last executing test programs: 54m6.823210177s ago: executing program 32 (id=1365): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000000)={0xffffffff, 0x6}, 0x8) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e1f, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0)=0xffffffffffffffff, 0x4) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x5000003) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) close(r0) socket(0x10, 0x3, 0x0) r1 = syz_open_dev$sndctrl(&(0x7f0000000080), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r1, 0xc0045516, &(0x7f0000000000)=0x639) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000140)='/sys/power/sync_on_suspend', 0x1e9a21, 0x20) r2 = syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_WAIT_VBLANK(r3, 0xc018643a, 0x0) r4 = syz_io_uring_setup(0x746a, &(0x7f0000000480)={0x0, 0x0, 0x400, 0x0, 0x335}, &(0x7f0000000080)=0x0, &(0x7f0000000100)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f0000000200)=@IORING_OP_READV=@use_registered_buffer={0x1, 0x1a, 0x4000, @fd_index=0x5, 0x2, 0x0, 0x0, 0x8, 0x0, {0x2}}) io_uring_enter(r4, 0x47ba, 0x0, 0x0, 0x0, 0x0) unshare(0x8040480) connect$vsock_stream(0xffffffffffffffff, &(0x7f0000000000)={0x28, 0x0, 0x0, @hyper}, 0x10) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) io_uring_register$IORING_REGISTER_FILES(0xffffffffffffffff, 0x1f, &(0x7f0000000000)=[0xffffffffffffffff], 0x1) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r2, 0xc4c85513, &(0x7f0000001180)={{0x3, 0x2, 0x80000002, 0x100, 'syz1\x00', 0xffffffff}, 0x0, [0x6ba74c59, 0x85, 0xf, 0x1, 0x9, 0x6, 0x5, 0xdb, 0x0, 0xf0, 0x3, 0x5, 0x8001, 0xfffffffffffffffb, 0x4, 0x2938, 0x100, 0xfffffffffffffff8, 0xfffffffffffffff9, 0xfffffffffffffffb, 0x6, 0x9025, 0x5, 0x5, 0x7, 0x100000001, 0x40, 0x9, 0x9, 0x2, 0x100, 0xa, 0xb, 0x1a7427c9, 0x7, 0x8, 0x7, 0x1ff, 0x5, 0x10000, 0xffffffff, 0xffffffffffffff3f, 0x800, 0x9, 0xe4e, 0xffffffffffffffff, 0x6, 0xff, 0x659, 0x5, 0xfff, 0x2, 0xffff, 0xffffffffffffff53, 0x0, 0x101, 0x7f, 0x4, 0x9, 0x10, 0x2, 0xd1c, 0x80000001, 0x9, 0x8001, 0x0, 0x1, 0xfffffffffffff3a0, 0x4, 0x4, 0x4, 0x1, 0x9, 0xe5, 0xfa0, 0x20000000000009, 0x1, 0x401, 0x8, 0x7fffffffffffffff, 0x101, 0xffffffffffffff2f, 0xe, 0x4, 0x4040000, 0xffffffff, 0x5, 0x7, 0x5, 0x1ff, 0x9, 0x4, 0x100, 0x5, 0x7, 0x5, 0x7, 0xfffffffffffffff9, 0x6, 0x5, 0x3, 0x4, 0x9, 0x27ee, 0x0, 0x0, 0x0, 0x4, 0x6, 0x8, 0x6, 0x8000000000000001, 0x90, 0xd27, 0x0, 0x4, 0x3ff, 0x3, 0x9, 0x87, 0x80, 0x3, 0x2, 0x2c, 0xa, 0x1, 0x1, 0x8]}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r7, &(0x7f00000002c0)=@file={0x1, './file0\x00'}, 0x6e) accept$unix(r8, &(0x7f0000000500)=@abs, &(0x7f0000000240)=0xffffffffffffffad) 50m46.780302868s ago: executing program 33 (id=2391): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="240000001900010028bd7000fcdbdf250a001400000000040004000008001700ffffffffdb44e28ee88294c0ec6e3b5f98de6e20"], 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x80) openat$tun(0xffffffffffffff9c, &(0x7f0000000b00), 0x0, 0x0) (async) r1 = syz_open_dev$ttys(0xc, 0x2, 0x0) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) (async) socket$alg(0x26, 0x5, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$inet_mptcp(0x2, 0x1, 0x106) (async) socket$tipc(0x1e, 0x5, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000040), 0x401, 0x0) (async) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_DELETE(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)={0x28, 0x2, 0x1, 0x401, 0x0, 0x0, {0x2, 0x0, 0xa}, [@CTA_FILTER={0x14, 0x19, 0x0, 0x1, [@CTA_FILTER_ORIG_FLAGS={0x8, 0x1, 0x400}, @CTA_FILTER_REPLY_FLAGS={0x8, 0x2, 0x826}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x24000084}, 0x20044804) (async) pselect6(0x40, &(0x7f0000000000)={0x6, 0xfffffffffffffffd, 0x9, 0x40, 0x2, 0x7fffffffffffffff}, 0x0, &(0x7f0000000680)={0x7ff, 0x7, 0x5, 0x7, 0xffffffffffffff22, 0x2, 0x5, 0x8}, 0x0, 0x0) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x68e201, 0x0) (async) io_setup(0x6, &(0x7f00000000c0)) (async) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000140)=0x1016) (async) r3 = openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) write$binfmt_aout(r3, &(0x7f0000000200)={{0xcc, 0x9, 0x10, 0x3b9, 0x11b, 0x2, 0xc6, 0x9e}, "6dc7e6e910ec05ab42e0f12cd204c2bc415c9a3982abfd3181994bb83da03cb87b757eb22956cdaedadd0962b2ebe4b9520e73e0fd038884ae623355b3cf89ccb2be485bda762a73c9886d3ff3d3f737407f430c54e7f79fc35455ec34ee1bd2194e28bb76be8eaf0a266f780ac9b3c3c2dbbb30477202a00951966246b08c96edd0ed6f42183e02b57435e10f216723dcf297c6731a1b28886164d9a98d34533bbbf90f5e6458235afa49d4005f389389516c84710e374786ac5b43c7f3a5bc963c6d0ffe2f11"}, 0xe7) (async) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000180)=0x1) 45m55.954685949s ago: executing program 1 (id=3755): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r1 = syz_open_dev$vbi(&(0x7f00000000c0), 0x3, 0x2) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f0000000180)={0x9, [0x0, 0x8, 0xff00, 0x0, 0x0, 0x701, 0x1000, 0xfffe, 0x0, 0xe225, 0x2, 0x4, 0x8, 0x4, 0x1, 0xfff2, 0x2, 0xffff, 0x47c, 0x4, 0x9, 0x5, 0x5, 0x6, 0x4, 0x7, 0x8, 0x9, 0xb247, 0x7d, 0x4, 0x6, 0xff80, 0x9, 0x7, 0x57, 0x0, 0x9000, 0xffff, 0x200, 0x5, 0x4, 0x7, 0x100, 0x0, 0x4, 0x2, 0x5], 0x9}) ioctl$sock_SIOCETHTOOL(r0, 0x89f1, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f0000000140)=@ethtool_cmd={0x2f, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x7ffff7fc, 0x0, 0x0, 0x0, 0x47, [0xfffffffc, 0x80]}}) 45m55.863662341s ago: executing program 1 (id=3758): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) syz_open_procfs(0x0, &(0x7f0000000180)='net/vlan/vlan0\x00') socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(r0, 0x8982, &(0x7f0000002800)={0x1, 'vlan0\x00'}) r1 = syz_open_procfs(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r1, 0xc018937b, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB], 0xe4}, 0x1, 0x0, 0x0, 0x8001}, 0x20050840) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000680)={'bridge0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newlink={0x50, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r3, 0x3f, 0x40206}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x20, 0x2, 0x0, 0x1, [@IFLA_BR_MULTI_BOOLOPT={0xc, 0x2e, {0x3, 0x3}}, @IFLA_BR_VLAN_FILTERING={0x5, 0x7, 0x8}, @IFLA_BR_MCAST_SNOOPING={0x5}]}}}]}, 0x50}, 0x1, 0x4000, 0x0, 0x44000}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704020180fc5409000c00", 0x33fe0}], 0x1}, 0x0) r4 = socket$kcm(0x2, 0xa, 0x2) fgetxattr(0xffffffffffffffff, &(0x7f0000000040)=@known='trusted.overlay.opaque\x00', &(0x7f0000000300)=""/141, 0x8d) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=ANY=[@ANYBLOB="50000000090601020000000000000000030000000900020073797a31000000000500010007000000280007800c00018008000140e00000010c00148008000140ac1414bb0c000280"], 0x50}, 0x1, 0x0, 0x0, 0xd24f4d5778621d46}, 0x4) 45m55.712598665s ago: executing program 1 (id=3759): r0 = open(&(0x7f00000000c0)='./file0\x00', 0x4040, 0x98) open(&(0x7f0000000000)='./file0\x00', 0x108843, 0x98) r1 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000001440), 0x0, 0x0) ioctl$VFAT_IOCTL_READDIR_BOTH(r1, 0x541b, 0x0) fcntl$setlease(r0, 0x400, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$vim2m_VIDIOC_ENUM_FMT(r2, 0xc0405602, &(0x7f0000000080)={0x1, 0x2, 0x0, "f067c51ac931286a106a241012c9bd17b30a3e5c6817c45fb9ff6b7176716429"}) pipe2(&(0x7f0000000040)={0xffffffffffffffff}, 0x80000) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r0, 0xc0189375, &(0x7f0000000080)={{0x1, 0x1, 0x18, r1}, './file0\x00'}) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000340)={'gretap0\x00', &(0x7f00000002c0)={'tunl0\x00', 0x0, 0x7, 0x8000, 0x2, 0x4, {{0x10, 0x4, 0x2, 0x1, 0x40, 0x66, 0x0, 0xfb, 0x29, 0x0, @loopback, @local, {[@end, @generic={0x88, 0xc, "130b6132d990e2dc3fb3"}, @lsrr={0x83, 0x13, 0xdb, [@local, @dev={0xac, 0x14, 0x14, 0x12}, @empty, @remote]}, @rr={0x7, 0xb, 0xe2, [@initdev={0xac, 0x1e, 0x1, 0x0}, @local]}]}}}}}) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f00000003c0)={0x1, 0x0}, 0x8) r7 = syz_open_procfs(0x0, &(0x7f0000000000)='net/raw\x00') preadv(r7, &(0x7f00000026c0)=[{&(0x7f0000000240)=""/4088, 0xff8}], 0x1, 0x15f, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x6, 0x13, &(0x7f0000000100)=@raw=[@tail_call={{0x18, 0x2, 0x1, 0x0, r3}}, @alu={0x4, 0x0, 0x7, 0xa, 0xb, 0x0, 0x7}, @btf_id={0x18, 0x4, 0x3, 0x0, 0x2}, @tail_call={{0x18, 0x2, 0x1, 0x0, r4}}, @map_fd={0x18, 0x2, 0x1, 0x0, r0}, @map_fd={0x18, 0xa, 0x1, 0x0, 0x1}, @map_idx={0x18, 0xb, 0x5, 0x0, 0x8}], &(0x7f00000001c0)='syzkaller\x00', 0xfffffffa, 0xa2, &(0x7f0000000200)=""/162, 0x41000, 0x0, '\x00', r5, @fallback=0x25, r0, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000380)={0x4, 0xe, 0xfffffffc, 0x65}, 0x10, r6, 0xffffffffffffffff, 0x3, &(0x7f0000000400)=[r7, r0], &(0x7f0000000440)=[{0x4, 0x5, 0x5, 0x3}, {0x1, 0x4, 0xd, 0x9}, {0x2, 0x1, 0x6, 0x6}], 0x10, 0x5}, 0x94) close(0x3) 45m55.496869895s ago: executing program 1 (id=3760): r0 = socket$inet6(0xa, 0x400000000001, 0x0) bind$inet6(r0, &(0x7f0000fa0fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x1) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r1, &(0x7f0000006300)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r1, &(0x7f0000000040)={0x50, 0x0, r2, {0x7, 0x1f, 0x20000000, 0x4041}}, 0x50) syz_fuse_handle_req(r1, &(0x7f00000021c0)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003dc150f4000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d90000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x80101, 0x0) r4 = syz_open_dev$loop(&(0x7f0000000000), 0x4, 0x1) ioctl$LOOP_SET_FD(r4, 0x4c00, r3) ioctl$LOOP_SET_FD(r4, 0x4c03, r4) dup2(r3, r1) open_tree(0xffffffffffffff9c, 0x0, 0x89901) sendto$inet6(r0, 0x0, 0x0, 0x20000008, &(0x7f00000001c0)={0xa, 0x4e20, 0x8, @loopback}, 0x1c) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000200)=0x3fd0, 0x4) sendto$inet6(r0, &(0x7f0000000b80)="8d", 0x1, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000004480)=[{{0x0, 0x0, 0x0}, 0x7aa}], 0x1, 0x2001, 0x0) 45m54.43039956s ago: executing program 1 (id=3765): r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000002840)=[{{0x0, 0x0, &(0x7f0000000b40)=[{&(0x7f0000000880)=""/22, 0x16}, {&(0x7f0000000240)=""/149, 0x95}, {&(0x7f0000000980)=""/127, 0x7f}, {&(0x7f0000000a00)=""/88, 0x58}, {&(0x7f0000002880)=""/4105, 0x1009}], 0x5}, 0xa}], 0x1, 0x142, 0x0) 45m53.957183177s ago: executing program 1 (id=3768): syz_emit_ethernet(0xa6, &(0x7f0000000780)={@local, @empty, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "0000fa", 0x70, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, [{0x5, 0xa, "a78c000005dc8080a2030003004003493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34060600000000000000dac15084dbaf736b41e5af0502"}, {0x0, 0x1, '\x00'/12}]}}}}}}, 0x0) (async) r0 = syz_usb_connect(0x5, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010003ac9bcc20d118af1ebb5a0102030109022400010700800b0904bb06023ae504000905070020000508ce090503"], &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0}) r1 = socket$nl_route(0x10, 0x3, 0x0) (async) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000540)={0x6c, 0x0, 0x2, 0x401, 0x0, 0x0, {0xa, 0x0, 0x7}, [@CTA_EXPECT_MASTER={0x4}, @CTA_EXPECT_MASK={0x18, 0x3, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @loopback}, {0x8, 0x2, @multicast2}}}]}, @CTA_EXPECT_TUPLE={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private2}, {0x14, 0x4, @private2}}}]}]}, 0x6c}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000940)=ANY=[@ANYBLOB="240000001800090000000000000000001c140000fe0001"], 0x24}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000e80)={0x84, &(0x7f0000000140)=ANY=[@ANYBLOB="400d02000000e2"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 45m53.492688801s ago: executing program 34 (id=3768): syz_emit_ethernet(0xa6, &(0x7f0000000780)={@local, @empty, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "0000fa", 0x70, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, [{0x5, 0xa, "a78c000005dc8080a2030003004003493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34060600000000000000dac15084dbaf736b41e5af0502"}, {0x0, 0x1, '\x00'/12}]}}}}}}, 0x0) (async) r0 = syz_usb_connect(0x5, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010003ac9bcc20d118af1ebb5a0102030109022400010700800b0904bb06023ae504000905070020000508ce090503"], &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0}) r1 = socket$nl_route(0x10, 0x3, 0x0) (async) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000540)={0x6c, 0x0, 0x2, 0x401, 0x0, 0x0, {0xa, 0x0, 0x7}, [@CTA_EXPECT_MASTER={0x4}, @CTA_EXPECT_MASK={0x18, 0x3, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @loopback}, {0x8, 0x2, @multicast2}}}]}, @CTA_EXPECT_TUPLE={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private2}, {0x14, 0x4, @private2}}}]}]}, 0x6c}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000940)=ANY=[@ANYBLOB="240000001800090000000000000000001c140000fe0001"], 0x24}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000e80)={0x84, &(0x7f0000000140)=ANY=[@ANYBLOB="400d02000000e2"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 44m20.294153957s ago: executing program 7 (id=4266): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @broadcast}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0, {0x400, 0x8191}}, './file0\x00'}) write$binfmt_script(r3, &(0x7f0000000480)={'#! ', './file0', [{0x20, '/dev/dri/card#\x00'}, {0x20, '\\{'}, {}, {0x20, '/dev/dri/card#\x00'}], 0xa, "541ac8718e"}, 0x34) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r6, 0x4008ae89, &(0x7f0000000280)={0x1, 0x0, [{0x4b564d06}]}) syz_usb_control_io(0xffffffffffffffff, &(0x7f0000000000)={0x2c, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="0003aa000000aa03"], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$printer(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000580)={0x24, &(0x7f0000000840)={0x40, 0xc, 0x75, {0x75, 0x7, "8762679c98499d594c82d6ce393b041a24b390ced8c995c233ef30c3cacda8d52586ebdd84e5783a3a95978d955848b4d54a122b9127da09df6165bb126ca2a880c0211b4a5f1e37d6be934fb4460730d3abb65cc25a267a63fe724f3093167db9c87c150283c39f8f067265395f0949458892"}}, &(0x7f00000004c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x42f}}, &(0x7f0000000440)=ANY=[@ANYRESOCT=r6], &(0x7f0000000540)={0x0, 0x21, 0x9, {0x9, 0x21, 0xb, 0x8, 0x1, {0x22, 0x2d6}}}}, &(0x7f0000000800)={0x2c, &(0x7f00000005c0)={0x60, 0x12, 0xc1, "33e2b29dec846d8a565fb77e4a2335b028cba2d191e7ea000a5fec4b55e147b7266d6c3a5dfbb3ed38713681feca8cc009190f0012c20124f01b66d8364e9168ca491bb5f306afb509b6f72c47da31057bff551d168436f4b3ac673a09334e0db17afec2d1c5b9c7ab099bd7896fc21b9d7551ce60878d840ad1ad8e851f482e2e8ee9efe1889b40408740ae5229ff2d7262fb79b0aae9057927ae2746eb11960ad3c2a6e295631933e5f4f2e07c81ed50242305161d9f1996804b92d56e87b75a"}, &(0x7f00000006c0)={0x0, 0xa, 0x1}, &(0x7f0000000700)={0x0, 0x8, 0x1, 0x4}, &(0x7f0000000740)={0x20, 0x1, 0x6b, "34013e1eea79c9820a579e59e0a035dadb78e5c0c8b57722fe3587561c580fe4bb12fc95f3a793f994dcc05c11b9f7cf06070343a637dbd563011584a0f68203373de0659c256debaf0bc3f64384a32a46230d767e4eb876781507361ab2621c45bec35e784c7019898e71"}, &(0x7f00000007c0)={0x20, 0x3, 0x1}}) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x11) write$9p(r3, &(0x7f00000001c0)="af30c16b567b99607d216fe2f497d5dc40f95475a00c16c9a8fe57586c1fce81e316d43be84de715b0a9f337c39b327f432c5df4c0d7573c947a3140f29ab64e202fcc842ba4ec5c00190cfb9c8e12adbdc4dacb32d092472f6cefb8c5212664915915b6370f94a8bdbdb6824866e58374c510be954ecae04298a71e8527ff66df", 0x81) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x12, &(0x7f0000000000)=0xffff2652, 0x4) getsockopt$IP_VS_SO_GET_SERVICES(r0, 0x0, 0x482, &(0x7f0000000300)=""/134, &(0x7f0000000140)=0x86) r7 = syz_open_dev$dri(&(0x7f00000008c0), 0x8562, 0x100003) r8 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r8, 0xc04064a0, &(0x7f0000000140)={0x0, &(0x7f0000000380)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r8, 0xc06864a1, &(0x7f00000003c0)={0x0, 0x0, r9}) ioctl$DRM_IOCTL_MODE_SETCRTC(r7, 0xc06864a2, &(0x7f0000000280)={0x0, 0x0, r9, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "af33ff30427ca7d876f59fbec25b88ca6c0a9b32cf13babada39e64196a7399e"}}) shutdown(r0, 0x1) 44m18.788771695s ago: executing program 7 (id=4278): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_io_uring_setup(0x118d7, 0x0, 0x0, &(0x7f00000002c0)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x0, 0xb49, 0x9, 0x8, 0x380000, 0x3}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f0000000140)={0xa, 0x4e22, 0xfffffffe, @empty, 0x5e}, 0x1c) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000080)={0xa, 0x14e22, 0xfffffff8, @ipv4, 0x6f}, 0x1c) r5 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000280)="89000000120081ae08060cdc030000007f03e3f7000000006ee2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec00120c00014002080c00bdad446b9bbc7a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947ee2b49e33538afa8af92347514f0b56a20ff27fff", 0x89}], 0x1}, 0x4040) setsockopt$inet_udp_int(r2, 0x11, 0x67, &(0x7f0000000000)=0x507, 0x4) sendmmsg$inet(r2, &(0x7f0000000600)=[{{&(0x7f0000000080)={0x2, 0x4e20, @local}, 0x10, 0x0}}], 0x1, 0x2000c844) r6 = socket$netlink(0x10, 0x3, 0x0) writev(r6, &(0x7f00000003c0)=[{&(0x7f0000000280)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) sendto$inet(r2, &(0x7f00000000c0)="8689d46205a34100bf2bbe11a5ce7839edaf02afe39ead95913e9c4f8cf31440606769ebdf12cfacae8e8c03f5db079da7d9ecda75e2a7d49d5cbcb370c4d789390a328ba42c9c60cf2154d1b659aa709e8980a522cfb72f23ad87fb7019706ccae98cfe7c4fd23e8297b8cabc46ede1ac3da78f1b488c6357e7edfcd417df6660af20a54ecdcb02f689ae15ee655d4b7b1ea733e88ee9f53669388dff487c1c49953f3bc142112bd4b582b29b35d43962ed245c2cd5d5df40a3e0ed6beaf3b641e84b0f0dfa121a9efe05269f9f4a0e9bcbf43c7a90a711f453668c730c3badedca687b71a9c27bab9e724cc4a4918713031596ea6fd01124f973f257ccd9665aee7df4a9d64f079d176abc00000000d7af3e2dd4396f72373fb0a787a6129ca41181f5087fb843212550b58e3707d5a0399de36c2503836cbe2133de4f574e9e05c96788b0de1bd13e390445433d96737b964fa8af2ac4b2f0f9390ca93d8d3d810044d024359e067c4553230ab748947d33f8fc115ce9a49e6571c45a05d786cbd49342c236537dbbeec666b07baab917252113a5b9a77283189b518f356debe42d80cf2d0687b9c64d0253a6a09286fded6e4f8557b8fb4f25ca4fb138af8945c74bbc98748eaaa030be5317646f195e6e085ac6ddb29542e3581961259987241f7e7061526a7afec8962e74215fea43703a4e543ee9d1a3c3f5f2a41977ece8fdadcf89ce331ce59bebae5f53513d0e10485d7ddbda60513bf339602510b3a23ea29a0d5d03a61e34d12942ea4a847c884b27b5344a456d02a55f8929cc567e7c792c01fab7a7b32780a14c361000609b817dd91507b04d875279527946fdb8fb92a512485e234d092c28f1d0a0498731ccc0eb10515d510e8945839307b46512ceca6f495fdd2c6ae5eb2ef3b2a40ebdc7edf0048e3fb5e3d97a9ea5113a6b70d20ad5c43f0df95d88c0f121a1884da21a21f0ba47420f8391a97921cc51871dbb272e43710fe71d5e342c3afd10608a8b02f00e8fbd8d570b6faace86c494ecea8913233391e7b7cec3d571bb3032181ed58e1b513e511f79ee562c8cde9b3b74c2e95dcde7fadb5a666bdc0c1684794620ce8cf0c0aee8e90b3ef6e7160d3f055cb4d1ced32e4edc15e7d102952d3237e6c02c591a95a182bf190c0124abc7f1225332ff1c5e1b94e4e9bf02c1a18bd7bfce20707f7298da322560bc1a4cf298d46f5bf8ff41da21e25aa17f65f9ee43ca890b5ef6a3ccf3efedf3ca60a9acef1352ad0c43e6cf375108cf0974ce89a99adba7e6a3f8949dc573440fafe0e3abdd0066057a2d868e8386080f18a421568d8e7a89536a4173861bd55245c8fcf7dcba18edce36d2e85b9630fbc218db9ebd16abb11ac06fdbf2bc3e6394d4c6e7ae71813d30772d487743a2856348fee09989ce03331e7848770fc91e62191c20fe5f4a73c5dae467dd612bdb63b1e50921d38271305d7412103d5a6214d6d534d1d530b9169f882b6926bbd338f0282a8bd9a44603934e5249e83f1d0947b39f82a7843d2b6f796d8abf7ff3e66cfd4519324d71cebbf6580dffc10d555e479e9acaa12c3c59e3732c181aa4223d0fcdac514e9d7c7963c2634964520286b028f60a4ae612b8e6049315139e884cbffd6836253094ad023329183496cf663366ad4d7f7f5f1bd2db9b0d33f106c041fba4494c7da404d45d8955e5459ca4a62862721ec1fa534fd95e262c5814426816e60000000000000000001aa4fb6f40ec24f42f6949cc28d2a0d4eb61cb1664627582d962523586539445b81e9759321652280ecb", 0xffe3, 0x6000000000000000, 0x0, 0x0) mkdir(&(0x7f00000000c0)='./file0\x00', 0x22) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, 0x0) unshare(0x62040200) syz_usb_connect(0x0, 0x4a, &(0x7f0000000080)=ANY=[@ANYBLOB="120100005520f010402038b14201040000010902"], 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, 0x0, 0x4000000) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) socket$alg(0x26, 0x5, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000c40)={&(0x7f00000004c0)=@setlink={0x40, 0x13, 0x5, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x40601}, [@IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FLAGS={0x8, 0x3, 0x7}]}, @IFLA_IFNAME={0x14, 0x3, 'veth0_vlan\x00'}]}, 0x40}}, 0x48000) 44m15.618984213s ago: executing program 7 (id=4289): r0 = socket$inet6_udplite(0xa, 0x2, 0x88) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @mcast2, 0xc}, 0x1c) restart_syscall() pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101301) ioctl$USBDEVFS_SUBMITURB(r2, 0x802c550a, &(0x7f0000000440)=@urb_type_iso={0x0, {0x1, 0x1}, 0x0, 0x2, 0x0, 0x0, 0x7172, 0xa8b, 0x1, 0x0, 0xfffffffe, 0x0, [{0x7, 0x568, 0x1}]}) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f00000002c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000040000,user_id', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="858a"]) read$FUSE(r3, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r3, &(0x7f0000000080)={0x50, 0x0, r4, {0x7, 0x29, 0x9, 0xffffffff9080edc4, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x9}}, 0x50) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x18) syz_fuse_handle_req(r3, &(0x7f00000042c0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006380)={0x20, 0x0, 0x0, {0x0, 0x1c}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getdents64(r5, &(0x7f0000000100)=""/134, 0x86) close_range(r1, 0xffffffffffffffff, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) socket$inet6(0xa, 0x2, 0x0) setxattr$incfs_size(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240), &(0x7f0000000340)=0x2, 0x8, 0x2) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e23, 0xff, @ipv4={'\x00', '\xff\xff', @broadcast}}, 0x1c) 44m14.698469503s ago: executing program 7 (id=4295): bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000000c0)={0x0, 0xffffffffffffffff, 0x0, 0x2, &(0x7f0000000040)='[\x00'}, 0x30) r0 = socket$inet(0x2, 0x3, 0x2) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = socket(0x200000000000011, 0x2, 0xd) bind$packet(r3, &(0x7f0000000080)={0x11, 0x800, 0x0, 0x1, 0x0, 0x6, @multicast}, 0x14) ioctl$IOCTL_VMCI_VERSION2(0xffffffffffffffff, 0x7a7, 0x0) ioctl$IOCTL_VMCI_INIT_CONTEXT(0xffffffffffffffff, 0x7a0, &(0x7f0000000000)={@my=0x0}) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f0000000140)={0x0, 0x8000}, 0x4) syz_emit_ethernet(0x35, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaa000000000000080045000027000000021011"], 0x0) recvfrom$packet(r3, 0x0, 0x0, 0x0, 0x0, 0x0) syz_emit_ethernet(0x2e, &(0x7f0000000000)=ANY=[@ANYBLOB="e904a20000000180c20000020800450000200000e00000119078000000000000000000000000000c907861040080"], 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000003000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000240)) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x2) ioctl$KVM_INTERRUPT(r7, 0x4004ae86, &(0x7f0000000240)=0x4) ioctl$KVM_RUN(r4, 0xae80, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x1, 0x0, 0x0, 0x408d6}, 0x24000010) setsockopt$inet_mreqsrc(r0, 0x0, 0x27, &(0x7f0000000040)={@multicast2, @local}, 0xc) r8 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r8, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x0, 0x0, 0x0) r9 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r9, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) umount2(&(0x7f00000002c0)='./file0\x00', 0x4) socket$inet(0x2, 0x3, 0x2) 44m13.440889018s ago: executing program 7 (id=4303): syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) socket$nl_route(0x10, 0x3, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000a, 0x204031, 0xffffffffffffffff, 0xec776000) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f00000006c0), 0x200080, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) r1 = openat$vimc1(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VIDIOC_STREAMOFF(r1, 0x40045613, &(0x7f00000001c0)=0x5) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000500)={r0, 0x0, 0x0}, 0x10) syz_usb_connect$hid(0x0, 0x3f, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'vcan0\x00'}) socket$nl_route(0x10, 0x3, 0x0) socket(0x1, 0x803, 0x0) openat$sequencer2(0xffffff9c, &(0x7f0000000040), 0x400, 0x0) r2 = socket(0x10, 0x3, 0x0) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r3, 0x89f2, &(0x7f0000000040)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4440}, 0x48805) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in6=@rand_addr=' \x01\x00', @in=@local, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa9, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa00, 0x40800000000000, 0x800000000000000}}, [@tmpl={0x44, 0x5, [{{@in=@local, 0x8000, 0x3c}, 0x0, @in=@broadcast, 0x0, 0x0, 0x3}]}]}, 0xfc}}, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000005c0)=@migrate={0x1d0, 0x21, 0x1, 0x0, 0x4, {{@in6=@mcast1, @in6=@private2, 0x0, 0x0, 0x0, 0x0, 0xa}}, [@migrate={0x180, 0x11, [{@in6=@remote, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in6=@rand_addr=' \x01\x00', @in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x2b, 0x2, 0x0, 0x3501, 0x2, 0x2}, {@in=@multicast1, @in=@local, @in6=@private2, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x33, 0x4, 0x0, 0x34ff, 0x2, 0x2}, {@in6=@private1={0xfc, 0x1, '\x00', 0x1}, @in6=@dev={0xfe, 0x80, '\x00', 0x35}, @in=@local, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0x3c, 0x0, 0x0, 0x0, 0xa, 0x8}, {@in=@private=0xa010102, @in6=@empty, @in=@local, @in6=@dev={0xfe, 0x80, '\x00', 0x3f}, 0x3c, 0x0, 0x0, 0x3505, 0x2, 0xa}, {@in=@loopback, @in6=@remote, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, @in6=@private0={0xfc, 0x0, '\x00', 0x1}, 0x33, 0x4, 0x0, 0x3503, 0xa, 0x2}]}]}, 0x1d0}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x1, 0x803, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=ANY=[@ANYBLOB="500000001000210400000000fedbdf2500000000", @ANYRES32=0x0, @ANYBLOB="adffa888e16000002800128009000100766c616e00000000180002800c0002000e0000000a000000060001000001000008000500", @ANYRES32=r8], 0x50}}, 0x2) 44m12.953162691s ago: executing program 7 (id=4306): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0x4e, &(0x7f0000000080)=0x3, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @loopback={0xfec0ffff00000000}}, 0x1c) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x14e22, 0xfffffff8, @ipv4}, 0x1c) 44m12.359214785s ago: executing program 35 (id=4306): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0x4e, &(0x7f0000000080)=0x3, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @loopback={0xfec0ffff00000000}}, 0x1c) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x14e22, 0xfffffff8, @ipv4}, 0x1c) 10m41.654656322s ago: executing program 6 (id=14436): r0 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000140)=@abs={0x0, 0x0, 0x4e20}, 0x6e) (async) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2) (async) r3 = socket$nl_rdma(0x10, 0x3, 0x14) r4 = syz_io_uring_setup(0xbdc, &(0x7f0000000640)={0x0, 0xe825, 0x3400, 0x1, 0x3c3}, &(0x7f0000000dc0)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x20, 0x4007, @fd=r3, 0x1, &(0x7f00000002c0)=[{&(0x7f0000000e00)=""/4096}], 0x0, 0xd, 0x1}) io_uring_enter(r4, 0x847ba, 0x0, 0xe, 0x0, 0x0) (async) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000600)=ANY=[@ANYBLOB="110600"/16], 0x10}}, 0x0) (async) sched_setattr(0x0, &(0x7f00000001c0)={0x38, 0x5, 0x8, 0x8005, 0x0, 0xe1, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) (async) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="34000000000803000000000000000000000000000900010073797a30000000000600024088a8000005000b00010000000400f154"], 0x34}}, 0x0) (async) sendmsg$IPCTNL_MSG_TIMEOUT_DELETE(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0xffffffffffffffc0, &(0x7f00000001c0)={&(0x7f00000002c0)=ANY=[], 0x20}, 0x1, 0x0, 0x0, 0x4000010}, 0x4010) (async) openat$iommufd(0xffffffffffffff9c, 0x0, 0x40001, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x80, 0x0) (async) r8 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r8, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x12}, 0x7}, 0x1c) socket$inet_sctp(0x2, 0x5, 0x84) (async) r9 = socket$kcm(0x29, 0x5, 0x0) accept4(r9, 0x0, 0x0, 0x80000) (async) syz_usb_connect(0x1, 0x24, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, 0x0, 0x0) (async) sendmmsg$inet6(r8, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x0) (async) sendmsg$nl_generic(r0, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x800d1}, 0x0) r10 = socket$rds(0x15, 0x5, 0x0) bind$rds(r10, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10) 10m40.360863887s ago: executing program 6 (id=14442): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x48, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_DESC={0xc, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x60000002}]}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x22}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x90}, 0x1, 0x0, 0x0, 0x44851}, 0x0) close(r1) r3 = syz_open_dev$sndpcmp(&(0x7f0000000200), 0x5, 0x12400) ioctl$SNDRV_PCM_IOCTL_FORWARD(r3, 0x40084149, &(0x7f0000000240)=0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000000)={'syzkaller0\x00', @broadcast}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) recvmmsg(r4, &(0x7f0000000dc0)=[{{&(0x7f0000000300)=@in6={0xa, 0x0, 0x0, @remote}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000440)=""/168, 0xa8}, {&(0x7f0000000380)=""/15, 0xf}, {&(0x7f0000000500)=""/100, 0x64}, {&(0x7f00000003c0)=""/44, 0x2c}], 0x4, &(0x7f00000005c0)=""/88, 0x58}, 0x6}, {{&(0x7f0000000840)=@nl=@unspec, 0x80, &(0x7f0000000640)=[{&(0x7f00000008c0)=""/140, 0x8c}], 0x1, &(0x7f0000000980)=""/117, 0x75}, 0x6067}, {{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000002300)=""/4096, 0x1000}], 0x1}, 0x9}, {{&(0x7f0000000a40)=@pptp={0x18, 0x2, {0x0, @broadcast}}, 0x80, &(0x7f0000000cc0)=[{&(0x7f0000000ac0)=""/115, 0x73}, {&(0x7f0000000b40)=""/203, 0xcb}, {&(0x7f0000000c40)=""/103, 0x67}], 0x3, &(0x7f0000000d00)=""/174, 0xae}, 0x5}], 0x4, 0x0, &(0x7f0000000ec0)={0x0, 0x989680}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x4d, 0xfffffffb, 0x7fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) sendmsg$nl_route_sched(r5, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000006c0)=@newqdisc={0x180, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r7, {0x10}, {}, {0xa, 0x3}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x150, 0x2, [@TCA_GRED_PARMS={0x38, 0x1, {0x7f, 0x81, 0x9, 0xa, 0xab, 0xe, 0xb, 0x5, 0x6, 0xfffffff9, 0xe, 0x19, 0x18, 0x10, 0x4a, 0x2}}, @TCA_GRED_DPS={0x10, 0x3, {0xe, 0xf, 0x1, 0x3}}, @TCA_GRED_STAB={0x104, 0x2, "ac6f895c6f6df4beb1a179acc52ef553ca603f57e6c31fd11681d95616639a10cf22a31925ad2e9398e600603df6600af0468efc4b6ef300692eaef5955c0c4dfeb704ebf9d0f3563d37d553cad054de78e15ca2c4023bd8b12b3d02a8f9761972d6af4d172bd3180d774ce0dc0020bf2b8558c4b0e2d726b1e6d707709a15f2cb238eba7b84be12fe76d1555bb2c616a691475aa7a672902053373632a3e9434c4424712584a5e7eb792a7bfd6a9daab1cdbd92d2e6aca2f75ef82ccf2aab1bfc976ae99149dea58be89f792610fd8f4c1076e9f154d48e6b545ddf1d011bb8394f367a22b6b6162008108b6ae15e29520c526b45d890a5d2e59d66ed49ceb8"}]}}]}, 0x180}, 0x1, 0x0, 0x0, 0x40098}, 0x8044) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r8) sendmsg$TIPC_CMD_ENABLE_BEARER(r8, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000001880)=ANY=[@ANYBLOB="b700000012edfffebfa30000000000000703000028feffff620af0fff8ffffff61a4f0ff000000003e0400000000000020000000000000005504000001ed0a002500000017ffffffcc040000000000007b0a00fe000000006e04000000000000c6000000000000009500000000000000023bc065b7a379d17cf9333379fc9e84af69912435f1b6a693002e7f3be3619184e50b91f32050e436fe275daf51efd601b6482a0800000098efd2a102ee010400006e7a1de4a21f379dbf01de00b1b564fef3bef70548aed0d600c095199fe3ff3128e599b0eaebbdbd7359a48f5b0afc532ef58de3c1b7646cb7798b3e6440c2fbdb00a3e35208b0bbf12cd8dff095edc710e4000000000000009fbe4b61a615c6c57a2b649dc74a1a610643b08d9e104d4d91af25b8123deda8a3658d42ecbf28bf6d8e8afcb913466aaa7f6df70252e79166d8582755a314d31a76e42f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0800000000000000d5f728d236619074d6ebdf098bc908f50ae728a40f9411fe7226a4040b96e37c4f46010400000000c3da29faf75ddd1aa96960bca97af133824b881cc1f62c0f8f8f0e8d76b86f9c45636614786f5a2cb77230a874640dcbe0b20bb77c022d4cab080078fce8c5c81b7037181fc2f18f781aaa6e2957d7e39cc1baddcb7ec6667e699f24e41697ee7ea23e4b29a8b6cc9a1f5a7b3caae05f1300010000949b3aab06b1e042ff2164d80c8ab1c156b97e5889685a96949e4cb40df77b8bb84b0e733a63784ccc214d930cbb7e090df9a2867b3acec439c163fc8706869ada11390d4dbcf840fa68e7d7071b53ac29df826f8ae6d6e18c1e0600bf870768d5217e9bb5a05d9e224e67f1231bd236ed200073824d93c4e1a0f50a74bb4850486727d970acc546087acbf30f2f8165b47ba56dfadd14b306e98931485747292c6fe6e188750cf4f87cce2aa7d67c7133a9f05954cde298a35ea6d715ba80aee6330000000000000000000000000000000000004000000000000000038600008fb854adb4f8080064e8407c6bdb37114c80fbaa4a0ec5aaf4b0ac6f2128668279eb6fc144344e2d461c9a1be8fa0061ea9d55ee4716bea8e1cebf9ed39325ab4c5530dd6ee9fffc00000000000000d7c5af73c683625aaad5eda5004a76c9f8975ed4c5e4eb3e77e9885f69754932609f19e2f615a01cb6d17fbf5cb539403cb0572534f054d5514ad8264f7b029b2bdf2ca4958a62a6e744f9a4c1e646e1dd2ca19583f0f8b0dc53debd7d44f334e6ed7445a9580f970e483b307c4b3c018bc194b23d37e6a2e52d8265e5aab6fec586d52386e8c07a88c88e8faec5f1b16b2014f6952ce7d6be12c6bdb9651ca6fc907061be311d1354e6295698594a73136237bee068d3819400e43544830a3f74b7942f22336953978a5b2032da4238cc61162c04c1297395b73e18c9387615a2bc87d9e2445f3d323d3fac347926a4bac694c55fe9d145906d410f58f1951405d10504efe402cae085afef5dbd617e87ddbd239e4a50d7eb8e327fb5db12cbd6a9efe8e671c4f251cafffe3400a670d14b9b3cd8d86e492997a0168c022ef3536bd1dc731f4f9f8cb66701f4578ba4cb9b706e605a88c3857fb8aaaa95024f8da775f72950212b84fc6133ae14d1429cd4905dabb52e43af7e65acf97b4951fa1e967d16a5ed642efc855a4a46b85cd079934ad3188276efae9387eaa232697526e24b5d4fded86c3811ccd00520150b16000080122965558074956da5e4c3bbefcb64aa8be4456ed2caf0f467b6bbf3aa4371f5e76ab3f6a20278a3c779e03afd9a6af6fd518e5dce030f88ec5a5cb7601a161da0f80893220800c523040d13e1f1300c2c6555bce60d95dd3288e53435713f03add23f14c8db5555c62de4f626483632a2ab547f88dd6efec73a0271a19ca3aa860aa4dcaeeb9bd91a0cb429efae2a5fcc08b3a572969bbe917d1767e38ba49e3e57fafea83e495a6a1d1a4ebf83434986091dd66ffe3ffed0c39552a312e2db596d9c827e02f6fc13c8ddbb50bfd7dd8aa2f35f259fc83e007fe79d2d25e30830b92fca00a292dd3b856faa4b7e66e1b64505f65900839df71a97d4d07d37f7ecf8ed9a22da26ae674bba16c204f6b2f8f74fc56b7126d7c11ece6e88ec41192aaee75415c58d264a2b6adae02c821b62428902aad499825ab85a348638384cd12e61dbde5c47056f0a20b4e2a2328d5db5cf026657a129e6be231acf5f57995c60d9fca5f63a0dfd18054717120bda466d04774b53208ad8b022719ca77a4e0a66b4708f791d849a5e2aaa0074a9560ede2600df5a5c41392fe9460080fcb1e65233fb8dbeec4c86dbcf6a0673e38d2d3615e5bfbde44afe0fa7564231fff7e7f1f3ad68492dd2cccb15b5d7d3e37e8b7d28921c4b9280979521173f322df408d9818b6cc400090300000021911480a876fbba698801937e8b4264eb6f5137bdaa075f1488d22230592a79000000000000000000000000000000000000000000110000000000000000000000000000000000000000000000000000000000000000002f316aa0886c174b73decb46c1c85edf50d8fcbac5ff76b365611666da86a8e65b308706bd7c000000000000003f7cd4d5cb9076b81b7741ec03877afb5237ea1694addebc14c3ae49f88c462ea2050acf2d9a97d3be29a5614d1eba2c98cf0236401e02d7c445e50f76419ab4f78f67a09e63dd4faa2e7b59399f055f2fa278783f26d0a52aefb0a5ef0b41e14a6fe6ba306206670b84894e901a523fcbadfeff535f2514bc834e876810d9a6a78e70a9e22860c36a724770b4185de44db6bf21fef32a8d5b36d9014f38fee012365f963b2a85e7d8075c333475b9f0284405e3127dde7e41285fbe0bdd370c06c6a41744c3d24eab511317f97b7b4a1c2ec33fedc46e9bf0fa640eebd3d58f0ebdb7cb8ccffd6d6ab7e0e843591d2618e2d2cdc7081c8fafffe9c3500800000087de4ee7aac6478d99de7dd82bef044a6d33c789d566c90c46ad581aa22f910547a77d55e26bf19f1d4661550b177ef53933a305e69b8a95119dcf5bda599d625054776151b2cd1fcde238bdc527594a6c17aa9728af24e2bb7a3830e7092b01b119ea4e7e7f0e21527d622cc29c9f0c8720195368f8374337ab4d130619d93c5ef37e7ddd0b2da147e6e513455b88753452de959a6cbfa1ffbc7ad5d8c3b48017fd31dcf72f337b639253f44cb27a12174bc4c191e21015d0c431a71906eb9c6a14c8a060459ef26787ce3d1cbfd5cc459f0048b5d06f6cbd3e9b34c89f3fb2f951ae81d7fcc8bc0000000000000000000000000000000000000000009231feef3117197c796369f776c8b2ea3970f358107945d9e74e9bdfa58e68b65a8f01bc4b73cc31df5aa29f363917f90e3fa1eaf553db1c761dd9b634a9c4d7c21c24fe6d953ed9438cad0f8dfe03e5e2f73019352f1fb682a5a6ebbf24ebc49e3d7058e696eb3f4b642f36c9006c0067e24a64aa8c53dd824a3c08bfda74a143c855030ae004ac797c575c202d8091eb77565212548ead770d68000000000099347593f67da85d1c962bfb320d1553a74ec3bf003ba62b1784dbf0168a7e85f28b77bdebce96bf386a6dd5df162a16f2b7e8a4de0ffc464a87f91f81866d2ef0af71ebb07a739c3cb1b7000000000000"], &(0x7f00000001c0)='GPL\x00'}, 0x48) 10m39.457893038s ago: executing program 6 (id=14449): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000cc0)=ANY=[@ANYBLOB="020d000018000000000000000000000005000600000000000a00000000000000fc010000000000000000000000000000000000000500000005000500000000000a000000000000000000000000000000000000000000000000000000000000000800120002000200000000000000000021002b000201feffff00000000000000fe880000000000000000000000000001fc010000000000000000000000000000040004"], 0xc0}}, 0x0) unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0xc3490000) syz_emit_ethernet(0x42, &(0x7f0000000000)={@local, @dev, @void, {@ipv4={0x800, @tcp={{0x8, 0x4, 0x0, 0x0, 0x34, 0x0, 0x0, 0x2, 0x6, 0x0, @private=0xa210104, @local, {[@timestamp_addr={0x44, 0xc, 0x6, 0x1, 0x0, [{@broadcast, 0xffffaa7e}]}]}}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0x0, 0x0, 0x0, 0x8}}}}}}, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x9, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="400000002000010000000000000000000200000000000000000000001400110067656e65766531000000000000000000080010000000000008000a"], 0x40}, 0x1, 0x0, 0x0, 0x4010}, 0x0) write$binfmt_misc(r2, &(0x7f0000000000), 0xfffffecc) splice(r1, 0x0, r3, 0x0, 0x8001, 0xd) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) r4 = socket$inet_smc(0x2b, 0x1, 0x0) getsockopt$EBT_SO_GET_INIT_INFO(r4, 0x0, 0x82, &(0x7f0000000000)={'nat\x00', 0x0, 0x0, 0x0, [0x0, 0x5, 0x4, 0x8a0f, 0x7fff, 0x200]}, &(0x7f0000000080)=0x78) 10m38.443228213s ago: executing program 6 (id=14451): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r1 = syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x0, 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000280)='./file0\x00', 0x0, 0x100000, 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x89901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000100)={[0xfffffffffffff14d, 0x10000, 0x4, 0xfffffffffffffffe, 0x10000, 0x0, 0x4002004c1, 0x2, 0x9, 0x0, 0x1, 0x0, 0x405, 0x0, 0x9, 0x100000091], 0x2, 0xcf00f63d02c93203}) r4 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r4) readv(0xffffffffffffffff, &(0x7f0000000200)=[{&(0x7f0000000100)=""/35, 0x23}], 0x1) ptrace$setregs(0xd, r4, 0x2, &(0x7f0000000180)) ptrace$cont(0x21, r4, 0x80000001, 0x4) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="ba4b1ba7a70554ee3b98109a6d34a0b422b8e778da8cc5db519e4617729fcf86160300000000000000de2de22b83ce9eb300fa12e877b890fe8e0a9d", @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000080)={{'fd', 0x3d, r5}, 0x2c, {'rootmode', 0x3d, 0x4000}}) r6 = open_tree(r2, &(0x7f0000000640)='\x00', 0x89901) move_mount(r6, &(0x7f0000000140)='.