] CR2: 00000000f53f3ff4 CR3: 000000006ae5f000 CR4: 0000000000352ef0 [ 125.831326][ T8300] Call Trace: [ 125.832668][ T8300] [ 125.833926][ T8300] ? register_device+0x1bb/0x6a0 [ 125.835878][ T8300] ? __pfx___ioremap_caller.isra.0+0x10/0x10 [ 125.838267][ T8300] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 125.840522][ T8300] ? register_device+0x164/0x6a0 [ 125.842643][ T8300] register_device+0x1bb/0x6a0 [ 125.844645][ T8300] phram_setup+0x3b1/0x4c0 [ 125.846484][ T8300] ? __pfx_phram_setup+0x10/0x10 [ 125.848424][ T8300] ? trace_contention_end+0x126/0x160 [ 125.850567][ T8300] ? param_attr_store+0xec/0x300 [ 125.852615][ T8300] ? __pfx___mutex_lock+0x10/0x10 [ 125.854666][ T8300] phram_param_call+0xa6/0xd0 [ 125.856726][ T8300] param_attr_store+0x199/0x300 [ 125.858740][ T8300] ? __pfx_param_attr_store+0x10/0x10 [ 125.861015][ T8300] module_attr_store+0x58/0x80 [ 125.863011][ T8300] ? __pfx_module_attr_store+0x10/0x10 [ 125.865221][ T8300] sysfs_kf_write+0xf2/0x150 [ 125.867133][ T8300] kernfs_fop_write_iter+0x3e0/0x5f0 [ 125.869162][ T8300] ? __pfx_sysfs_kf_write+0x10/0x10 [ 125.871164][ T8300] vfs_write+0x6af/0x1050 [ 125.872957][ T8300] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 125.875308][ T8300] ? __pfx_vfs_write+0x10/0x10 [ 125.877279][ T8300] ? find_held_lock+0x2b/0x80 [ 125.879403][ T8300] ksys_write+0x12a/0x250 [ 125.881214][ T8300] ? __pfx_ksys_write+0x10/0x10 [ 125.883086][ T8300] __do_fast_syscall_32+0x14b/0x8c0 [ 125.885166][ T8300] do_fast_syscall_32+0x32/0x70 [ 125.887180][ T8300] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 125.889811][ T8300] RIP: 0023:0xf7f84fbc [ 125.891507][ T8300] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 125.898635][ T8300] RSP: 002b:00000000f543650c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 125.902791][ T8300] RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 0000000080000380 [ 125.905889][ T8300] RDX: 000000000000001e RSI: 0000000000000000 RDI: 0000000000000000 [ 125.909031][ T8300] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 125.912108][ T8300] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 125.915122][ T8300] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 125.918207][ T8300] [ 125.919503][ T8300] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 125.922330][ T8300] CPU: 0 UID: 0 PID: 8300 Comm: syz.6.478 Not tainted syzkaller #0 PREEMPT(full) [ 125.925727][ T8300] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 125.929507][ T8300] Call Trace: [ 125.930807][ T8300] [ 125.931985][ T8300] dump_stack_lvl+0x100/0x190 [ 125.933772][ T8300] vpanic+0x553/0x970 [ 125.935376][ T8300] ? __pfx_vpanic+0x10/0x10 [ 125.937202][ T8300] panic+0xd1/0xe0 [ 125.938696][ T8300] ? __pfx_panic+0x10/0x10 [ 125.940506][ T8300] check_panic_on_warn.cold+0x19/0x34 [ 125.942631][ T8300] ? __ioremap_caller.isra.0.cold+0x59/0xa4 [ 125.944965][ T8300] __warn.cold+0x191/0x318 [ 125.946734][ T8300] __report_bug+0x30f/0x440 [ 125.948528][ T8300] ? __ioremap_caller.isra.0.cold+0x59/0xa4 [ 125.950865][ T8300] ? __pfx___report_bug+0x10/0x10 [ 125.952876][ T8300] ? irq_work_queue+0xd1/0x100 [ 125.954785][ T8300] ? __wake_up_klogd+0xe5/0x140 [ 125.956701][ T8300] ? vprintk_emit+0x1c9/0x6b0 [ 125.958568][ T8300] ? __pfx_vprintk_emit+0x10/0x10 [ 125.960587][ T8300] ? __ioremap_caller.isra.0.cold+0x59/0xa4 [ 