\x00', r1, &(0x7f0000000180)='./file0\x00', 0x116) 10m37.479855835s ago: executing program 6 (id=14454): r0 = openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) socket$isdn(0x22, 0x3, 0x26) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0x20, 0xffffffff}, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) socket$netlink(0x10, 0x3, 0xf) openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) r4 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r4, 0x4010640d, 0x0) r5 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_SET_EVBIT(r5, 0x40045564, 0x15) ioctl$UI_ABS_SETUP(r5, 0x401c5504, &(0x7f0000000340)={0x400000100002f}) ioctl$UI_SET_EVBIT(r5, 0x40045564, 0x3) ioctl$UI_DEV_CREATE(r5, 0x5501) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r4, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000180)=[0x0], 0x1}) syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7ffffffc}]}) fstat(r7, &(0x7f0000000000)) ioctl$DRM_IOCTL_MODE_OBJ_SETPROPERTY(r4, 0xc01864ba, &(0x7f0000000300)={0x8, 0x0, r6}) ioctl$KVM_GET_VCPU_EVENTS(r3, 0x8040ae9f, &(0x7f0000000380)=@arm64) r8 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) cachestat(r8, &(0x7f0000000000)={0x9}, &(0x7f0000000040), 0x0) syz_io_uring_setup(0x80000498, &(0x7f0000000200)={0x0, 0xc2e, 0x3180, 0x7ffa, 0x333}, &(0x7f0000000340), &(0x7f00000000c0)) 10m36.040737595s ago: executing program 6 (id=14462): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) msgctl$MSG_STAT(0x0, 0xb, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_open_dev$dri(0x0, 0xd21, 0x4000) r2 = openat$kvm(0xffffff9c, &(0x7f0000000100), 0x41, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x1, 0x70bd29, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x2b24d, 0x11a20}, [@IFLA_IFNAME={0x14, 0x3, 'netdevsim0\x00'}, @IFLA_VFINFO_LIST={0xc, 0x16, 0x0, 0x1, [{0x8, 0x1, 0x0, 0x1, [@IFLA_VF_VLAN_LIST={0x4}]}]}, @IFLA_LINKMODE={0x5, 0x11, 0x6}]}, 0x48}, 0x1, 0x0, 0x0, 0xc1}, 0x0) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000040)) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_PIT(r3, 0x8048ae66, &(0x7f0000000080)={[{0x5, 0x0, 0x1, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, {0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x7}, {0x0, 0x4, 0x9, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}]}) r6 = msgget$private(0x0, 0x4a0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="6c0000001000050400"/18], 0x6c}, 0x1, 0x0, 0x0, 0x840}, 0x0) msgctl$IPC_STAT(r6, 0x2, 0x0) statfs(&(0x7f0000000180)='./file0\x00', &(0x7f0000000680)=""/246) msgsnd(r6, &(0x7f0000000440)=ANY=[@ANYBLOB="030000000000000039eb950e9541f76e229bd4363e5b8fb61f8b723b1f86cb83a4d2e41270471e247aa8a56afe17dd9a78c213ddeb8fd520e5ebae49cfde9100c78c045fb56a259a4949d0c27d9b1098d84e8cf9e38f72d3c036cf5ec78eec4424f773a1494584f1338a8b39d49dd91a83245d79da88848d99f509bbb08aeeaac331a162e6b57913082002a56614f3051b46720ff85172b0e60cf708eff48ccca1b7684434f780ba3e41f2c90cb610cb3179807e7e43ecedfba97d9243d731578c5efb9701bf2c82d7c8960181d10a6e11720486474b2908d559a7d590d593482382174ecdb616233c3943f72fdde3e4cece90282cca08a96de23f9046d5bdcacc2358306164a233dd59426b07ece166a05f799fadaa841ec227fe035020f6f466c36202a4db59ee8e33b268e3573c2ac6b88d9544a3f28772b6131a02d4507a10ca62acf467f24505e384cfad0c3541662c7a933fc7e11f6633a06b3c4ebe3c49362fde4721b8d4f313ac23000000000000000000000000000000000000000000000000000000e4feef1292a8ead0edc697b13b724c69dc2a9d3a573e95b326aa54c2d859c0a705dc2e29663b79a7e99f62b204e7358e09e173fcc60c696eac679bc1a140ce513ed6a3fe19eb190f74f964e563a8cc056a42c7e96100656badb949ea448d69fecc13bbafb016d5a55426ee8db55f255c01f6fa82348236a5e55ce9b4ac9cf3305c9f26447951863f5af3384985817c98bc50f9909b6795050e1c3cafd958e98eebb414673edc35f9ede33f"], 0xe3, 0x0) bind$tipc(0xffffffffffffffff, 0x0, 0x0) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000380)={[0xf, 0x3, 0x4, 0x1000000000000002, 0x102000000000002, 0x8000000d, 0x2004c8, 0xffff, 0x3, 0xffffffff, 0xffffffffffffffff, 0x7fffffffffffffff, 0xd0b, 0xfffffffffffffff9, 0x2000000000000003, 0x5], 0x80a0000, 0x4284}) ioctl$KVM_RUN(r5, 0xae80, 0x0) r8 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x1) ioctl$KVM_CREATE_IRQCHIP(r10, 0xae60) ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x0) close_range(r8, 0xffffffffffffffff, 0x0) 10m35.396796471s ago: executing program 36 (id=14462): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) msgctl$MSG_STAT(0x0, 0xb, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_open_dev$dri(0x0, 0xd21, 0x4000) r2 = openat$kvm(0xffffff9c, &(0x7f0000000100), 0x41, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x1, 0x70bd29, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x2b24d, 0x11a20}, [@IFLA_IFNAME={0x14, 0x3, 'netdevsim0\x00'}, @IFLA_VFINFO_LIST={0xc, 0x16, 0x0, 0x1, [{0x8, 0x1, 0x0, 0x1, [@IFLA_VF_VLAN_LIST={0x4}]}]}, @IFLA_LINKMODE={0x5, 0x11, 0x6}]}, 0x48}, 0x1, 0x0, 0x0, 0xc1}, 0x0) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000040)) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_PIT(r3, 0x8048ae66, &(0x7f0000000080)={[{0x5, 0x0, 0x1, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, {0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x7}, {0x0, 0x4, 0x9, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}]}) r6 = msgget$private(0x0, 0x4a0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="6c0000001000050400"/18], 0x6c}, 0x1, 0x0, 0x0, 0x840}, 0x0) msgctl$IPC_STAT(r6, 0x2, 0x0) statfs(&(0x7f0000000180)='./file0\x00', &(0x7f0000000680)=""/246) msgsnd(r6, &(0x7f0000000440)=ANY=[@ANYBLOB="030000000000000039eb950e9541f76e229bd4363e5b8fb61f8b723b1f86cb83a4d2e41270471e247aa8a56afe17dd9a78c213ddeb8fd520e5ebae49cfde9100c78c045fb56a259a4949d0c27d9b1098d84e8cf9e38f72d3c036cf5ec78eec4424f773a1494584f1338a8b39d49dd91a83245d79da88848d99f509bbb08aeeaac331a162e6b57913082002a56614f3051b46720ff85172b0e60cf708eff48ccca1b7684434f780ba3e41f2c90cb610cb3179807e7e43ecedfba97d9243d731578c5efb9701bf2c82d7c8960181d10a6e11720486474b2908d559a7d590d593482382174ecdb616233c3943f72fdde3e4cece90282cca08a96de23f9046d5bdcacc2358306164a233dd59426b07ece166a05f799fadaa841ec227fe035020f6f466c36202a4db59ee8e33b268e3573c2ac6b88d9544a3f28772b6131a02d4507a10ca62acf467f24505e384cfad0c3541662c7a933fc7e11f6633a06b3c4ebe3c49362fde4721b8d4f313ac23000000000000000000000000000000000000000000000000000000e4feef1292a8ead0edc697b13b724c69dc2a9d3a573e95b326aa54c2d859c0a705dc2e29663b79a7e99f62b204e7358e09e173fcc60c696eac679bc1a140ce513ed6a3fe19eb190f74f964e563a8cc056a42c7e96100656badb949ea448d69fecc13bbafb016d5a55426ee8db55f255c01f6fa82348236a5e55ce9b4ac9cf3305c9f26447951863f5af3384985817c98bc50f9909b6795050e1c3cafd958e98eebb414673edc35f9ede33f"], 0xe3, 0x0) bind$tipc(0xffffffffffffffff, 0x0, 0x0) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000380)={[0xf, 0x3, 0x4, 0x1000000000000002, 0x102000000000002, 0x8000000d, 0x2004c8, 0xffff, 0x3, 0xffffffff, 0xffffffffffffffff, 0x7fffffffffffffff, 0xd0b, 0xfffffffffffffff9, 0x2000000000000003, 0x5], 0x80a0000, 0x4284}) ioctl$KVM_RUN(r5, 0xae80, 0x0) r8 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x1) ioctl$KVM_CREATE_IRQCHIP(r10, 0xae60) ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x0) close_range(r8, 0xffffffffffffffff, 0x0) 6m1.329886286s ago: executing program 4 (id=14640): pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = syz_open_dev$radio(0x0, 0xffffffffffffffff, 0x2) ioctl$VIDIOC_QUERYMENU(r3, 0xc02c5625, &(0x7f0000000040)={0x98f904, 0x2, @value=0x5}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$inet6(0xa, 0x3, 0x7) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000) close(0xffffffffffffffff) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r4, 0x0) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000240)=@generic={&(0x7f00000001c0)='./file0\x00', 0x0, 0x18}, 0x18) socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)={0x3c, r6, 0x211, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0xf}}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x3c}}, 0x0) r7 = io_uring_setup(0x790d, &(0x7f0000000100)={0x0, 0xcc57, 0x1, 0x0, 0x3f, 0x0, r0}) io_uring_register$IORING_REGISTER_BUFFERS(r7, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) 5m59.949546352s ago: executing program 4 (id=14644): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) dup(r0) r1 = syz_io_uring_setup(0xbdb, &(0x7f0000000640)={0x0, 0xe826, 0x800, 0x1, 0x3c3}, &(0x7f0000000dc0)=0x0, &(0x7f0000000000)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_emit_ethernet(0x5e, &(0x7f00000003c0)=ANY=[@ANYBLOB="aaaaaaaaaaaabbbbbbbbbbbb88a8a2f62b814900000d000000602a02000001f887f2091d1dc3b29e05d7c11308000000ef50b763"], 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{&(0x7f0000001800)=""/216, 0xd8}], 0x1}) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x0, &(0x7f0000000040), 0x0, 0x4) io_uring_enter(r1, 0x847ba, 0x0, 0xe, 0x0, 0x0) 5m59.469196774s ago: executing program 4 (id=14646): r0 = dup(0xffffffffffffffff) openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x40000) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000c18000)="ad", 0x1) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000d71000/0x2000)=nil, 0x2000, 0x2000, 0x3, &(0x7f0000179000/0x2000)=nil) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r3 = io_uring_setup(0x3454, &(0x7f0000000080)={0x0, 0x0, 0x800, 0x1, 0xa7, 0x0, r0}) io_uring_register$IORING_REGISTER_BUFFERS(r3, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) mremap(&(0x7f00003eb000/0x2000)=nil, 0x2000, 0x1000, 0x3, &(0x7f0000003000/0x1000)=nil) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockname(r4, 0x0, &(0x7f0000000180)) migrate_pages(0x0, 0x3, &(0x7f0000000040)=0x7f, &(0x7f0000000300)=0xa) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0) r5 = syz_open_dev$video4linux(&(0x7f0000000040), 0x100000000009, 0x80000) ioctl$VIDIOC_SUBDEV_S_FMT(r5, 0xc0585605, &(0x7f0000000080)={0x0, 0x0, {0x0, 0x31b, 0x2007, 0x0, 0x0, 0x1, 0x3, 0x6}}) r6 = creat(&(0x7f0000000100)='./file0\x00', 0x7a) write$binfmt_elf32(r6, &(0x7f0000000040)=ANY=[@ANYBLOB="7f454c46000000000000000000000000030006000000000000000000380000000000000000191bda0000200001000000000280000000000003"], 0x69) close(r6) r7 = inotify_init() inotify_add_watch(r7, &(0x7f00000000c0)='./file0\x00', 0x14000401) execve(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19) userfaultfd(0x80001) 5m57.940171459s ago: executing program 4 (id=14651): syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x8401) openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x8001, 0x0, 0x5, 0xbf8a, 0xfffffe0000000001, 0xfa11, 0xfff}, 0x0) r2 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000600)=@newtfilter={0x258, 0x2c, 0xd2b, 0x70bd2b, 0x35dfdbfe, {0x0, 0x0, 0x0, r3, {0xf}, {}, {0x7, 0xfff3}}, [@filter_kind_options=@f_u32={{0x8}, {0x22c, 0x2, [@TCA_U32_SEL={0x214, 0x5, {0x9, 0x7f, 0x3, 0x200, 0x8, 0x0, 0x3, 0x8, [{0x4, 0x400003, 0x0, 0x2}, {0x4800, 0x1, 0x9, 0x5}, {0x1a8f, 0x9, 0xfffff801, 0x7}, {0x7, 0x6, 0x2, 0x400}, {0x73, 0x1400, 0x57e76c05, 0x7fff}, {0x7, 0x5, 0x0, 0x81}, {0x7f, 0x1, 0x1, 0x4}, {0x7fffffff, 0x0, 0x9, 0x7}, {0x2, 0x8, 0x2}, {0x7, 0x8, 0xff, 0x6}, {0x401, 0xffffffff, 0x7, 0x7}, {0x2, 0x0, 0x100, 0x6}, {0x6, 0x8, 0x1, 0x9}, {0x81, 0x4, 0x2, 0x4}, {0x4, 0x5b61, 0x0, 0xe37}, {0x1, 0x6, 0x6, 0x3ff}, {0x7, 0x1, 0x401, 0x9}, {0x4, 0x6, 0x5, 0x8001}, {0xfffffffb, 0xd, 0x7f, 0x7f}, {0x2, 0x81, 0x80000000, 0x8}, {0x0, 0x7, 0x6, 0xe0}, {0x0, 0x8, 0x4, 0x36c2}, {0x6, 0xc63, 0xb, 0x7}, {0x1, 0x1fe0, 0x5, 0x4}, {0x7, 0x200, 0x0, 0x400}, {0x0, 0x9, 0xc, 0xa}, {0xd, 0x6, 0x2, 0x8}, {0x8, 0xffffffff, 0x80, 0x200}, {0x7, 0x3, 0x6, 0x401}, {0x400, 0xaef2, 0x400, 0x1}, {0x10001, 0xfffffffb, 0xfffffffa, 0x1ad}, {0x2, 0x4, 0x800, 0x5}]}}, @TCA_U32_INDEV={0x14, 0x8, 'vxcan1\x00'}]}}]}, 0x258}}, 0x24040084) bind$inet(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCADD6RD(0xffffffffffffffff, 0x89f9, &(0x7f0000000240)={'sit0\x00', &(0x7f00000000c0)={@private1, @private=0xa010100, 0xd, 0x16}}) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) process_mrelease(0xffffffffffffffff, 0x0) request_key(&(0x7f00000011c0)='big_key\x00', &(0x7f0000001200)={'syz', 0x1}, &(0x7f0000001240)='\x00', 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r4 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_ERR_FILTER(r4, 0x65, 0x7, &(0x7f00000001c0)=0x8, 0x4) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'vxcan1\x00', 0x0}) sendmsg$can_raw(r4, &(0x7f0000000080)={&(0x7f0000000000)={0x1d, r5}, 0x10, &(0x7f00000005c0)={&(0x7f0000000140)=@canfd={{0x4, 0x0, 0x1}, 0x32, 0x2, 0x0, 0x0, "1a0f15a74ced1faed02d8eca4b9583bc785f35ec178ecc6b1505e76345becf55672f46211934eb4f58e9242778e88aa57dced2c654dd907a466d31f4b8149d71"}, 0x48}, 0x1, 0x0, 0x0, 0x8000}, 0x0) syz_emit_vhci(&(0x7f0000000400)=ANY=[@ANYBLOB="02c820043b000d85ebbe9fe2407267056d5700010003f69e530dd1cac2df99b50323008de89b535bf037b2fcc1c60b3c3e6a5562a953114859e42984c943b8ff3d4815fc94b44a1ef1436cc216f2e230cb79010d075cebbbc8e61df40d36149db45848f5845bc4dc36449897fe5f943083e58bc83b79fa976ef820a621d730acb85abf4380c2db9d9f5696d593b1dd150d5e76ed04c3761fc608aac4a029470fbbda4ae68f4352fd10a34a96d8418640da8c8c9eae33038380a5e1eebe31c963e4e9f4ca3a3e867e1455c744ccc8a93741ddcaca0cec1ff60ada0a2d3a43394c25c9027ac479d9e918878e4b81c5f9c71e4eb3bc5d564a337689a3e6df989a1938d325a3418fa4feef36ce99d9fcdd00"/284], 0x9) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = syz_open_dev$loop(&(0x7f0000000200), 0x4, 0x40100) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='cpuset.effective_cpus\x00', 0x275a, 0x0) ioctl$LOOP_CONFIGURE(r6, 0x4c0a, &(0x7f00000005c0)={r7, 0x800, {0x2a00, 0x80010000, 0x0, 0x5, 0x0, 0x0, 0x0, 0x1c, 0x1c, "fee8a2ab78fc179fd1f8a0e9a1af1ea09dc2b7fb0a010000000000000000030000000000000000000000000000000000000000000000001b00", "28095397bab22d0000b42076c1ce8ef05f819e01177d3d458dac0000000000000000000800000000003788cf8f00", "90be8b1c5512406c7f00", [0x4, 0xa]}}) r8 = syz_open_dev$loop(&(0x7f0000000300), 0x8f, 0x40240) ioctl$LOOP_CONFIGURE(r8, 0x4c0a, &(0x7f0000001280)={r6, 0x0, {0x2a12, 0x80010000, 0x0, 0x0, 0x4, 0x0, 0x0, 0xe, 0x14, "fee8a2ab78fc179fd1f809000000aca7ca64c6a4b4e00d9683dda1af01000000deff1200100000000000000000000000000800", "2809e8dbe1b22d0000b420a1a93c7540f476779e0117613dd4070000ebff08000000000000000000020000000800000000faffffff00", "e7460000102000000000e4440000002000000000000000000000008bd02800", [0xe0]}}) ioctl$LOOP_CHANGE_FD(r8, 0x4c06, r6) 5m56.645961114s ago: executing program 4 (id=14657): r0 = syz_open_dev$hiddev(&(0x7f0000000000), 0x5, 0xc00) ioctl$HIDIOCGUSAGE(r0, 0xc018480b, &(0x7f0000000040)={0x3, 0x973d704cff8935b8, 0x3, 0x3, 0x5, 0x8}) ioctl$HIDIOCGREPORTINFO(r0, 0xc00c4809, &(0x7f0000000080)={0x2, 0xffffffff, 0x7}) ioctl$HIDIOCGDEVINFO(r0, 0x801c4803, &(0x7f00000000c0)=""/208) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r1, 0x29, 0x41, &(0x7f00000001c0)={'mangle\x00', 0x5, [{}, {}, {}, {}, {}]}, 0x78) ioctl$HIDIOCGCOLLECTIONINDEX(r0, 0x40184810, &(0x7f0000000240)={0x2, 0x1, 0xff, 0x1, 0x1, 0x3}) ioctl$HIDIOCGUSAGE(r0, 0xc018480b, &(0x7f0000000280)={0x1, 0x1, 0x8, 0x5, 0xfff, 0x2e}) ioctl$SNDCTL_SEQ_GETOUTCOUNT(0xffffffffffffffff, 0x80045104, &(0x7f00000002c0)) r2 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r2, 0x84, 0xc, &(0x7f0000000300), &(0x7f0000000340)=0x4) getsockopt$inet_sctp_SCTP_ASSOCINFO(r2, 0x84, 0x1, &(0x7f0000000380)={0x0, 0x2, 0x5, 0x8, 0x7}, &(0x7f00000003c0)=0x14) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x72, &(0x7f0000000400)={r3, 0x7, 0x20}, 0xc) r4 = socket$netlink(0x10, 0x3, 0x5) ioctl$HIDIOCGFLAG(r0, 0x8004480e, &(0x7f0000000440)) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000480)={0x0, 0x8366, {0xffffffffffffffff}, {0xffffffffffffffff}, 0x101, 0x7}) sched_setattr(r5, &(0x7f00000004c0)={0x38, 0x0, 0x10, 0xa0000, 0x8, 0x5, 0xeca, 0x10000, 0x5, 0x6}, 0x0) getpeername$packet(0xffffffffffffffff, &(0x7f0000000540)={0x11, 0x0, 0x0}, &(0x7f0000000580)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000680)={'erspan0\x00', &(0x7f00000005c0)={'gretap0\x00', 0x0, 0x8, 0x7800, 0x7, 0xed, {{0x20, 0x4, 0x3, 0x2b, 0x80, 0x67, 0x0, 0x8, 0x29, 0x0, @multicast1, @empty, {[@generic={0x89, 0x3, "bc"}, @timestamp={0x44, 0x1c, 0x7b, 0x0, 0xe, [0x8, 0x7fffffff, 0x8, 0x7ff0, 0x5, 0xc]}, @timestamp_prespec={0x44, 0x4c, 0xd6, 0x3, 0x8, [{@empty, 0x6}, {@remote, 0x6}, {@multicast2, 0x3}, {@broadcast, 0x5}, {@dev={0xac, 0x14, 0x14, 0x16}, 0x2}, {@private=0xa010102, 0x8}, {@dev={0xac, 0x14, 0x14, 0x15}}, {@private=0xa010101, 0x1}, {@remote, 0x6}]}]}}}}}) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r4, &(0x7f0000000780)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000740)={&(0x7f00000006c0)={0x74, 0x0, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@ETHTOOL_A_CHANNELS_COMBINED_COUNT={0x8, 0x9, 0x152}, @ETHTOOL_A_CHANNELS_HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @ETHTOOL_A_CHANNELS_OTHER_COUNT={0x8, 0x8, 0x1d80000}, @ETHTOOL_A_CHANNELS_RX_COUNT={0x8, 0x6, 0x100}, @ETHTOOL_A_CHANNELS_COMBINED_COUNT={0x8, 0x9, 0x8b71}, @ETHTOOL_A_CHANNELS_TX_COUNT={0x8, 0x7, 0xede7}, @ETHTOOL_A_CHANNELS_COMBINED_COUNT={0x8, 0x9, 0x7f}, @ETHTOOL_A_CHANNELS_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}]}, @ETHTOOL_A_CHANNELS_RX_COUNT={0x8, 0x6, 0x200}, @ETHTOOL_A_CHANNELS_TX_COUNT={0x8, 0x7, 0x800}]}, 0x74}}, 0x0) r8 = syz_open_dev$media(&(0x7f00000007c0), 0x6, 0x40000) close_range(r8, r1, 0x2) r9 = syz_open_dev$sndpcmp(&(0x7f0000000800), 0x4, 0x10400) ioctl$FIDEDUPERANGE(r9, 0xc0189436, &(0x7f0000000840)={0x7f, 0x8, 0x2, 0x0, 0x0, [{{r4}, 0x7}, {{r0}, 0x2}]}) r10 = socket(0x9, 0x80000, 0x7) syz_open_dev$ptys(0xc, 0x3, 0x0) r11 = epoll_create1(0x80000) sendmsg$unix(r10, &(0x7f0000000d80)={&(0x7f00000008c0)=@abs={0x0, 0x0, 0x4e24}, 0x6e, &(0x7f0000000cc0)=[{&(0x7f0000000940)="4f738c3212103ea19200d2a743a43a925f5d358e64368865aca5f671b64f91e9a41b79f13ed809399efbb9319a90aae5cec2983838da79ac10afe79a1a83e1681de9c9a2c40bdf75e49f41395f496b3f6303e18c492247264f8c6731771def2472592602e3792e3562bcccfbd3209a952d30cf82a0730ca5ea442eac9e21bd7917818015f89d712e1978", 0x8a}, {&(0x7f0000000a00)="d6c539b6", 0x4}, {&(0x7f0000000a40)="e98f65143ff4e054b92122d408008108e3021b92cfc94978c0400da79cea1090bfd059731e2985950840ac2c51f73457188773e38221", 0x36}, {&(0x7f0000000a80)="3ca55a0ec63e4f877c8757095c4117a87ac0", 0x12}, {&(0x7f0000000ac0)="4ab8a51b6eecc47475ae56125424ab62669d2e8def8b09005ab023f71a1f9df11db96a5a4665ebd9f2fe2262057158acd48085bf25f366e211bb7d33838b4fcd820fb307e1ba11d58b4755983364553eebfbc674c4e072fc07fa9de85ecf6345e981e76ce4c232757d20878d0ca4dcc611b1dae99a4ee22872a7ba4103d928262b94380b3d24331b1bc9c2be671c5b304506e6f22f786aec46c83d0523f80f77195c8c98d22b3487f2627da1daf1f33b1cbc3d1681627a64bcb95c8312cae8de238a21bd0229a2804fab51e815969e", 0xcf}, {&(0x7f0000000bc0)="08b3621617f96a0ec075a9eeff7a57740ec421fdfed6fb0388f0c8bf81e3da392ba27f2161601879c88a4d553d05577f249542572e2504", 0x37}, {&(0x7f0000000c00)="7a55ad9851ec77819bf9cd8a4982596e65a5b213e06455d8dcf3219d3f302a73952baf6775e961edf76870fb1528c650d269d39bac7ab6bdbb48dcf1a487445e264d32483f63ecee9a526e2ffdea08aab226d3646556e1fe6b1622e561182c703a626654510cba1c0e20d7bd95e32af9185c1869f923c1198b2c4fb5cfb64bf4d46237", 0x83}], 0x7, &(0x7f0000000d40)=[@rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, r11, r10]}}], 0x20, 0x4}, 0x4004005) r12 = syz_open_dev$vcsn(&(0x7f0000000dc0), 0x89, 0x1) ioctl$KVM_CAP_MANUAL_DIRTY_LOG_PROTECT2(r12, 0x4068aea3, &(0x7f0000000e00)={0xa8, 0x0, 0x3}) 5m56.53938954s ago: executing program 4 (id=14658): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$UI_END_FF_UPLOAD(r1, 0x406855c9, &(0x7f00000001c0)={0xd, 0x0, {0x51, 0xa90, 0xd07e, {0x8000, 0x7}, {0x5, 0xe2f2}, @ramp={0x4, 0x1, {0x5, 0x8, 0x3, 0xf}}}, {0x55, 0x4, 0xa32, {0x5, 0x1ff}, {0x10, 0x7}, @cond=[{0x5, 0xbf, 0x5, 0x7fff, 0x2, 0xe18}, {0xedd6, 0x52fc, 0x7, 0x2, 0x1, 0x7}]}}) sendmsg$NL80211_CMD_SET_BEACON(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000c00)=ANY=[@ANYBLOB="6335a600", @ANYRES16=r0, @ANYBLOB="000428bd7000fbdbdf250e0000000c009900000200006d000000c0007f002658000908a0f19a0fb23efbfff8d64fc15b4f0e1667178a051afbfdb39917018bab6fec617b498868fd9903f891af246b5157bc944c4cf1e362ec31ac99057b3761d5a65402646a8b51b0c585adacd4754fff4505a44c76c481760605122600ff0fbd060802110000017e15ad0205ffffffffffff00000000000000000c0000000602ff7f0406080810000e00832540b30708021100000006000000080211000000c600000010000000080211000001080000000406020afdfffffffa07910059556c5cffd71070766d6aae7e84d1dea71807d308676d4d8d599f63b38735b938d1170a55777580bbd21b2b34cb8eb2c566f73305695946d07a85ef660576e94390087872c49d19f13faffb3abbf74e3f556735603dc89bc47863803fff593b50eba475c76ffa8e42c6b876dc650dec9661ac20fa7c062cdbf1cb2c67549ee7c9b5366c6bb5c66364399f255c53acb4bab2e0f8a43964ab466c24249da19b2db68b0360217c24431f65ceee46e0ba768138b2192776ee740bc3756ebf74284f96896cc2d64b457c43f90a0933c9ed78fd6fa275bbf3b927d48777fec811f143069512a982e91b358e273ac37d96e9e9e679a600dd552a409dd3974b833b1ce9646c5f68012e2650c83b22a0df80669f80e747b0cb9640da5f98ec9064955acf10d1f0f18b7622431ebf1cb17773315b5886773e3b1abafda38eb4a177423ba513ebeef6f3cc95db054238cdb91b359c390f4f054f04688f90b238768daa2ddca224b0bdd552d8d84d03746279154f1a97a0f9bbdcdffa00a93dc46c0ff4679998054d0d9b43056e2a74f5c4be17790a392172cab9b8a7aac5516b4bbf62cee416905934fa08a3f0fdf732aad14a76107cb5d009046df2e8c40b173f37c115cc5bf002a7451981006de38d12cca7d9d7f300bf52b4d204191a7e377f6029ea17913591a4d24fdae8ab0fb80726279160e34ac573641601c178760e9dec5b6f4ecbe0428daf20fb4968431e878b9b702e4672fad99385bb8e13433403b36a0d58e8eeab6f781dfe6fba14ce2358b98ce9e174d6d782c86a6503365bb2c1ffb1f3237c467717963ba521c4b89ff95a195befbfe2f51b6e348d323093dd2e32fa8ff1a56c4fdc5f74defdfa60b7fa5e88d5f5aaf7b82543a06531ec6728e9afce88ebafaa4f325260b5d2c469f9379da72cff8f395277f58ad5e8b0645bc93501bc9b4299e58f56d198e9744da607b7b00e3a7dc5ba72c3a36869607871aa2a86c7fb202a9878fffc34af7d81f4a544aeac2e0710fd244b465cf23910f5676a8fa28c2a6c2b087b366952baa494d30cdea5ca712d35dd37fa2155d03355a9c15448ebe6abe6ef885921274665557da6d2f1867ef96a039e94060cdeb2ddfbb4ea07b8b235d025d902fe871e4d67cca1e20bc78a6466633244d2f63213963549fd937ff41e58c19dfdf88c3df9d849abe8976dca7d24cc41d7d878b8103bda15437ec74f28e42341befdc955d0725e95d27b76385637e51d3ad377e98bc54c542e99a7e59c822e4786bf244e9edf9b1a0a260e63ede669ec5003438665e03c7343bb18ee862d1f0cd08f18207e1e77fed13acceb48e8e9f7e6614b22ebdb5035935332ea3b9b0d4a9bf06bddc2f287fa441d67f5db077772ffa57273e991e90cdd46b27b15ac4029b971d1e7fece0de075c9c3fff425e3af25fcbabe0564f6a1f1f43624a6283d8128f818887b05a020d2d0fdbcefaf54e2711d2c3e859c1693732ee189253e84859f02ea9af17e85d58bde087805eaa32af21c7dbf9ead91b7b97441582f37b63e1bf0e2ae3939bec7aae0de4467836ec35f756f9adbe634b9f9b478af582d44c78a401c973f9bd74b4389f1c129bc69dfcfd141fd5984dd6bedba6a22a8cf54e48cf4e8460de37fd93e0f0e7dbd1e4b99ac89f5800160de4c0e2ea355da057da59271c8fc255e3b56ce337afae3a19b539a03c0abfeac50718ec3e0383a24485dd6e35cacdae53ad90a88fe2aa360deadb0cdddd305aca1568230cc12450e5ad828d16adb6d202e9039dcd6ebce8da1cbffa1223543c7030e9c100b5de4847cb4480f7108640d1ba7af2b72fcde19ece1e9915891fa262f26e7cdf1285468ae5016209aae332ae1c43fa136f2864a89cae1923cfa8f58e91577170874a30d65d99345d7215371ba705d84e56f8d0c6eb05f70c11604e2fa120f96c7892b570cc8e486bcd4f0598c07aa8032711a5ccbd9ce961ece743b4fc252fb3c27914e956bde57ef8e652625bf77b445ce880c0199b78227fbdd422d7c6dbd042cd67ebb499139c7ef594a0bc7e47bf92079a646547e0b29d837ff737ed49582a3de07e259516358911e5c4122ed05fc3670204282304dcde771263a6872b26e9aadd2a7656cd51b7cb2a0c7ac7c9093baf8aefaaadb6c58cfbca994724b51cb5c19ed99715a17c2a054bac6d54868fb5446cd7b631693315ce3b442aefbe216ad97eb6487d2556e1b83812074434ec3cd2fccdbadf68994843f1c37be0bf11d4b9ec773423cb2793ac89d395ede3b17fd9a86bd8ad64e03dc854a12ab6593a88c97cb8d96a978f93c1ba402cce30c52b73880397de511c5427106ec00358c0a58af9ee16bdcb8300f4dfa10daa05a744111347988885b168d3cf7dedf34b80c74063f4a1c89993160349b09d85d4b026bb045411abf01d4a3d58d04057b5c2b514dbd6ed0949aa269740f4ab708c657ab6048e7b22b9261b115fbc82fdd5727a505c504ce771894dacbf0007878802f2bb8f86b53ee61551cdc90edd6db20e56dbf75548d1ba3687e2ef7ff62a5c64caefdb44133741bc2c14da42c549828a136798e2a5147723f0c421d8d4d37f90db90d76981454b02873c825d7a3a4106008db8aa4037f606501a56eac719be1ddebd9409272e45ee8bd02ccabd66fea98fb81173b059a475768eaa1f2c2d7d79086a583ac77270109f3634bcaea9ad534a71fe7d0509e80bff86c52cb2ba26c7f91a23869c2fd19b3c068360f88f2a9cf174f770e0ccd5f7d69fef6673b6319279a8074f0aa8d4bb035432fad186e24d52ec3bc0d26a17bd5c4fc6295af86aecd46ad19973d67b36917a4c4d19db344ede9faf5b3c5091a20c6d73bbb3fe32226b0b1075ebc000090010e80040003007800020041fc8db651ae67e757d252d4405f1406cad298457c9f7ea276d4f827692ab6e00e9297cdace11e8fc7195a955f1156bb115b9f1459b0337d8500ffa593ba8bb5db05e96f2cda1490d1543437cb59b7d634806fd83021ab39e0f8c2663ef6d972b2ed8aa7ff3c77c8a1f33e6b3edec9fc7a5198ccf1000200a5ed852771090b7ecc961d8d7584bf0e385ea26474fb94c7d93205ff15a410d61dc0b81d59167ba57577547b5da195edc30aa66a9d0c02e45bd13c03b411a2cccf0ba6bf650e0b99228688ccd946fb9125c1dc0eaefd39f23766bd47cae862cb3b90077de48f8474f698c3b611b59f72f82786ff1e737d3b2020a85cbeb51beff8f0972ceffc24e85682ff480c26d1cab938e85d4bec8f01fd6159263c6bedd32e7e258d1c82d75f6d3baff0afc9597e9a50d3ca739d933924f87ec2dce6bea470813a65d65b89897433ee25a133f5fe802fd14cb2f609ca663e8c086b0266ad7419a58bcf0c645024d7565f19000000190002003cab1aa627084d684ce1a41d391ce0a1b76df44ec2000000"], 0xa6c}, 0x1, 0x0, 0x0, 0x801}, 0x20008000) r2 = syz_io_uring_setup(0x10d2, &(0x7f0000000480)={0x0, 0x7734, 0x80, 0x0, 0x280}, &(0x7f00000000c0)=0x0, &(0x7f0000000240)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) sendmsg$NL80211_CMD_SET_TID_CONFIG(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f0000000200)=ANY=[@ANYBLOB='<'], 0x3c}, 0x1, 0x0, 0x0, 0x4}, 0x4) syz_usb_connect(0x0, 0x49, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000a52bfb0821048f79548601020301090237000100000000090400000002fe170005"], 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_POLL_REMOVE={0x7, 0x50, 0x0, 0x0, 0x0, 0x1}) io_uring_enter(r2, 0x47bc, 0x0, 0x0, 0x0, 0x0) 5m41.282805673s ago: executing program 37 (id=14658): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$UI_END_FF_UPLOAD(r1, 0x406855c9, &(0x7f00000001c0)={0xd, 0x0, {0x51, 0xa90, 0xd07e, {0x8000, 0x7}, {0x5, 0xe2f2}, @ramp={0x4, 0x1, {0x5, 0x8, 0x3, 0xf}}}, {0x55, 0x4, 0xa32, {0x5, 0x1ff}, {0x10, 0x7}, @cond=[{0x5, 0xbf, 0x5, 0x7fff, 0x2, 0xe18}, {0xedd6, 0x52fc, 0x7, 0x2, 0x1, 0x7}]}}) sendmsg$NL80211_CMD_SET_BEACON(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000c00)=ANY=[@ANYBLOB="6335a600", @ANYRES16=r0, @ANYBLOB="000428bd7000fbdbdf250e0000000c009900000200006d000000c0007f002658000908a0f19a0fb23efbfff8d64fc15b4f0e1667178a051afbfdb39917018bab6fec617b498868fd9903f891af246b5157bc944c4cf1e362ec31ac99057b3761d5a65402646a8b51b0c585adacd4754fff4505a44c76c481760605122600ff0fbd060802110000017e15ad0205ffffffffffff00000000000000000c0000000602ff7f0406080810000e00832540b30708021100000006000000080211000000c600000010000000080211000001080000000406020afdfffffffa07910059556c5cffd71070766d6aae7e84d1dea71807d308676d4d8d599f63b38735b938d1170a55777580bbd21b2b34cb8eb2c566f73305695946d07a85ef660576e94390087872c49d19f13faffb3abbf74e3f556735603dc89bc47863803fff593b50eba475c76ffa8e42c6b876dc650dec9661ac20fa7c062cdbf1cb2c67549ee7c9b5366c6bb5c66364399f255c53acb4bab2e0f8a43964ab466c24249da19b2db68b0360217c24431f65ceee46e0ba768138b2192776ee740bc3756ebf74284f96896cc2d64b457c43f90a0933c9ed78fd6fa275bbf3b927d48777fec811f143069512a982e91b358e273ac37d96e9e9e679a600dd552a409dd3974b833b1ce9646c5f68012e2650c83b22a0df80669f80e747b0cb9640da5f98ec9064955acf10d1f0f18b7622431ebf1cb17773315b5886773e3b1abafda38eb4a177423ba513ebeef6f3cc95db054238cdb91b359c390f4f054f04688f90b238768daa2ddca224b0bdd552d8d84d03746279154f1a97a0f9bbdcdffa00a93dc46c0ff4679998054d0d9b43056e2a74f5c4be17790a392172cab9b8a7aac5516b4bbf62cee416905934fa08a3f0fdf732aad14a76107cb5d009046df2e8c40b173f37c115cc5bf002a7451981006de38d12cca7d9d7f300bf52b4d204191a7e377f6029ea17913591a4d24fdae8ab0fb80726279160e34ac573641601c178760e9dec5b6f4ecbe0428daf20fb4968431e878b9b702e4672fad99385bb8e13433403b36a0d58e8eeab6f781dfe6fba14ce2358b98ce9e174d6d782c86a6503365bb2c1ffb1f3237c467717963ba521c4b89ff95a195befbfe2f51b6e348d323093dd2e32fa8ff1a56c4fdc5f74defdfa60b7fa5e88d5f5aaf7b82543a06531ec6728e9afce88ebafaa4f325260b5d2c469f9379da72cff8f395277f58ad5e8b0645bc93501bc9b4299e58f56d198e9744da607b7b00e3a7dc5ba72c3a36869607871aa2a86c7fb202a9878fffc34af7d81f4a544aeac2e0710fd244b465cf23910f5676a8fa28c2a6c2b087b366952baa494d30cdea5ca712d35dd37fa2155d03355a9c15448ebe6abe6ef885921274665557da6d2f1867ef96a039e94060cdeb2ddfbb4ea07b8b235d025d902fe871e4d67cca1e20bc78a6466633244d2f63213963549fd937ff41e58c19dfdf88c3df9d849abe8976dca7d24cc41d7d878b8103bda15437ec74f28e42341befdc955d0725e95d27b76385637e51d3ad377e98bc54c542e99a7e59c822e4786bf244e9edf9b1a0a260e63ede669ec5003438665e03c7343bb18ee862d1f0cd08f18207e1e77fed13acceb48e8e9f7e6614b22ebdb5035935332ea3b9b0d4a9bf06bddc2f287fa441d67f5db077772ffa57273e991e90cdd46b27b15ac4029b971d1e7fece0de075c9c3fff425e3af25fcbabe0564f6a1f1f43624a6283d8128f818887b05a020d2d0fdbcefaf54e2711d2c3e859c1693732ee189253e84859f02ea9af17e85d58bde087805eaa32af21c7dbf9ead91b7b97441582f37b63e1bf0e2ae3939bec7aae0de4467836ec35f756f9adbe634b9f9b478af582d44c78a401c973f9bd74b4389f1c129bc69dfcfd141fd5984dd6bedba6a22a8cf54e48cf4e8460de37fd93e0f0e7dbd1e4b99ac89f5800160de4c0e2ea355da057da59271c8fc255e3b56ce337afae3a19b539a03c0abfeac50718ec3e0383a24485dd6e35cacdae53ad90a88fe2aa360deadb0cdddd305aca1568230cc12450e5ad828d16adb6d202e9039dcd6ebce8da1cbffa1223543c7030e9c100b5de4847cb4480f7108640d1ba7af2b72fcde19ece1e9915891fa262f26e7cdf1285468ae5016209aae332ae1c43fa136f2864a89cae1923cfa8f58e91577170874a30d65d99345d7215371ba705d84e56f8d0c6eb05f70c11604e2fa120f96c7892b570cc8e486bcd4f0598c07aa8032711a5ccbd9ce961ece743b4fc252fb3c27914e956bde57ef8e652625bf77b445ce880c0199b78227fbdd422d7c6dbd042cd67ebb499139c7ef594a0bc7e47bf92079a646547e0b29d837ff737ed49582a3de07e259516358911e5c4122ed05fc3670204282304dcde771263a6872b26e9aadd2a7656cd51b7cb2a0c7ac7c9093baf8aefaaadb6c58cfbca994724b51cb5c19ed99715a17c2a054bac6d54868fb5446cd7b631693315ce3b442aefbe216ad97eb6487d2556e1b83812074434ec3cd2fccdbadf68994843f1c37be0bf11d4b9ec773423cb2793ac89d395ede3b17fd9a86bd8ad64e03dc854a12ab6593a88c97cb8d96a978f93c1ba402cce30c52b73880397de511c5427106ec00358c0a58af9ee16bdcb8300f4dfa10daa05a744111347988885b168d3cf7dedf34b80c74063f4a1c89993160349b09d85d4b026bb045411abf01d4a3d58d04057b5c2b514dbd6ed0949aa269740f4ab708c657ab6048e7b22b9261b115fbc82fdd5727a505c504ce771894dacbf0007878802f2bb8f86b53ee61551cdc90edd6db20e56dbf75548d1ba3687e2ef7ff62a5c64caefdb44133741bc2c14da42c549828a136798e2a5147723f0c421d8d4d37f90db90d76981454b02873c825d7a3a4106008db8aa4037f606501a56eac719be1ddebd9409272e45ee8bd02ccabd66fea98fb81173b059a475768eaa1f2c2d7d79086a583ac77270109f3634bcaea9ad534a71fe7d0509e80bff86c52cb2ba26c7f91a23869c2fd19b3c068360f88f2a9cf174f770e0ccd5f7d69fef6673b6319279a8074f0aa8d4bb035432fad186e24d52ec3bc0d26a17bd5c4fc6295af86aecd46ad19973d67b36917a4c4d19db344ede9faf5b3c5091a20c6d73bbb3fe32226b0b1075ebc000090010e80040003007800020041fc8db651ae67e757d252d4405f1406cad298457c9f7ea276d4f827692ab6e00e9297cdace11e8fc7195a955f1156bb115b9f1459b0337d8500ffa593ba8bb5db05e96f2cda1490d1543437cb59b7d634806fd83021ab39e0f8c2663ef6d972b2ed8aa7ff3c77c8a1f33e6b3edec9fc7a5198ccf1000200a5ed852771090b7ecc961d8d7584bf0e385ea26474fb94c7d93205ff15a410d61dc0b81d59167ba57577547b5da195edc30aa66a9d0c02e45bd13c03b411a2cccf0ba6bf650e0b99228688ccd946fb9125c1dc0eaefd39f23766bd47cae862cb3b90077de48f8474f698c3b611b59f72f82786ff1e737d3b2020a85cbeb51beff8f0972ceffc24e85682ff480c26d1cab938e85d4bec8f01fd6159263c6bedd32e7e258d1c82d75f6d3baff0afc9597e9a50d3ca739d933924f87ec2dce6bea470813a65d65b89897433ee25a133f5fe802fd14cb2f609ca663e8c086b0266ad7419a58bcf0c645024d7565f19000000190002003cab1aa627084d684ce1a41d391ce0a1b76df44ec2000000"], 0xa6c}, 0x1, 0x0, 0x0, 0x801}, 0x20008000) r2 = syz_io_uring_setup(0x10d2, &(0x7f0000000480)={0x0, 0x7734, 0x80, 0x0, 0x280}, &(0x7f00000000c0)=0x0, &(0x7f0000000240)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) sendmsg$NL80211_CMD_SET_TID_CONFIG(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f0000000200)=ANY=[@ANYBLOB='<'], 0x3c}, 0x1, 0x0, 0x0, 0x4}, 0x4) syz_usb_connect(0x0, 0x49, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000a52bfb0821048f79548601020301090237000100000000090400000002fe170005"], 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_POLL_REMOVE={0x7, 0x50, 0x0, 0x0, 0x0, 0x1}) io_uring_enter(r2, 0x47bc, 0x0, 0x0, 0x0, 0x0) 1m44.268688829s ago: executing program 9 (id=15620): r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) keyctl$KEYCTL_PKEY_QUERY(0x18, 0x0, 0x0, &(0x7f0000000000)='\t', 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x1, 0xf, &(0x7f0000000480)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0xffff}, {{0x18, 0x1, 0x1, 0x0, r1}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x48) r4 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x2) setsockopt$inet6_tcp_TLS_TX(r4, 0x11a, 0x1, &(0x7f0000000080)=@gcm_256={{0x304}, "00781beca8267798", "d9126a286bc05380c199d04f41ad9dfc24b430a77b6f6a722839d492519b521f", "af7a86ef", "54d5c7080263672f"}, 0x38) writev(r4, &(0x7f0000000a00)=[{&(0x7f0000000200)="45d49d259ac7c2bb8948bc86fb98df39938ec1d2bcaaee103e1fcdd517fa2f524efeed5efa5beb", 0x27}], 0x1) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r3}, &(0x7f0000000000), &(0x7f0000000140)=r2}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x8, &(0x7f0000000180)=ANY=[@ANYBLOB="1808000000000000050000000000000018120000", @ANYRES32=r3, @ANYBLOB="0000000000000000b703000000000000850000000c000000b70000002000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1m43.82287957s ago: executing program 9 (id=15621): r0 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) socket$tipc(0x1e, 0x2, 0x0) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x2, 0x0, 0x2, 0x0) getpid() r2 = open(&(0x7f0000000140)='./file0\x00', 0x2a4c0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00'}) sendmsg$nl_route_sched(r5, 0x0, 0x4048000) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000180), r6) sendmsg$MPTCP_PM_CMD_SET_FLAGS(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)={0x28, r7, 0x1, 0x80000, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e20}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0xb}]}]}, 0x28}}, 0x40000) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[], 0x50) socket(0x1000000010, 0x80002, 0x0) r8 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r8, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x400, 0x0, 0xb2}, 0x9c) ioctl$BLKDISCARD(r2, 0x1277, &(0x7f00000001c0)=0x1) bind$inet6(r8, 0x0, 0x0) sendto$inet6(r8, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) lstat(&(0x7f0000000100)='./file0\x00', &(0x7f0000000340)) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001540)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x80, 0x100c3}, [@IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FLAGS={0x8, 0x3, 0x4}]}, @IFLA_GROUP={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000040}, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000100)={0x4, 0x2, 0x4}) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0585609, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x3}) 1m40.265671383s ago: executing program 9 (id=15631): r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) keyctl$KEYCTL_PKEY_QUERY(0x18, 0x0, 0x0, &(0x7f0000000000)='\t', 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x1, 0xf, &(0x7f0000000480)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0xffff}, {{0x18, 0x1, 0x1, 0x0, r1}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x48) r4 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x2) setsockopt$inet6_tcp_TLS_TX(r4, 0x11a, 0x1, &(0x7f0000000080)=@gcm_256={{0x304}, "00781beca8267798", "d9126a286bc05380c199d04f41ad9dfc24b430a77b6f6a722839d492519b521f", "af7a86ef", "54d5c7080263672f"}, 0x38) writev(r4, &(0x7f0000000a00)=[{&(0x7f0000000200)="45d49d259ac7c2bb8948bc86fb98df39938ec1d2bcaaee103e1fcdd517fa2f524efeed5efa5beb", 0x27}], 0x1) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r3}, &(0x7f0000000000), &(0x7f0000000140)=r2}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x8, &(0x7f0000000180)=ANY=[@ANYBLOB="1808000000000000060000000000000018120000", @ANYRES32=r3, @ANYBLOB="0000000000000000b703000000000000850000000c000000b70000002000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1m40.048312094s ago: executing program 9 (id=15636): r0 = getpgid(0x0) r1 = socket$inet(0x2, 0x3, 0x4) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000280), 0x6e, &(0x7f0000000680)=[{&(0x7f0000000340)=""/22, 0x16}, {&(0x7f00000003c0)=""/202, 0xca}, {&(0x7f0000000500)=""/66, 0x42}, {&(0x7f0000000580)=""/177, 0xb1}], 0x4, &(0x7f00000006c0)}, 0x41) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10) ptrace$setopts(0x4206, r0, 0x81, 0x12) r2 = syz_open_dev$dri(&(0x7f0000000180), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000040)={0x4046, 0xfffffff9, 0x80000002}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="680000007906050000000000000000000000fffd0e0003006269746d61703a697000000005000400000000000900020073797a310000000020000780050003001f0000000c00018008000140ffffffff080006400000021c05000500020000000500010006000000"], 0x68}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)={{'fd', 0x3d, r4}, 0x2c, {'rootmode', 0x3d, 0x4000}}) r5 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) move_mount(r5, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) chroot(&(0x7f0000000300)='./file0/../file0/../file0/../file0\x00') r6 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r6, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) pivot_root(&(0x7f0000000380)='./file0/../file0/../file0/../file0/file0\x00', &(0x7f0000000080)='./file0/../file0/../file0/../file0\x00') ioctl$BTRFS_IOC_TREE_SEARCH_V2(r2, 0xc0709411, &(0x7f00000001c0)={{0x0, 0x0, 0x60c, 0x9, 0x1, 0x7, 0x2, 0x0, 0x200, 0x9, 0x1, 0xb0, 0x1, 0x0, 0xf}, 0x50, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) 1m39.865425783s ago: executing program 9 (id=15639): r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x22242, 0x0) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000440)=[{{0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000001cc0)="83556f524e5b4275202de9e9190a4e45413b785e52d04218ff14259285fc60a04bc6b2219b8c6853a6622cf43ff12c6e70030000009d24e78c3e9315e114c8a7316f4fe07425a43afc3f2146fd5b3fa9944ac1fff9e40cb9d497259e2f8443386550fc0255f733c2c4592534f4c24aa04090941068f785925c294a23cffdd0da78bccb1ee094cc21d79dddfd1ee274ec69d98e4ce1efdf0600000000000000e348b88fd9387473855b1fdcd7493d01f0453924af3a79bc5d40b7e5ab2c6bd87501f9966ca87560521e3999c6952f389f038abd8f0b2c59445502d726c974e0e57eab107a6ad6f2a998529e4bdafb9ed3a4c3482682f5369b1ca77c8d03000000000000000da5b3b17b58909c93344ff6b6908a5de6530ebb79b7096253ed28f981b117f1af480914519ce90117ffc37d83297da593ce451f464a6b272b35441e3bc42881092cc92420590b6230a6af3817a7b4ca4d7a46e0c5d814ee1f6d9a20a255c54b88476ac582e3e4d99ba105b0f4dfb48d666aa23f70fbe69249f33f75fb4e5cbf27f1ecd1f47bfa745d508d3c599de413ab6b7f00ae14e2ed3c83da269536787bf4f73f0d117b8415df306504b3020bfa61450bd88b8c73362f2ccd2217a49b8948f0ead1cac7c3f8da62ecc2219826bde12cf42eb9f9378909858d000000006316d96e2735850218ae8f25571077a7602a55d51b2582a5d5e322e5816bc464beace66726fa5a8b0b84be74b85dd81115bf7dc16d2a45db14e6b52e05ab8f54b7d775d90d09ea7a63d7a84812ed0456346fcbd1ef7b0f8f3f6818a99270f678ec85e3ce2ce718531e898016f81dec1c2702e7e0b04539cdc298c00cd464ca36342b634a61e2ba4e8c3ede56f08cac00fb4137aaddba05c519713989c60aed06a93859c4d00f9c27455c8d845cc9da0000000000", 0x297}], 0x1}}], 0x1, 0x60c5895) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x202, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) ioctl$KVM_GET_MSRS_cpu(r3, 0xc008ae88, &(0x7f0000000380)={0x21, 0x0, [{0x298, 0x0, 0x100}]}) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000000)={0x1, 0x1}, 0x2) r4 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f00000000c0)=@req={0x8000, 0xb4f, 0x300, 0x1daf6}, 0x10) setsockopt$packet_rx_ring(r4, 0x107, 0x5, 0x0, 0x0) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) r5 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000), 0x22301, 0x0) r6 = syz_genetlink_get_family_id$devlink(&(0x7f00000008c0), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r5, &(0x7f00000009c0)={&(0x7f0000000880)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000980)={&(0x7f0000000f40)=ANY=[@ANYBLOB="07f81ea00ab6bb9a06508be6edb4f387bcc07ca4794b40c858642a96fc1de05ab943c7e034735be51801a9aec2529ddb32fed30f43a3071c3f43f6b967f1f4f974d6513225c2912e264cd00b2355bb5685e080e72190d9ab0020e23c5962b07fb860fcd8add37db6d29123808308af59ed9708dc43240fcd2c", @ANYRES16=r6, @ANYBLOB="00022cbd7000fddbdf2517000000080001007063690011000200303030303a30303a31302e3000000000080003000200000008000b0007000000060016000c0000000500120000000000"], 0x50}, 0x1, 0x0, 0x0, 0x8010}, 0x20000000) ioctl$SNDCTL_DSP_SETFMT(r5, 0xc0045005, &(0x7f0000000080)=0x100) ioctl$SNDCTL_DSP_SYNC(r5, 0x5001, 0x0) preadv(r0, &(0x7f0000000b00)=[{&(0x7f0000000800)=""/21, 0x15}], 0x1, 0x40001001, 0x3) r7 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'bridge0\x00', 0x0}) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r9, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000800)=@newsa={0x140, 0x10, 0x1, 0x0, 0x0, {{@in=@local, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x16}, {@in=@local, 0x4d2, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x1f}}, {0x0, 0x0, 0x8, 0x1, 0x0, 0x0, 0x1}, {0x0, 0x80000000000000}, {}, 0x0, 0x0, 0xa, 0x1}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}, @tfcpad={0x8, 0x16, 0xbdef}]}, 0x140}, 0x1, 0x0, 0x0, 0x8000}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) r11 = socket$inet_sctp(0x2, 0x4, 0x84) getsockopt$inet_sctp_SCTP_RECVNXTINFO(r11, 0x84, 0x21, &(0x7f0000000a00), &(0x7f0000000a40)=0x4) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000640)=ANY=[@ANYBLOB="44000000100003050000ea000000000000000000", @ANYRES32=0x0, @ANYBLOB="15460100ef0000001c0012800b0001006d616373656300000c000280050003000800000008000500", @ANYRES32=r8, @ANYBLOB], 0x44}}, 0x0) socket$xdp(0x2c, 0x3, 0x0) sendmmsg(r10, &(0x7f0000000e80)=[{{&(0x7f0000000040)=@nl=@unspec, 0x80, &(0x7f0000000140)=[{&(0x7f00000000c0)}], 0x1, &(0x7f0000000180)=ANY=[@ANYBLOB="900000000000000009010000080000004c68e91ed946420c0ad25b765c7fd9317fa6e1068da91983fe08077bb4f8544b0c6ecd3a9a182ecbd6ed607bfd61ded4f34f1d8ffc24c3b25e0379286e113b7fd45f81fd43debde653b766d24d6e03173d8db872212f894d4093f5cf4ba391430667496e604a97da2d30f13620bf0b952ad1a931cdd373ef14ec71d200000000c000000000000000110000000b000000219464d69aa86f4692c5f17e3a38e70d71ee996657b09a574f0df5e4b28b36ed17a97f03bb5902cdbc9e1061018e3ea93bd0d2c2b7f96345fafa3130b50607ac03b0e5d09f1e37db088a9c1edb4bc62d465af9c328bd16547f751df70d6d128955e065a94353b20752a7e86dbae37c07bc30fc47927ebb5cee6b65b83457525d01bd4cd216b353ecebac077900e6815196f39c5d614e0fd6b578ba55be638b228581a531d2b2ef9e72e8db7800000000a000000000000000030100000600000056dc5b04b63adc241806ef743ef9a26b188200502dc6960f4bfce12474035f73b0115ff89bd1a0b51f36b183c93e85becd8e7a7a10689f8fd534f3fadc8e8648c86ea8662cb789124ec440df7615f7f6c05230ffd094072d31f88ea19df6da475cfb95ef398b80b1b538d5473572c13512849259a805340d2ae4f247019e624565360e7b9bd890a8c4ca719928fd510078000000000000000d00000091000000abb32983a3cf6b351338dc459f82c1ed35bac206bd708883e71c7249bdafb78311fa9520f77498bc5a83d84e3d7a287d2cf48844c8842d625d1b96827549291d5a3336b538882c7cd69b7311478980c5e50a3a54474e3a7025f0086b1af9b0f464d9f78667000000b0000000000000003a000000920000002ae864eaea6f060dd81b56cf3d9ad18239a430b740fe287bba381d3fb8fe7d37da09dafc48b5ab81ce5aab225376d9ef641cbcbec6f529db4cc4acc7b908e527337695b1b2fd1373c41485aff473eb64de5f9a894d615abb0afff5cbca178115527819ebdbc7094fcbe85715e47d225e6edb8f08b8ad68ab0397d8b6e26bbf421f6846a455db1be424b45497c585a1ece1fab6bfb9024828a79f000000000000a800000000000000ff0000000900000098b31ec14926f3ee1e857c4637887ea4cdd18a1226c6ad198f726e7c743f901b29a54ec26230dbfe224bc79b63cf91cf65a209ad2448dddc6f0c51da7188b52a56803ae9e825c8f2ac32c41997118cfc30bbf453a2f7c59c164142732036e5f1cd7937a44859fa568919b92ced17d310f26370ed8e2ab2496b9bfc1f91105aa87296bd8c06dcbe9ee4ead13026787cc2d7000000000000005800000000000000020100000f0000004077c07401d24df453b42105b2ab503fb577e6df789423bec1f6a924f7d35e15efbe92241f0210da41b07895089c3fc2e0f394fc4366982400db51f173046a26dd84f5346f00000088000000000000002900000090000000994675eae349161c42f534bb60e948dd90a5f94583fadde0747e81cf8ea528c99dd3399de82beb2e183aefbde8c2ab6e97fa3fa66132d6f03747428cc3bbdf9f79c1eb26d556f564918b0566bc7bbf5d9715dd54629b73820c43f4d4b70504f42b85968c9373c62dc44ab39a677edc9ece00000000000000"], 0x4a0}}, {{&(0x7f00000006c0)=@pppol2tp={0x18, 0x1, {0x0, r11, {0x2, 0x4e21, @multicast1}, 0x4, 0x3, 0x0, 0x2}}, 0x80, &(0x7f0000000840)=[{&(0x7f0000001180)="6c58ff1823471faacfdb6b7ac0cafd47e6b62e67448cb7c5e65960cca838c4c1f7ce468d90fbc47e4dd638a4a06156e6866d3f14903344f57a0d0245a7ff914d9abc48f8806977123f7649bddc3b49a7c434f3d0222fc8cb636987e39b4aeb5d4b833fa68e91c01120962c99234b43895da75e9bcb37691f203e49e366de0754008ef9d2ac3e9502e5e01e41b5789a42edb3134343fdb8111b569d3b7650a8a85165caaea61ab301cfe2242543ce9c070bfa0a49fb5610a7529d76751c5018267c093aabcd6a1164eafd107e85c339b54ddd99b91ce3d030e09f075b429cce0fc5c9d7730643e7c116c77c985c57ffd84b36eb5895b9bf45a2a97d470145fa4801e6d461ed0f07c56367b70b729f6310d8557dc80ad07ae4c367ecf876f086f29b89adf3045acdfa38068f46bd75b2fb65402840e419157eab3aee0cb592c5c6d41497f15efccf40140c1d5dee19954edaa19807976554484365efc57fb4fc0fcdc15e86d7f3b14734a8a9ffa40f4bbeab40d6f4c894446b625f4ba47f03c4d8ac1c695444ef2f3d7e352d07768bfd0964dbcfaa4b41473242c7c112d5b1bc01da12b4ef953570bd7c42332131aabfde224b2da266d31316b7d254bd6bb9b87f5021164d3f301271919b7a071b16969c2059eaaf2a4f3a9f0a12c6ad51be6121e0390bb2f40ba1b8f28c0d9e55824330429cba0fba49d0aa7df566f559477dd52e419b7ce39b207cc16206155ddf9a5de37568e1a5e2e4bfca685be290092cf7839e834213bd6ae1639f05bbf4fba429036175616857f420374147bda048ff86b6e2d7bfb562205b2b606dce65f3e68751582638ecd185c56f6a546640c40802a7d9b9bc4fb60f2323aee0af907dfce3c5fc28a2138fb997a09575523768d0438cf1cd67f08d1391419b03eb06d5ea4a45eb31f98888e5aa4a817bd40607d998c5add35014c25486a98b859e4e1f598136cee3d71e5d01d3260325ce6c1d080b6262f2bc3326e533ace46c7808af421627aebce284a95032afda7ee1e6226a962a1a2c96edc0521f7f28547c26ec014fd5f47c4eb0ad1dbd0f8fc883eefe2a95950c4a61296d4aa08da11baac4f64e89cf398a96d3f342721938d72366760616671e21364bb647cebcdae7e1a6c9be7ad41c589f25e3ed4b816afb4858c30a6af3dad47ca54f190be7b4daa3149f204abca23a6d7874a8c204a9a86e145f3be86e26ba1347f496e82c2775c606a3d4e05724a1c38cc99ad38b10a657a0166f976c72ef2cfde189f29e30db32c8e9643683b432b181050bbecc2fa8b87dcb9bbe5fdcdd8ff657c9f9b668de69ee9c56b3395eb56bb5680b97ec985104524a2e26429454bacacfa4357cd002cadeb7dbb34b3956ba5177924892f788eb7bcc87ef32900301d2b4e6ce68dde1f46ce42bcf72fac478d735f394e7413b292ee2eddc6189e31284206a9aff42b1f92eaedc4de0c3afb0353c830273e15e87637d769faae586cac7e565d40e943ff33afc12267051cd4b86855651e0838838a007eb9fb3dfcf4dabc79be0d78e0951ca9cf34c06aee98ec576fa96004daa34eb92754f8c571e1d0898f169240bbe054eaebd1f5ed7075ff62bb36051880a06d0329a577fdb66b581f7aafd7290cc9b52454072f8e2d45784f201c133e6ed7b7bc7701a185b73e714a161371f39fe0dac6453ed168514c9607b1c38630ace1e2df69efd8df31a0422c48c2e46cc48e2814e2ef4226b37674a846745cbf1233a32affb68a519a046476408d3e396e38ec16517cddb638a8c89b75e314fe3b1e8fc457cf17d464bd93b2cbb9c206cdf8948876323aa4460026f85f4919d25111d1637ba3fafd27fe2d71b6f2fe7df5a6636a6939d4e67c80b73171814ae8c752515a4923d419de8bb0bd8a5d57a34ffae25a157c093302e7ffac984aa709f12f84ff5318959510f13fc101687371cf86e2a3a1b448916eef2114b0b0ba2fc2f247b54c4243d7f0e52163dfa6f3b3869b0d08eac6e74d77a8c986e422b686ed9255f5daf344dcc5e79a79dfde8750d8a021b9c122cbc52c8ec5cbc6466e0c7a7126de84dc114d0995cbdf7644960d9d1d4c101d6f6222fb6a7cdbd97173fed24e9f8f1e69a6612983549d4760575a624eb2496e57f1cd8ca214c5323d5038c4f605a5d2476aab8f380e352b014992d4d9f8452f9b65032b1004146c4a735727131d477aea6b8feff2bd214bb7161a0eff0d5f2ea0578068dd05a696302276fcbd633be96c62e51689abf59e580f19081e209417405370615bff0fe6c8c17b55e2d91127db8497642b2a0656384ed219940a62c43114c0802455080138a6995a35ceba1d9c62a0fe1b5d7761f199fe1ef69208e7b35750aca94d86c8fdaf2c47109b8bb2d604e43252653344f1aba71bfa4c152aab6e2365b24f0a133fe361f41759490eb9e84db70d1854d2689719fcdf6c12a07ab981b308f887158b6d16ae0a2075c5956d189e4379e77ba0aa80b89772e3963de7c3a6a1c274a95a9ec63229fb394b1feda90bfdfc2ad8a430e0199fcc5ad4b3afcbe8254fc008b141f674b7a96235086a96a36d3c5cd740a747d54f380026bd111f0664aaf3959866384da229fd05a901f184dd435633d47990afe8c3b4b8c722ab8ddf2511e8a3463a3787d278532f14b82df50ecac9b8df8f63fa7b5f53627fdaa79b23894f601a9ff3fb077616bf3e4ccead960c0b0fa69c3fcda037f3e272df21a54cdf08bcda61507050eb3cbbcd25dc6d66c7d42090ff17296aa0f7cc1917cc31fefd8dfbfbacc690e99f2dc0307f24a583406296b1a2f8e6cb0b0d574b573ce821d9059c886a1c3494a854e442aa66e46cd82e094ee3b1bb030b4cbce2e4c157ca6e1a323798130e8d4de6db0abdbb411ba25330ab776653d3bc5c16e50a37d1b9b27136b0ab61407e4136f5f0b951b404b614aeceef13c0d7c6d1a72b5601203905de4b4f898674de4669cd2e3a925af1e263fcf2d8770feb9854f7768ea3a9928593841d3e96b59e960c1362b1d39c14502332462b143fdd0203c8323fc832097b054d0ff6927131f639bee25fdd64bc6f30658a199ef14a26267e3f9719d4543c3c2d76a3499309999456c79968ddaaeb2707d5e27f7104682b903c3e81db6d5d90959bf6e1f04a828c8c638d42f6385535ccde0530d103add03280c09379ad847919300be8b790d8976ff849629a5f93caaf9aa760be4d7c6bbc44ff53a47b25c5cd2585f45d46c5e151912537369b1f5fb5d943825f13b7f9450e707ffa4b3ed236a2af8ecf9ce2764464ac1750269c2b1850bd8acd532ecbf087a3c25a3b1a4171c56ce934469d6c3ecfb9998b17b4b688dbf810f95864744190d4ec54df9b3cf2b324f2723936a832a0828c9fd47b39c46426de53107349bbef4ae7136c2d117528bae2bd92120a7e5ed5ad049ee0cbac84e535ca8168a34acde8c478584207a69dd7cbc8fe5fdf386fc4746d2a8810b5ce268c1d57b250c6f255689dff839e7d420d7a41f9679740486a23909637166024ffe15d5f9df4fc670b18668f87c5406cc1f048571a6d0e8f5f7e3975a8841fa56fc988ef94bb1a4f29febf696850a500eb17b1998a2838d2216cca7c4f5666cc4cbf6f0e4e820a796d573634290b5b62afe47bfe317839c42315f33abdd583e99b8649ca9a39c1ab918449293c28b3726cf21f75b8131eaaee982f22592380658727ec4f835a4f23911163e921f6fe10ef06ae473f4f8eff4c15f7f722dbe87a2988d63e954d9d4ce854465245a1fa7fc5775ca447693a65310eebd980cbd0544c8bba8463b925c45005e61a6d3c0b361b5a0400eb25d1856043b66acc4efa8f14d7b751435745c7036e16e2be0c2df454dc2aa363d5b378d5f17cfe12b5d498564d47440d2fc970109c3d0bab741656b7712343894cd75c346fc4c5bfed4f5a0bc34a7e7d98aca59923c275b1d5fab2ff02d31283eb82a3b7f7999a80602687706c2c19c51a546753fcda180ce4e26dae4cf9e18acae587bc638f8b69e5e950a370e829ce7408fa679cb377b3c7059fc2532722620a220b1e2be3ecf3dbc35ad32b3f8bd164581dfe930354f826590659d46ea230e4fb645ac7bc7348e7d031a34e1a5630844dff6f366136d9697e97f8e925b8a4d9b23964388ae27d5e02a7fa82da7b6047e0ee278b3a061af2814d3d70c257e0a288ef5ddb1d9ad0f607f34714b278852cc6a661b51351a7bf022f718710ee0985f7d8439332821c826054c2b7fc9dfd1fb50e5ff95d9a1f87ee9f7b13df694e7b7eaf2d252b1dc757f90b9c81f28bf6d41ac010bcc816cd667b2715c4b19a4db5f86119f64e4a867794214f0c6a85734aede81c55e71d290db23401c26593b10562be8ae493012e6d19e25f0b9c87e68721e0a022e30740ba42ab50ebc80286dcf3586891126bfbc37c75695b32bbed7c495bf9cd954c3da8ecae7294b4c9b41a46797ab91f52ab5ee2a5b5c8d2ad343b5e58cb80fbd58e945a70261f3c5bce6a58611562712f0c6d431a2e42a3cfe2668553cdad61c71b30d07f9a1a08828e8ee2df7656bd93399b58087529c055a23fc619f0b1c44f91cf06f6f9e56bf1b8042c12cc69bc463d80392bb857b5a63b96c2e03c89f5883406f235cc2f5c43f73774f60d4bc2de65ffec2b1b35984322743fdea5033f9849c28e1465a092edb1c8697b13d7178465c7e59ffedd2604e1937d0bdf30e90c56a46bf90d79bfce5b36c3b3d9994409d2fd960871491662b37a85735ab7f04e7544c3c153724f25d4bdd3665074e8a2f490145e6e9b5a459b23729c7c2b06d431f6867b883c7dc6a760200143935825bc54305d1aaebe89d408719a7644d11c379dbc90f2afba6d7819c30acc4b1c65bb67f4fdf11e390adfd764bffdd8da24e611fd156d456505ca1471937fa19a65a2de9bb39ad995d9f6d69cd17289aba5b982a1b1ece3cbf13a9da420d1ad350d3761f0aa35144b9c85f6039b492da095afac282204de106a8fedd02728c77c72e646aefcb8969acc8be825ac714741edd0e74d19abed8d88e5ab539da9c29e008e51c5d5291819180a887ecb302738bf4377f767270fbb2f8ae96bc0af01b2f59eb7093eb0fa07bcde103513ad37336391b18d112c50b264ee3219a29885d5b7967e505053560e4609ff8df413189bb6196fb73a13203597fb93949c82ca759d4bd617d577e2b1e10185584c573ab081236e98322f70326f8f46c6fc8f19560f8941701b9c8f3790e4aa0a632dbf525d100e0355d9b910cfe7c32fcd511034d5f8528766609001428213606b5114fdc80e8f8d0e485f9349e43d50079a81dc56f4ac28577abf80f03c98f66fb1dd82b3a181e226c971701a06de57290dca4cbcf2f2b64674b89df2c10531add48a8e87a3b6b64906c129194b6eb7ac032eda8b8938ffb2336c333fc8bbb5545f6e123fcf8548cfca9519c12c369b3b34fc6d664f7c93afcedcb5f6c64dd9985a9489f70c80ecc55e0d3e0ee45306425f701599537deca846c493d4d92e00cea5d81e2f8a1492b5f0e633c01e636a91db2aacf18dff0fa6074925172b789f63cd6bd6cc41a7cf254f37b11d17d54931e5ab34837eb977098b35e2e5ea04ba21b47f57cb544d12c39debb50c5ec8005ad8165246ed246c71e1340ebbe35a5fabf867e466cc8ece0f92de66b8b2b214b3feb93aaa2c3eec97acf6d9775265c7d65c7b9e03e4b13d2b07352d091a0fa3c2bace433e1ba67fe334f28c4fe17b9e54f1d7ff32cef008139be9be68173298b", 0x1000}, {&(0x7f0000000740)="021563f6a51129cab1fefe8402a25bec4940e2afadc960f6d7dcd6cdc9701847b49a1c03f7de406319fc73fd1e468d5921d1267aea87ddf4735d4a674f25fc707603dbb7da56be8d9c9f71a0f7789a15de680a0978885c44d89703cbbba9143d89c715fe9bbde0a0e4e488d3eaac903d9e069756626b5b278a00097393e65806165834ad6701f56e49f2d5ce8e669190ed6450bda935a3d9ac127f3b752a79a36ee49a49d66299c21befbdcbc137363dc6bb6a45e8f9216cbfa5f87f6e2667df5204ce45445f254cf784e1b0e7beeaf3a5e18b4610c17df6668be296256ffa28b175554ccd9ba3ec611a31462d17", 0xee}], 0x2, &(0x7f0000002180)=ANY=[@ANYBLOB="480000000000000000000000c0010000138ef7536adf795565678b3ad3c408b77ade9d64d26feb0d34db2a0a5e68f4d4fefeaabf205c9303672659c270faa06c3d00000000000000e80000000000000093010000010012003511bc2183b1644498cee4ebb26f3f4847694f22528aeb602a6642cd71f8052daf4b8f4163535810b18a3739821ca1fa440e7db2a84d3c863a7366a196d0d2525036ba93efdda2f83c2ff777df67010248d5d55d8e2239f48667eb2624421a41167ee0273ff38c25d2ac5b9c102dc6a8e5c5d6c4012667e873e10656a6ab65a55c8c73df762eeebb45e4d3a36c80c09a38db361d74d874ce4172332b9179fbdefd20ac5407d785b26c6577ddf5478285ab56f3b14d9a36f4ae7c4441887a8a0ed8dab11b5ce72bd314759ad7a766355f9571a55ff02902baca300f7532da10000000000000000000b80000000000000015010000ffff0000d51799ac93019a9aa86875cb7c253c35b771bfb7b9401b40c735ab7adf851808000000d1f83e94ac3d793a87d1f94ea9145072111a4e20d78d8fbb17af83af20a6cf8da6236c18301cc829f93fd1568613803ba7287926a66b83149394377ae4c811ba5a2f44a918de562cc8f4ada6fb52974257c1d67174ce2f1ab28e9b4554302dbba39e5b57782a0aae36390f3622b10ec9848985aaba4dd5111479b1800dedfd0ed00183177366e29be24224da6987be3f2114eb813970c59426d00adb2f1ff298e6b2d67309e4ed5db1d50dce3436f648c1626cdb692cda7cdc9b014d6e1b88856c09de9e38f742eab0450472a8505ff1ef00ccda8d71"], 0x1f8}}, {{&(0x7f0000000a80)=@in6={0xa, 0x4e24, 0x3, @dev={0xfe, 0x80, '\x00', 0x1b}, 0x7fff}, 0x80, &(0x7f0000000c80)=[{&(0x7f0000000b00)="b02b10d45c773f1ee51f6e72e36e195c6e2bec4300abce62843045995613db56523af4c89ea5edab9584e1682a40a010c1a5bdd5f10079ea982da1fe2db62576c15fed1516b4f47470bb860d", 0x4c}, {&(0x7f0000000b80)="c8c0884781b0e82cfa50371bddfb712ecfbe88155958da7eb80aff749500f50f9bdade0df6bc0782843e5bd07a0f221fd5384ddb7342861747ff92bea1c4d955f904116c7b0c8a94f6a3757cabb05b0b34666f6cbce53453f3f06bec652dca439ac596d998586a92df89c110f9c4ffba8f4518d168b74c365a6bef2d9cbacb831b60c07149b93e53090e9306375208895b4b87e05217ddbf4f5e07bc1706518be2ff050bc3da93d81d31976505b34b2c37ed424bf783da968f39b062c50cb360681e5c86ace4893ee703aaf533740ad602cf503242eaab1074bf10a32510850196", 0xe1}], 0x2, &(0x7f0000000cc0)=ANY=[@ANYBLOB="c80000000000000003010000010001006e5133d8e8666afc57afb8daf505043bd7e327d7cb0b5d377a20c7af375a4869d6773dcd88092b723ad32ae83639e29c02e43422ed01bf10dd4d7ca5d38529f8c9560aee822996df3230d6fda4096175849b9ced3a1bea5c2fe1ab25003b5f82bd6ecf8d92b8424106b65a2fbcc7f02241dfe14ef1d536b31894c1642afada07bcd54c67d3e7027fe3519adb5f199b8d474a5cc75418d8f205e811129ab4ebe84c445a00439f4052d344b6bb805df8ffffffff1c180000007000000000000000ff000000030000007d53d7acab071671d630de0708dad3e266dec689889f28b195392d9407dbef166197a22e93a95df352c2718855af80491bea7b80d13f30e7b9e1754227170efa47d7aae7313a6f4f0728188b95e3f11f6a90ce23927064b58d2dd94d8500000050000000000000003a000000370e000092a673a4d8026380cd34d88ef66a18c43e4a1438ee3dd8fcc092ef6aa5612fe5cf14253ab96f13e0df83a281775fd1d52a5b2ed736e389b20300000000000000"], 0x188}}], 0x3, 0x4040000) 1m39.392156681s ago: executing program 9 (id=15642): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000000c0)={0x68, 0x2, 0x6, 0x5, 0x0, 0x0, {0x0, 0x0, 0xfffd}, [@IPSET_ATTR_TYPENAME={0xe, 0x3, 'bitmap:ip\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x20, 0x7, 0x0, 0x1, [@IPSET_ATTR_CIDR={0x5, 0x3, 0x1f}, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}, @IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0x21c}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x68}}, 0x0) (fail_nth: 5) 1m38.591847659s ago: executing program 38 (id=15642): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000000c0)={0x68, 0x2, 0x6, 0x5, 0x0, 0x0, {0x0, 0x0, 0xfffd}, [@IPSET_ATTR_TYPENAME={0xe, 0x3, 'bitmap:ip\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x20, 0x7, 0x0, 0x1, [@IPSET_ATTR_CIDR={0x5, 0x3, 0x1f}, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}, @IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0x21c}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x68}}, 0x0) (fail_nth: 5) 6.235415472s ago: executing program 5 (id=15968): syz_open_dev$vim2m(&(0x7f0000000040), 0x3, 0x2) openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$inet6(0x2d, 0x806, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$video(&(0x7f0000000040), 0xa4, 0x0) ioctl$VIDIOC_S_FMT(r2, 0xc0d05640, &(0x7f0000000340)={0x1, @pix={0x0, 0x0, 0x30314442, 0x0, 0x0, 0x0, 0x7, 0xfeeddafe, 0x0, 0x0, 0x0, 0x4}}) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8002, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0x8}, 0x0) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000300)='illinois', 0x8) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x3, 0x0, @loopback}, 0x1c) connect$inet6(r3, &(0x7f00000002c0)={0xa, 0x3, 0x9, @mcast1, 0xfffffffa}, 0x1c) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) r4 = syz_io_uring_setup(0x49a, &(0x7f00000000c0)={0x0, 0x79af, 0x3180, 0x8000, 0x40024e}, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-serpent-avx2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r7, 0x117, 0x1, 0x0, 0x0) r8 = accept4(r7, 0x0, 0x0, 0x800) syz_io_uring_submit(r5, r6, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x40, 0x6000, @fd=r8, 0xffffffffffffffff, &(0x7f00000006c0)=""/210, 0xd2, 0x2, 0x1}) io_uring_enter(r4, 0x627, 0x4c1, 0x43, 0x0, 0x30) 5.920696713s ago: executing program 8 (id=15969): utime(&(0x7f0000000340)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]}) r0 = openat$kvm(0xffffff9c, &(0x7f0000000040), 0x80800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = socket$unix(0x1, 0x2, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000180)={{0x1, 0x1, 0x18, r2, {0x4}}, '\xe9\x1fq\x89Y\x1e\x923aK/file0\x00'}) getsockopt$IP_VS_SO_GET_VERSION(r4, 0x0, 0x480, &(0x7f0000000280), &(0x7f0000000300)=0x40) bind$unix(r3, &(0x7f0000000100)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) unshare(0x24020400) unshare(0x2c060000) sendmsg$unix(r3, &(0x7f00000000c0)={&(0x7f0000000200)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x4040801}, 0x20008840) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000001c0)={[0xfffffffffffffffb, 0x6, 0x0, 0x4, 0x10003, 0x4, 0x400200cc4, 0x5, 0x7d, 0x0, 0x0, 0x0, 0x5, 0x1, 0xb9, 0x8d], 0xeeee8000, 0x2011c0}) ioctl$KVM_RUN(r2, 0xae80, 0x0) r5 = socket(0x2, 0x80805, 0x0) close(0x3) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r6, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r6, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f00000003c0)=[@in6={0xa, 0x4e20, 0x0, @private2}]}, &(0x7f0000000180)=0x10) r7 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r7, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r5, 0x84, 0x0, &(0x7f0000000000)={r8, 0x7, 0xfd99, 0x80000000}, 0x10) ioctl$KVM_RUN(r2, 0xae80, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x3000003, 0x4031, 0xffffffffffffffff, 0x0) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) munmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000) syz_open_procfs(0x0, &(0x7f0000000100)='syscall\x00') socket$nl_route(0x10, 0x3, 0x0) socket(0x1, 0x803, 0x0) 5.804455605s ago: executing program 2 (id=15970): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0xffffffffffffff6e, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="5000000010008105e9c51c000000000000000000", @ANYRES32=r2, @ANYBLOB="01000000000000002800128009000100766c616e000000001800028006000100000000000c0002000c0000000d00000008000500", @ANYRES64=r0], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x0) 5.706831419s ago: executing program 2 (id=15971): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="fc0100001900010000000000ffdbdf2520010000000000000000000000000000ffffffff00000000000000000000000000000003000000000a00002008000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001dffffffffffffff800000000000000000000080000000000000000000000000d90200000000000000000000c06b6e00000000010000000044010500ac14143b000000000000000000000000000004d32b00000000000000ac14148c0000000000000000000000000000000000000100000000000000000000000000fc020000000000000000000000000000000000003200000000000000ac1414aa0000000000000000000000000000000004000000000000000100000000000000fe8000e0000000000000000000000038000000003c000000ad"], 0x1fc}}, 0x0) 5.585512657s ago: executing program 8 (id=15972): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0xfe, 0x7fff0006}]}) (async) r1 = socket$netlink(0x10, 0x3, 0x0) (async) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getpeername$packet(r2, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000240)=ANY=[@ANYBLOB="5000000010000305fcffffff0000000000000000", @ANYRES32=0x0, @ANYBLOB="1111020031880000280012800b0001006d61637365630000180002800c000400010000010002800008000500feffff7f08000500", @ANYRES32=r3], 0x50}, 0x1, 0x0, 0x0, 0x48890}, 0x0) (async) r4 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000240), 0xa2003, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r4, 0xc0184800, &(0x7f0000000100)={0x20004, r0, 0x2}) r6 = syz_open_dev$dri(&(0x7f0000000280), 0x1ff, 0x140) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r6, 0xc00c642e, &(0x7f00000000c0)={0x0, 0x0, r5}) ioctl$DRM_IOCTL_GEM_FLINK(r6, 0xc008640a, &(0x7f0000000300)={r7, 0x0}) ioctl$DRM_IOCTL_GEM_OPEN(r6, 0xc010640b, &(0x7f0000000140)={r8, 0x0}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r6, 0xc00c64d2, &(0x7f0000000180)={r9, 0x80000}) ioctl$DRM_IOCTL_GEM_OPEN(r6, 0xc010640b, &(0x7f00000001c0)={r8}) (async) r10 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r11 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r11, 0x0, 0xc8, &(0x7f0000003d40), 0x4) (async) setsockopt$MRT_ADD_VIF(r11, 0x0, 0xca, &(0x7f0000003d80)={0x1, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @dev}, 0x10) setsockopt$inet_mreq(r10, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8) syz_emit_ethernet(0x2a, &(0x7f0000000200)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb08004500001c00000000159a700002907800000000e00003003544fbcc00000000"], 0x0) (async) syz_emit_ethernet(0x66, &(0x7f00000000c0)={@multicast, @link_local, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x2f, 0x0, @rand_addr=0x64010102, @multicast1=0xe000c800}, {{0x0, 0x0, 0x1, 0x0, 0xb, 0x0, 0x0, 0x4, 0x6558}, {0x0, 0x0, 0x0, 0x0, 0x11}, {}, {0x8, 0x88be, 0x0, {{}, 0xfffff788}}}}}}}, 0x0) (async) r12 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r12, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)=ANY=[@ANYBLOB="3c020000190001000000000000000000e00000020000000000000000000000000000000000000000000000000000000000000003000000000a0000205e000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000000800000000000000000000000000000700000000000000000000000000000000000000000000000300000000000000070000000000000000000000000000000000000000000000e02700000000000000000000000000002d00000000000000000000000000000084010500ac1414bb000000000000000000000000000000006c01000000000000ac14142c000000000000000000000000000000000000560000000000fdffffff01000000ac141410000000000000000000000000000000003200000000000000fe800000000000000000000000000500023500000000000000000200feffffff00000000ff010000000000000000000000000001000000003c00000002000000ff0200000000000000000000000000010000000001030000000000000000000000000000ff020000000000000000000000000001000004d33c00000002"], 0x23c}}, 0x0) 5.565937882s ago: executing program 2 (id=15973): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20044010}, 0x4040) 5.510098213s ago: executing program 8 (id=15974): openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000280)='fd/3\x00') r1 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000004780), 0x2, 0x0) ioctl$VIDIOC_TRY_FMT(r1, 0xc0d05640, &(0x7f00000047c0)={0x9, @pix_mp={0xffffffff, 0xfd, 0x3131354f, 0x4, 0xa, [{0xc30}, {0x47, 0x6}, {0x1ff, 0x5}, {0x8, 0x4}, {0x3, 0x10001}, {0x4, 0x80000001}, {0x80000000, 0x1}, {0x0, 0x5}], 0x5, 0x7f, 0x7, 0x1, 0x6}}) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000240)={0x80000011}) ppoll(&(0x7f0000000180)=[{r2, 0xb060}], 0x2000008e, 0x0, 0x0, 0x0) r3 = socket$xdp(0x2c, 0x3, 0x0) ioctl$IOCTL_VMCI_INIT_CONTEXT(0xffffffffffffffff, 0x7a0, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r3, 0x400c6615, &(0x7f0000000080)={0x0, @adiantum, 0x0, @desc2}) ioctl$IOCTL_VMCI_DATAGRAM_SEND(0xffffffffffffffff, 0x7ab, &(0x7f0000000280)={&(0x7f0000001000)={{@host, 0x6}, {@my=0x1, 0x800000}, 0x400, "884fbe2726aa0a32f3e65f909acda971a093228292456e0332e6c11577b514f0bb8db731789d860e9589c4cbdd60b7a851a8a3c55ada2f90c5fe68bf4a5c3e32296535dc838ef00dc18a32a79118dc858628f741f107552021e5a81d38e4374a8a717a7ca9015083cfff5d16156ef9cabf4f60c0da46870a10bf520cc5abcf9e3a437761ea75776763139fadd55c46daf5338870951822f6a803ccfbab9c3f507672d7c39ea9ccf81d9bc2b4649e7b44ed9fd7cb9bd389240cd41c415113d1caac4536f05c07e596d6addad2a4d27ba21a3b655753c508caedcc812ca235a7cd1686426b208bdecf8a4265ba8f6824aa60306e2d623481eed301b6dc21041fa8b6592be00bb74de1989a45a5aa32c189e9f5a5bb878281d0129afcfb8410cd1fa5acd080993d01084213130a9b8d517d13251e6605a03d9b8faf507e820205a1f471af7b261419e79e09c547f7c10fd3f1ad876f59fdcc5e07d0ff4dee6ea2e3856616a352d648b9b5261b6263020fc3ae8eb404bc25703b3d3b83172d07ff22907d6631d226c8247c92c1826ff814590dfe8c7fc54dfb265e906f756846546316b20e0105e2a5355a210b2b7f5db61d8f90bb783b41ce368233bd08044e9283531fffe49e3d305ecfb16075a047557f57bb7baf8ba58502975ad0d60ed8de9cb8adc9f667bc6826cbea8e260e4bff28a5ec19d38d1fc019db3cfaf310e764d78619cb27fb17af05a0e8ae831ce8413721e71138e62cc4ad8e7974d1506b4fb581c549a3dd7b7ef44ac37201aa3bce6f37f648d781bcb4f329fd45ffa640f1b04efb38a36e0ed0fbabcb07e4ad88ae3edfb6d840d75340204243d0e1c1c3139823b0d5ad196430bf4566619a1a97df4376a7e9a9e9c1d97b9f773c921778f2cb5165c02da1423305c502076177e4af50cb3343c10b01b78e3fe5520bdfae2b3dbe42db0f0eb55bbcb19038018d45ccdb8b0df400085a02c61b033f430fb6a7408e090c65798bc49d35e049d276fd1952d2b3dfd92a2548411e21be26216fe68fc3cf1c6625031260153708a53255b3d3d0411d5f0e8ab2102a97e539c34e9c769a7dafb87c5918deb59ef05e928c2c52775de467fa843cbcdabc290097eeb2ee7c58d86e3fccc39a5b694c18a4cc0d6af1e61d9c69e6466bc0cbef15365109e4f67a6268625f8c3f358fb7d567cbea52e1bc289bd8effda4e362a729e8cd3064970b97e3f72535d9ba88e97a14834cfd8dc86b5d2f9b35425a4162e6abe8b785ef462883e716c91b8eb281d81f68f606f16fcbc5cddfdec3b515818a647d86a4c17bae6ad525e95598052c49cdee821ceb45b2350dda13628db0dd266f30285241a2b147d65113b8ed3665a3451f7a56cf430ec98aeac702d9b9f776d97520a9d039e5b2fff34ac4d4e0a32e1f35c8f38e4f4fe1b3212a70f185ad71ec86b8c9"}, 