125.962787][ T8300] report_bug+0xb3/0x220 [ 125.964197][ T8300] ? __ioremap_caller.isra.0.cold+0x59/0xa4 [ 125.966135][ T8300] handle_bug+0x16a/0x2a0 [ 125.967939][ T8300] exc_invalid_op+0x17/0x50 [ 125.969826][ T8300] asm_exc_invalid_op+0x1a/0x20 [ 125.971629][ T8300] RIP: 0010:__ioremap_caller.isra.0.cold+0x59/0xa4 [ 125.973797][ T8300] Code: 48 8b 34 24 48 c7 c7 00 2e ec 8b e8 2a 22 01 00 e9 1b 21 9a 00 e8 10 cb ea 00 4c 89 ee 48 c7 c7 60 2c ec 8b e8 11 22 01 00 90 <0f> 0b 90 e9 fb 20 9a 00 e8 f3 ca ea 00 41 0f b6 d7 4c 89 ee 48 c7 [ 125.979746][ T8300] RSP: 0018:ffffc900072478b8 EFLAGS: 00010286 [ 125.981659][ T8300] RAX: 0000000000000032 RBX: 1ffff92000e48f1b RCX: 0000000000000000 [ 125.984286][ T8300] RDX: 0000000000000032 RSI: ffffffff81e9d1c9 RDI: fffff52000e48f08 [ 125.986559][ T8300] RBP: 0000000000001000 R08: 0000000000000007 R09: 0000000000000000 [ 125.989022][ T8300] R10: 8000000000000000 R11: 0000000000000001 R12: 8000000000000fff [ 125.991461][ T8300] R13: 8000000000000000 R14: 0000000000000002 R15: 0000000000020000 [ 125.994172][ T8300] ? vprintk_emit+0x1c9/0x6b0 [ 125.995624][ T8300] ? __ioremap_caller.isra.0.cold+0x58/0xa4 [ 125.997534][ T8300] ? register_device+0x1bb/0x6a0 [ 125.999088][ T8300] ? __pfx___ioremap_caller.isra.0+0x10/0x10 [ 126.000980][ T8300] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 126.002708][ T8300] ? register_device+0x164/0x6a0 [ 126.004329][ T8300] register_device+0x1bb/0x6a0 [ 126.005834][ T8300] phram_setup+0x3b1/0x4c0 [ 126.007242][ T8300] ? __pfx_phram_setup+0x10/0x10 [ 126.008801][ T8300] ? trace_contention_end+0x126/0x160 [ 126.010389][ T8300] ? param_attr_store+0xec/0x300 [ 126.011969][ T8300] ? __pfx___mutex_lock+0x10/0x10 [ 126.013592][ T8300] phram_param_call+0xa6/0xd0 [ 126.015064][ T8300] param_attr_store+0x199/0x300 [ 126.016634][ T8300] ? __pfx_param_attr_store+0x10/0x10 [ 126.018308][ T8300] module_attr_store+0x58/0x80 [ 126.019808][ T8300] ? __pfx_module_attr_store+0x10/0x10 [ 126.021509][ T8300] sysfs_kf_write+0xf2/0x150 [ 126.022986][ T8300] kernfs_fop_write_iter+0x3e0/0x5f0 [ 126.024660][ T8300] ? __pfx_sysfs_kf_write+0x10/0x10 [ 126.026286][ T8300] vfs_write+0x6af/0x1050 [ 126.027651][ T8300] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 126.029465][ T8300] ? __pfx_vfs_write+0x10/0x10 [ 126.030962][ T8300] ? find_held_lock+0x2b/0x80 [ 126.032488][ T8300] ksys_write+0x12a/0x250 [ 126.033896][ T8300] ? __pfx_ksys_write+0x10/0x10 [ 126.035379][ T8300] __do_fast_syscall_32+0x14b/0x8c0 [ 126.037028][ T8300] do_fast_syscall_32+0x32/0x70 [ 126.038560][ T8300] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 126.040551][ T8300] RIP: 0023:0xf7f84fbc [ 126.041769][ T8300] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 126.047569][ T8300] RSP: 002b:00000000f543650c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 126.050156][ T8300] RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 0000000080000380 [ 126.052649][ T8300] RDX: 000000000000001e RSI: 0000000000000000 RDI: 0000000000000000 [ 126.055158][ T8300] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 126.057624][ T8300] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 126.060074][ T8300] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 126.062558][ T8300] [ 126.064142][ T8300] Kernel Offset: disabled [ 126.065857][ T8300] Rebooting in 86400 seconds..