0x418, 0x9}) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) ioctl$BLKZEROOUT(r4, 0xc0c0128e, &(0x7f0000000240)={0x2000, 0x1000000}) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000e2793b10d1050120000701020301090212000100001a000904"], 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000680)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)={0x4c, r6, 0x1, 0x70bd28, 0x25dfdbfe, {{}, {@void, @val={0x8, 0x3, r7}, @val={0xc, 0x99, {0x7ff, 0x70}}}}, [@NL80211_ATTR_IFNAME={0x14, 0x4, 'syzkaller0\x00'}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}, @NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x81}, 0x24044884) r8 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) ioctl$IMADDTIMER(r8, 0x80044940, &(0x7f00000002c0)) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_clone(0x40000, 0x0, 0x0, 0x0, 0x0, 0x0) r11 = socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r11, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r11, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)={0x30, r12, 0x1, 0x70bd2d, 0x25dfdbfb, {{}, {@void, @void, @val={0xc, 0x99, {0x2, 0x4a}}}}, [@NL80211_ATTR_PID={0x8, 0x52, r10}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r13}]}, 0x30}, 0x1, 0x0, 0x0, 0x48000}, 0x8482) sendmsg$NL80211_CMD_SET_WDS_PEER(r9, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, r12, 0x8, 0x70bd2c, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @random="6a669277f972"}, @NL80211_ATTR_MAC={0xa}]}, 0x2c}, 0x1, 0x0, 0x0, 0xc000}, 0x4044040) read(r8, &(0x7f00000019c0)=""/4097, 0x1001) syz_usb_connect$hid(0x5, 0x36, &(0x7f00000001c0)=ANY=[@ANYRES8], 0x0) syz_usb_connect(0x5, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="120100007c1905409904e25a0f090102070109021b0001000000000904000001ff53c2000904"], 0x0) 5.441428206s ago: executing program 2 (id=15975): syz_genetlink_get_family_id$tipc2(&(0x7f0000000200), 0xffffffffffffffff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket(0x10, 0x803, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340), 0x302, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffff, 0xf}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x4, 0x6}}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)=@newtfilter={0xd4, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {0xe, 0x7}, {}, {0x7}}, [@filter_kind_options=@f_u32={{0x8}, {0xa8, 0x2, [@TCA_U32_SEL={0x94, 0x5, {0x7, 0xef, 0x8, 0x8, 0x5, 0x9, 0x7, 0x0, [{0x1000, 0x4, 0x401, 0x6}, {0x8, 0x7, 0x1009, 0x5}, {0xfffffff9, 0x43, 0x7ffd, 0x5}, {0x7fde, 0x40, 0xcf9, 0x3ff}, {0x8, 0xb, 0x1, 0x42}, {0x6, 0x400004, 0x8, 0x8}, {0x8001, 0x0, 0x0, 0x8001}, {0x1, 0x1800000, 0xa525}]}}, @TCA_U32_LINK={0x8, 0x3, 0x1000000}, @TCA_U32_CLASSID={0x8, 0x1, {0xa, 0xfff2}}]}}]}, 0xd4}, 0x1, 0x0, 0x0, 0x80}, 0x40) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB=' '], 0x20}}, 0x4000044) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r8 = openat$ppp(0xffffffffffffff9c, &(0x7f00000001c0), 0x88802, 0x0) ioctl$PPPIOCNEWUNIT(r8, 0xc004743e, &(0x7f0000000140)) ioctl$PPPIOCSFLAGS1(r8, 0x40047459, &(0x7f00000000c0)=0x41) socket$nl_route(0x10, 0x3, 0x0) 5.441274552s ago: executing program 0 (id=15976): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="fc0100001900010000000000ffdbdf2520010000000000000000000000000000ffffffff00000000000000000000000000000003000000000a00002008000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001d00000000000000000500000000000000000080000000000000000000000000d90200000000000000000000c06b6e00000000010000000044010500ac14143b000000000000000000000000000004d32b00000000000000ac14148c0000000000000000000000000000000000000100000000000000000000000000fc020000000000000000000000000000000000003200000000000000ac1414aa0000000000000000000000000000000004000000000000000100000000000000fe8000e0000000000000000000000038000000003c000000ad000000fc0000000000000000000000000000010000000001"], 0x1fc}}, 0x0) 5.325303581s ago: executing program 0 (id=15977): r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SG_IO(r0, 0x2285, 0x0) r1 = syz_io_uring_setup(0x10d, &(0x7f0000000380)={0x0, 0x0, 0x80, 0x0, 0x4000}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000440)=0xfffffffc, 0x0, 0x4) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x2, 0x0, 0x0) syz_io_uring_submit(r2, r3, &(0x7f00000002c0)=@IORING_OP_SHUTDOWN={0x22, 0x9}) syz_emit_ethernet(0x46, &(0x7f0000000000)={@local, @broadcast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0xb, 0x4, 0x0, 0x3, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2f, 0x0, @broadcast=0xac14140a, @multicast1}, "0400655800000000"}}}}}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0xaee2, 0x800, 0xffffffff, 0xbfe00000}, &(0x7f0000000000)=0x0, &(0x7f0000000280)=0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f00000000c0)=0x0) ptrace$ARCH_FORCE_TAGGED_SVA(0x1e, r7, 0x0, 0x4004) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r5, r6, 0x0) io_uring_enter(r4, 0x47f6, 0x0, 0x2, 0x0, 0x300) io_uring_enter(r1, 0x3516, 0x0, 0x0, 0x0, 0x0) pselect6(0xf0, 0x0, 0x0, 0x0, 0x0, 0x0) 4.671990731s ago: executing program 5 (id=15978): io_submit(0x0, 0x1, &(0x7f0000000100)=[0x0]) (async) io_submit(0x0, 0x1, &(0x7f0000000100)=[0x0]) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='memory.current\x00', 0x275a, 0x0) write$binfmt_misc(r0, &(0x7f0000000040), 0xe09) r1 = syz_open_dev$loop(&(0x7f0000000140), 0x9, 0x40000) socket$can_bcm(0x1d, 0x2, 0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './bus\x00'}, 0x6e) (async) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './bus\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) ioctl$VIDIOC_CROPCAP(r0, 0xc02c563a, &(0x7f0000000000)={0x4, {0x3, 0x4, 0x51bd, 0x6}, {0x3cae, 0x805f, 0x1}, {0xff, 0xecc1}}) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet6_group_source_req(r4, 0x29, 0x2e, &(0x7f0000000080)={0x7, {{0xa, 0x4e20, 0xe0, @mcast2, 0x138e}}, {{0xa, 0x4e21, 0x9, @private2, 0x4}}}, 0x108) setsockopt$inet6_group_source_req(r4, 0x29, 0x2c, &(0x7f00000001c0)={0x7, {{0xa, 0x4e24, 0x5, @mcast2, 0x81}}, {{0xa, 0x4e20, 0xfffffffb, @empty, 0x8000}}}, 0x108) ioctl$VIDIOC_S_SELECTION(0xffffffffffffffff, 0xc040565f, &(0x7f0000000040)={0x9, 0x100, 0x0, {0xffffffff, 0xbde, 0xb, 0x10000}}) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000480)='./bus\x00', 0x8) (async) mkdir(&(0x7f0000000480)='./bus\x00', 0x8) syz_emit_ethernet(0x7a, &(0x7f0000000080)=ANY=[@ANYBLOB="ffffffffffff0180c200000086dd606ed6c400442ffffc020000000000000000000000000000ff020000000000000000000000000001242088a80000fffc00000800000086dd88a888be08000000100800fe0100000000000001080022eb000000042000c0000281e90405000000000000000800655800000000"], 0x0) socket$netlink(0x10, 0x3, 0x0) (async) r5 = socket$netlink(0x10, 0x3, 0x0) read$snddsp(r0, &(0x7f0000000580)=""/205, 0xcd) sendmsg$netlink(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000120021030000000000bc61682a00968008001d001d"], 0x1c}], 0x1}, 0x0) recvmmsg(r5, &(0x7f00000077c0)=[{{0x0, 0x0, &(0x7f0000000540)=[{0x0}], 0x1}}, {{0x0, 0x0, 0x0}}], 0x2, 0x2040, 0x0) (async) recvmmsg(r5, &(0x7f00000077c0)=[{{0x0, 0x0, &(0x7f0000000540)=[{0x0}], 0x1}}, {{0x0, 0x0, 0x0}}], 0x2, 0x2040, 0x0) ioctl$LOOP_CONFIGURE(r1, 0x4c0a, &(0x7f00000002c0)={r0, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0xb, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "f4bd00000080190000000000000800", [0x0, 0x3]}}) 4.276617008s ago: executing program 0 (id=15979): syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0) r0 = socket$rxrpc(0x21, 0x2, 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={0xffffffffffffffff, 0x0, 0x0}, 0x20) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) r3 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) r5 = socket(0x10, 0x80002, 0x0) syz_open_dev$vbi(&(0x7f0000000000), 0x3, 0x2) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x11) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0xffa1, &(0x7f0000000380)={&(0x7f0000000140)=ANY=[@ANYBLOB="440000001300a7cc4a372eaf541d002007000000", @ANYRES32=r4, @ANYBLOB="00000000100000001c001a80080002802d00ff0008000200", @ANYBLOB="35874207"], 0x44}, 0x1, 0x0, 0x0, 0x50}, 0x0) connect$rxrpc(r0, 0x0, 0x0) syz_io_uring_setup(0x49a, &(0x7f0000000140)={0x0, 0x79b2, 0x3180, 0x1, 0x283}, 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, 0x0, 0x0, 0x4) r6 = socket$inet_smc(0x2b, 0x1, 0x0) socket$can_bcm(0x1d, 0x2, 0x2) socket$nl_route(0x10, 0x3, 0x0) socket$tipc(0x1e, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) syz_emit_ethernet(0x0, 0x0, 0x0) r7 = syz_io_uring_setup(0x1238, &(0x7f0000000380)={0x0, 0x80fd, 0x80, 0x1003, 0xab9}, &(0x7f0000000040)=0x0, &(0x7f0000000200)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r8, 0x4, &(0x7f0000000180)=0xfffffff4, 0x0, 0x4) syz_io_uring_submit(r8, r9, &(0x7f00000001c0)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r6, 0x80, &(0x7f0000000080)=@l2tp={0x2, 0x0, @local}}) io_uring_enter(r7, 0x3532, 0x32c9, 0x45, 0x0, 0x0) 3.704984205s ago: executing program 8 (id=15981): setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) add_key$keyring(&(0x7f0000000040), &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0, 0xffffffffffffffff) r0 = epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x1, 0x3, &(0x7f0000000380)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8a06, 0x0, 0x0, 0x0, 0x4}}, &(0x7f0000000000)='syzkaller\x00', 0xd, 0xfed, &(0x7f0000001840)=""/4077}, 0x94) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r2, &(0x7f0000000100)={0x20000014}) epoll_wait(r3, &(0x7f0000000340)=[{}], 0x1, 0x80000000) r4 = syz_open_dev$cec(&(0x7f00000000c0), 0x0, 0xa41) ioctl$CEC_ADAP_S_LOG_ADDRS(r4, 0xc05c6104, &(0x7f00000001c0)={"1b00", 0x0, 0x5, 0x2, 0x802, 0x80000000, "f759e1006dc710000000d9fc6300", '\x00', "06000061", "e8cc1304", ["00e8ffffffffffffff00", "c2fe00408000", '\x00\x00\x00\t\t\x00\x00\x00\x00\x00\x00$', "0000005fc8000040001000"]}) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r0, &(0x7f0000000000)={0xa0000001}) ppoll(&(0x7f0000000200)=[{r3, 0x1}], 0x1, 0x0, 0x0, 0x3) setsockopt$IP_VS_SO_SET_FLUSH(0xffffffffffffffff, 0x0, 0x485, 0x0, 0x0) unshare(0x42000000) 3.577236077s ago: executing program 3 (id=15982): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) (async) r0 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000000)=ANY=[@ANYBLOB="120110017a953210ac0504c777620102030109022d0001080540040904270102fffd01000921e700070122b30409050c0200020103400905df02"], 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000bc0)={0x24, 0x0, &(0x7f0000000b00)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x4ff}}, 0x0, 0x0}, 0x0) (async) syz_usb_control_io$printer(r0, 0x0, &(0x7f00000007c0)={0x34, &(0x7f0000000440)={0x40, 0x18, 0x6, "d0f060ced921"}, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x9) 3.189092086s ago: executing program 5 (id=15983): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="fc0100001900010000000000ffdbdf2520010000000000000000000000000000ffffffff00000000000000000000000000000003000000000a00002008000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001d80ffffffffffffff0000000000000000000080000000000000000000000000d90200000000000000000000c06b6e00000000010000000044010500ac14143b000000000000000000000000000004d32b00000000000000ac14148c0000000000000000000000000000000000000100000000000000000000000000fc020000000000000000000000000000000000003200000000000000ac1414aa0000000000000000000000000000000004000000000000000100000000000000fe8000e0000000000000000000000038000000003c000000ad"], 0x1fc}}, 0x0) 3.187645121s ago: executing program 2 (id=15984): r0 = syz_open_dev$usbmon(&(0x7f0000000080), 0x1, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000000), 0x20000007b, 0x101000) r2 = dup3(r0, r1, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES8=r0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0100549ec8d469759160667937945199b2000000cc3a3285aa4000000000000012e5fcc389f96f1200000000000045cf17643d714735d01e929fc6ed2248571603fbb906721bb314"], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x1, 0xb, &(0x7f0000000700)=ANY=[@ANYBLOB="18220000", @ANYRESDEC=0x0, @ANYBLOB="008172d4eee664fb8b12a10d", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000050000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000020000008500000082000000"], &(0x7f00000001c0)='syzkaller\x00', 0x1, 0x0, 0x0, 0x41100, 0x1c, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r4, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) read$FUSE(r2, &(0x7f0000003040)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f00000004c0)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) connect$unix(r6, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) lstat(&(0x7f0000000240)='./file0\x00', 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000200)={0xfffffffe, 0x3, 0x4}) unshare(0x62040200) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) landlock_create_ruleset(&(0x7f0000000240)={0x1fff}, 0x18, 0x0) landlock_restrict_self(0xffffffffffffffff, 0x4) unlinkat(0xffffffffffffff9c, &(0x7f00000003c0)='./file2\x00', 0x0) syz_usb_connect(0x1, 0x4a, &(0x7f0000000600)=ANY=[@ANYBLOB="124100005520f0104000000000000000000109027e4b0f1254405dbcc118c04129643d89d3bf68526ffcad5d30cd0ac7ea9e439a09ed0bd573e137b10c9799576cd368bb6bd60298ba620c826366e2b4e2a84a2c2d85636170fdda808ce713a8e330f195a682cc46256ed0c9bf6b745624d393940c54571eb73c2c1a03ec9153683e3d835e620b1db7f8f8527dd7680d5a27a5b7f12fd18a11693f78687a25acbc902876f948c4997fa1c3f2251ddd7b9731ee70ddc533643aa348c820f9009e52dd74aa7ec9752b325a128476abcad705bc7925c5f3"], 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) io_uring_setup(0x61d5, &(0x7f0000000040)={0x0, 0xc46f, 0xee12d5c3889302f, 0xa, 0x20002fb, 0x0, r7}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000080)={0x15, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="dbaa00fea0"], 0x0, 0x9, 0x0, 0x0, 0x0, 0x60, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xd}, 0x94) unshare(0x2020000) syz_emit_ethernet(0x46, &(0x7f0000000500)=ANY=[@ANYBLOB="aaaaaaaaaaaa00000000000086dd600000fa00103aff00000000000000000000ffffac141438ff02000000000000000000000000000186009078ff0000000100010000000000718f9944f1fd131ef3895fcfb0b174f75458c0d81f48ec6bc22e697abf78482c8f7a9a9054"], 0x0) io_uring_enter(0xffffffffffffffff, 0x2219, 0x7721, 0x6, 0x0, 0x0) bind$inet(r2, &(0x7f0000000080)={0x2, 0x4e20, @multicast2}, 0x10) r8 = syz_usb_connect(0x2, 0x24, &(0x7f0000000380)=ANY=[@ANYRESHEX=r4, @ANYRES64=r3, @ANYRESHEX=r5], 0x0) syz_usb_control_io$uac1(r8, 0x0, &(0x7f0000000580)={0x44, &(0x7f0000000040)=ANY=[@ANYBLOB="2072dc"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 3.055902642s ago: executing program 5 (id=15985): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20044010}, 0x4040) 2.869855497s ago: executing program 5 (id=15986): ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0xffffffffffffffff}}, './file0\x00'}) close(r0) ioctl$UFFDIO_MOVE(r0, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'nr0\x00', 0x0}) r3 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0) write$tcp_congestion(r3, &(0x7f0000000100)='nv\x00', 0x3) ioctl$HIDIOCSFEATURE(r1, 0xc0404806, &(0x7f0000000140)="c85dea5956989c62eee70cd5ad757f62ca0f0195d799e92c55d2a8985927fcced5a195d8e88e42b46afcd2343d522cd0203b1ca1cd46d1e167956621cd34e573c2eb8f6564990140fe0063ce8a4d1b490d26afaca20c529ee61a8b772e") r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), r1) sendmsg$ETHTOOL_MSG_FEATURES_GET(r1, &(0x7f0000000380)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000340)={&(0x7f0000000240)={0xe4, r4, 0x4, 0x70bd2b, 0xe4000, {}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syzkaller0\x00'}]}, @HEADER={0x34, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_team\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bond\x00'}]}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}]}, @HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pim6reg1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @HEADER={0x40, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netpci0\x00'}]}]}, 0xe4}}, 0x81) r5 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f00000003c0), 0x2, 0x0) ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES(r5, 0x80489439, &(0x7f0000000400)) ioctl$SIOCSIFMTU(r1, 0x8922, &(0x7f0000000480)={'\x00', 0x3}) splice(r5, &(0x7f00000004c0)=0x9, r3, &(0x7f0000000500)=0x23d8, 0xc, 0x1) r6 = dup(r3) sendmsg$ETHTOOL_MSG_CHANNELS_GET(r6, &(0x7f00000006c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000680)={&(0x7f0000000580)={0xe4, r4, 0x20, 0x70bd2d, 0x25dfdbff, {}, [@HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}, @HEADER={0x54, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_bridge\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'dummy0\x00'}]}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}]}, @HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_macvtap\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}]}, @HEADER={0x34, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_vlan\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_team\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x8012}, 0x8000) getsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r6, 0x84, 0x8, &(0x7f0000000700), &(0x7f0000000740)=0x4) ioctl$F2FS_IOC_WRITE_CHECKPOINT(r6, 0xf507, 0x0) execveat(r0, &(0x7f0000000780)='./file0\x00', &(0x7f0000000880)={[&(0x7f00000007c0)='nv\x00', &(0x7f0000000800)='\x00', &(0x7f0000000840)='\x00']}, &(0x7f00000009c0)={[&(0x7f00000008c0)='+\x00', &(0x7f0000000900)='[@+\'\x00', &(0x7f0000000940)='pim6reg1\x00', &(0x7f0000000980)='/()]{']}, 0x100) io_uring_register$IORING_UNREGISTER_FILES(r6, 0x3, 0x0, 0x0) llistxattr(&(0x7f0000000a00)='./file0/file0\x00', &(0x7f0000000a40)=""/67, 0x43) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$sock(r7, &(0x7f0000001f00)={&(0x7f0000000ac0)=@in6={0xa, 0x4e20, 0x5, @mcast1, 0x80}, 0x80, &(0x7f0000001e40)=[{&(0x7f0000000b40)="863e4f17286fde675a52e35aa7327e2ee3d6502021a88ed217d36cd7f207820648809066a9628e22bbda60cbec5aa97078ba18095b55138e527a97aae8ed89c991be9feb4614fa79f0a7cc627b78c615ffde2a86910e9460e2441c330889ed8d01ff552ee34c41f262cba3feada8b52282856ad41f1e0a38d92db95d85458cbd3377af310f635fd95048ad830712a9c678c126146ab5996a5e21cbe5901350e55b48a6aeb86f91fc2dc3170505f9383c1f4f4710f89680d5184708a15e8a054400d747e2eef9641c17e260466fc85ef711b6edaa7cb4daa5b3465e475879bcea471440f4bac68c34ed7914457bc51e88dbd1e66b2d42cdb0a8c0029df91ea6989725ef45da44a3b632b62c5ebf621da95f7203fea4cc7e5750c6cf936c4c1cb8263847da407d3339afb3c2d452d246f95dba4ebbe9cc83ea901cea8b18f9deaa6866a4a18eff16adfffbfc0258e845f2b401571d20f7beae68d6ccca263976d013512d7af7938c640cd47d16e7cf65fe4ac9332932bdf42e1ad2d791cdd643b60f795cb1ad79979fe785a6d7925ec462395bc395e5491593ad47a98294c7976ae2f2b62f319021e6bbc556fa35b8fbe4c1b85bd850323c64b31ad4c7a3ec9ddb56353d653344fc8aafa4ab98d5a814d2ea9b1464247f6ff558295161f8f536c9e69417a6b145d1d70838f51d28031237efc1ea4bd7904de910994555e5cb2d680e4efac0891fb5c5c3fa3654e043039ed7da4e8e7b05290667ca5efde95ae22d727f36b13c7424f7cc0b668a95aac2272d3a2f85ab31bc2579f26f7e72b326475d439181806d2fa347614b8503804f70d2100030366541be61fb1cade3dabdcc300419808cfe5e19004c3174fca56759a763714e228666a43778ab6f1e69d5ae7fdb30dd8bc1e0b0087b9dc3eb7647bb702882b707c108e9197f308ec41b285520d8470aa9dfc2053b79aa25fa5bdc96490c78483dc5f1032ad7f95f832246fde316e73e2491249e2f5618816f580e1f61c00a5d833e7dd6b8680231de6166474a99cc23c78359c03e06ad5974a1bcae8a0da9825c4aaf30f9d31d853078e86e80956fa3ba698c7aac289f4a4f1e074cb8555ef35709f5ce0ccb9c94dee58704761fbc3c87df2241e8c811cdc54751f4e45f2ab3651719d73e2b52be035294093c6d2ee94b3766aa9e8d37eb43903c011843aebec44e1dd8634aff45a3aa18e696c255db75d91b73748e5adb0f00831c3f3403be4c0b55aedfd0df9ec1185d8e91ee3db1cc55bf1657f94dfe4265633368cd9619a90fac71cdf306b5bdca21af2215c910b71e6e07e4168188770a0ddc5778f66701688d2bdc0843d05e712cf0e8768670dcca29fdd8a8eee12ee92190c617401afc19bf3e7006e8e557b30e1e99bd72b8d61add655b5e409490a2c49fa20e2fb16ddd170607e88842200b0b9ea1413cda127e316bf550cd523e2c5da927db6ebfd6f7ce409580ef4237ecfa5d81f5ba92385394a473b864713df2b7729f8b84e0bcf7d47a6a392a0ac3fc103889fb06dbf937ef210f33487bc1168983cb27b9067a98207643e3e31db671f94a50130437de7a13e0d29a9ee088a749f0c0e450d0e09edf833ed38b4335f22ef59b76e53f32710222b9455a754884408bc8c074e8e3887a3808c777bfb168adc076fa4e1786d9b2f4d218790a360c3bf4bf2345ff75f8dcd00201c4646334d73ee070f882665f818e780e7d4076c6cad45359c5a9f6426e617683180d4b0498a06cf7f4ccdbdcc9c8b90ecad45c9e6f7f461b757979de04f7e48ced04afb8f7e578ea18d99030e35380b10d839efda155ab1a8a7aa004825b43efaf5175842941c00e1a9251fa95fd97ad025f9a460c5b1e8c533ed1b5294c0d75ea42d3a43a010c6caf4c6415b8138018929eac80ab9b46327d6326a967e8f52db979f4aa8509183bcb74700713cc9fe32e333cbebdb1a0ae075b41d44820ac6e2f7dc510acc0107c21d8b002dfc84c4fa1518a87e61355c5294b564b48414d0c045ec7dc8d7cf8f7aabf1f493319c540b2bb50ee6ac50425b91365a3b1163ed25e1db54ff2d1b615febbd8916c515e5ddcd465e6511672e32e458dbb0e605f57ad3f58d3545bc3900b92ffb558c65bc3815a72ae38006d02109edb874d96bcc0c3889e7e4e9195102b2c97e7e6e90e6515640fbd944f5d6e5219411e5cc05cc4826bf4caed89cb328a6645ca015a0431d0de3a9615f058002816ac113905047f935a12a964a51990442a59ae1a85aa4d097ae59743dc103b1e1c297c1cc0fb095ab3a9b81e4cdd820d90e258145d39c27ff7a55153ace586fba16b3e47a84d8e256620361b3fa75a413fafd579bbd910e06d707d824c4b945dddd0857d4a02765a654e9bc06f0e5ca12382466d58759587c675506059a3b2fe24583fc076fca95e692c4a39bad9085d988d798484b0ddb3e7c5fe3fb2b607e6df59b815ab24eaa012c694dced8c582360b690ddc8a6b9cdf5c3995e1d1c3778ee1b7aee618dd28333c21f6faefbbc1997778e7b20af35cbfa94da720eb4db0fa12573b8e9ead2ca7898e6fb75bf55f1b878c3add4ceda04f932be9f40e391db81a8b42b78de1c3f1be3d23681e74ccc03f376daf314cf54eff98129aac08e09bd095da6fe129852b932dd7cbbc72814af4d0cd09d72088cf9b14b0dc96667fdad9464b3574ce813f57bce9213baff194c9b003cdf5650eec0ac2c9239cbfb9912f4d9218631c353b311aa7f8eb8fae0c1f38898fe63951406e5f93606a18cc0c8ccea2e62852e0f7b70fb5a79946e266e2c6c0c5f592bdc9b27eafbd969e0649e6cd59a31f3df5b78f771be502fd7df96e2398061fbc63c2b99ada732b2b6a37aacfed22ad4aa1894d251165715c7f798374e93b4a2408ed3222de573d4b4d07f3b28a4baf30e52804987ab2923b396e83391c41646c7a7305fe9fd6e58ee9b7e7487240d2c7b195dcd861a62d1ee23db37017a863c5f77b1ca1bd3a483f8eaa78b410c96b4d857f26e4712bebaecbba1a5ef46b46327fc6176c62cda2a194156cda9cc2c61f57481c49ed4d8fbf1cd427796beb8891dc74e8b90bfea14e316c55dd506405fe9aa006a10d2abc91025f2c10f5fccd33b3d384b54878fcad617093e0f499307be48bebe04461389af1da220e14768250525b4cdc4a73f008f1091ac73145aee7f91fdd24329a334aa1f1473e5917342d34dcbf67abd0ae48cb5af1c5f8482d7552b8ac65a1cb68f54d926c01a5747c05c718de532abb90a13ec50d8f8c4905d01a9bb1d5be7be7c314c5df9bfac5597a6f5177f893a62300a93efa0483ce901e6d96dc43bd689c67c4f510f514fcac6f971ddf62ca4379a4adc3e5625630759bf9339d139c9ce609d8f62350762bccb7fd2eccce156c799ca8ee0145dd831872ea09548713ceb301bd2ba197b7e9b0766eea64063dfb86ad77376f6a20f9dd4c838aa21c112a637e0e70a3b37c91a10b3d9a38193bb933ad3cd2f50670d716425f46f15c7104fb7df8564160eadbb9c93b7f909cbcead7b865cb207d438945139faa1835fd8623f19dcac92e9536aabdc3f3e2a647df59fcdbd14ed956bc33696865e7675097604c44ea837b45ee817ec5b1184fd60be434f1da510ef7cdc75cfd8e18940ac3f28308218bce5571ebc3a9cd1a51934509ee0d0b83393f19f35f21fed893ed9693a10a1752921a937b03d11731a6b6e893f6af6fc50e17c2475df8e432e0c83b9ff92e3148ce9d90548e793b567b6ac9e83301dca8adac155cb1e001b73780b797a2fb3c272d9741ef82e5eff7f45e095dacb9946413d88aa1620c3bb2d5ac6b1a68db3aa7770294bfc4b7a02c5f565969e2288724b48ce7df268a647ea94527680f574721e961b719961876a3641a23a68f835530ee23b0eb011157b98dea4ca9f48c8d449c68cc2b118888532424aec4656df3a81992ab25455dca94ffc104705c4c07f234c623ffe74ced1b2fd04d44c1cce8db8804865a660ab1915cb11ea6d60f23d865857a2e29b84a5a5317faccf38c22f8cd140469e4e376e15cfbd69fbbef5449ec507337282bd15684648bdf6efbfbdd5aea4818ddcc8d8cd3721fdde1891b616a7283d81e66d7476dac68ecdebe2bb0c517a3707f2a3b1104e7528cfcf8e178a372f58fcc03680a4aedb3b840d1f530aaec37505d19b223a56cea711291ca99891084fa488febae7d19260fb83cc09cfda78820b90854b3b8fc4c6332e84be79ad0599fdc5557329405bec410fd689d0f7c7a29f39f6cfdc722dd2553bb34fcf8c7d42749eb755df78970ea212bebe775863618be9c2a94744e982cc2d601b724ab33a652df85e3d0a904b1ad3f410e630bec765f3e3e499c34cbcb3d281e59b653ce5f95e5ab4e5e4788c70ca13f912bfeca8dbdd3c08057d94bfc6abe45518df3ceb23dd8c61d393c55c36b9d2e2d90a883ec9f9e0348a71bc4d824598f7723396bc6ee8ed4cd52ef6654dfbbea1a593849e0d5ac7f6b42219efbe4f049ea164703671a3c449cb459f13099f88c1ab7bd6644b1baebfbe7d17154b25824975b4e674b21645b68ea9df0e1107256d8b14b57d2f33cc2dc76b8b91f3de9858f3a9e0c06a9f46ec02e82d47f751f80f983b03d0b7fee0c9ec34bad51cf4d148634416c0d1fe387515bc08089eef81f48d58379463385ae5b0a5293e9c55bc362fa0a460ad05ec889fadda88a4559fab6340c8a6a30c75e3f2908110418f4613a602a25728ec5d1a263bfdb5b5e9258fc7d774ecf60ed9f29389ae17d4399e5cbf9e829dc063636f4a5069da15a5e666ee429190410087db5ee4dacb21f638f52f3c4987b298ca93318f45096951d25178bb993d1c19020318e61863c53f3944f9fc35673991006d2734cfe928817e9070e1ab0e84a812d91888af9ad1ffe32687b2af49e609311606063b0e040be258f8193673507bef12eeb0a6be27a2be3c14b45237649ca742078ef9587dd59aa5aa6de0e7b30d50573b7711fd1785688346c7930091ed7e8577c7703fe33c48dcf726b91b916c2073cbe3631932bb99198695a8dc1d62f341b7420625c1685e8c10a823aff03351281863730eb62913195969dac66bf87f9e244e7cc2201718160a6ea541901fbc3a8d540e53f06838f51c451ae98bae63b86b2a97502a93f715b522000d87830daab334d2360776c058b1a27cf7be3a5ec4e6ee2ff59e15071f25ed04ae7a967d64567e4cf8dbea366eb7b4a0929b76cee7e89173892dd9394b04e6a51144769a05ebbbf395950dd6966faccdceec110ae66cdde5e554a3e1bd300ff17942c73dbc87c353bd549d02548c8ed6a45c3ec8c441e415f4b9e54463cf99525f912c935b65217db8a881743b0a1aa4518b77561b9cda8b1b9c9f4713fe1d2cde1b3fad3d038fdcbc646686bd91de9a6c32d623af1cabf275215728242e3b13d70fe98fbaad43d4f9045ac05135f1698d4e3620541046aa6b60af38ab545d3992c44cc16bd3df2399b6f15f7b5a212e7640c995d1f6955cac43715dc54d54da7e22e694145e956833a5e6c927b55982ad13740cac588ebd768ba721249979491f03341d515467ff7084e429ad21c7442d9ad8b1a3a0543301e2017afd462ca197a17569627096a948c2cb35f9ea86846674a7e5e4555496093a7b73c5d8013c0ece73ed68cb47a907dc8c9910fa7a97a4110d5a6e4ccdccbd0e27ef7b0f25ccf2bd5f42e0ab5a48db34f3293e6005008cf19199ba8f340aa5392612e41db52929fa9e506fa44b755d", 0x1000}, {&(0x7f0000001b40)="cec6ae6613e74d55b3433e9de1c747be7ed7c752ebe721e9115fc36a1918df943dd880727873b72c9748a69b52ce9e006bbf16d91c9b9f8d5bcc2143c2f1c8327f73e85dcb7f43d23832431e07d5fece57a2133cc0e3613c61b55aae8e67dc8be35bf531f7e015284b5764ba2a9b0473dacfd80873e1649c240fcb9c73a09fc17b8d733fb51882d3429fd1291f879dfa331cc609d54c56123ef8afa724691af6974361152d45052ed58c08e7d3dbbae0ea1cea930be981529919288b9d7ffbd4256855f9fa48", 0xc6}, {&(0x7f0000001c40)="57fa3c471de3abbefefe28113a8f72b0ed98c6a8a84596a62fb0b768698c462a711ee375b46d3e2d25051644038b96847683ca9fb310bd8290eb83153a0485bd4d8a31ca01fb3ef6deb727a9da2509dc7697fcf27eca9b4a0dad6bae29afe62af674b724fe5d4363d62be004a4071292b8c65e44d343da0a8563676593f2bb2a36573ce06138dc319ca0c7790a2d80d5c70fff836d5bbc5f353d806f970710590da7d0cfe69000b91e6fcc41e170d0d58e2b5dbf855c55a8cb386657aa01b9ad6bba37fc23d94a15d8c7050401d9eea622c36a", 0xd3}, {&(0x7f0000001d40)="1855544b3d4a9ee12709d3545ceb96c6e043ec1edf3813d9198c6af53c8db9a4e296449f98a680f62eaa27d69f1745a11f6d9eb175fc2f667e8c3b566bc12c4691cd86422bc3e9ec3212052199a8a92243ddd2d14758ded3eeb7c11a66a641ea6628b3a96b8aece970ecd90c8c041b26d69583cdf95288276d5004f6910e569a0c3871755b39b7359455aa43540b196d45ab6fd9a0290d6b9092843e4feb17289ba368d7b8d1953ec1a2c7c26c986ae528f8bfaf8c6203e4626076acb456612707a3df03b3afc65fe0c31465f0c7ca2bda93268728679181196f1c77c0e8af7acdd93991e740f8", 0xe7}], 0x4, &(0x7f0000001e80)=[@mark={{0x14, 0x1, 0x24, 0x8}}, @txtime={{0x18, 0x1, 0x3d, 0x3}}, @txtime={{0x18, 0x1, 0x3d, 0x80000001}}, @mark={{0x14, 0x1, 0x24, 0x5}}], 0x60}, 0x1) r8 = openat(r6, &(0x7f0000001f40)='./file0/file0\x00', 0x341000, 0x20) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000001f80)={0xfffffffa, 0x0}, 0x8) bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000001fc0)=r9, 0x4) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$sock_int(r6, 0x1, 0x20, &(0x7f0000002000), &(0x7f0000002040)=0x4) openat(r8, &(0x7f0000002080)='./file0\x00', 0x529cc0, 0x2) r10 = socket$can_raw(0x1d, 0x3, 0x1) getsockopt$CAN_RAW_FD_FRAMES(r10, 0x65, 0x5, &(0x7f00000020c0), &(0x7f0000002100)=0x4) 2.617152258s ago: executing program 5 (id=15987): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) socket(0xa, 0x5, 0x36) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x0, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_HWPT_SET_DIRTY_TRACKING(r3, 0x3b8b, &(0x7f0000000140)={0x10, 0x2000000}) r4 = syz_open_dev$video(0x0, 0x1d24, 0x23635de98487b93e) r5 = openat$adsp1(0xffffffffffffff9c, &(0x7f00000003c0), 0x2000, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r5, 0xc004500a, &(0x7f0000000000)) ioctl$SNDCTL_DSP_SPEED(r5, 0xc0045002, &(0x7f00000001c0)) ioctl$SNDCTL_DSP_SETFMT(r5, 0xc0045005, &(0x7f0000000580)=0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r7, &(0x7f0000001d00)=[{{&(0x7f00000000c0)=@abs={0x1, 0x0, 0x4e20}, 0x6e, &(0x7f00000006c0)=[{0x0}, {&(0x7f00000004c0)="e7432224dd859ec9b7dbd6e3aac445879d4e04c8597d3202736a105f536f9169073c64682f53656b8800f79f40e24da9c7e3e615ed03e0bdbf2695808e6a4c964065d8eae13a2a635f9b7238feaba0e1d15f2b6814d82e56cda484676e2f6922dafe9a8a559f7c7e522a94abc3cdc10910ed3f4f50cf9e6ee6a2aea26606f7d562ad0f881859b35c19f534acb1887db0fb520d4487fff6c2b8ff806f4dc52e1ef509", 0xa2}, {&(0x7f00000002c0)="d238577f92411fbb7e1b375e170c6776baea17aa460c46faff7e7e19852bbb784647f77b5449421bf7043d6fd555de986c9c8b65b14b15277af57e5b3a31055d53432fcff254d9e9b8b3f33c09421efd88b0403d067083e759ce58fc5bb9", 0x5e}, {0x0}, {&(0x7f0000000900)="49bab2b4434ebf2836755acc47349d4509c1855932edbfc72eeb67d67da5ca72a87c7c353b8ce38e4068eb964bd105ed020ec85de524df2caf6d8714be9c1ba363cdb24ea8ec1deb2c1fd77d6fc4a6e89e8bb7bcdc33be03f451fdda0cf86c583fd3960d7688acea7ee6bd92b1914d196a0b50794267bf930364d70963931dbb67d95b2e6d837e56f49f840c8b10d5a8514ebfc09a5b3622c15034a8328f7c9fc8119a49f33cb88b31c0c964b433bc8e619429431b5f1e01adb989f2b0b6cdfef8b7f4febc5b0d69bb13dd2c1d7323becfd8fbb91cdfee2de4328eec3314550f1904902978762b67dae9db57167dab77bea13040829d35d6e689e043c745bdbcfc172896adc5dc573fd3ae363b3b05932c5494ff50de0850095f34d225ac540fa88d5a79f39b685317a5f0f7b21f390d95cc5902d40443bf652312b0dbd26e53f1cb674690e798493c0ec1f6a628a35708ccfd06b4137504e2cc5fbaca198b89cfb379ba9d9af2e49974e06727a339d23029b4d037d9e7485cb7e568339362ad44d31f29a8983463176bd30672866e1c56f12ffaabebd5a8eaa06251ce9420c3e8a19e8e5f0942d8d164b63aa008f229af5129f3fc4f56aebfdd7151e2642f0f9ba61b2839dd171e811c074f21ceabd7fb6915c63613db9faadbcf5c4754d13bca374eb5a43389353a2a2c8e6bb12eda3bd47dd6706ff17fb01c05d25b54ed81cc9d3a9ddc0d03e622fcb05b3945a1f7ee01757bd9dd94ceac18bd67ea2f780ed64b511db0911b0fc08c478ea17ea9b0c81cd183833f1d081cbd018fd2aa4cb864cb73fd67da6c2b59d107c6b1f4af195d018dd7fdd0e27837ddc3d3017665ed11ba804054733bac7a3c99a7ef675e944a550caca75c6121d0004b5d0df215e14eac5ff05d1b6827b0474d3039388065bc0d30054e87c5e4d19e7f91a38e2ad1e9093fd7e6c8d602c8c21dd215747dbe4f9f5e7bc11d0d362ace3fc3320c6031fc455f9f7ba83ad5957c7023e32f7e991aec205e8ff9701a8358266ae33e8a12b15698834ab56ad03e2ee75a6c1dfd23898af8e911da564b866ed35f1ee750f7ecd51e701329fb233f7980b90618e24f15f5e055fcfb0eb0a0abee611107439aafe20031d7e64650e28944dada0ded48e7d1056efc9fbf00414f797aa2f68ec2b459454af9aea7f7f2f714180c7d210b59950cf59a9cb152b53914cf0c6eb1ac3186983a9cda28224ce613ff0f07099242a6bad11f5dc4450bae0ebf5443760721a4ce004710b079c6c1f7fd7d4700aaaea7af33f4a1dbcd4bc3f72903a78c71302353c0ede6d001f3929526ba47e5329ee70ff3eb5ccdb9cf277ce7eba0fd4c71c85afb15b402a7ab0a3667666cdf905ab116977963f1968c7ae5a4b645ddc36c3a15c8f7c45c8885565f99f0515ae103e050436e1f5e5470a180b5ee8ce0e5c4271957f353b227af3da873671011004915c91ac069d7ba01b1ca621e35277ef5301e1a32141990cda7fb0f2fbdde3f04c5a93745b386f02bb2e68c2fac48b8803587a9a186d5f92b6edee42cd1d0c9973130b5baeb2e5713f7ca706cfafeeea89332e8039e83d34f66954e14ae669faea602711831a9d43a094efd2e8815dfdd94c36a623a6c85d1533daf3dfdf33e24f32752406519cc36c750c9a7caff647622a5160e61cd349e5389a91db2c0ea73bdfa5191cf5f07dfb666979c1f34f7ed1f286467270847f568ce6b4e4a3547a27e74025777d5d2a7f66844597b4e2e3dbaa174b3e28ba1ded9ab1fdd36ab9ad09d3f6350bca82e2605e803271b2344ea43b8370b452226178e73952a6c4a2f8422a3da750089dcf6ef00db80c8410e46a9b544c3fa3e6c3771d4ae929ccf426a168fad14a32f9de9f311de4eb9cf90959c48f3ecaf84c51f130c52a92cd0d242781f9883f8d15b68fecdfccc7dc8bc9fb5a243dfb50e6ed094b1d0894e4914e389e82fe4124e237f3ec7a65558481682aed8da585e828c5d7fe4290b1cd0fcb1e202bf0a223baed54acedfa6cbc0a898693d2101e75c0cc34be05d47c9d658fa821840b3bfb3826eb3229618cf5ff1700bf8972cb9f1aceef2b6769ea6b1769da7f047c12b6c14f6042722afc55256ec707ebc1308f09b939ff3e68b5a26fcd6ecee96158eafd665d603aec66aa8dcbd245e2c4a20be9bc0bc2ba34a0d4dc22cfa37a393d9fef14e93755f3627b9bcf8df1db88e77a734e72c5666485f599cbf5c402fa8b491cae71d158af470603b7c80df8671702bb5f3498d0230a89ad370e6dfb7124b04f4679fc9fbdf8a1194fa5cd012ec362081981071350ddd7d11d268d062acb6700f209bf7cf05b0cd3f4501a41b43fda21cca7a4ef66434974cdb2be61d8dde4fad3e440c13d553d55132398ca446df1b661cb32ffab0769558dac81ff70c2f3e70048dbb4c5746b77fec2c6b1bde369203e9040136447f6e0d98737c10c9d58d2cb53cf0e4feb4858f0a601253822eb13d6733b46520a204764914c3bf212cd42663e4699bb08abf9c1e7b03fcf7e3c34e2aef80216187541b9ab876effcaa289d522753c8c27e043ae1545e9fcb9c20f4591dffc4a96b6f5b3a6ce1752f644a4f2a5071afe2968e975661d1f311335670a4923cf2c19f0a30d9bce32f421a9e51badc4cb41e53ed8517291eebfd35711b83da35f3672aba96b79d3645137512167099ecf1fd4eebc3ba88ad935deb23a781f449896cd5f33855d4afb8bf739b8c10dc599cb034c42de9241ed2cd11a46ec04a96b63fa62618c952d10f9c173b8364eaaffb777933350d7c0bfead1a9e0f04b55e449ba15a9b08d55c4f2d2c591241b1ab578f8c96f0bc704dd56f4b62ebab9a65fc01cfb137720c201c75bddc868835135a31e04b9cdf8735c4a67d3898724342b06486e3b91f36bbb6bcab6532014c8598f0c179c5279350a2a8ed561690089ef26e74f5a2e2d29c20cb37b016f88140ae89fcc25ccbb929f57d20ffdeee1e36fc090993648344f7e681c109bc46a741025c6a7cc85537e92e5000b55f0ee67f97c16b1519804eccb1c4fb26bfaff83a6c1b20e6b275d456c5bdbbaafa43c600345056ebab20fbb85548eeb60ac4967f3efacc1170b8345a2129ea288fd59ddf89444b073513c9dc311ed1060b0e8a467640503a20749a65be45bd99d494d51fbdd9f48b069ddddfb8b41d2abeabfb8563f568e09f9dadf1a04dcf49248c8fa70f8c26d9721ca28edab3bef8a12fb7ad3b50d620e470feb066fc9124f839b830c4d1c7382564ff7f42f3e5ee3d262e909af71b05d0e68a5299ec4fae4f360383c9185fce1138a4a4197836190c5381ed9ca6f404ff03f4261f4e7c751749ade660508d720c708f784a21524763c257b9e687c8a6b2df8741efc9450f33abc7c8a38ab1861680cb27e5d8789e078761ae4215c6a6f76edeee974ee5ef80dcaebce4d88a7b211f574a8629070ad54ab476e2cbdfed410cf1efca889e5e5b9d008941dd04fdea2c9c649c3bc83ce36b2252fddd32d01f5e31b5d9668fed89e5447dada0fbe6f1bdabdf793358d4096d81c71c0bc5b8468f4b713ca4d7c4abb2f585f239e9a135734c66b013e85b5901e62b58435153c2963a755bec582db9ebc66dece176efea36420e4d7e371588e3e9b4a73d05fc46a270fd2c5d92f4f2f284722b3b51b60ea642d97fc64661f000e15b1256ae508a8285791364da21c5a6b87dee6c572b770c23119cdd2a02fe4d5c0718419c295294a6531fc85aeab9a705081d6d6b82c5e99b3dfd9a2f7711803060b9640376adaad16dcfd22e8f2e1025531db70b6889ca0afeb9cffefbe8011c5c46e09ae647db484cc8a629e6f9f480b180ec5e43718604d7718b925aa503df03e6ab5acd522216cab49df1284ac9ebb91469f34b506e2be379d58c4f9c8220b099cd86ad5cc613709d34de5217d06db51872f671d84248a0b92b5ae2894232337fbf4a59596ace6e909a3b7731f7e07070a34b86678c736b932df3633c44323cae3d1c9663849c00540b170baa5e02a68d9cc90c99248128b24987509fee78e868941bf153bc97e3264f106aee80a8f0e7392f206c2c10602dd25d7b517d53f4cdc58c3b9c76bd8a0d2e01233cb67e20d9df79c18e5113e94704b69711e7379fff39733c68503b35294c497fad1403fa78183315af514eeae606ec3be3b0fdc2f911bb0a6b7df02a4d3544164595e87dadd452a757d653936e1aed8da951ad673949921123f8c7f4a1b69ac6066dcb828d9831714d1e49fba32d3cf9afac782ecfda10ebb92f5cc3315ec40d2c4a3f04882348a8cdb4109a9aa53fb49dcc465080f760387dc9311229588ab57f89cb731084bc3486f6cf6baa59d71fe35349de4da2746ae599414cd1221a7d4980c2dfdca9240d530e641534acdf21782b251eb253540f9ce495becc8a0e330394746a2151355165a02347f60eab6a6bd4ac0034388cf2b7a6a16b4d85ff176717eb40d643b47672de840b0945438906256a255ededbc063fe4f4046d9f8a98a955a62db51f081e2ab29bbfb70ae3a7f8e7016502768bd9735cb624fc028b2e19c2dec2e513d33178f8f8c0777374264a29d00be49fda53bfd29735bc805a734ae59cbd4a5cb58fabe36c48ed12dac4636cd85e7910ede1b1e8b19ced2bd6b09d5ff95e5da4399b5c42e1592305aad0e49a785e4230a90831600d840c48b39a81d7ec73cdf3ad1be82a1a29ebcb32fb85e8db21e6b510f569cc183099c8122e8ce0c5d4741eec4d8107cba215e72b6ff69315bac635780d4677f014a13fff6f1e6e13d91a8c42c51e4854fe9276c977536c7f3296caa8fbb330fb3e23286dc614c441ca47fbff37f2a11349841e83c5b9954997ef2d917fb0fded8162150eee708ccf8c227ea74e4e426018ace2a9898027ec3f6f642443e798e500a0bda9cba277f574f8047d5eaa795f834ad3c792f3590fab1bb8dd9a9d41a9dbb089b73f9e2c376df380a8cf74ee670771260168f6b4e580448e133a836f35f11d850dac04a31469d1aa6bd306a09721fba0da01b0698f9a6a1e5af17a6ee7b4ad746a042f6c6545a37ca6166d6a96ff32e51348a5585b710cef05dca857643583982b99d84e11a4a50dc9f2da09764b1459531ce60fcdc38582ca7f435d4ae19e66c9e013f6dba7ef50b2535e50119a78ac79cc338366234f2e142f683f6afa873dcec2141a9d877e6a031858b9fb90cba516930ab2a92bf18eaa58cc076e357b3be31bc1e793143a2002d265f251385f542c91a0c277e4b163786597aa3f38c98012e2d0c6da0142c47a7e561c1855fb67546706628b390dc73ff7b8c13e37e33c4a4911b76663e663100b72edf23e2fe92a19963082154baf86e8a468f2d4a6fbceaace9ce29a9f5cac4dfd1f1efd0c012cf693161816d06d83df2fbcc5832476dee3c48f2c64be3d4fc3fa632f5f3821aaa42e0f7859e58dd055f8f490537f8d686e3e321595ddc26eb1c004a051485e5c9f06a09c9ab592ef7bdb9b965366eb09e07cdf6e2b67cf1e26c224a67de74937ae8a9c552dd89858e3b35be42de32c36fb9410072416ec49fc59725956b5ba3954baff4c843c9f6f7cd460ea8568edc3a383d0972d4adddc3b6097b9842ca6abe9bee7926949b23d495a561702684eb34affb49b8271043896bdfca8c1af9307664f400970cbfbb03dbf415a4b7e592d792b583cd3350d0f2298dc1ac246670203ee5b5f458177e2d0f9607f64532ed7aaa655cca493f2fdd53b14819fb750854ec2aadc51fec39083e", 0x1000}, {&(0x7f0000001b00)="fbaa5ccdf7e888b102b5dbc3e588f400066fc19c24cd43a481d8bd7dd15943edfe8ef6138c0656d6bda9e4d4544600c117970e65f2313c26a23e10ce210f605cde6560a61421b0a7e352175f62c72bd820440ecca59fc79c839b2b08885a9d953e2514d671affd1f8aa8eaec65e5a5b17130664dc53ff9114032cc8e243bda7eceed1440192dc93e182068249765abbfedebbfaa9b341942ca0155d1f88ab8957eae696cfd08a9f81ca0c058b997bf08faed20af6de55d7eaa08523a0c628e72fff7e652b80dcd777dadf0418e7aae215e094ec382bd4842e51ef55db3a071195fe2982c3eb717f8975945a48d35aa8ceb87fb0787d1e4a8e181c6", 0xfb}], 0x6, &(0x7f0000000740)}}, {{0x0, 0x0, &(0x7f0000000800)=[{&(0x7f0000001900)="cd33209c198d76b55750f96c7234ca1352b89a33810ab3d974acb17d26ec90308f779428ab91b6176e1be3734b31d482bb4fc05ae61b6c02efa012ff301cf134c9d775a31eaebc8f0a5a2e205e208e334a159766128057986aafbb50901759cf57b668349c7767ae4a7cafeadda948b64a31e79956ed671de88f6f41ef03b3b704aa23f67598461826de50cae22d9e89c6789117cfbebbe3c1f343f1970912295115c25b8781a12ffb8e77da9d3bbe5ddaf06d589fec6ea717d132f7f9cea38c3101acd6114173a5be889d2204af3b4487008c2f1cf0c2e1ab662e39b4e3caa0331bb8ddac94bb2dda49efa5d010d7bcab", 0xf1}], 0x1, &(0x7f0000001dc0)=ANY=[@ANYBLOB="01000000000000000100000001000000264a0bf4448bd08ae6a71fd0cee3eb7f7f111f6600000000000000bf1c33e2dff449bd3a123b9b8780b3cb37971cd0f01a6ee65cdf310ff24983a4e09e512b3c10edc801eef34521e6fcdfcc8d4bc66c0cb6bbdab23252d07a4ad19f7fe3e6fd379f59c75f7d4d642aa3b4e7f661c0b72ab7a4fc7ebfbf2586c61d6763566b7d266435960796c6e8ccb6a3939635dff55447a2afabd010489cf318", @ANYRES32=r7, @ANYRESHEX=r0, @ANYRESDEC=r5], 0x20, 0x4048080}}, {{0x0, 0x0, &(0x7f0000001c00), 0x0, &(0x7f0000001c80)=ANY=[@ANYBLOB, @ANYRES32, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00010000000200007100"/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000100000000000000001000000010000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES16=r4, @ANYBLOB='\x00\x00\x00\x00'], 0x70, 0x404}}], 0x3, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r8 = syz_io_uring_setup(0x49a, &(0x7f0000000140)={0x0, 0x79b2, 0x3180, 0x1, 0x283}, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r9, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) syz_io_uring_submit(r9, r10, &(0x7f00000001c0)=@IORING_OP_WRITE={0x17, 0x48, 0x4007, @fd_index=0x3, 0x22, 0x0, 0x0, 0x6, 0x1}) io_uring_enter(r8, 0x627, 0x4c1, 0x63, 0x0, 0x0) r11 = timerfd_create(0x0, 0x0) syz_io_uring_setup(0x7670, &(0x7f0000001a00)={0x0, 0xfd55, 0x4000, 0x0, 0x401049, 0x0, r8}, &(0x7f0000000180)=0x0, &(0x7f0000000240)=0x0) r14 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000003005740ed0b0011c3ec000000010902120001000000000904"], 0x0) syz_usb_control_io(r14, 0x0, &(0x7f00000010c0)={0x44, &(0x7f0000000080)=ANY=[@ANYBLOB="00000100000008"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r14, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r14, 0x0, &(0x7f00000018c0)={0x1c, &(0x7f0000001800)={0x10, 0xb, 0x4a, "8eeb906a016ea85ff6d5d45c8b3e92ae2c3f287ca2df9ec3c655dcf71eff826603921928c255362f6c75398b6968f2ad827591a74d4bb98dbef63a567844642b79cb25f96d1dd40637e0"}, 0x0, 0x0}) syz_io_uring_submit(r12, r13, &(0x7f0000000200)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd=r11, 0x0, &(0x7f0000002280)=""/4102, 0x1006, 0x1a}) 2.162958337s ago: executing program 8 (id=15988): r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0) eventfd(0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000240)={0x1f, 0x0, 0x0, 0x322, 0x0, 0x0, 0x0, 0x10000}, 0x0, 0x0) write$P9_RSTATu(r0, &(0x7f00000004c0)={0x293, 0x7d, 0x0, {{0x500, 0xf0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0, 0x1f, ' nodev{cvfox\x92\xff\xff\xff\x81\x02\x00\x00\x00\x00\x001\xff\xce\xbc\x92\x00\x00\x00', 0x38, 'pJ\x86\xce\xc6\x02\x00}\xfag>\xff\xeb\t\xb55\x1f[\xde\x05\xf7\x00\x00\x00\x00\x18{\x82\x00\xb5\x00\x00;Y_\xcb\x14\x03CT\xb9\xfd\x9e\xf1\x96\xa5\x1c\xd5\x15z\xdc\x81\x06\xb4\x94\xe1', 0x12, '\xcf\xc2\x00\x10\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\xf3\x13\xf6\x00', 0x55, '\xf8\xf6i\xfbqm\xcf1^\xca\xf3\x85@\x9a\xc6[\x94\bg\x8c,;\x9e\x1dR\xc3l\xde{\xa4\xa4\x00\xb4\xb0\xb4\xf1t\xa6f\xa8R\x9aE\x1b4\a\xdb\xda\xb2\x88K\xaf\x05\x00\x00\x00\x00\x00\x00\x00G\xec!\xca\xbf\xf2\x0f\x9c\x1c\xbe6\xf4\xfd\x1aL\xc2\x80\xe8\xd4\x89\xdad\x9a7\x00'}, 0x12c, 'odev-n\xb1{#\x00\xf9\xda\xa5\xee#&n\xcf\x85\xfe\xa6^B\xd9y\xa3\xfd\xe5\xf4u\xda\xf0;\x11r\xd9{\xad\xc7\tZ\xfdv\xfeO\x04A\xf7\xf7t\x1e\xac\x03\x00\x00\xec\xff\x00\x00\xdb\xa0\xc2\xf7\xf0\x9f\xf5<~M\x1a\xd6n-\a\x01\x98\x01\x9f0\x11\x84G\xaa\x9at\xf5\x16\x85\xf5\x06\xae\x89H\x06\x87\x82g\xd5\xa1)\x8dy,J7\xf2\xe1\xcb\xbd$\x82\x92\x9a\r\x89r\xb5\xcfs.\xa5\xb0\xd7#\x85\x9d\xba?\x93\xae\xd3\xb4.\xe7\xca\xc0}\xe0\x9d\x1dh\xa6\x033\xa8\x82F}+1\xaa\xcd\xf9\x18\x85I\xb1\x12]lL\x9b\x18\xc2\xfbV\xc5}}\xc6&\xe49\a\x96\xa1\xebH\'Fi\xab\x13\xf8\xb1\x1d\x14`Y\xf3\x10\xe2cMY?\xece\xd5)\xf3\x82\x06fd\xdf$NL\x90W\np\x04\x9f9\x9f\x06\x1fu\xb7y|\xe1\xfe\x11\xea\x91\x96\t\xd5\x1aA\xdd=\xe3\x04\xbd|~\xd0\xa4V\xf0\xae\x12Qa\x05\xc9\xce\x88}\xf5\xa6\xe0\xb6\xa7}Yl\xf8\x8b\xa6\xe5\xc69|}P!\xd7\x98\x95(\xfd\x179\xe1\xc2\xd8\x7f\xff\x00'/300}}, 0x232) 1.927896114s ago: executing program 0 (id=15989): r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SG_IO(r0, 0x2285, 0x0) r1 = syz_io_uring_setup(0x10d, &(0x7f0000000380)={0x0, 0x0, 0x80, 0x0, 0x4000}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a80)=@newsa={0x144, 0x10, 0x713, 0x70bd26, 0x0, {{@in=@rand_addr=0x64010101, @in=@dev={0xac, 0x14, 0x14, 0x13}, 0x4e22, 0x0, 0x4e23, 0x3, 0x2, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {@in6=@remote, 0x0, 0x32}, @in=@multicast1, {0x0, 0x0, 0x9, 0xa, 0x400000000000, 0x0, 0x0, 0x3}, {0x4010, 0x0, 0x2, 0xfffffffffffffff8}, {0xc, 0x0, 0x2}, 0x70bd29, 0x0, 0x2, 0x0, 0x0, 0x28}, [@algo_aead={0x4c, 0x12, {{'rfc4543(gcm(aes))\x00'}, 0x0, 0x80}}, @extra_flags={0x8, 0x18, 0x3}]}, 0x144}, 0x1, 0x0, 0x0, 0x40100c0}, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000440)=0xfffffffc, 0x0, 0x4) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x2, 0x0, 0x0) r5 = syz_open_procfs(0x0, &(0x7f0000000000)='net/fib_trie\x00') mmap$xdp(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x0, 0x11, r5, 0x0) syz_io_uring_submit(r2, r3, &(0x7f00000002c0)=@IORING_OP_SHUTDOWN={0x22, 0x9}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r6 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0xaee2, 0x800, 0xffffffff, 0xbfe00000}, &(0x7f0000000000)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r7, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r7, r8, 0x0) io_uring_enter(r6, 0x47f6, 0x0, 0x2, 0x0, 0x300) io_uring_enter(r1, 0x3516, 0x0, 0x0, 0x0, 0x0) pselect6(0xf0, 0x0, 0x0, 0x0, 0x0, 0x0) 1.088931523s ago: executing program 8 (id=15990): r0 = socket$kcm(0x10, 0x2, 0x0) r1 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000000018105704da0700000000000109022400010000ba00090400000903000000092100000001222200090581033d3503c249526e4f2c7fba4b9529dddbc845d67356ef5923dd0cf479562952dc11a9833524eb186db0b200fcbb7ec159ccd4f01aae848e4db16c1034cdd91f75a6a0930a122bec406d96ecbb6b04907c95bcfd6690a4fab154e6b951540947e64721ae52c898bff84c102c3d8be74d3a2642618941ea5956b1cca50ca763dac8cd8d05"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="00222200000049e9b31ce93ee9070c000000290495b9585dde83000000000b09007a15b3"], 0x0}, 0x0) r2 = syz_usb_connect$rtl8150(0x4, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xbda, 0x8150, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$rtl8150(r2, &(0x7f0000000140)={0x14, &(0x7f0000000040)={0x20, 0x1, 0x49, {0x49, 0xe, "8fee11aa4fc5f48bbed6c9081435fbd390491570479b0aff6d3c53c1e4852078d462529c9ee0fa7a9a37730c2f3a4c3ac9c54077701b4c5f357a3c0224167b5cacd8ae4209832a"}}, &(0x7f00000000c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x42f}}}, &(0x7f0000000540)={0x2c, &(0x7f0000000480)={0x20, 0xb, 0x14, "b6f3faeac29a5039b55e0884ad19d41e3f9d09ff"}, &(0x7f0000000180)={0x0, 0xa, 0x1, 0x6f}, &(0x7f0000000300)={0x0, 0x8, 0x1, 0x9}, &(0x7f0000000400)={0xc0, 0x5, 0x5, "e18a6abd0b"}, &(0x7f0000000500)={0x40, 0x5, 0x2, "7298"}}) syz_open_dev$hidraw(&(0x7f0000002300), 0x0, 0x14e040) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r4, 0x4068aea3, &(0x7f00000001c0)={0x79, 0x0, 0xc73}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000340)={[0x8, 0x1, 0x7, 0x100000000, 0x1, 0x0, 0x2, 0x7, 0x2, 0x0, 0x0, 0x0, 0x20000000007, 0x6, 0x1, 0x5], 0x8000000, 0x8340}) r6 = socket(0x10, 0x803, 0x0) r7 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5ac, 0x324, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x70, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x40}}}}}]}}]}}, 0x0) syz_usb_control_io(r7, 0x0, 0x0) syz_usb_control_io(r7, &(0x7f00000003c0)={0x2c, &(0x7f0000000200)={0x40, 0x11, 0x17, {0x17, 0xe, "8886ae0371f0352caacd696ee74d78209a32cc3c7e"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, r9, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffe0, 0xfff3}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x4, 0x3c}}]}}]}, 0x48}}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000700)={0x0, 0xe4, &(0x7f0000000140)={&(0x7f0000000740)=@newtfilter={0xb0, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r9, {0xf}, {}, {0x7, 0xfff3}}, [@filter_kind_options=@f_u32={{0x8}, {0x7c, 0x2, [@TCA_U32_ACT={0x54, 0x7, [@m_skbedit={0x50, 0x1, 0x0, 0x0, {{0xc}, {0x24, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_PRIORITY={0x8, 0x3, {0xf, 0x3}}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0x9, 0x6, 0x1, 0xd6}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x3}}}}]}, @TCA_U32_SEL={0x24, 0x5, {0xd, 0x7, 0x1, 0x3d3f, 0x0, 0xfff, 0x3, 0x58f, [{0x0, 0x20008000, 0x4, 0x1}]}}]}}, @TCA_RATE={0x6, 0x5, {0x2, 0xe}}]}, 0xb0}}, 0x24040084) ioctl$KVM_RUN(r5, 0xae80, 0x0) sendmsg$kcm(r0, &(0x7f0000000940)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000200)="d8000000100081046881f782db44b904021d080b16000000e8fe55a11800150006001400030000120800040048000000a80016000a0001400d000d00036010fab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a9d7c7c0b7a196e6f66112c88ac417898516277ce06bbace80177ccbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d0080000000000000b57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb14feb9f5588a63644caf1ce1bd6c769ad809d52a9ecbee", 0xd8}], 0x1}, 0x20000814) 923.089034ms ago: executing program 0 (id=15991): mremap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x4000, 0x3, &(0x7f0000005000/0x4000)=nil) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x1, 0x4, &(0x7f0000000100)=ANY=[@ANYBLOB="183f0000000000000000000003000000950000006400000095"], &(0x7f00000003c0)='GPL\x00', 0x1, 0x20, &(0x7f0000001840)=""/4066, 0x0, 0x6, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) 778.150852ms ago: executing program 3 (id=15992): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x20000, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x4, 0xf}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0xc, 0x2, [@TCA_FQ_CODEL_TARGET={0x8, 0x1, 0xa000}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x404c810}, 0x0) r0 = socket(0x10, 0x3, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="700200001300290a000000000000000007000000", @ANYBLOB="000000000000000010010c8013000c800ca3488008000000000000000800038064001d80050006000000000014000500714abbd2547de97cbbf6efb226f19bf90d0002003a288e5e5b5b5a40000000006000078014000400293a02149f3b75a67093c28fd6f55a2314000400e48f01e49713f0c2d839f940d9f088d8050006000000003bd00002006272696467655f736c6176655f30000007000200293a00000500060000000000080001000000000018002580140004004d2906d0880fc8acc30fe2020f9849675000028004000500a1085e7df341b9dc3d8008a2fe5bdaad140004009c7e472c916020fe41bcc5aa8f56c9471400050080ab8be51421cfa3c9e5cbfe8217e0af0800010000000000080001000000000060001a803f0003"], 0x270}, 0x1, 0x0, 0x0, 0x20008014}, 0x4) 731.875859ms ago: executing program 3 (id=15993): socket$inet6_sctp(0xa, 0x1, 0x84) socket(0x10, 0x3, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) write$binfmt_elf64(0xffffffffffffffff, 0x0, 0x78) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/stat\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x49a, &(0x7f00000000c0)={0x0, 0x79af, 0x3180, 0x8000, 0x40024e}, &(0x7f0000000340)=0x0, 0x0) r2 = fcntl$getown(r0, 0x9) ptrace$peekuser(0x3, r2, 0x9) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="200000006800e97800000000ffdbdf250a0000000000000008000500", @ANYRES32=r6, @ANYBLOB="b88079f4db21d0608285953aae4d6214f1a48cac4173f228f25096c39737af06231ebbeb2dc3f3b97c2ba0bbcc1c27425cb150900da0c8c85e168916ce1a093d50f4175029e7dec0657f"], 0x20}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=@newnexthop={0x38, 0x68, 0x1, 0x100003, 0x7ffffffd, {}, [@NHA_GROUP={0xc, 0x2, [{0x1, 0x15}]}, @NHA_RES_GROUP={0xc, 0xc, 0x0, 0x1, [@NHA_RES_GROUP_BUCKETS={0x6, 0x1, 0x3fd4}]}, @NHA_GROUP_TYPE={0x6, 0x3, 0x1}]}, 0x38}, 0x1, 0x0, 0x0, 0x4008018}, 0x4000080) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000003c0)=@newlink={0x20, 0x10, 0x437, 0x0, 0x0, {0x0, 0x0, 0x0, r6, 0x192}}, 0x20}}, 0x0) bind$tipc(0xffffffffffffffff, 0x0, 0x0) 497.330622ms ago: executing program 0 (id=15994): r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000240)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1e7d, 0x2d50, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x5, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x0, 0x33, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0xc, 0x0, 0x7}}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000003c0)={0x2c, &(0x7f0000000100)={0x0, 0x4, 0x57, {0x57, 0x7, "a7ea3163fd3bc518194b120c1e73d54cfc4ad2841ef4f6a3fd7c59ccb785025f2e7b3504ff87cbfd10f3c080b733000000000000000800000000000000ea7a288982d5337c364daf03bd400d66293b0a2b103dd93f"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = bpf$MAP_CREATE(0x0, 0x0, 0x48) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001880)={0x18, 0x10, &(0x7f0000001680)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x8}, {{0x18, 0x1, 0x1, 0x0, r1}}, {}, [@alu={0x4, 0x0, 0x4, 0x9, 0x5, 0x24, 0x10}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000001700)='GPL\x00', 0x8, 0x3, &(0x7f0000001740)=""/3, 0x41100, 0x2c, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001780)={0x3, 0x3}, 0x8, 0x10, &(0x7f00000017c0)={0x0, 0xc, 0x9, 0x3}, 0x10, 0x0, 0x0, 0x7, 0x0, &(0x7f0000001800)=[{0x0, 0x4, 0xd, 0xb}, {0x2, 0x5, 0x7, 0xa}, {0x5, 0x4, 0x1, 0x6}, {0x2, 0x5, 0x7, 0x1}, {0x5, 0x4, 0x0, 0xa}, {0x1, 0x3, 0x5}, {0x4, 0x3, 0xb, 0x4}], 0x10, 0x1000}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000001940)={&(0x7f0000001640)='spi_setup\x00', r2, 0x0, 0xffffffffffffffff}, 0x18) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYRES32=r1], 0x0, 0x0, 0x0, 0x0, 0x41000}, 0x94) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) listen(r3, 0xfffffffc) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) mbind(&(0x7f00000a2000/0x4000)=nil, 0x4000, 0x4002, &(0x7f0000000200)=0x2001000000000004, 0x5, 0x3) connect$inet(r4, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) sendmmsg(r4, &(0x7f00000094c0)=[{{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000300)="eb", 0x1}], 0x1}}], 0x1, 0x80) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000340)={0x1, &(0x7f0000000000)=[{0x6, 0xf, 0x0, 0x7fff8000}]}) close_range(r5, 0xffffffffffffffff, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_GET(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)={0x34, r7, 0x701, 0x0, 0x0, {0x45}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}}, 0x0) r8 = syz_usb_connect(0x2, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100003f3fdc20221802324a130102030109021b0001000010000904cdf100d3"], 0x0) syz_usb_control_io$cdc_ecm(r8, &(0x7f00000002c0)={0x14, &(0x7f0000000180)={0x40, 0x0, 0x72, {0x72, 0xe, "28845b38bfa7b58a52cd054fee0b1c8958c70e04ae31aa3ba82a92e6417da6dcd549c5bfb00a84c4ff1693f3696f1a762d8bdbc82903dd6d6864f2446149be0f3b5b7f18b216e243a6eca09cc10cfef785a94b40dcac509d4972bdd0977732d2aa22603c71782ef479b9aeeb29072b1f"}}, &(0x7f0000000200)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000001600)={0x1c, &(0x7f00000004c0)={0x60, 0x3, 0xf2, "9b4ded4ac9fd5629375e8e670cad8d1e8e6e4d5333f0636f1e1e5749778f895fcfc2e57d0cce298cabd1cc4a1cd8fae41a51cf4f51692a6a5799dbd274e18ba3ef4201ee3dd475b51a586cec52121fb72ea3431e06a5e01e56ea8ae256a0a8e1111845b011caa936b048df394030b1ef7dc73130bb23f545c0b88deb4eeff8fb9c41088fa63c4b89a015bd532998433d0880ccbfe5fcc51423c884b221a6cb1e7e3b312712699443a94c24dd14296b5e0795eb88342eeca1f7f8347242c9ec54711081b0af8b96d0e3667af271ec505807a41683fe9e697140205f95c48520719c6f0d0bc44e3ef988efb1e9802b0bfc8b9b"}, &(0x7f0000000380)={0x0, 0xa, 0x1, 0x7}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0xb}}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x1, 0x4, &(0x7f0000000100)=ANY=[@ANYBLOB="183f0000000000000000000003000000950000000000000095"], &(0x7f00000003c0)='GPL\x00', 0x2, 0x1007, &(0x7f00000005c0)=""/4103, 0x40f00, 0x4, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0xc0) 226.392022ms ago: executing program 3 (id=15995): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="fc0100001900010000000000ffdbdf2520010000000000000000000000000000ffffffff00000000000000000000000000000003000000000a00002008000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001d00000300000000000000000000000000000080000000000000000000000000d90200000000000000000000c06b6e00000000010000000044010500ac14143b000000000000000000000000000004d32b00000000000000ac14148c0000000000000000000000000000000000000100000000000000000000000000fc020000000000000000000000000000000000003200000000000000ac1414aa0000000000000000000000000000000004000000000000000100000000000000fe8000e0000000000000000000000038000000003c000000ad"], 0x1fc}}, 0x0) 138.360246ms ago: executing program 3 (id=15996): r0 = syz_io_uring_setup(0x49a, &(0x7f00000000c0)={0x0, 0x79af, 0x3180, 0x8000, 0x40024e}, &(0x7f0000000340)=0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-serpent-avx2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, 0x0, 0x0) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x2caa6e7e63ab02f3}], 0x1, 0x40800) syz_io_uring_submit(r1, 0x0, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x40, 0x6000, @fd=r3, 0xffffffffffffffff, &(0x7f00000006c0)=""/210, 0xd2, 0x2, 0x1}) io_uring_enter(r0, 0x627, 0x4c1, 0x43, 0x0, 0x30) 5.221488ms ago: executing program 2 (id=15997): syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, &(0x7f0000000440)={0x44, &(0x7f0000000240)=ANY=[@ANYBLOB='@'], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r0 = syz_open_dev$evdev(&(0x7f0000001540), 0x0, 0x0) ioctl$EVIOCGLED(r0, 0x5452, &(0x7f0000000240)=""/77) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000180)={0x57, 0x0, 0x0, {0xfffe, 0x1}, {0x74, 0x2}, @const={0x6, {0x7f, 0x0, 0x8000, 0xfffd}}}) r1 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_MFC(r1, 0x0, 0xcc, &(0x7f0000000140)={@multicast2, @multicast1, 0x0, "aaa517d60f2811d48c8a2cc60c4380bc23b510d442ff13482864280a9c0f4eb5", 0x0, 0x0, 0x0, 0x3}, 0x3c) bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="0c00000004000000040000000c00000004000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000000000000000000000000000000000000000000b8cb2e41622848485627c488396e4186e93aae6033edd1e8dd9d6d5e0692bbd64470bba22551cf0db951fda50833e61b1e6cce9e98d65fe935d670f98e051ff80279a67240937bb655c09a0114a29570f2dc7f9c2d3efcc9cc331863b5003a58d46d531286350b9f3053bd"], 0x48) setsockopt$MRT_ADD_MFC_PROXY(r1, 0x0, 0xd2, &(0x7f0000000040)={@multicast2, @multicast1, 0x2, "4f6fb4d1af0f724e6118ecd4ac1100843af297baebb0efcdf5a284da144a011a", 0x4}, 0x3c) setsockopt$MRT_DEL_MFC_PROXY(r1, 0x0, 0xd3, &(0x7f0000000100)={@multicast2, @multicast1, 0x3, "c6c0e6ec8755b5dc4e305886d95f086707764f8d0e5a0358ea21274f844a69e9", 0x9, 0x200, 0x489c}, 0x3c) r2 = syz_open_dev$evdev(&(0x7f00000000c0), 0x78, 0x822b01) write$char_usb(r2, &(0x7f0000000040)="e2", 0x1068) 0s ago: executing program 3 (id=15998): r0 = syz_usb_connect(0x0, 0x24, &(0x7f00000009c0)={{0x12, 0x1, 0x0, 0x3a, 0x98, 0x2a, 0x8, 0xccd, 0x10a3, 0x23a2, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x57, 0x33, 0x19}}]}}]}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x2}) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18010000000000d00000000080000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000700)={&(0x7f0000000140)='kmem_cache_free\x00', r2}, 0x18) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x14, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000100)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) r5 = socket$igmp6(0xa, 0x3, 0x2) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r5, 0x8983, &(0x7f0000000300)={0x0, 'syzkaller1\x00'}) write$tun(r1, &(0x7f0000000000)={@void, @void, @eth={@remote, @remote, @val={@val={0x88a8, 0x0, 0x0, 0x4}}, {@ipv4={0x800, @generic={{0x5, 0x4, 0x1, 0x26, 0x14, 0x68, 0x0, 0x9, 0x88, 0x0, @private=0xa010101, @initdev={0xac, 0x1e, 0x3, 0x0}}}}}}}, 0x2a) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x10, &(0x7f0000000040)={0x0, 0x2, 0x6, "92afc102df3e"}, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) kernel console output (not intermixed with test programs): , Product=0, SerialNumber=0 [ 3492.438080][T13779] usb 3-1: USB disconnect, device number 84 [ 3492.475950][T25882] usb 6-1: config 0 descriptor?? [ 3492.526799][T25882] usb 6-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 3492.578981][T25882] dvb_usb_af9015 6-1:0.0: probe with driver dvb_usb_af9015 failed with error -22 [ 3492.675050][T22825] usb 4-1: new high-speed USB device number 89 using dummy_hcd [ 3492.683675][T23180] usb 10-1: new high-speed USB device number 51 using dummy_hcd [ 3492.734606][ T5920] usb 6-1: USB disconnect, device number 73 [ 3492.903788][T23180] usb 10-1: Using ep0 maxpacket: 16 [ 3492.916820][T22825] usb 4-1: Using ep0 maxpacket: 16 [ 3492.926565][T22825] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 3492.939663][T23180] usb 10-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 3492.950114][T22825] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 18 [ 3493.002958][T22825] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 3493.004689][T23180] usb 10-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 18 [ 3493.063634][T13779] usb 3-1: new full-speed USB device number 85 using dummy_hcd [ 3493.088073][T22825] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 3493.102251][T23180] usb 10-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 3493.123421][T22825] usb 4-1: SerialNumber: syz [ 3493.138815][T23180] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 3493.164527][T22825] hub 4-1:1.0: bad descriptor, ignoring hub [ 3493.180687][T23180] usb 10-1: SerialNumber: syz [ 3493.193717][T22825] hub 4-1:1.0: probe with driver hub failed with error -5 [ 3493.222017][T23180] hub 10-1:1.0: bad descriptor, ignoring hub [ 3493.250813][T22825] cdc_ether 4-1:1.0: probe with driver cdc_ether failed with error -22 [ 3493.261335][T13779] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 3493.276142][T23180] hub 10-1:1.0: probe with driver hub failed with error -5 [ 3493.320989][T13779] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 127, setting to 64 [ 3493.353791][T23180] cdc_ether 10-1:1.0: probe with driver cdc_ether failed with error -22 [ 3493.413317][T13779] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 3493.461678][T13779] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3493.502925][T28847] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 3493.522169][T28847] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 3493.575551][T13779] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 3493.644108][T24280] Bluetooth: hci3: command 0x0406 tx timeout [ 3493.797467][T13779] usb 3-1: USB disconnect, device number 85 [ 3494.906895][T28871] netlink: 12 bytes leftover after parsing attributes in process `syz.2.15583'. [ 3495.203600][T13779] usb 9-1: new high-speed USB device number 90 using dummy_hcd [ 3495.345821][T23180] usb 10-1: USB disconnect, device number 51 [ 3495.394534][T13779] usb 9-1: Using ep0 maxpacket: 8 [ 3495.455090][T13779] usb 9-1: New USB device found, idVendor=0fe9, idProduct=db01, bcdDevice=e9.9b [ 3495.490954][T13779] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3495.510671][T13779] usb 9-1: Product: syz [ 3495.524163][T13779] usb 9-1: Manufacturer: syz [ 3495.539052][T13779] usb 9-1: SerialNumber: syz [ 3495.575398][T13779] usb 9-1: config 0 descriptor?? [ 3495.606100][T13779] dvb-usb: found a 'DViCO FusionHDTV DVB-T USB (LGZ201)' in warm state. [ 3495.637812][T13779] dvb-usb: bulk message failed: -22 (2/0) [ 3495.668572][T13779] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 3495.710612][T13779] dvbdev: DVB: registering new adapter (DViCO FusionHDTV DVB-T USB (LGZ201)) [ 3495.727015][T28884] syzkaller0: entered promiscuous mode [ 3495.736323][T28884] syzkaller0: entered allmulticast mode [ 3495.746646][T13779] usb 9-1: media controller created [ 3495.760336][T28884] netlink: 8 bytes leftover after parsing attributes in process `syz.9.15588'. [ 3495.769752][ T5920] usb 4-1: USB disconnect, device number 89 [ 3495.800955][T13779] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 3495.817528][T28884] netlink: 8 bytes leftover after parsing attributes in process `syz.9.15588'. [ 3495.919531][T13779] dvb-usb: bulk message failed: -22 (1/0) [ 3496.064603][T28894] netlink: 4 bytes leftover after parsing attributes in process `syz.3.15589'. [ 3496.086466][T13779] DVB: Unable to find symbol mt352_attach() [ 3496.106772][T13779] dvb-usb: no frontend was attached by 'DViCO FusionHDTV DVB-T USB (LGZ201)' [ 3496.136933][T28894] netlink: 4916 bytes leftover after parsing attributes in process `syz.3.15589'. [ 3496.374373][T13779] rc_core: IR keymap rc-dvico-portable not found [ 3496.391042][T13779] Registered IR keymap rc-empty [ 3496.419633][T13779] rc rc0: DViCO FusionHDTV DVB-T USB (LGZ201) as /devices/platform/dummy_hcd.8/usb9/9-1/rc/rc0 [ 3496.435156][T23180] usb 10-1: new high-speed USB device number 52 using dummy_hcd [ 3496.463647][T25882] usb 6-1: new high-speed USB device number 74 using dummy_hcd [ 3496.471495][T13779] input: DViCO FusionHDTV DVB-T USB (LGZ201) as /devices/platform/dummy_hcd.8/usb9/9-1/rc/rc0/input300 [ 3496.490628][T13779] dvb-usb: schedule remote query interval to 100 msecs. [ 3496.504173][T13779] dvb-usb: DViCO FusionHDTV DVB-T USB (LGZ201) successfully initialized and connected. [ 3496.556737][T13779] usb 9-1: USB disconnect, device number 90 [ 3496.624091][T23180] usb 10-1: Using ep0 maxpacket: 32 [ 3496.666742][T13779] dvb-usb: DViCO FusionHDTV DVB-T USB (LGZ201) successfully deinitialized and disconnected. [ 3496.680024][T25882] usb 6-1: config 0 has an invalid interface number: 99 but max is 0 [ 3496.694595][T23180] usb 10-1: New USB device found, idVendor=0582, idProduct=008d, bcdDevice=b8.a2 [ 3496.704109][T25882] usb 6-1: config 0 has no interface number 0 [ 3496.733879][T23180] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3496.747224][T25882] usb 6-1: New USB device found, idVendor=0c72, idProduct=0012, bcdDevice=22.96 [ 3496.762394][T23180] usb 10-1: Product: syz [ 3496.770282][T25882] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3496.780434][T23180] usb 10-1: Manufacturer: syz [ 3496.794369][T23180] usb 10-1: SerialNumber: syz [ 3496.802918][T25882] usb 6-1: Product: syz [ 3496.822302][T25882] usb 6-1: Manufacturer: syz [ 3496.839643][T25882] usb 6-1: SerialNumber: syz [ 3496.846231][T23180] usb 10-1: interface 1 not found [ 3496.864216][T25882] usb 6-1: config 0 descriptor?? [ 3496.925203][T25882] peak_usb 6-1:0.99: probe with driver peak_usb failed with error 99 [ 3497.230648][T28915] netlink: 'syz.8.15595': attribute type 4 has an invalid length. [ 3497.260931][T28922] FAULT_INJECTION: forcing a failure. [ 3497.260931][T28922] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 3497.278651][T28920] netlink: 'syz.8.15595': attribute type 4 has an invalid length. [ 3497.292663][T25882] usb 10-1: USB disconnect, device number 52 [ 3497.309920][T28922] CPU: 1 UID: 0 PID: 28922 Comm: syz.2.15597 Tainted: G L syzkaller #0 PREEMPT(full) [ 3497.309951][T28922] Tainted: [L]=SOFTLOCKUP [ 3497.309959][T28922] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 3497.309970][T28922] Call Trace: [ 3497.309979][T28922] [ 3497.309987][T28922] dump_stack_lvl+0xe8/0x150 [ 3497.310017][T28922] should_fail_ex+0x414/0x560 [ 3497.310051][T28922] _copy_from_user+0x2d/0xb0 [ 3497.310075][T28922] ___sys_sendmsg+0x158/0x2a0 [ 3497.310100][T28922] ? __pfx____sys_sendmsg+0x10/0x10 [ 3497.310150][T28922] ? __fget_files+0x2a/0x420 [ 3497.310171][T28922] ? __fget_files+0x3a0/0x420 [ 3497.310209][T28922] __x64_sys_sendmsg+0x19b/0x260 [ 3497.310234][T28922] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 3497.310264][T28922] ? __pfx_ksys_write+0x10/0x10 [ 3497.310293][T28922] do_syscall_64+0xec/0xf80 [ 3497.310312][T28922] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 3497.310329][T28922] ? trace_irq_disable+0x37/0x100 [ 3497.310353][T28922] ? clear_bhb_loop+0x60/0xb0 [ 3497.310376][T28922] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 3497.310394][T28922] RIP: 0033:0x7fb20758f749 [ 3497.310410][T28922] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 3497.310427][T28922] RSP: 002b:00007fb2083a0038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 3497.310447][T28922] RAX: ffffffffffffffda RBX: 00007fb2077e5fa0 RCX: 00007fb20758f749 [ 3497.310462][T28922] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 3497.310474][T28922] RBP: 00007fb2083a0090 R08: 0000000000000000 R09: 0000000000000000 [ 3497.310487][T28922] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 3497.310499][T28922] R13: 00007fb2077e6038 R14: 00007fb2077e5fa0 R15: 00007fb20790fa28 [ 3497.310530][T28922] [ 3497.783639][T25882] usb 3-1: new high-speed USB device number 86 using dummy_hcd [ 3497.943611][T25882] usb 3-1: Using ep0 maxpacket: 8 [ 3497.968495][T25882] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 3497.980821][T25882] usb 3-1: New USB device found, idVendor=046d, idProduct=0892, bcdDevice=6d.2a [ 3498.009549][T25882] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3498.042247][T25882] usb 3-1: config 0 descriptor?? [ 3498.089167][T25882] gspca_main: vc032x-2.14.0 probing 046d:0892 [ 3498.183663][T13779] usb 4-1: new high-speed USB device number 90 using dummy_hcd [ 3498.343637][T13779] usb 4-1: Using ep0 maxpacket: 16 [ 3498.352899][T13779] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 3498.363712][T13767] usb 10-1: new high-speed USB device number 53 using dummy_hcd [ 3498.396070][T13779] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3498.422620][T13779] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 3498.446215][T13779] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 18 [ 3498.477199][T13779] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 3498.503737][T13779] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 3498.514355][T13767] usb 10-1: Using ep0 maxpacket: 8 [ 3498.522868][T13767] usb 10-1: config 127 has an invalid interface number: 171 but max is 1 [ 3498.536173][T13767] usb 10-1: config 127 has an invalid descriptor of length 0, skipping remainder of the config [ 3498.560328][T13779] usb 4-1: SerialNumber: syz [ 3498.569855][T13767] usb 10-1: config 127 has 1 interface, different from the descriptor's value: 2 [ 3498.601036][T13779] hub 4-1:1.0: bad descriptor, ignoring hub [ 3498.609475][T13767] usb 10-1: config 127 has no interface number 0 [ 3498.619080][T13779] hub 4-1:1.0: probe with driver hub failed with error -5 [ 3498.626603][T13767] usb 10-1: config 127 interface 171 has no altsetting 0 [ 3498.652712][T13779] cdc_ether 4-1:1.0: probe with driver cdc_ether failed with error -22 [ 3498.666565][T13767] usb 10-1: New USB device found, idVendor=04e2, idProduct=1414, bcdDevice=c5.b9 [ 3498.682322][T13767] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3498.704374][T13767] usb 10-1: Product: syz [ 3498.725451][T13767] usb 10-1: Manufacturer: syz [ 3498.746735][T13767] usb 10-1: SerialNumber: syz [ 3499.019714][T13767] usb 10-1: USB disconnect, device number 53 [ 3499.074110][T13779] usb 6-1: USB disconnect, device number 74 [ 3499.663664][T23180] usb 6-1: new high-speed USB device number 75 using dummy_hcd [ 3499.725996][T28941] netlink: 132 bytes leftover after parsing attributes in process `syz.2.15598'. [ 3499.784190][T25882] gspca_vc032x: reg_w err -110 [ 3499.797344][T25882] vc032x 3-1:0.0: probe with driver vc032x failed with error -110 [ 3499.851018][T23180] usb 6-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 3499.896214][T23180] usb 6-1: config 27 interface 0 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 3499.915540][T23180] usb 6-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 0 [ 3499.939070][T23180] usb 6-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 3499.973809][T13779] usb 3-1: USB disconnect, device number 86 [ 3499.997066][T23180] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3500.077918][T23180] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 3500.270856][T23180] snd-usb-audio 6-1:27.0: probe with driver snd-usb-audio failed with error -12 [ 3500.291326][T28940] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3500.317765][T28940] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3500.357942][ T30] audit: type=1326 audit(1767625788.535:3147): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28937 comm="syz.5.15602" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f3da378f749 code=0x0 [ 3500.469698][T28957] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3500.496312][T28957] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3500.533488][T13779] usb 6-1: USB disconnect, device number 75 [ 3500.869303][T23180] usb 4-1: USB disconnect, device number 90 [ 3501.545105][T23180] usb 10-1: new high-speed USB device number 54 using dummy_hcd [ 3501.743688][T23180] usb 10-1: Using ep0 maxpacket: 8 [ 3501.768439][T23180] usb 10-1: config 179 has an invalid interface number: 65 but max is 0 [ 3501.819148][T23180] usb 10-1: config 179 has no interface number 0 [ 3501.846856][T23180] usb 10-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 3501.912647][T23180] usb 10-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 3501.969042][T23180] usb 10-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 3502.025345][T23180] usb 10-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 3502.078940][T23180] usb 10-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 3502.151237][T23180] usb 10-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 3502.196164][T23180] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3502.268783][T28975] raw-gadget.0 gadget.9: fail, usb_ep_enable returned -22 [ 3502.572385][T25882] input: Generic X-Box pad as /devices/platform/dummy_hcd.9/usb10/10-1/10-1:179.65/input/input301 [ 3502.791437][T28998] FAULT_INJECTION: forcing a failure. [ 3502.791437][T28998] name failslab, interval 1, probability 0, space 0, times 0 [ 3502.846119][T25882] usb 10-1: USB disconnect, device number 54 [ 3502.852186][ C0] xpad 10-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 3502.852218][ C0] xpad 10-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 3502.891577][T28998] CPU: 1 UID: 0 PID: 28998 Comm: syz.5.15616 Tainted: G L syzkaller #0 PREEMPT(full) [ 3502.891608][T28998] Tainted: [L]=SOFTLOCKUP [ 3502.891615][T28998] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 3502.891627][T28998] Call Trace: [ 3502.891635][T28998] [ 3502.891644][T28998] dump_stack_lvl+0xe8/0x150 [ 3502.891675][T28998] should_fail_ex+0x414/0x560 [ 3502.891710][T28998] should_failslab+0xa8/0x100 [ 3502.891736][T28998] __kmalloc_noprof+0xdf/0x800 [ 3502.891756][T28998] ? tomoyo_encode+0x28b/0x550 [ 3502.891786][T28998] tomoyo_encode+0x28b/0x550 [ 3502.891817][T28998] tomoyo_realpath_from_path+0x58d/0x5d0 [ 3502.891854][T28998] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 3502.891876][T28998] tomoyo_path_number_perm+0x1e8/0x5a0 [ 3502.891900][T28998] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 3502.891920][T28998] ? __lock_acquire+0x6b6/0x2cf0 [ 3502.891952][T28998] ? __mutex_unlock_slowpath+0x1a1/0x730 [ 3502.891994][T28998] ? __fget_files+0x2a/0x420 [ 3502.892021][T28998] ? __fget_files+0x2a/0x420 [ 3502.892042][T28998] ? __fget_files+0x3a0/0x420 [ 3502.892062][T28998] ? __fget_files+0x2a/0x420 [ 3502.892087][T28998] security_file_ioctl+0xcb/0x2d0 [ 3502.892106][T28998] __se_sys_ioctl+0x47/0x170 [ 3502.892135][T28998] do_syscall_64+0xec/0xf80 [ 3502.892151][T28998] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 3502.892171][T28998] ? trace_irq_disable+0x37/0x100 [ 3502.892190][T28998] ? clear_bhb_loop+0x60/0xb0 [ 3502.892208][T28998] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 3502.892222][T28998] RIP: 0033:0x7f3da378f749 [ 3502.892237][T28998] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 3502.892254][T28998] RSP: 002b:00007f3da4695038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3502.892272][T28998] RAX: ffffffffffffffda RBX: 00007f3da39e5fa0 RCX: 00007f3da378f749 [ 3502.892287][T28998] RDX: 0000200000000040 RSI: 0000000080045519 RDI: 0000000000000003 [ 3502.892299][T28998] RBP: 00007f3da4695090 R08: 0000000000000000 R09: 0000000000000000 [ 3502.892311][T28998] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 3502.892322][T28998] R13: 00007f3da39e6038 R14: 00007f3da39e5fa0 R15: 00007f3da3b0fa28 [ 3502.892353][T28998] [ 3503.145247][T28998] ERROR: Out of memory at tomoyo_realpath_from_path. [ 3503.983677][T13779] usb 4-1: new high-speed USB device number 91 using dummy_hcd [ 3504.174394][T13779] usb 4-1: Using ep0 maxpacket: 16 [ 3504.188821][T13779] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 3504.230091][T13779] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3504.289683][T13779] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 3504.330889][T13779] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 18 [ 3504.401807][T13779] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 3504.411986][T13779] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 3504.440211][T13779] usb 4-1: SerialNumber: syz [ 3504.472644][T13779] hub 4-1:1.0: bad descriptor, ignoring hub [ 3504.496242][T13779] hub 4-1:1.0: probe with driver hub failed with error -5 [ 3504.536407][T13779] cdc_ether 4-1:1.0: probe with driver cdc_ether failed with error -22 [ 3504.893879][T13779] usb 6-1: new high-speed USB device number 76 using dummy_hcd [ 3505.076197][T13779] usb 6-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 3505.114715][T13779] usb 6-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 3505.156525][T13779] usb 6-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 3505.200887][T13779] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3505.245685][T29022] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 3505.299035][T13779] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 3505.529233][T13767] usb 6-1: USB disconnect, device number 76 [ 3505.996098][T29028] netlink: 8 bytes leftover after parsing attributes in process `syz.2.15624'. [ 3506.153252][T29032] netlink: 8 bytes leftover after parsing attributes in process `syz.2.15625'. [ 3506.534288][T29038] FAULT_INJECTION: forcing a failure. [ 3506.534288][T29038] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 3506.587214][T29038] CPU: 1 UID: 0 PID: 29038 Comm: syz.2.15628 Tainted: G L syzkaller #0 PREEMPT(full) [ 3506.587253][T29038] Tainted: [L]=SOFTLOCKUP [ 3506.587261][T29038] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 3506.587274][T29038] Call Trace: [ 3506.587282][T29038] [ 3506.587291][T29038] dump_stack_lvl+0xe8/0x150 [ 3506.587322][T29038] should_fail_ex+0x414/0x560 [ 3506.587357][T29038] _copy_to_user+0x31/0xb0 [ 3506.587383][T29038] simple_read_from_buffer+0xe1/0x170 [ 3506.587412][T29038] proc_fail_nth_read+0x1b3/0x220 [ 3506.587436][T29038] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 3506.587460][T29038] ? rw_verify_area+0x2a6/0x4d0 [ 3506.587488][T29038] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 3506.587511][T29038] vfs_read+0x200/0xa30 [ 3506.587528][T29038] ? fdget_pos+0x247/0x320 [ 3506.587556][T29038] ? __pfx___mutex_lock+0x10/0x10 [ 3506.587578][T29038] ? __pfx_vfs_read+0x10/0x10 [ 3506.587598][T29038] ? __fget_files+0x2a/0x420 [ 3506.587623][T29038] ? __fget_files+0x3a0/0x420 [ 3506.587647][T29038] ? __fget_files+0x2a/0x420 [ 3506.587675][T29038] ksys_read+0x145/0x250 [ 3506.587690][T29038] ? __fget_files+0x3a0/0x420 [ 3506.587715][T29038] ? __pfx_ksys_read+0x10/0x10 [ 3506.587732][T29038] ? __pfx_usbdev_ioctl+0x10/0x10 [ 3506.587769][T29038] do_syscall_64+0xec/0xf80 [ 3506.587790][T29038] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 3506.587809][T29038] ? trace_irq_disable+0x37/0x100 [ 3506.587834][T29038] ? clear_bhb_loop+0x60/0xb0 [ 3506.587857][T29038] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 3506.587877][T29038] RIP: 0033:0x7fb20758e15c [ 3506.587894][T29038] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 3506.587910][T29038] RSP: 002b:00007fb2083a0030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 3506.587930][T29038] RAX: ffffffffffffffda RBX: 00007fb2077e5fa0 RCX: 00007fb20758e15c [ 3506.587945][T29038] RDX: 000000000000000f RSI: 00007fb2083a00a0 RDI: 0000000000000004 [ 3506.587958][T29038] RBP: 00007fb2083a0090 R08: 0000000000000000 R09: 0000000000000000 [ 3506.587971][T29038] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 3506.587982][T29038] R13: 00007fb2077e6038 R14: 00007fb2077e5fa0 R15: 00007fb20790fa28 [ 3506.588014][T29038] [ 3507.125169][T29040] FAULT_INJECTION: forcing a failure. [ 3507.125169][T29040] name failslab, interval 1, probability 0, space 0, times 0 [ 3507.142943][T29040] CPU: 0 UID: 0 PID: 29040 Comm: syz.2.15630 Tainted: G L syzkaller #0 PREEMPT(full) [ 3507.142965][T29040] Tainted: [L]=SOFTLOCKUP [ 3507.142969][T29040] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 3507.142976][T29040] Call Trace: [ 3507.142981][T29040] [ 3507.142986][T29040] dump_stack_lvl+0xe8/0x150 [ 3507.143005][T29040] should_fail_ex+0x414/0x560 [ 3507.143025][T29040] should_failslab+0xa8/0x100 [ 3507.143040][T29040] __kmalloc_cache_noprof+0x84/0x700 [ 3507.143051][T29040] ? ip_set_pernet+0x23/0x240 [ 3507.143062][T29040] ? ip_set_pernet+0x23/0x240 [ 3507.143071][T29040] ? ip_set_create+0x348/0x19c0 [ 3507.143085][T29040] ip_set_create+0x348/0x19c0 [ 3507.143098][T29040] ? rcu_is_watching+0x15/0xb0 [ 3507.143116][T29040] ? __pfx_ip_set_create+0x10/0x10 [ 3507.143144][T29040] nfnetlink_rcv_msg+0xb4d/0x1130 [ 3507.143157][T29040] ? __lock_acquire+0x6b6/0x2cf0 [ 3507.143167][T29040] ? nfnetlink_rcv_msg+0x20d/0x1130 [ 3507.143188][T29040] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 3507.143217][T29040] ? __lock_acquire+0x6b6/0x2cf0 [ 3507.143236][T29040] netlink_rcv_skb+0x208/0x470 [ 3507.143250][T29040] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 3507.143263][T29040] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 3507.143281][T29040] ? bpf_lsm_capable+0x9/0x20 [ 3507.143294][T29040] ? security_capable+0x7e/0x2e0 [ 3507.143310][T29040] nfnetlink_rcv+0x282/0x2590 [ 3507.143323][T29040] ? is_bpf_text_address+0x26/0x2b0 [ 3507.143342][T29040] ? __kernel_text_address+0xd/0x40 [ 3507.143357][T29040] ? unwind_get_return_address+0x4d/0x90 [ 3507.143369][T29040] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 3507.143386][T29040] ? arch_stack_walk+0xfc/0x150 [ 3507.143402][T29040] ? __lock_acquire+0x6b6/0x2cf0 [ 3507.143414][T29040] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 3507.143426][T29040] ? stack_depot_save_flags+0x33/0x810 [ 3507.143443][T29040] ? __lock_acquire+0x6b6/0x2cf0 [ 3507.143457][T29040] ? __lock_acquire+0x6b6/0x2cf0 [ 3507.143472][T29040] ? __netlink_lookup+0xbd/0x8a0 [ 3507.143496][T29040] ? netlink_deliver_tap+0x2e/0x1b0 [ 3507.143519][T29040] ? netlink_deliver_tap+0x2e/0x1b0 [ 3507.143543][T29040] ? netlink_deliver_tap+0x2e/0x1b0 [ 3507.143571][T29040] netlink_unicast+0x82f/0x9e0 [ 3507.143600][T29040] ? __pfx_netlink_unicast+0x10/0x10 [ 3507.143618][T29040] ? __alloc_skb+0x198/0x3a0 [ 3507.143638][T29040] ? netlink_sendmsg+0x642/0xb30 [ 3507.143661][T29040] ? skb_put+0x11b/0x210 [ 3507.143684][T29040] netlink_sendmsg+0x805/0xb30 [ 3507.143716][T29040] ? __pfx_netlink_sendmsg+0x10/0x10 [ 3507.143744][T29040] ? aa_sock_msg_perm+0xf1/0x1b0 [ 3507.143768][T29040] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 3507.143778][T29040] ? __pfx_netlink_sendmsg+0x10/0x10 [ 3507.143791][T29040] __sock_sendmsg+0x21c/0x270 [ 3507.143808][T29040] ____sys_sendmsg+0x505/0x820 [ 3507.143824][T29040] ? __pfx_____sys_sendmsg+0x10/0x10 [ 3507.143840][T29040] ? import_iovec+0x74/0xa0 [ 3507.143855][T29040] ___sys_sendmsg+0x21f/0x2a0 [ 3507.143868][T29040] ? __pfx____sys_sendmsg+0x10/0x10 [ 3507.143897][T29040] ? __fget_files+0x2a/0x420 [ 3507.143910][T29040] ? __fget_files+0x3a0/0x420 [ 3507.143927][T29040] __x64_sys_sendmsg+0x19b/0x260 [ 3507.143941][T29040] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 3507.143958][T29040] ? __pfx_ksys_write+0x10/0x10 [ 3507.143974][T29040] do_syscall_64+0xec/0xf80 [ 3507.143985][T29040] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 3507.143994][T29040] ? trace_irq_disable+0x37/0x100 [ 3507.144008][T29040] ? clear_bhb_loop+0x60/0xb0 [ 3507.144020][T29040] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 3507.144030][T29040] RIP: 0033:0x7fb20758f749 [ 3507.144041][T29040] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 3507.144050][T29040] RSP: 002b:00007fb2083a0038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 3507.144063][T29040] RAX: ffffffffffffffda RBX: 00007fb2077e5fa0 RCX: 00007fb20758f749 [ 3507.144071][T29040] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 3507.144077][T29040] RBP: 00007fb2083a0090 R08: 0000000000000000 R09: 0000000000000000 [ 3507.144084][T29040] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 3507.144090][T29040] R13: 00007fb2077e6038 R14: 00007fb2077e5fa0 R15: 00007fb20790fa28 [ 3507.144107][T29040] [ 3507.866406][T13779] usb 4-1: USB disconnect, device number 91 [ 3508.215244][T29065] netlink: 'syz.3.15640': attribute type 2 has an invalid length. [ 3508.503702][T25882] usb 9-1: new high-speed USB device number 91 using dummy_hcd [ 3508.696311][T25882] usb 9-1: Using ep0 maxpacket: 32 [ 3508.713197][T25882] usb 9-1: config index 0 descriptor too short (expected 29220, got 36) [ 3508.749427][T25882] usb 9-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 3508.785325][T25882] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 3508.813316][T25882] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 3508.853486][T25882] usb 9-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 3508.889780][T25882] usb 9-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 3508.947340][T25882] usb 9-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 3508.971801][T25882] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3509.021448][T25882] usb 9-1: config 0 descriptor?? [ 3509.279702][T25882] usblp 9-1:0.0: usblp0: USB Bidirectional printer dev 91 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 3509.407204][T25882] usb 9-1: USB disconnect, device number 91 [ 3509.466449][T25882] usblp0: removed [ 3509.806838][ T3493] bridge_slave_1: left allmulticast mode [ 3509.844203][T25882] usb 9-1: new high-speed USB device number 92 using dummy_hcd [ 3509.851841][ T3493] bridge_slave_1: left promiscuous mode [ 3509.879939][ T3493] bridge0: port 2(bridge_slave_1) entered disabled state [ 3509.901010][T24280] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 3509.917189][T24280] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 3509.932397][T24280] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 3509.945990][T24280] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 3509.958367][T24280] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 3509.972017][ T3493] bridge_slave_0: left allmulticast mode [ 3510.042596][ T3493] bridge_slave_0: left promiscuous mode [ 3510.069839][ T3493] bridge0: port 1(bridge_slave_0) entered disabled state [ 3510.093626][T25882] usb 9-1: Using ep0 maxpacket: 32 [ 3510.106821][T25882] usb 9-1: config index 0 descriptor too short (expected 29220, got 36) [ 3510.155844][T25882] usb 9-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 3510.208283][T25882] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 3510.241867][T25882] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 3510.286180][T29090] netlink: 4 bytes leftover after parsing attributes in process `syz.2.15648'. [ 3510.303638][T13767] usb 4-1: new high-speed USB device number 92 using dummy_hcd [ 3510.340494][T25882] usb 9-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 3510.386156][T25882] usb 9-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 3510.442205][T25882] usb 9-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 3510.501923][T25882] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3510.511113][T13767] usb 4-1: Using ep0 maxpacket: 16 [ 3510.535825][T13767] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 3510.559049][T25882] usb 9-1: config 0 descriptor?? [ 3510.594584][T13767] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3510.798825][T13767] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 3510.811056][T25882] usblp 9-1:0.0: usblp0: USB Bidirectional printer dev 92 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 3510.927273][T13767] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 18 [ 3511.037904][T13767] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 3511.093435][T13767] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 3511.145632][T13767] usb 4-1: SerialNumber: syz [ 3511.236575][ T5920] usb 9-1: USB disconnect, device number 92 [ 3511.254627][ T5920] usblp0: removed [ 3511.330827][T13767] hub 4-1:1.0: bad descriptor, ignoring hub [ 3511.371698][T13767] hub 4-1:1.0: probe with driver hub failed with error -5 [ 3511.437010][T13767] cdc_ether 4-1:1.0: probe with driver cdc_ether failed with error -22 [ 3512.037048][T24280] Bluetooth: hci0: command tx timeout [ 3512.052069][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 3512.071234][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 3512.783975][ T5920] usb 4-1: USB disconnect, device number 92 [ 3512.865744][ T3493] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 3512.876981][ T3493] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 3512.887325][ T3493] bond0 (unregistering): Released all slaves [ 3513.388123][ T3493] bond1 (unregistering): Released all slaves [ 3513.614831][ T3493] bond2 (unregistering): Released all slaves [ 3514.127284][T24280] Bluetooth: hci0: command tx timeout [ 3514.740088][ T3493] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 3514.788005][T23191] usb 9-1: new high-speed USB device number 93 using dummy_hcd [ 3514.798973][ T3493] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 3514.921891][ T3493] team0 (unregistering): Port device batadv1 removed [ 3514.964032][T23191] usb 9-1: Using ep0 maxpacket: 16 [ 3515.024389][T23191] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3515.054273][T23191] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 3515.079039][T23191] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 3515.129469][T23191] usb 9-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 3515.189432][T23191] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3515.261023][T23191] usb 9-1: config 0 descriptor?? [ 3515.779123][T23191] microsoft 0003:045E:07DA.0174: unknown main item tag 0x0 [ 3515.814561][T23191] microsoft 0003:045E:07DA.0174: unknown main item tag 0x0 [ 3515.853438][T23191] microsoft 0003:045E:07DA.0174: unknown main item tag 0x0 [ 3515.934336][T23191] microsoft 0003:045E:07DA.0174: unknown main item tag 0x0 [ 3515.982052][T23191] microsoft 0003:045E:07DA.0174: unknown main item tag 0x0 [ 3516.046894][T23191] microsoft 0003:045E:07DA.0174: unknown main item tag 0x0 [ 3516.065442][T23191] microsoft 0003:045E:07DA.0174: unknown main item tag 0x0 [ 3516.104337][T23191] microsoft 0003:045E:07DA.0174: unknown main item tag 0x0 [ 3516.112050][T23191] microsoft 0003:045E:07DA.0174: unknown main item tag 0x0 [ 3516.155097][T23191] microsoft 0003:045E:07DA.0174: unknown main item tag 0x0 [ 3516.193757][T24280] Bluetooth: hci0: command tx timeout [ 3516.231011][T23191] input: HID 045e:07da as /devices/platform/dummy_hcd.8/usb9/9-1/9-1:0.0/0003:045E:07DA.0174/input/input302 [ 3516.402454][T23191] microsoft 0003:045E:07DA.0174: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.8-1/input0 [ 3516.483698][T23180] usb 3-1: new high-speed USB device number 87 using dummy_hcd [ 3516.653622][T23180] usb 3-1: Using ep0 maxpacket: 16 [ 3516.673083][T23180] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 3516.711835][T23180] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3516.741827][T23180] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 18 [ 3516.812976][T23180] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 3516.846904][T23180] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 3516.856011][T23180] usb 3-1: SerialNumber: syz [ 3516.990981][T23180] hub 3-1:1.0: bad descriptor, ignoring hub [ 3517.037575][T23180] hub 3-1:1.0: probe with driver hub failed with error -5 [ 3517.088335][T23180] cdc_ether 3-1:1.0: probe with driver cdc_ether failed with error -22 [ 3517.507324][T25882] usb 9-1: reset high-speed USB device number 93 using dummy_hcd [ 3517.993747][T25882] usb 9-1: device descriptor read/64, error -71 [ 3518.105453][ T3493] team0 (unregistering): Port device team_slave_1 removed [ 3518.176128][ T3493] team0 (unregistering): Port device team_slave_0 removed [ 3518.253691][T25882] usb 9-1: reset high-speed USB device number 93 using dummy_hcd [ 3518.262611][T25882] usb 9-1: device reset changed ep0 maxpacket size! [ 3518.273406][T23180] usb 9-1: USB disconnect, device number 93 [ 3518.286844][T24280] Bluetooth: hci0: command tx timeout [ 3518.473756][T23180] usb 9-1: new high-speed USB device number 94 using dummy_hcd [ 3518.628920][T23180] usb 9-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 3518.638348][T23180] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3518.646973][T23180] usb 9-1: Product: syz [ 3518.651304][T23180] usb 9-1: Manufacturer: syz [ 3518.656620][T23180] usb 9-1: SerialNumber: syz [ 3518.676195][T23180] usb 9-1: config 0 descriptor?? [ 3518.690335][T23180] i2c-tiny-usb 9-1:0.0: version 6d.cc found at bus 009 address 094 [ 3518.921163][T23180] (null): failure reading functionality [ 3518.947343][T23180] i2c i2c-3: failure reading functionality [ 3518.979795][T23180] i2c i2c-3: connected i2c-tiny-usb device [ 3519.000381][T23180] usb 9-1: USB disconnect, device number 94 [ 3519.564580][ T5920] usb 9-1: new high-speed USB device number 95 using dummy_hcd [ 3519.599425][T29087] chnl_net:caif_netlink_parms(): no params data found [ 3519.627435][T23180] usb 6-1: new high-speed USB device number 77 using dummy_hcd [ 3519.715638][ T5920] usb 9-1: Using ep0 maxpacket: 8 [ 3519.722521][ T5920] usb 9-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 3519.739815][ T5920] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 3519.758819][ T5920] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 3519.772030][ T5920] usb 9-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 3519.785582][ T5920] usb 9-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 3519.795484][ T5920] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3519.835066][T23180] usb 6-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 3519.859829][T23180] usb 6-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 3519.882142][T23180] usb 6-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 3519.902274][T23180] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3519.926570][T29199] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 3520.005641][T23180] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 3520.010294][ T5920] usb 9-1: GET_CAPABILITIES returned 0 [ 3520.018475][ T5920] usbtmc 9-1:16.0: can't read capabilities [ 3520.131682][T29087] bridge0: port 1(bridge_slave_0) entered blocking state [ 3520.168076][T29087] bridge0: port 1(bridge_slave_0) entered disabled state [ 3520.191083][T29087] bridge_slave_0: entered allmulticast mode [ 3520.217566][T23180] usb 6-1: USB disconnect, device number 77 [ 3520.232160][T29087] bridge_slave_0: entered promiscuous mode [ 3520.270915][T29087] bridge0: port 2(bridge_slave_1) entered blocking state [ 3520.311398][T29087] bridge0: port 2(bridge_slave_1) entered disabled state [ 3520.334648][T29087] bridge_slave_1: entered allmulticast mode [ 3520.355845][T29087] bridge_slave_1: entered promiscuous mode [ 3520.366639][T13767] usb 3-1: USB disconnect, device number 87 [ 3520.507182][T29087] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 3520.528303][T29087] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 3520.599453][T29087] team0: Port device team_slave_0 added [ 3520.611699][T29087] team0: Port device team_slave_1 added [ 3520.678101][T29087] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 3520.690494][T29087] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 3520.690528][T29087] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 3520.693422][T29087] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 3520.758454][T29087] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 3520.785996][T29087] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 3520.814084][ T5920] usb 6-1: new high-speed USB device number 78 using dummy_hcd [ 3520.883994][T23180] usb 3-1: new full-speed USB device number 88 using dummy_hcd [ 3520.895673][T29087] hsr_slave_0: entered promiscuous mode [ 3520.904880][T29087] hsr_slave_1: entered promiscuous mode [ 3520.916779][T29087] debugfs: 'hsr0' already exists in 'hsr' [ 3520.929195][T29087] Cannot create hsr debugfs directory [ 3520.976306][ T5920] usb 6-1: Using ep0 maxpacket: 16 [ 3520.986213][ T5920] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3521.002789][ T5920] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 3521.037314][T23180] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 3521.045804][ T5920] usb 6-1: New USB device found, idVendor=1770, idProduct=ff00, bcdDevice= 0.00 [ 3521.063685][T23180] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 3521.076877][T23180] usb 3-1: New USB device found, idVendor=22b8, idProduct=6027, bcdDevice=b7.44 [ 3521.091859][ T5920] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3521.100897][T23180] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3521.128329][T23180] usb 3-1: Product: syz [ 3521.141508][ T5920] usb 6-1: config 0 descriptor?? [ 3521.143542][T23180] usb 3-1: Manufacturer: syz [ 3521.173127][T23180] usb 3-1: SerialNumber: syz [ 3521.202990][T23180] usb 3-1: config 0 descriptor?? [ 3521.479114][ T30] audit: type=1326 audit(1767625809.655:3148): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29227 comm="syz.2.15670" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fb20758f749 code=0x0 [ 3521.603074][T29242] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3521.644848][ T5920] usbhid 6-1:0.0: can't add hid device: -71 [ 3521.657625][T29242] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3521.686412][ T5920] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 3521.764946][ T5920] usb 6-1: USB disconnect, device number 78 [ 3521.803012][T29087] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 3522.005732][T29087] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 3522.019277][T29247] netlink: 'syz.3.15671': attribute type 4 has an invalid length. [ 3522.030934][T29247] netlink: 'syz.3.15671': attribute type 1 has an invalid length. [ 3522.133220][T29087] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 3522.254370][T29087] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 3522.340862][ T5920] usb 9-1: USB disconnect, device number 95 [ 3522.769655][T29087] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 3522.808841][T29087] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 3522.861333][T29087] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 3522.901084][T29087] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 3523.525565][T29087] 8021q: adding VLAN 0 to HW filter on device bond0 [ 3523.672325][T29087] 8021q: adding VLAN 0 to HW filter on device team0 [ 3523.692541][T23180] usb 3-1: USB disconnect, device number 88 [ 3523.796096][T19375] bridge0: port 1(bridge_slave_0) entered blocking state [ 3523.803312][T19375] bridge0: port 1(bridge_slave_0) entered forwarding state [ 3524.126956][T18508] bridge0: port 2(bridge_slave_1) entered blocking state [ 3524.134129][T18508] bridge0: port 2(bridge_slave_1) entered forwarding state [ 3524.164293][T29087] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 3524.181835][T29087] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 3524.300404][T29087] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 3524.479720][T29087] veth0_vlan: entered promiscuous mode [ 3524.495640][T23176] usb 9-1: new high-speed USB device number 96 using dummy_hcd [ 3524.529504][T29087] veth1_vlan: entered promiscuous mode [ 3524.608014][T29087] veth0_macvtap: entered promiscuous mode [ 3524.640566][T29087] veth1_macvtap: entered promiscuous mode [ 3524.719438][T29087] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 3524.733638][T23176] usb 9-1: Using ep0 maxpacket: 16 [ 3524.758023][T23176] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 3524.780938][T29087] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 3524.828992][T19375] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 3524.844993][T23176] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3524.866675][T19375] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 3524.887322][T19371] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 3524.968405][T19371] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 3524.987821][T23176] usb 9-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 18 [ 3525.244955][T23176] usb 9-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 3525.302455][T23176] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 3525.386651][T23176] usb 9-1: SerialNumber: syz [ 3525.450151][T23176] hub 9-1:1.0: bad descriptor, ignoring hub [ 3525.488137][T23176] hub 9-1:1.0: probe with driver hub failed with error -5 [ 3525.538509][T19378] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 3525.556055][T23176] cdc_ether 9-1:1.0: probe with driver cdc_ether failed with error -22 [ 3525.593163][T19378] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 3525.757925][T18508] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 3525.808201][T18508] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 3526.349129][T29310] netlink: 84 bytes leftover after parsing attributes in process `syz.3.15684'. [ 3526.548517][T23176] usb 6-1: new high-speed USB device number 79 using dummy_hcd [ 3526.697555][T29321] 8021q: VLANs not supported on gre0 [ 3526.713898][T23176] usb 6-1: Using ep0 maxpacket: 8 [ 3526.734971][T23176] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3526.785568][T23176] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 3526.838071][T23176] usb 6-1: config 0 interface 0 has no altsetting 0 [ 3526.907194][T23176] usb 6-1: New USB device found, idVendor=3923, idProduct=0371, bcdDevice=2d.a1 [ 3526.959608][T23176] usb 6-1: New USB device strings: Mfr=252, Product=111, SerialNumber=0 [ 3527.034589][T23176] usb 6-1: Product: syz [ 3527.063087][T23176] usb 6-1: Manufacturer: syz [ 3527.098639][T23176] usb 6-1: config 0 descriptor?? [ 3527.144851][T13767] usb 9-1: USB disconnect, device number 96 [ 3527.273632][T23183] usb 3-1: new high-speed USB device number 89 using dummy_hcd [ 3527.443751][T23183] usb 3-1: Using ep0 maxpacket: 16 [ 3527.456474][T23183] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3527.482065][T23183] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 3527.483718][T13767] usb 9-1: new full-speed USB device number 97 using dummy_hcd [ 3527.509842][T23183] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 3527.533222][T23183] usb 3-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 3527.557041][T23176] hid-generic 0003:3923:0371.0175: unbalanced collection at end of report description [ 3527.568332][T23183] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3527.585377][T23176] hid-generic 0003:3923:0371.0175: probe with driver hid-generic failed with error -22 [ 3527.599421][T29336] netlink: 'syz.5.15683': attribute type 4 has an invalid length. [ 3527.616139][T23183] usb 3-1: config 0 descriptor?? [ 3527.663731][T13767] usb 9-1: device descriptor read/64, error -71 [ 3527.866756][T29338] bridge0: port 2(bridge_slave_1) entered disabled state [ 3527.874598][T29338] bridge0: port 1(bridge_slave_0) entered disabled state [ 3527.915761][T13767] usb 9-1: new full-speed USB device number 98 using dummy_hcd [ 3528.073696][T13767] usb 9-1: device descriptor read/64, error -71 [ 3528.178312][T29338] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 3528.194417][T23183] input: HID 0955:7214 Haptics as /devices/virtual/input/input303 [ 3528.208456][T13767] usb usb9-port1: attempt power cycle [ 3528.267352][T29338] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 3528.310370][T23183] shield 0003:0955:7214.0176: Registered Thunderstrike controller [ 3528.334407][T23183] shield 0003:0955:7214.0176: : USB HID v0.00 Device [HID 0955:7214] on usb-dummy_hcd.2-1/input0 [ 3528.370561][T29350] random: crng reseeded on system resumption [ 3528.594338][T13767] usb 9-1: new full-speed USB device number 99 using dummy_hcd [ 3528.655855][T13767] usb 9-1: device descriptor read/8, error -71 [ 3528.891982][T13779] shield 0003:0955:7214.0176: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO [ 3528.892292][T23180] usb 3-1: USB disconnect, device number 89 [ 3528.911140][T18508] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 3528.923942][T13767] usb 9-1: new full-speed USB device number 100 using dummy_hcd [ 3528.962599][T13779] shield 0003:0955:7214.0176: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 3528.965758][T13767] usb 9-1: device descriptor read/8, error -71 [ 3529.020970][T13779] shield 0003:0955:7214.0176: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 3529.073864][T13779] shield 0003:0955:7214.0176: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 3529.088672][T18508] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 3529.112190][T18508] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 3529.133955][T13767] usb usb9-port1: unable to enumerate USB device [ 3529.159866][T18508] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 3529.293196][T13779] usb 6-1: USB disconnect, device number 79 [ 3529.773687][T23180] usb 3-1: new high-speed USB device number 90 using dummy_hcd [ 3529.803665][T13767] usb 4-1: new high-speed USB device number 93 using dummy_hcd [ 3529.843668][T13779] usb 6-1: new high-speed USB device number 80 using dummy_hcd [ 3529.923642][T23180] usb 3-1: Using ep0 maxpacket: 32 [ 3529.931281][T23180] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3529.942811][T23180] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 3529.953977][T13767] usb 4-1: Using ep0 maxpacket: 8 [ 3529.971192][T13767] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 3529.982115][T23180] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 3529.998392][T13767] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 3530.013624][T23180] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3530.023810][T13779] usb 6-1: Using ep0 maxpacket: 8 [ 3530.037520][T13767] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 3530.050854][T23180] usb 3-1: config 0 descriptor?? [ 3530.068764][T13779] usb 6-1: config 0 has no interfaces? [ 3530.069284][T13767] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 3530.080872][T13779] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 3530.088146][T23180] hub 3-1:0.0: USB hub found [ 3530.116235][T13767] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 3530.117887][T29364] 8021q: VLANs not supported on gre0 [ 3530.130816][T13767] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 3530.135435][T13779] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3530.144957][T13767] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3530.166468][T13779] usb 6-1: Product: syz [ 3530.176437][T13779] usb 6-1: Manufacturer: syz [ 3530.186666][T13779] usb 6-1: SerialNumber: syz [ 3530.203001][T13779] usb 6-1: config 0 descriptor?? [ 3530.300804][T23180] hub 3-1:0.0: 1 port detected [ 3530.374258][T13767] usb 4-1: GET_CAPABILITIES returned 0 [ 3530.379826][T13767] usbtmc 4-1:16.0: can't read capabilities [ 3530.572765][T29360] picdev_write: 12 callbacks suppressed [ 3530.572778][T29360] kvm: pic: non byte write [ 3530.607393][T29360] kvm: pic: non byte write [ 3530.637082][T29360] kvm: pic: non byte write [ 3530.655584][T29360] kvm: pic: single mode not supported [ 3530.660271][T13779] usb 6-1: USB disconnect, device number 80 [ 3530.672471][T29360] kvm: pic: non byte write [ 3530.684112][T29360] kvm: pic: non byte write [ 3530.717411][T29360] kvm: pic: non byte write [ 3530.733103][T29360] kvm: pic: non byte write [ 3530.747091][T29360] kvm: pic: non byte write [ 3530.760264][T29360] kvm: pic: non byte write [ 3530.773469][T29360] kvm: pic: non byte write [ 3530.833815][ T5920] usb 9-1: new high-speed USB device number 101 using dummy_hcd [ 3531.013625][ T5920] usb 9-1: Using ep0 maxpacket: 16 [ 3531.025931][ T5920] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 3531.046833][ T5920] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3531.070476][ T5920] usb 9-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 18 [ 3531.101470][ T5920] usb 9-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 3531.117314][ T5920] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 3531.133843][ T5920] usb 9-1: SerialNumber: syz [ 3531.164487][ T5920] hub 9-1:1.0: bad descriptor, ignoring hub [ 3531.173677][ T5920] hub 9-1:1.0: probe with driver hub failed with error -5 [ 3531.197228][ T5920] cdc_ether 9-1:1.0: probe with driver cdc_ether failed with error -22 [ 3531.342959][T23180] hub 3-1:0.0: hub_hub_status failed (err = -32) [ 3531.367212][T23180] hub 3-1:0.0: config failed, can't get hub status (err -32) [ 3531.414472][T23180] usbhid 3-1:0.0: can't add hid device: -32 [ 3531.414626][T23180] usbhid 3-1:0.0: probe with driver usbhid failed with error -32 [ 3532.685407][T23183] usb 3-1: USB disconnect, device number 90 [ 3533.476925][T13767] usb 9-1: USB disconnect, device number 101 [ 3533.504868][T23183] usb 4-1: USB disconnect, device number 93 [ 3533.677342][T29436] TCP: tcp_parse_options: Illegal window scaling value 150 > 14 received [ 3534.003847][T23183] usb 9-1: new high-speed USB device number 102 using dummy_hcd [ 3534.203960][T23183] usb 9-1: device descriptor read/64, error -71 [ 3534.453680][T23183] usb 9-1: new high-speed USB device number 103 using dummy_hcd [ 3534.634501][T23183] usb 9-1: device descriptor read/64, error -71 [ 3534.756713][T23183] usb usb9-port1: attempt power cycle [ 3535.113739][T23183] usb 9-1: new high-speed USB device number 104 using dummy_hcd [ 3535.205414][T23183] usb 9-1: device descriptor read/8, error -71 [ 3535.272370][T29469] netlink: 'syz.5.15713': attribute type 10 has an invalid length. [ 3535.338411][T29469] bond9: (slave netdevsim0): Releasing backup interface [ 3535.473638][T23183] usb 9-1: new high-speed USB device number 105 using dummy_hcd [ 3535.550139][T23183] usb 9-1: device descriptor read/8, error -71 [ 3535.685146][T23183] usb usb9-port1: unable to enumerate USB device [ 3536.198027][T29481] fuse: Unknown parameter 'ro$0mode' [ 3537.041027][T23183] usb 4-1: new high-speed USB device number 94 using dummy_hcd [ 3537.284223][T23183] usb 4-1: Using ep0 maxpacket: 16 [ 3537.312164][T23183] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 3537.360713][T23183] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3537.400911][T23183] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 18 [ 3537.432807][T29528] hub 9-0:1.0: USB hub found [ 3537.454836][T29528] hub 9-0:1.0: 1 port detected [ 3537.467979][T23183] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 3537.494557][T23183] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 3537.541528][T23183] usb 4-1: SerialNumber: syz [ 3537.579192][T23183] hub 4-1:1.0: bad descriptor, ignoring hub [ 3537.631146][T23183] hub 4-1:1.0: probe with driver hub failed with error -5 [ 3537.665749][T23183] cdc_ether 4-1:1.0: probe with driver cdc_ether failed with error -22 [ 3539.574297][T25882] usb 4-1: USB disconnect, device number 94 [ 3539.636651][T29559] program syz.2.15732 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 3539.936593][T25882] usb 3-1: new high-speed USB device number 91 using dummy_hcd [ 3539.978440][T29570] netlink: 'syz.0.15737': attribute type 10 has an invalid length. [ 3539.994514][T29570] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 3540.010999][T29570] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 3540.100587][T25882] usb 3-1: unable to get BOS descriptor or descriptor too short [ 3540.113684][T23183] usb 4-1: new high-speed USB device number 95 using dummy_hcd [ 3540.132099][T25882] usb 3-1: config 3 has an invalid interface number: 19 but max is 0 [ 3540.141459][T25882] usb 3-1: config 3 has an invalid interface number: 4 but max is 0 [ 3540.152121][T25882] usb 3-1: config 3 has 2 interfaces, different from the descriptor's value: 1 [ 3540.182267][T25882] usb 3-1: config 3 has no interface number 0 [ 3540.200536][T25882] usb 3-1: config 3 has no interface number 1 [ 3540.224184][T25882] usb 3-1: config 3 interface 19 altsetting 9 endpoint 0x6 has invalid maxpacket 1040, setting to 64 [ 3540.282978][T25882] usb 3-1: config 3 interface 19 altsetting 9 has 2 endpoint descriptors, different from the interface descriptor's value: 4 [ 3540.296384][T23183] usb 4-1: Using ep0 maxpacket: 32 [ 3540.317034][T23183] usb 4-1: config 9 has an invalid interface number: 223 but max is 3 [ 3540.325434][T23183] usb 4-1: config 9 has an invalid interface number: 143 but max is 3 [ 3540.326798][T25882] usb 3-1: too many endpoints for config 3 interface 4 altsetting 131: 175, using maximum allowed: 30 [ 3540.359353][T23183] usb 4-1: config 9 has an invalid interface number: 203 but max is 3 [ 3540.377540][T23183] usb 4-1: config 9 has an invalid interface number: 74 but max is 3 [ 3540.380602][T25882] usb 3-1: config 3 interface 4 altsetting 131 bulk endpoint 0x8E has invalid maxpacket 32 [ 3540.403719][T25882] usb 3-1: config 3 interface 4 altsetting 131 endpoint 0xC has invalid wMaxPacketSize 0 [ 3540.413990][T25882] usb 3-1: config 3 interface 4 altsetting 131 bulk endpoint 0xC has invalid maxpacket 0 [ 3540.424027][T25882] usb 3-1: config 3 interface 4 altsetting 131 has 2 endpoint descriptors, different from the interface descriptor's value: 175 [ 3540.448553][T25882] usb 3-1: config 3 interface 19 has no altsetting 0 [ 3540.475021][T25882] usb 3-1: config 3 interface 4 has no altsetting 0 [ 3540.482154][T23183] usb 4-1: config 9 contains an unexpected descriptor of type 0x2, skipping [ 3540.514368][T25882] usb 3-1: New USB device found, idVendor=067b, idProduct=2303, bcdDevice=13.f5 [ 3540.546518][T23183] usb 4-1: config 9 contains an unexpected descriptor of type 0x1, skipping [ 3540.568945][T23183] usb 4-1: config 9 has no interface number 0 [ 3540.571988][T25882] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3540.583859][T25882] usb 3-1: Product: syz [ 3540.588808][T25882] usb 3-1: Manufacturer: syz [ 3540.595032][T25882] usb 3-1: SerialNumber: syz [ 3540.606571][T23183] usb 4-1: config 9 has no interface number 1 [ 3540.620473][T23183] usb 4-1: config 9 has no interface number 2 [ 3540.627882][T23183] usb 4-1: config 9 has no interface number 3 [ 3540.636415][T23183] usb 4-1: config 9 interface 223 altsetting 56 endpoint 0x9 has invalid maxpacket 512, setting to 64 [ 3540.649848][T23183] usb 4-1: config 9 interface 223 altsetting 56 bulk endpoint 0xD has invalid maxpacket 8 [ 3540.692277][T23183] usb 4-1: config 9 interface 223 altsetting 56 endpoint 0xA has invalid maxpacket 1024, setting to 64 [ 3540.707292][T23183] usb 4-1: config 9 interface 223 altsetting 56 has a duplicate endpoint with address 0xF, skipping [ 3540.733200][T23183] usb 4-1: config 9 interface 223 altsetting 56 has a duplicate endpoint with address 0xA, skipping [ 3540.747508][T23183] usb 4-1: config 9 interface 223 altsetting 56 endpoint 0xE has an invalid bInterval 127, changing to 10 [ 3540.770675][T23183] usb 4-1: config 9 interface 143 altsetting 9 has a duplicate endpoint with address 0x9, skipping [ 3540.790818][T23183] usb 4-1: config 9 interface 143 altsetting 9 has an endpoint descriptor with address 0x14, changing to 0x4 [ 3540.810187][T23183] usb 4-1: config 9 interface 143 altsetting 9 endpoint 0x4 has an invalid bInterval 166, changing to 11 [ 3540.823970][T23183] usb 4-1: config 9 interface 143 altsetting 9 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 3540.850678][T23183] usb 4-1: config 9 interface 203 altsetting 6 has a duplicate endpoint with address 0x9, skipping [ 3540.866344][T23183] usb 4-1: config 9 interface 203 altsetting 6 endpoint 0x7 has invalid maxpacket 512, setting to 64 [ 3540.880280][T23183] usb 4-1: config 9 interface 203 altsetting 6 has a duplicate endpoint with address 0xF, skipping [ 3540.896682][T23183] usb 4-1: config 9 interface 203 altsetting 6 has a duplicate endpoint with address 0x7, skipping [ 3540.916572][T23183] usb 4-1: config 9 interface 203 altsetting 6 has a duplicate endpoint with address 0x2, skipping [ 3540.928098][T23183] usb 4-1: config 9 interface 203 altsetting 6 has a duplicate endpoint with address 0x4, skipping [ 3540.961662][T23183] usb 4-1: config 9 interface 74 altsetting 127 has a duplicate endpoint with address 0xE, skipping [ 3540.973367][ T5920] usb 9-1: new high-speed USB device number 106 using dummy_hcd [ 3540.987714][T23183] usb 4-1: config 9 interface 74 altsetting 127 has an invalid descriptor for endpoint zero, skipping [ 3540.999829][T23183] usb 4-1: config 9 interface 74 altsetting 127 has a duplicate endpoint with address 0x7, skipping [ 3541.040621][T23183] usb 4-1: config 9 interface 74 altsetting 127 has a duplicate endpoint with address 0x5, skipping [ 3541.052485][T23183] usb 4-1: config 9 interface 74 altsetting 127 has a duplicate endpoint with address 0x5, skipping [ 3541.065543][T23183] usb 4-1: config 9 interface 74 altsetting 127 has a duplicate endpoint with address 0xB, skipping [ 3541.076862][T23183] usb 4-1: config 9 interface 74 altsetting 127 has an invalid descriptor for endpoint zero, skipping [ 3541.089172][T23183] usb 4-1: config 9 interface 74 altsetting 127 has a duplicate endpoint with address 0x9, skipping [ 3541.101234][T23183] usb 4-1: config 9 interface 74 altsetting 127 has a duplicate endpoint with address 0xD, skipping [ 3541.126589][T23183] usb 4-1: config 9 interface 223 has no altsetting 0 [ 3541.135402][T23183] usb 4-1: config 9 interface 143 has no altsetting 0 [ 3541.142299][T23183] usb 4-1: config 9 interface 203 has no altsetting 0 [ 3541.149347][ T5920] usb 9-1: Using ep0 maxpacket: 8 [ 3541.162590][ T5920] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 7 [ 3541.178172][ T5920] usb 9-1: New USB device found, idVendor=082d, idProduct=0100, bcdDevice=70.4b [ 3541.198740][T23183] usb 4-1: config 9 interface 74 has no altsetting 0 [ 3541.205924][ T5920] usb 9-1: New USB device strings: Mfr=44, Product=2, SerialNumber=3 [ 3541.215869][ T5920] usb 9-1: Product: syz [ 3541.223108][T23183] usb 4-1: New USB device found, idVendor=0bda, idProduct=c82e, bcdDevice=de.97 [ 3541.233684][T23183] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3541.241727][ T5920] usb 9-1: Manufacturer: syz [ 3541.247461][ T5920] usb 9-1: SerialNumber: syz [ 3541.254021][T23183] usb 4-1: Product: Н [ 3541.259603][T23183] usb 4-1: Manufacturer: 埂禒囧앬濫찢腤뉦穟믎﷞⨉䥴햢㜛軵嫯⛸ᯮﱷ獔퍕틀릙蔨ῖ糪ﳒ٧ꕚ㧵녅錘檶츘ঋﰀ呎杞踺㠾ֈ䥲熑䅌﹑겘䙉䘏㻛ⱔ⋫ꤝፐ핝몼魽벴콸찜쐷뿙껨 [ 3541.302661][T23183] usb 4-1: SerialNumber: Ќ [ 3541.349724][T23183] usb 4-1: rejected 1 configuration due to insufficient available bus power [ 3541.371042][T25882] pl2303 3-1:3.19: required endpoints missing [ 3541.393857][T23183] usb 4-1: no configuration chosen from 1 choice [ 3541.446300][T25882] pl2303 3-1:3.4: required interrupt-in endpoint missing [ 3541.505572][ T5920] usb 9-1: Invalid connection information received from device [ 3541.555130][T25882] usb 3-1: USB disconnect, device number 91 [ 3541.711131][ T5920] usb 9-1: USB disconnect, device number 106 [ 3541.737911][T23189] usb 6-1: new high-speed USB device number 81 using dummy_hcd [ 3541.923602][T23189] usb 6-1: Using ep0 maxpacket: 16 [ 3541.937039][T23189] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 3541.979936][T23189] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3542.012735][T23189] usb 6-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 18 [ 3542.061239][T23189] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 3542.099374][T23189] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 3542.118913][T23189] usb 6-1: SerialNumber: syz [ 3542.133090][T29596] xt_hashlimit: size too large, truncated to 1048576 [ 3542.149059][T23189] hub 6-1:1.0: bad descriptor, ignoring hub [ 3542.188020][T23189] hub 6-1:1.0: probe with driver hub failed with error -5 [ 3542.224134][T23189] cdc_ether 6-1:1.0: probe with driver cdc_ether failed with error -22 [ 3542.488955][T29609] netlink: 'syz.2.15750': attribute type 12 has an invalid length. [ 3542.498474][T29609] netlink: 'syz.2.15750': attribute type 29 has an invalid length. [ 3542.516330][T29609] netlink: 148 bytes leftover after parsing attributes in process `syz.2.15750'. [ 3542.642293][T29613] sch_tbf: burst 9 is lower than device syzkaller0 mtu (1500) ! [ 3542.686813][T23189] usb 9-1: new high-speed USB device number 107 using dummy_hcd [ 3542.717903][T29614] netlink: 8 bytes leftover after parsing attributes in process `syz.0.15748'. [ 3542.857081][T23180] usb 4-1: USB disconnect, device number 95 [ 3542.874012][T23189] usb 9-1: Using ep0 maxpacket: 32 [ 3542.894363][T23189] usb 9-1: config 0 has an invalid interface number: 133 but max is 0 [ 3542.915726][T23189] usb 9-1: config 0 has an invalid descriptor of length 36, skipping remainder of the config [ 3542.971601][T23189] usb 9-1: config 0 has no interface number 0 [ 3543.016284][T23189] usb 9-1: config 0 interface 133 altsetting 0 bulk endpoint 0xB has invalid maxpacket 1024 [ 3543.039955][T23189] usb 9-1: config 0 interface 133 altsetting 0 endpoint 0xF has invalid maxpacket 43520, setting to 1024 [ 3543.092497][T23189] usb 9-1: config 0 interface 133 altsetting 0 bulk endpoint 0xF has invalid maxpacket 1024 [ 3543.144341][T23189] usb 9-1: config 0 interface 133 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 3543.253452][T23189] usb 9-1: New USB device found, idVendor=0424, idProduct=012c, bcdDevice=71.1e [ 3543.279696][T23189] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3543.336208][T23189] usb 9-1: Product: syz [ 3543.360952][T23189] usb 9-1: Manufacturer: syz [ 3543.373764][T23189] usb 9-1: SerialNumber: syz [ 3543.404025][T23189] usb 9-1: config 0 descriptor?? [ 3543.448901][T29606] raw-gadget.2 gadget.8: fail, usb_ep_enable returned -22 [ 3543.805660][T29628] netlink: 'syz.8.15749': attribute type 7 has an invalid length. [ 3543.821211][T29628] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3543.870004][T29628] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3544.571467][T29635] netlink: 28 bytes leftover after parsing attributes in process `syz.2.15755'. [ 3544.611529][T29635] netlink: 28 bytes leftover after parsing attributes in process `syz.2.15755'. [ 3545.174021][T23180] usb 6-1: USB disconnect, device number 81 [ 3545.213200][T29646] netlink: 'syz.3.15761': attribute type 12 has an invalid length. [ 3545.237436][T29646] netlink: 'syz.3.15761': attribute type 29 has an invalid length. [ 3545.252382][T29646] netlink: 148 bytes leftover after parsing attributes in process `syz.3.15761'. [ 3545.542673][T29655] kAFS: unable to lookup cell '({^@' [ 3545.933617][ T5920] usb 3-1: new full-speed USB device number 92 using dummy_hcd [ 3546.093640][ T5920] usb 3-1: device descriptor read/64, error -71 [ 3546.142186][T23189] usb 9-1: probing VID:PID(0424:012C) [ 3546.151587][T23189] usb 9-1: vub300 testing BULK OUT EndPoint(0) 0B [ 3546.193108][T23189] usb 9-1: vub300 testing BULK OUT EndPoint(1) 0F [ 3546.246005][T23189] usb 9-1: Could not find two sets of bulk-in/out endpoint pairs [ 3546.291042][T23189] vub300 9-1:0.133: probe with driver vub300 failed with error -22 [ 3546.351727][T23189] usb 9-1: USB disconnect, device number 107 [ 3546.363600][ T5920] usb 3-1: new full-speed USB device number 93 using dummy_hcd [ 3546.524225][ T5920] usb 3-1: device descriptor read/64, error -71 [ 3546.538628][T29664] netlink: 'syz.8.15767': attribute type 1 has an invalid length. [ 3546.583427][T29664] 8021q: adding VLAN 0 to HW filter on device bond13 [ 3546.618685][T29664] bond13: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 3546.666180][ T5920] usb usb3-port1: attempt power cycle [ 3546.733158][T29664] 8021q: adding VLAN 0 to HW filter on device bond14 [ 3546.752915][T29664] bond13: (slave bond14): Enslaving as an active interface with a down link [ 3546.879100][T29670] veth0_to_hsr: entered promiscuous mode [ 3546.905368][T29670] bond0: (slave veth0_to_hsr): Enslaving as an active interface with an up link [ 3547.033857][ T5920] usb 3-1: new full-speed USB device number 94 using dummy_hcd [ 3547.076184][ T5920] usb 3-1: device descriptor read/8, error -71 [ 3547.324664][ T5920] usb 3-1: new full-speed USB device number 95 using dummy_hcd [ 3547.369160][ T5920] usb 3-1: device descriptor read/8, error -71 [ 3547.495987][ T5920] usb usb3-port1: unable to enumerate USB device [ 3547.615866][T23183] usb 6-1: new high-speed USB device number 82 using dummy_hcd [ 3547.796647][T23183] usb 6-1: Using ep0 maxpacket: 16 [ 3547.831905][T23183] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 3547.861946][T23183] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3547.916823][T23183] usb 6-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 18 [ 3547.985641][T23183] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 3548.016008][T23183] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 3548.075803][T23183] usb 6-1: SerialNumber: syz [ 3548.126168][T23183] hub 6-1:1.0: bad descriptor, ignoring hub [ 3548.151442][T23183] hub 6-1:1.0: probe with driver hub failed with error -5 [ 3548.184237][T23183] cdc_ether 6-1:1.0: probe with driver cdc_ether failed with error -22 [ 3548.343623][T23180] usb 4-1: new high-speed USB device number 96 using dummy_hcd [ 3548.498455][T23180] usb 4-1: device descriptor read/64, error -71 [ 3548.784527][T23180] usb 4-1: new high-speed USB device number 97 using dummy_hcd [ 3548.953954][T23180] usb 4-1: device descriptor read/64, error -71 [ 3549.084352][T23180] usb usb4-port1: attempt power cycle [ 3549.453737][T23180] usb 4-1: new high-speed USB device number 98 using dummy_hcd [ 3549.487542][T23180] usb 4-1: device descriptor read/8, error -71 [ 3549.743632][T23180] usb 4-1: new high-speed USB device number 99 using dummy_hcd [ 3549.774108][T23180] usb 4-1: device descriptor read/8, error -71 [ 3549.893970][T23180] usb usb4-port1: unable to enumerate USB device [ 3550.168757][T23180] usb 6-1: USB disconnect, device number 82 [ 3550.356783][T29721] netlink: 4 bytes leftover after parsing attributes in process `syz.5.15782'. [ 3550.369070][T29721] openvswitch: netlink: Flow actions attr not present in new flow. [ 3550.393685][T23180] usb 9-1: new high-speed USB device number 108 using dummy_hcd [ 3550.547647][T23180] usb 9-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 3550.557046][T23180] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3550.565187][T23180] usb 9-1: Product: syz [ 3550.569570][T23180] usb 9-1: Manufacturer: syz [ 3550.574226][T23180] usb 9-1: SerialNumber: syz [ 3550.587349][T23180] usb 9-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 3550.614117][T23189] usb 6-1: new high-speed USB device number 83 using dummy_hcd [ 3550.645143][T25882] usb 9-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 3550.774111][T23189] usb 6-1: Using ep0 maxpacket: 8 [ 3550.782316][T23189] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 3550.795087][T23189] usb 6-1: New USB device found, idVendor=084e, idProduct=1001, bcdDevice=ed.ae [ 3550.805141][T23189] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3550.813174][T23189] usb 6-1: Product: syz [ 3550.818082][T23189] usb 6-1: Manufacturer: syz [ 3550.822702][T23189] usb 6-1: SerialNumber: syz [ 3550.831298][T23189] usb 6-1: config 0 descriptor?? [ 3550.872595][T23183] usb 9-1: USB disconnect, device number 108 [ 3551.039489][T29720] netlink: 4 bytes leftover after parsing attributes in process `syz.5.15782'. [ 3551.393269][T29720] fuse: Unknown parameter '000000000000000000000x000000000000000a' [ 3551.715639][T25882] ath9k_htc 9-1:1.0: ath9k_htc: Target is unresponsive [ 3551.738763][T25882] ath9k_htc: Failed to initialize the device [ 3551.761631][T23183] usb 9-1: ath9k_htc: USB layer deinitialized [ 3552.508089][T29745] netlink: 4 bytes leftover after parsing attributes in process `syz.2.15787'. [ 3552.632590][T29747] netlink: 40 bytes leftover after parsing attributes in process `syz.2.15787'. [ 3553.053706][T25882] usb 9-1: new high-speed USB device number 109 using dummy_hcd [ 3553.243800][T25882] usb 9-1: Using ep0 maxpacket: 32 [ 3553.266282][T25882] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3553.299803][T25882] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 3553.329363][T25882] usb 9-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 3553.345295][T23183] usb 4-1: new high-speed USB device number 100 using dummy_hcd [ 3553.373778][T25882] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3553.386463][ T5920] usb 6-1: USB disconnect, device number 83 [ 3553.455552][T25882] usb 9-1: config 0 descriptor?? [ 3553.512174][T25882] hub 9-1:0.0: USB hub found [ 3553.523805][T23183] usb 4-1: Using ep0 maxpacket: 16 [ 3553.542212][T23183] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 3553.575729][T23183] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3553.598750][T23183] usb 4-1: config 1 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 3553.622536][T23183] usb 4-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 3553.652546][T23183] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 3553.679975][T23183] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 3553.693541][T23183] usb 4-1: SerialNumber: syz [ 3553.714461][T25882] hub 9-1:0.0: 1 port detected [ 3553.715651][T23183] hub 4-1:1.0: bad descriptor, ignoring hub [ 3553.733688][T23183] hub 4-1:1.0: probe with driver hub failed with error -5 [ 3553.752765][T23183] cdc_ether 4-1:1.0: probe with driver cdc_ether failed with error -22 [ 3553.853588][ T5920] usb 6-1: new high-speed USB device number 84 using dummy_hcd [ 3553.965760][T29751] picdev_write: 2 callbacks suppressed [ 3553.965771][T29751] kvm: pic: non byte write [ 3553.989309][T29751] kvm: pic: single mode not supported [ 3553.989407][T29751] kvm: pic: non byte write [ 3554.010000][ T5920] usb 6-1: Using ep0 maxpacket: 8 [ 3554.019833][T29751] kvm: pic: non byte write [ 3554.024000][ T5920] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 3554.043970][ T5920] usb 6-1: New USB device found, idVendor=16d0, idProduct=10a9, bcdDevice=30.52 [ 3554.046008][T29751] kvm: pic: non byte write [ 3554.065532][ T5920] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3554.076034][T23183] usb 3-1: new high-speed USB device number 96 using dummy_hcd [ 3554.076278][T29751] kvm: pic: non byte write [ 3554.084228][ T5920] usb 6-1: Product: syz [ 3554.096345][ T5920] usb 6-1: Manufacturer: syz [ 3554.102082][ T5920] usb 6-1: SerialNumber: syz [ 3554.107392][T29751] kvm: pic: non byte write [ 3554.110775][ T5920] usb 6-1: config 0 descriptor?? [ 3554.119953][T29751] kvm: pic: non byte write [ 3554.134194][T29751] kvm: pic: non byte write [ 3554.146652][T29751] kvm: pic: non byte write [ 3554.162987][T29751] kvm: pic: non byte write [ 3554.178722][T29751] kvm: pic: single mode not supported [ 3554.178735][T29751] kvm: pic: level sensitive irq not supported [ 3554.243635][T23183] usb 3-1: Using ep0 maxpacket: 16 [ 3554.258048][T23183] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 3554.271932][T25882] hub 9-1:0.0: hub_hub_status failed (err = -71) [ 3554.278118][T23183] usb 3-1: New USB device found, idVendor=046d, idProduct=0721, bcdDevice=9c.25 [ 3554.291028][T23183] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3554.299556][T25882] hub 9-1:0.0: config failed, can't get hub status (err -71) [ 3554.305728][T23183] usb 3-1: Product: syz [ 3554.311658][T23183] usb 3-1: Manufacturer: syz [ 3554.317921][T23183] usb 3-1: SerialNumber: syz [ 3554.324648][T25882] usbhid 9-1:0.0: can't add hid device: -71 [ 3554.338830][T25882] usbhid 9-1:0.0: probe with driver usbhid failed with error -71 [ 3554.357410][T23183] usb 3-1: config 0 descriptor?? [ 3554.373169][T23183] uvcvideo 3-1:0.0: probe with driver uvcvideo failed with error -22 [ 3554.394975][T25882] usb 9-1: USB disconnect, device number 109 [ 3554.566615][T23180] usb 3-1: USB disconnect, device number 96 [ 3554.842299][T25882] usb 6-1: USB disconnect, device number 84 [ 3554.853078][T29762] netlink: 12 bytes leftover after parsing attributes in process `syz.8.15793'. [ 3555.048946][T29767] veth1: entered promiscuous mode [ 3555.058355][T29767] bridge3: entered promiscuous mode [ 3555.065477][T29767] hsr2: Slave A (veth1) is not up; please bring it up to get a fully working HSR network [ 3555.080052][T29767] hsr2: entered promiscuous mode [ 3555.483682][T25882] usb 3-1: new full-speed USB device number 97 using dummy_hcd [ 3555.647615][T25882] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 13629, setting to 64 [ 3555.662448][T25882] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 3555.675733][T25882] usb 3-1: New USB device found, idVendor=0457, idProduct=07da, bcdDevice= 0.00 [ 3555.686872][T25882] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3555.707857][T25882] usb 3-1: config 0 descriptor?? [ 3555.721927][T29771] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 3556.191787][T25882] hid-multitouch 0003:0457:07DA.0177: hidraw0: USB HID v0.00 Device [HID 0457:07da] on usb-dummy_hcd.2-1/input0 [ 3556.251240][T14478] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 3556.265529][T14478] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 3556.276213][T14478] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 3556.283314][T23183] usb 4-1: USB disconnect, device number 100 [ 3556.290682][T14478] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 3556.303186][T14478] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 3556.386158][T29781] netlink: 20 bytes leftover after parsing attributes in process `syz.3.15799'. [ 3556.567089][T29771] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3556.606451][T29771] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3556.785376][T29771] netlink: 6 bytes leftover after parsing attributes in process `syz.2.15796'. [ 3556.795958][T29771] A link change request failed with some changes committed already. Interface vxcan1 may have been left with an inconsistent configuration, please check. [ 3557.021587][T29783] chnl_net:caif_netlink_parms(): no params data found [ 3557.212743][T29783] bridge0: port 1(bridge_slave_0) entered blocking state [ 3557.224685][T29783] bridge0: port 1(bridge_slave_0) entered disabled state [ 3557.241426][T29783] bridge_slave_0: entered allmulticast mode [ 3557.259046][T29783] bridge_slave_0: entered promiscuous mode [ 3557.292056][T29783] bridge0: port 2(bridge_slave_1) entered blocking state [ 3557.305214][T29783] bridge0: port 2(bridge_slave_1) entered disabled state [ 3557.312557][T29783] bridge_slave_1: entered allmulticast mode [ 3557.329586][T29783] bridge_slave_1: entered promiscuous mode [ 3557.434982][T29783] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 3557.466464][T29783] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 3557.579441][T29783] team0: Port device team_slave_0 added [ 3557.595402][T29783] team0: Port device team_slave_1 added [ 3557.690472][T19375] bridge_slave_1: left allmulticast mode [ 3557.697329][T19375] bridge_slave_1: left promiscuous mode [ 3557.705823][T19375] bridge0: port 2(bridge_slave_1) entered disabled state [ 3557.724238][T19375] bridge_slave_0: left allmulticast mode [ 3557.730189][T19375] bridge_slave_0: left promiscuous mode [ 3557.738233][T19375] bridge0: port 1(bridge_slave_0) entered disabled state [ 3558.366435][T25882] usb 3-1: USB disconnect, device number 97 [ 3558.379205][T24280] Bluetooth: hci5: command tx timeout [ 3558.515787][T19375] bond1 (unregistering): (slave ip6gretap1): Releasing backup interface [ 3558.537858][T19375] ip6gretap1 (unregistering): left allmulticast mode [ 3558.573854][T23189] usb 9-1: new high-speed USB device number 110 using dummy_hcd [ 3558.790792][T23189] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3558.802786][T23189] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 3558.813274][T23189] usb 9-1: New USB device found, idVendor=28de, idProduct=1142, bcdDevice= 0.00 [ 3558.822450][T23189] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3558.837313][T23189] usb 9-1: config 0 descriptor?? [ 3559.032817][T19375] erspan0 (unregistering): left promiscuous mode [ 3559.122642][T19375] bond10 (unregistering): (slave erspan1): Releasing active interface [ 3559.143601][ T5920] usb 3-1: new high-speed USB device number 98 using dummy_hcd [ 3559.157121][T19375] erspan1 (unregistering): left promiscuous mode [ 3559.269135][T19375] bond12 (unregistering): (slave gretap1): Releasing active interface [ 3559.333878][ T5920] usb 3-1: Using ep0 maxpacket: 16 [ 3559.362162][ T5920] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 3559.373620][ T5920] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3559.385358][ T5920] usb 3-1: config 1 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 3559.416474][ T5920] usb 3-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 3559.452235][ T5920] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 3559.471062][ T5920] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 3559.508648][ T5920] usb 3-1: SerialNumber: syz [ 3559.540271][ T5920] hub 3-1:1.0: bad descriptor, ignoring hub [ 3559.551395][ T5920] hub 3-1:1.0: probe with driver hub failed with error -5 [ 3559.563710][ T5920] cdc_ether 3-1:1.0: probe with driver cdc_ether failed with error -22 [ 3559.731426][T29826] netlink: 4 bytes leftover after parsing attributes in process `syz.8.15807'. [ 3560.443728][T24280] Bluetooth: hci5: command tx timeout [ 3560.583001][T19375] bond0 (unregistering): left promiscuous mode [ 3560.601513][T19375] bond_slave_0: left promiscuous mode [ 3560.616634][T19375] bond_slave_1: left promiscuous mode [ 3560.628136][T19375] mac80211_hwsim hwsim91 wlan1: left promiscuous mode [ 3560.697763][T19375] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 3560.721176][T19375] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 3560.747311][T19375] bond0 (unregistering): (slave wlan1): Releasing backup interface [ 3560.769368][T19375] bond0 (unregistering): Released all slaves [ 3561.204997][T19375] bond1 (unregistering): Released all slaves [ 3561.383250][T19375] bond2 (unregistering): Released all slaves [ 3561.562457][T19375] bond3 (unregistering): Released all slaves [ 3561.745711][T19375] bond4 (unregistering): Released all slaves [ 3561.922287][T19375] bond5 (unregistering): Released all slaves [ 3562.102773][T19375] bond6 (unregistering): Released all slaves [ 3562.269250][T19375] bond7 (unregistering): Released all slaves [ 3562.440413][T19375] bond8 (unregistering): Released all slaves [ 3562.453264][T19375] bond9 (unregistering): Released all slaves [ 3562.520824][T24280] Bluetooth: hci5: command tx timeout [ 3562.625212][T19375] bond10 (unregistering): Released all slaves [ 3562.820758][T19375] bond11 (unregistering): Released all slaves [ 3562.837252][T19375] bond12 (unregistering): Released all slaves [ 3563.039940][T19375] bond13 (unregistering): Released all slaves [ 3563.312520][T19375] bond14 (unregistering): Released all slaves [ 3563.328248][T29783] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 3563.335364][T29783] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 3563.362114][T29783] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 3563.679754][T29826] macsec1: left allmulticast mode [ 3563.700802][T29826] macsec1: left promiscuous mode [ 3563.706336][T29826] bridge0: port 3(macsec1) entered disabled state [ 3563.713452][T23180] usb 3-1: USB disconnect, device number 98 [ 3563.733047][T29826] bridge_slave_1: left allmulticast mode [ 3563.759738][T29826] bridge_slave_1: left promiscuous mode [ 3563.765650][T29826] bridge0: port 2(bridge_slave_1) entered disabled state [ 3563.791868][T29826] bridge_slave_0: left allmulticast mode [ 3563.799412][T29826] bridge_slave_0: left promiscuous mode [ 3563.821548][T29826] bridge0: port 1(bridge_slave_0) entered disabled state [ 3564.329376][T29783] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 3564.341507][T29783] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 3564.367961][T29783] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 3564.374447][T23180] usb 3-1: new high-speed USB device number 99 using dummy_hcd [ 3564.379044][T19375] tipc: Left network mode [ 3564.386752][T23189] usbhid 9-1:0.0: can't add hid device: -32 [ 3564.405628][T23189] usbhid 9-1:0.0: probe with driver usbhid failed with error -32 [ 3564.568473][T23183] usb 9-1: USB disconnect, device number 110 [ 3564.583767][T23180] usb 3-1: Using ep0 maxpacket: 32 [ 3564.605484][T24280] Bluetooth: hci5: command tx timeout [ 3564.611538][T23180] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3564.634461][T23180] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 3564.652556][T23180] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 3564.661958][T23180] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3564.680438][T23180] usb 3-1: config 0 descriptor?? [ 3564.700931][T23180] hub 3-1:0.0: USB hub found [ 3564.753077][T29783] hsr_slave_0: entered promiscuous mode [ 3564.765178][T29783] hsr_slave_1: entered promiscuous mode [ 3564.771855][T29783] debugfs: 'hsr0' already exists in 'hsr' [ 3564.779652][T29783] Cannot create hsr debugfs directory [ 3564.874393][T29850] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 3565.007157][T29858] netlink: 16 bytes leftover after parsing attributes in process `syz.8.15819'. [ 3565.054837][T23183] usb 4-1: new full-speed USB device number 101 using dummy_hcd [ 3565.096939][T23180] hub 3-1:0.0: config failed, can't read hub descriptor (err -22) [ 3565.219972][T23183] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 13629, setting to 64 [ 3565.232899][T23183] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 3565.270400][T23183] usb 4-1: New USB device found, idVendor=0457, idProduct=07da, bcdDevice= 0.00 [ 3565.303192][T23183] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3565.345614][T23180] usbhid 3-1:0.0: can't add hid device: -71 [ 3565.351714][T23180] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 3565.403724][T23183] usb 4-1: config 0 descriptor?? [ 3565.404659][T23180] usb 3-1: USB disconnect, device number 99 [ 3565.410297][T29855] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 3565.805455][ T5920] usb 9-1: new high-speed USB device number 111 using dummy_hcd [ 3565.996443][T23183] hid-multitouch 0003:0457:07DA.0178: hidraw0: USB HID v0.00 Device [HID 0457:07da] on usb-dummy_hcd.3-1/input0 [ 3566.013073][ T5920] usb 9-1: Using ep0 maxpacket: 16 [ 3566.043732][ T5920] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 3566.088600][ T5920] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3566.199924][ T5920] usb 9-1: config 1 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 3566.301281][T29855] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3566.312487][ T5920] usb 9-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 3566.340453][T29855] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3566.358939][ T5920] usb 9-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 3566.369437][T19375] hsr_slave_0: left promiscuous mode [ 3566.394096][T19375] hsr_slave_1: left promiscuous mode [ 3566.399622][ T5920] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 3566.419150][T19375] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 3566.428328][ T5920] usb 9-1: SerialNumber: syz [ 3566.451504][T19375] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 3566.468301][ T5920] hub 9-1:1.0: bad descriptor, ignoring hub [ 3566.490612][T19375] batman_adv: batadv0: Removing interface: virt_wifi0 [ 3566.498568][ T5920] hub 9-1:1.0: probe with driver hub failed with error -5 [ 3566.527481][ T5920] cdc_ether 9-1:1.0: probe with driver cdc_ether failed with error -22 [ 3567.606447][T29783] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 3567.640459][T29783] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 3567.659953][T29783] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 3567.671887][T29783] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 3568.109506][T19375] IPVS: stop unused estimator thread 0... [ 3568.187015][T29783] 8021q: adding VLAN 0 to HW filter on device bond0 [ 3568.272905][T29783] 8021q: adding VLAN 0 to HW filter on device team0 [ 3568.326948][T29910] kvm: pic: single mode not supported [ 3568.327075][T29910] kvm: pic: single mode not supported [ 3568.343897][T29910] kvm: pic: level sensitive irq not supported [ 3568.349557][T29910] kvm: pic: single mode not supported [ 3568.350502][T19375] bridge0: port 1(bridge_slave_0) entered blocking state [ 3568.355948][T29910] kvm: pic: level sensitive irq not supported [ 3568.361190][T19375] bridge0: port 1(bridge_slave_0) entered forwarding state [ 3568.397340][T29910] picdev_write: 1 callbacks suppressed [ 3568.397358][T29910] kvm: pic: non byte write [ 3568.408644][ T5920] usb 9-1: USB disconnect, device number 111 [ 3568.450039][T29910] kvm: pic: non byte write [ 3568.467395][T29910] kvm: pic: non byte write [ 3568.484622][T19375] bridge0: port 2(bridge_slave_1) entered blocking state [ 3568.491872][T19375] bridge0: port 2(bridge_slave_1) entered forwarding state [ 3568.655188][ T30] audit: type=1326 audit(1767625856.835:3149): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29918 comm="syz.8.15828" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f83bd38f749 code=0x0 [ 3568.751263][T29783] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 3568.825501][T23189] usb 4-1: USB disconnect, device number 101 [ 3568.949191][T29783] veth0_vlan: entered promiscuous mode [ 3568.980541][T29783] veth1_vlan: entered promiscuous mode [ 3569.031925][T29783] veth0_macvtap: entered promiscuous mode [ 3569.044847][T29783] veth1_macvtap: entered promiscuous mode [ 3569.080199][T29783] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 3569.101207][T29783] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 3569.122853][ T5988] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 3569.140883][ T5988] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 3569.166805][T13767] usb 3-1: new high-speed USB device number 100 using dummy_hcd [ 3569.181405][ T5988] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 3569.222061][T18508] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 3569.274374][T23189] usb 4-1: new low-speed USB device number 102 using dummy_hcd [ 3569.333756][T13767] usb 3-1: Using ep0 maxpacket: 8 [ 3569.341755][T13767] usb 3-1: config 1 interface 0 altsetting 255 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 3569.362378][T19375] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 3569.382134][T13767] usb 3-1: config 1 interface 0 has no altsetting 0 [ 3569.389185][T19375] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 3569.409588][T13767] usb 3-1: New USB device found, idVendor=1d34, idProduct=0004, bcdDevice= 0.40 [ 3569.437538][T13767] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3569.451327][T13767] usb 3-1: Product: у [ 3569.455904][T13767] usb 3-1: Manufacturer: 姴㸯㟭ꍮ﨣䅱᪉猂굶쟁呃귆⃋榸風篠鷵択胶问놼⒇↱旟ᱹ砕Ꝟ⠋ｯ梸㩆엑䵷⯸咩峵ᡃ箁걝씅듂⯼༜뱎ୌﭷ舢촙햍鞌⒇譇狫ꭁ﷤㺩ཛྷ﷬휼龿占ꒉ쁠笣跷ꘝﶅ냱ꑅ璻咿ힹ둵㏹蚽Ŭ忓魃擆⚰⠉炼댹륛뚳᜷呏珑៼孁➥ౄ [ 3569.465313][T27790] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 3569.489500][T13767] usb 3-1: SerialNumber: у [ 3569.506636][T23189] usb 4-1: LPM exit latency is zeroed, disabling LPM. [ 3569.526011][T23189] usb 4-1: config 1 interface 0 altsetting 7 endpoint 0x82 is Bulk; changing to Interrupt [ 3569.533721][T27790] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 3569.562920][T23189] usb 4-1: config 1 interface 0 altsetting 7 endpoint 0x3 is Bulk; changing to Interrupt [ 3569.609556][T23189] usb 4-1: config 1 interface 0 has no altsetting 0 [ 3569.629843][T23189] usb 4-1: string descriptor 0 read error: -22 [ 3569.663444][T23189] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.3c [ 3569.720217][T23189] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3569.768974][T29928] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 3569.778787][T29935] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3569.809047][T29928] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 3569.826149][T29935] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3569.831901][T23189] cdc_ether 4-1:1.0: probe with driver cdc_ether failed with error -22 [ 3570.020478][T13767] usbhid 3-1:1.0: can't add hid device: -71 [ 3570.042395][T13767] usbhid 3-1:1.0: probe with driver usbhid failed with error -71 [ 3570.077400][T29928] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3570.101728][T13767] usb 3-1: USB disconnect, device number 100 [ 3570.127124][T29928] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3570.170459][T29940] bridge0: port 2(bridge_slave_1) entered disabled state [ 3570.178238][T29940] bridge0: port 1(bridge_slave_0) entered disabled state [ 3570.195762][T29928] netlink: 52 bytes leftover after parsing attributes in process `syz.3.15830'. [ 3570.556724][T29940] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 3570.606344][T29940] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 3570.955052][T19378] netdevsim netdevsim5 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 3570.972419][T27097] usb 4-1: USB disconnect, device number 102 [ 3570.981099][T19378] netdevsim netdevsim5 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 3571.018886][T19378] netdevsim netdevsim5 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 3571.045412][T19378] netdevsim netdevsim5 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 3571.462226][T29963] FAULT_INJECTION: forcing a failure. [ 3571.462226][T29963] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 3571.475625][T29963] CPU: 0 UID: 0 PID: 29963 Comm: syz.8.15837 Tainted: G L syzkaller #0 PREEMPT(full) [ 3571.475654][T29963] Tainted: [L]=SOFTLOCKUP [ 3571.475661][T29963] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 3571.475673][T29963] Call Trace: [ 3571.475680][T29963] [ 3571.475686][T29963] dump_stack_lvl+0xe8/0x150 [ 3571.475716][T29963] should_fail_ex+0x414/0x560 [ 3571.475744][T29963] _copy_from_user+0x2d/0xb0 [ 3571.475758][T29963] ___sys_sendmsg+0x158/0x2a0 [ 3571.475773][T29963] ? __pfx____sys_sendmsg+0x10/0x10 [ 3571.475801][T29963] ? __fget_files+0x2a/0x420 [ 3571.475814][T29963] ? __fget_files+0x3a0/0x420 [ 3571.475831][T29963] __x64_sys_sendmsg+0x19b/0x260 [ 3571.475851][T29963] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 3571.475868][T29963] ? __pfx_ksys_write+0x10/0x10 [ 3571.475883][T29963] do_syscall_64+0xec/0xf80 [ 3571.475894][T29963] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 3571.475904][T29963] ? trace_irq_disable+0x37/0x100 [ 3571.475918][T29963] ? clear_bhb_loop+0x60/0xb0 [ 3571.475930][T29963] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 3571.475940][T29963] RIP: 0033:0x7f83bd38f749 [ 3571.475950][T29963] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 3571.475960][T29963] RSP: 002b:00007f83be170038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 3571.475972][T29963] RAX: ffffffffffffffda RBX: 00007f83bd5e6180 RCX: 00007f83bd38f749 [ 3571.475980][T29963] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000009 [ 3571.475987][T29963] RBP: 00007f83be170090 R08: 0000000000000000 R09: 0000000000000000 [ 3571.475994][T29963] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 3571.476000][T29963] R13: 00007f83bd5e6218 R14: 00007f83bd5e6180 R15: 00007f83bd70fa28 [ 3571.476016][T29963] [ 3572.003990][ T24] usb 4-1: new high-speed USB device number 103 using dummy_hcd [ 3572.177126][ T24] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 3572.200618][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3572.230175][ T24] usb 4-1: Product: syz [ 3572.261003][ T24] usb 4-1: Manufacturer: syz [ 3572.279994][ T24] usb 4-1: SerialNumber: syz [ 3572.301437][ T24] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 3572.317309][T29930] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 3572.574019][ T24] usb 9-1: new full-speed USB device number 112 using dummy_hcd [ 3572.635947][T29973] netlink: 112 bytes leftover after parsing attributes in process `syz.2.15840'. [ 3572.645229][T29973] netlink: 8 bytes leftover after parsing attributes in process `syz.2.15840'. [ 3572.730810][ C1] usb 4-1: ath9k_htc: over RX MAX_PKT_NUM [ 3572.746472][ T24] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 13629, setting to 64 [ 3572.761860][ T24] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 3572.777128][ T24] usb 9-1: New USB device found, idVendor=0457, idProduct=07da, bcdDevice= 0.00 [ 3572.791561][ T24] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3572.818775][ T24] usb 9-1: config 0 descriptor?? [ 3572.830586][T29971] raw-gadget.1 gadget.8: fail, usb_ep_enable returned -22 [ 3572.939590][T23180] usb 4-1: USB disconnect, device number 103 [ 3573.262904][ T24] hid-multitouch 0003:0457:07DA.0179: hidraw0: USB HID v0.00 Device [HID 0457:07da] on usb-dummy_hcd.8-1/input0 [ 3573.393921][T29930] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 3573.402350][T29930] ath9k_htc: Failed to initialize the device [ 3573.413057][T23180] usb 4-1: ath9k_htc: USB layer deinitialized [ 3573.483744][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 3573.491750][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 3573.687232][T29971] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3573.738617][T29971] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3573.950631][T29998] netlink: 2980 bytes leftover after parsing attributes in process `syz.0.15845'. [ 3574.014356][T30001] netlink: 6 bytes leftover after parsing attributes in process `syz.8.15839'. [ 3574.044472][T30001] A link change request failed with some changes committed already. Interface vxcan1 may have been left with an inconsistent configuration, please check. [ 3575.203962][T23180] usb 6-1: new high-speed USB device number 85 using dummy_hcd [ 3575.375110][T29930] usb 9-1: USB disconnect, device number 112 [ 3575.385859][T23180] usb 6-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 3575.420583][T23180] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3575.450686][T23180] usb 6-1: config 0 descriptor?? [ 3575.490529][T23180] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 3575.551317][T30022] netlink: 8 bytes leftover after parsing attributes in process `syz.2.15851'. [ 3575.566039][T30022] netlink: 8 bytes leftover after parsing attributes in process `syz.2.15851'. [ 3575.578643][T30022] netlink: 8 bytes leftover after parsing attributes in process `syz.2.15851'. [ 3575.592170][T30022] netlink: 8 bytes leftover after parsing attributes in process `syz.2.15851'. [ 3575.602436][T30022] netlink: 8 bytes leftover after parsing attributes in process `syz.2.15851'. [ 3575.696468][ T24] usb 4-1: new high-speed USB device number 104 using dummy_hcd [ 3575.843648][ T24] usb 4-1: device descriptor read/64, error -71 [ 3576.093571][ T24] usb 4-1: new high-speed USB device number 105 using dummy_hcd [ 3576.115066][T30013] fuse: Unknown parameter 'っ8`' [ 3576.183643][T27097] usb 9-1: new high-speed USB device number 113 using dummy_hcd [ 3576.243647][ T24] usb 4-1: device descriptor read/64, error -71 [ 3576.343664][T27097] usb 9-1: Using ep0 maxpacket: 16 [ 3576.356468][T27097] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 3576.381833][T27097] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3576.382027][ T24] usb usb4-port1: attempt power cycle [ 3576.419527][T27097] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 3576.455217][T27097] usb 9-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 3576.477699][T27097] usb 9-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 3576.490899][T27097] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 3576.499423][T27097] usb 9-1: SerialNumber: syz [ 3576.522016][T27097] hub 9-1:1.0: bad descriptor, ignoring hub [ 3576.529054][T27097] hub 9-1:1.0: probe with driver hub failed with error -5 [ 3576.540822][T23180] gspca_stv06xx: HDCS-1000/1100 sensor detected [ 3576.570607][T27097] cdc_ether 9-1:1.0: probe with driver cdc_ether failed with error -22 [ 3576.793686][ T24] usb 4-1: new high-speed USB device number 106 using dummy_hcd [ 3576.822186][T30049] netdevsim netdevsim2 netdevsim0: entered allmulticast mode [ 3576.832092][T23180] STV06xx 6-1:0.0: probe with driver STV06xx failed with error -71 [ 3576.844969][ T24] usb 4-1: device descriptor read/8, error -71 [ 3576.853977][T30049] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 3576.875708][T23180] usb 6-1: USB disconnect, device number 85 [ 3576.937770][T30049] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 3577.083748][ T24] usb 4-1: new high-speed USB device number 107 using dummy_hcd [ 3577.135201][ T24] usb 4-1: device descriptor read/8, error -71 [ 3577.265821][ T24] usb usb4-port1: unable to enumerate USB device [ 3578.380415][T30068] 8021q: VLANs not supported on gre0 [ 3578.533918][T27097] usb 3-1: new full-speed USB device number 101 using dummy_hcd [ 3578.708955][T27097] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 13629, setting to 64 [ 3578.770323][T27097] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 3578.787143][T27097] usb 3-1: New USB device found, idVendor=0457, idProduct=07da, bcdDevice= 0.00 [ 3578.797714][T27097] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3578.834488][T27097] usb 3-1: config 0 descriptor?? [ 3578.842832][T30064] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 3578.853898][ T24] usb 4-1: new high-speed USB device number 108 using dummy_hcd [ 3578.964229][T23180] usb 9-1: USB disconnect, device number 113 [ 3579.035520][ T24] usb 4-1: config 25 has an invalid interface number: 118 but max is 0 [ 3579.060663][ T24] usb 4-1: config 25 has no interface number 0 [ 3579.074365][ T24] usb 4-1: config 25 interface 118 has no altsetting 0 [ 3579.090251][ T24] usb 4-1: New USB device found, idVendor=19d2, idProduct=0158, bcdDevice=51.b3 [ 3579.100245][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3579.109919][ T24] usb 4-1: Product: syz [ 3579.117007][ T24] usb 4-1: Manufacturer: 肐邯ᘍ宖莂ꁷݡ㾴龅ギ廨갬嵎鹀䳪ᐉ䚗쾽飵䆡꽕쟲 [ 3579.131316][ T24] usb 4-1: SerialNumber: syz [ 3579.269557][T27097] hid-multitouch 0003:0457:07DA.017A: hidraw0: USB HID v0.00 Device [HID 0457:07da] on usb-dummy_hcd.2-1/input0 [ 3579.324714][T23180] usb 9-1: new full-speed USB device number 114 using dummy_hcd [ 3579.357510][T30076] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3579.370733][T30076] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3579.385356][T30076] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3579.397742][T30076] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3579.408253][T30076] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3579.419518][T30076] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3579.429530][T30076] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3579.441722][T30076] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3579.451675][T30076] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3579.461995][T30076] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3579.493342][T23180] usb 9-1: unable to read config index 0 descriptor/start: -71 [ 3579.504359][T23180] usb 9-1: can't read configurations, error -71 [ 3579.507081][ T24] option 4-1:25.118: GSM modem (1-port) converter detected [ 3579.529010][ T24] usb 4-1: USB disconnect, device number 108 [ 3579.549415][ T24] option 4-1:25.118: device disconnected [ 3579.579746][T30064] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3579.588996][T30064] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3579.649740][T30096] netlink: 6 bytes leftover after parsing attributes in process `syz.2.15866'. [ 3579.658839][T30096] A link change request failed with some changes committed already. Interface vxcan1 may have been left with an inconsistent configuration, please check. [ 3580.783597][ T24] usb 9-1: new high-speed USB device number 116 using dummy_hcd [ 3580.956243][ T24] usb 9-1: Using ep0 maxpacket: 16 [ 3580.988618][ T24] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 3581.035713][ T24] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3581.054863][ T24] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 3581.077069][ T24] usb 9-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 3581.106091][ T24] usb 9-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 3581.118687][ T24] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 3581.137354][ T24] usb 9-1: SerialNumber: syz [ 3581.182797][ T24] hub 9-1:1.0: bad descriptor, ignoring hub [ 3581.206059][ T24] hub 9-1:1.0: probe with driver hub failed with error -5 [ 3581.235267][ T24] cdc_ether 9-1:1.0: probe with driver cdc_ether failed with error -22 [ 3581.356581][T23180] usb 3-1: USB disconnect, device number 101 [ 3583.027742][T29930] usb 3-1: new high-speed USB device number 102 using dummy_hcd [ 3583.212402][T29930] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3583.253560][T29930] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 3583.292330][T29930] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 3583.335674][T29930] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 3583.368385][T29930] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3583.404265][T29930] usb 3-1: config 0 descriptor?? [ 3583.708502][T30170] syzkaller0: entered promiscuous mode [ 3583.764313][T23180] usb 9-1: USB disconnect, device number 116 [ 3583.773535][T30170] syzkaller0: entered allmulticast mode [ 3583.782815][T30171] netlink: 16 bytes leftover after parsing attributes in process `syz.0.15899'. [ 3583.876592][T29930] plantronics 0003:047F:FFFF.017B: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 3584.314934][T30182] netlink: 12 bytes leftover after parsing attributes in process `syz.3.15904'. [ 3584.347978][T30182] netlink: 'syz.3.15904': attribute type 1 has an invalid length. [ 3584.498526][T30185] syzkaller0: entered promiscuous mode [ 3584.539299][T30185] syzkaller0: entered allmulticast mode [ 3584.604111][T29930] usb 3-1: USB disconnect, device number 102 [ 3584.856242][T30203] netlink: 'syz.0.15907': attribute type 1 has an invalid length. [ 3584.995423][T30208] netlink: 40 bytes leftover after parsing attributes in process `syz.2.15910'. [ 3586.411650][T23180] usb 6-1: new high-speed USB device number 86 using dummy_hcd [ 3586.633307][T23180] usb 6-1: Using ep0 maxpacket: 16 [ 3586.683892][T23180] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 3586.784950][T23180] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3586.849782][T23180] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 3586.882342][T23180] usb 6-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 3586.957320][T23180] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 3586.967028][T23180] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 3587.051036][T23180] usb 6-1: SerialNumber: syz [ 3587.137300][T23180] hub 6-1:1.0: bad descriptor, ignoring hub [ 3587.145715][T23180] hub 6-1:1.0: probe with driver hub failed with error -5 [ 3587.167523][T23180] cdc_ether 6-1:1.0: probe with driver cdc_ether failed with error -22 [ 3589.881527][T30203] 8021q: adding VLAN 0 to HW filter on device bond1 [ 3589.900964][T30207] bond1: (slave gretap2): making interface the new active one [ 3589.910204][T30207] bond1: (slave gretap2): Enslaving as an active interface with an up link [ 3590.244708][T30246] netlink: 228 bytes leftover after parsing attributes in process `syz.8.15922'. [ 3590.363955][T23180] usb 3-1: new high-speed USB device number 103 using dummy_hcd [ 3590.528416][T23180] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3590.552102][T23180] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 3590.574483][T23180] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 3590.604101][T23180] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 3590.618059][T23180] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3590.634366][T13767] usb 9-1: new high-speed USB device number 117 using dummy_hcd [ 3590.646654][T23180] usb 3-1: config 0 descriptor?? [ 3591.034618][T13767] usb 9-1: config 0 has an invalid interface number: 122 but max is 0 [ 3591.076621][T13767] usb 9-1: config 0 has no interface number 0 [ 3591.082720][T13767] usb 9-1: config 0 interface 122 has no altsetting 0 [ 3591.115818][T23180] plantronics 0003:047F:FFFF.017C: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 3591.223846][T29930] usb 6-1: USB disconnect, device number 86 [ 3591.358022][T13767] usb 9-1: New USB device found, idVendor=13d3, idProduct=3219, bcdDevice=7a.67 [ 3591.390534][T13767] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3591.429853][T13767] usb 9-1: Product: syz [ 3591.448421][T13767] usb 9-1: Manufacturer: syz [ 3591.469020][T13767] usb 9-1: SerialNumber: syz [ 3591.485102][T13767] usb 9-1: config 0 descriptor?? [ 3591.580258][T30264] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 3591.782998][T13767] usb 3-1: USB disconnect, device number 103 [ 3593.054427][T23180] usb 4-1: new high-speed USB device number 109 using dummy_hcd [ 3593.223693][T23180] usb 4-1: Using ep0 maxpacket: 16 [ 3593.254907][T23180] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 3593.291028][T23180] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3593.336668][T23180] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 3593.373648][T23180] usb 4-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 3593.418161][T23180] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 3593.440958][T23180] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 3593.471071][T23180] usb 4-1: SerialNumber: syz [ 3593.497563][T23180] hub 4-1:1.0: bad descriptor, ignoring hub [ 3593.516864][T23180] hub 4-1:1.0: probe with driver hub failed with error -5 [ 3593.550210][T23180] cdc_ether 4-1:1.0: probe with driver cdc_ether failed with error -22 [ 3593.853263][T23180] usb 9-1: USB disconnect, device number 117 [ 3593.866662][T23180] dvb-usb: generic DVB-USB module successfully deinitialized and disconnected. [ 3595.419283][T30311] @: renamed from vlan0 [ 3595.553925][T23180] usb 9-1: new high-speed USB device number 118 using dummy_hcd [ 3595.728635][T23180] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3595.769608][T23180] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 3595.820159][T23180] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 3595.849184][T23180] usb 9-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 3595.889107][T23180] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3595.910481][T23180] usb 9-1: config 0 descriptor?? [ 3596.084350][T29930] usb 4-1: USB disconnect, device number 109 [ 3596.358193][T23180] plantronics 0003:047F:FFFF.017D: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.8-1/input0 [ 3596.583620][ T30] audit: type=1326 audit(1767625884.745:3150): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30323 comm="syz.5.15944" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f43d438f749 code=0x7ffc0000 [ 3596.668239][ T30] audit: type=1326 audit(1767625884.745:3151): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30323 comm="syz.5.15944" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f43d438f749 code=0x7ffc0000 [ 3596.728309][ T30] audit: type=1326 audit(1767625884.745:3152): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30323 comm="syz.5.15944" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f43d438f749 code=0x7ffc0000 [ 3596.786826][ T30] audit: type=1326 audit(1767625884.775:3153): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30323 comm="syz.5.15944" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f43d438f749 code=0x7ffc0000 [ 3596.870325][ T30] audit: type=1326 audit(1767625884.775:3154): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30323 comm="syz.5.15944" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7f43d438f749 code=0x7ffc0000 [ 3596.949285][ T30] audit: type=1326 audit(1767625884.775:3155): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30323 comm="syz.5.15944" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f43d438f749 code=0x7ffc0000 [ 3597.054693][ T30] audit: type=1326 audit(1767625884.775:3156): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30323 comm="syz.5.15944" exe="/root/syz-executor" sig=0 arch=c000003e syscall=259 compat=0 ip=0x7f43d438f749 code=0x7ffc0000 [ 3597.133620][ T30] audit: type=1326 audit(1767625884.775:3157): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30323 comm="syz.5.15944" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f43d438f749 code=0x7ffc0000 [ 3597.208115][T23180] usb 9-1: USB disconnect, device number 118 [ 3597.225344][ T30] audit: type=1326 audit(1767625884.775:3158): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30323 comm="syz.5.15944" exe="/root/syz-executor" sig=0 arch=c000003e syscall=322 compat=0 ip=0x7f43d438f749 code=0x7ffc0000 [ 3597.297858][ T30] audit: type=1326 audit(1767625884.775:3159): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30323 comm="syz.5.15944" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f43d438f749 code=0x7ffc0000 [ 3598.483742][T23180] usb 9-1: new high-speed USB device number 119 using dummy_hcd [ 3598.663616][T23180] usb 9-1: Using ep0 maxpacket: 16 [ 3598.696756][T23180] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 3598.736421][T23180] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3598.791072][T23180] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 3598.821937][T23180] usb 9-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 3598.900631][T23180] usb 9-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 3598.976024][T23180] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 3599.072051][T23180] usb 9-1: SerialNumber: syz [ 3599.164768][T23180] hub 9-1:1.0: bad descriptor, ignoring hub [ 3599.244856][T23180] hub 9-1:1.0: probe with driver hub failed with error -5 [ 3599.318973][T23180] cdc_ether 9-1:1.0: probe with driver cdc_ether failed with error -22 [ 3599.603088][T30365] 8021q: VLANs not supported on gre0 [ 3600.005240][T30371] openvswitch: netlink: Flow key attr not present in new flow. [ 3600.803751][T23180] usb 4-1: new full-speed USB device number 110 using dummy_hcd [ 3600.966042][T23180] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 13629, setting to 64 [ 3600.986132][T23180] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 3601.014654][T23180] usb 4-1: New USB device found, idVendor=0457, idProduct=07da, bcdDevice= 0.00 [ 3601.036353][T23180] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3601.067518][T23180] usb 4-1: config 0 descriptor?? [ 3601.088170][T30381] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 3601.522802][T23180] hid-multitouch 0003:0457:07DA.017E: hidraw0: USB HID v0.00 Device [HID 0457:07da] on usb-dummy_hcd.3-1/input0 [ 3601.856207][T30381] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3601.888355][T30381] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3601.995056][T23180] usb 9-1: USB disconnect, device number 119 [ 3602.125997][T30405] 8021q: VLANs not supported on gre0 [ 3602.723594][T29930] usb 9-1: new high-speed USB device number 120 using dummy_hcd [ 3602.924336][T29930] usb 9-1: Using ep0 maxpacket: 16 [ 3602.938631][T29930] usb 9-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 7.00 [ 3602.967890][T29930] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3602.989007][T29930] usb 9-1: Product: syz [ 3603.002759][T29930] usb 9-1: Manufacturer: syz [ 3603.021685][T29930] usb 9-1: SerialNumber: syz [ 3603.049859][T29930] usb 9-1: config 0 descriptor?? [ 3603.072736][T29930] ftdi_sio 9-1:0.0: FTDI USB Serial Device converter detected [ 3603.105428][T29930] usb 9-1: Detected FT2232H [ 3603.363411][T30416] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3603.396600][T30416] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3603.433322][T30416] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3603.472356][T30416] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3603.600312][T29930] ftdi_sio ttyUSB0: Unable to read latency timer: -71 [ 3603.660949][T29930] ftdi_sio ttyUSB0: Unable to write latency timer: -71 [ 3603.711826][T29930] usb 9-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 3603.819371][T29930] usb 9-1: USB disconnect, device number 120 [ 3603.866454][T29930] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 3603.874185][T23180] usb 4-1: USB disconnect, device number 110 [ 3603.961412][T29930] ftdi_sio 9-1:0.0: device disconnected [ 3604.016630][T30439] netlink: 'syz.3.15980': attribute type 12 has an invalid length. [ 3604.039789][T30439] netlink: 'syz.3.15980': attribute type 29 has an invalid length. [ 3604.104722][T30439] netlink: 148 bytes leftover after parsing attributes in process `syz.3.15980'. [ 3605.223590][T23180] usb 3-1: new low-speed USB device number 104 using dummy_hcd [ 3605.386244][T23180] usb 3-1: device descriptor read/64, error -71 [ 3605.392577][T27097] usb 4-1: new high-speed USB device number 111 using dummy_hcd [ 3605.633951][T27097] usb 4-1: Using ep0 maxpacket: 16 [ 3605.653618][T23180] usb 3-1: new low-speed USB device number 105 using dummy_hcd [ 3605.676173][T27097] usb 4-1: config 8 has an invalid interface number: 39 but max is 0 [ 3605.717179][T27097] usb 4-1: config 8 has no interface number 0 [ 3605.723360][T27097] usb 4-1: config 8 interface 39 altsetting 1 has an endpoint descriptor with address 0xDF, changing to 0x8F [ 3605.775019][T27097] usb 4-1: config 8 interface 39 altsetting 1 endpoint 0x8F has invalid wMaxPacketSize 0 [ 3605.823650][T27097] usb 4-1: config 8 interface 39 altsetting 1 bulk endpoint 0x8F has invalid maxpacket 0 [ 3605.843699][T27097] usb 4-1: config 8 interface 39 has no altsetting 0 [ 3605.853673][T23180] usb 3-1: device descriptor read/64, error -71 [ 3605.888290][T27097] usb 4-1: New USB device found, idVendor=05ac, idProduct=c704, bcdDevice=62.77 [ 3605.910119][T27097] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3605.939627][T27097] usb 4-1: Product: syz [ 3605.949355][T27097] usb 4-1: Manufacturer: syz [ 3605.959476][T27097] usb 4-1: SerialNumber: syz [ 3605.966499][T23180] usb usb3-port1: attempt power cycle [ 3606.253747][T29930] usb 6-1: new high-speed USB device number 87 using dummy_hcd [ 3606.323726][T23180] usb 3-1: new low-speed USB device number 106 using dummy_hcd [ 3606.469079][T27097] ipheth 4-1:8.39: ipheth_get_macaddr: usb_control_msg: -71 [ 3606.482608][T29930] usb 6-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 3606.518621][T29930] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3606.537834][T23180] usb 3-1: device descriptor read/8, error -71 [ 3606.553720][T27097] ipheth 4-1:8.39: probe with driver ipheth failed with error -71 [ 3606.595738][T27097] usb 4-1: USB disconnect, device number 111 [ 3606.685001][T29930] usb 6-1: config 0 descriptor?? [ 3606.824966][T23180] usb 3-1: new low-speed USB device number 107 using dummy_hcd [ 3606.876966][T23180] usb 3-1: device descriptor read/8, error -71 [ 3607.037961][T23180] usb usb3-port1: unable to enumerate USB device [ 3607.143550][T27097] usb 9-1: new full-speed USB device number 121 using dummy_hcd [ 3607.152987][T29930] cp210x 6-1:0.0: cp210x converter detected [ 3607.406496][T27097] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 13629, setting to 64 [ 3607.442352][T27097] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 3607.469498][T30497] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 3607.478947][T27097] usb 9-1: New USB device found, idVendor=0457, idProduct=07da, bcdDevice= 0.00 [ 3607.499167][T30497] batadv_slave_0: entered promiscuous mode [ 3607.503629][T27097] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3607.525920][T27097] usb 9-1: config 0 descriptor?? [ 3607.539591][T30487] raw-gadget.1 gadget.8: fail, usb_ep_enable returned -22 [ 3607.592942][T29930] cp210x 6-1:0.0: failed to get vendor val 0x000e size 3: -32 [ 3607.637331][T29930] usb 6-1: cp210x converter now attached to ttyUSB0 [ 3607.919370][T30503] [ 3607.921739][T30503] ===================================================== [ 3607.928658][T30503] WARNING: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected [ 3607.936125][T30503] syzkaller #0 Tainted: G L [ 3607.942085][T30503] ----------------------------------------------------- [ 3607.948996][T30503] syz.2.15997/30503 [HC0[0]:SC0[0]:HE0:SE1] is trying to acquire: [ 3607.956809][T30503] ffff88806c20ba98 (&new->fa_lock){...-}-{3:3}, at: kill_fasync+0x199/0x4d0 [ 3607.965530][T30503] [ 3607.965530][T30503] and this task is already holding: [ 3607.972884][T30503] ffff88801fb22028 (&client->buffer_lock){..-.}-{3:3}, at: evdev_pass_values+0xb9/0xbd0 [ 3607.982165][T27097] hid-multitouch 0003:0457:07DA.017F: hidraw0: USB HID v0.00 Device [HID 0457:07da] on usb-dummy_hcd.8-1/input0 [ 3607.982608][T30503] which would create a new lock dependency: [ 3608.000273][T30503] (&client->buffer_lock){..-.}-{3:3} -> (&new->fa_lock){...-}-{3:3} [ 3608.008349][T30503] [ 3608.008349][T30503] but this new dependency connects a SOFTIRQ-irq-safe lock: [ 3608.017776][T30503] (&client->buffer_lock){..-.}-{3:3} [ 3608.017795][T30503] [ 3608.017795][T30503] ... which became SOFTIRQ-irq-safe at: [ 3608.030820][T30503] lock_acquire+0x107/0x340 [ 3608.035399][T30503] _raw_spin_lock+0x2e/0x40 [ 3608.039998][T30503] evdev_pass_values+0xb9/0xbd0 [ 3608.044918][T30503] evdev_events+0x1e6/0x340 [ 3608.049487][T30503] input_pass_values+0x288/0x890 [ 3608.054493][T30503] input_event_dispose+0x3e5/0x6b0 [ 3608.059670][T30503] input_event+0x89/0xe0 [ 3608.063977][T30503] hidinput_hid_event+0x145e/0x1e50 [ 3608.069254][T30503] hid_process_event+0x4be/0x620 [ 3608.074259][T30503] hid_input_array_field+0x41c/0x5f0 [ 3608.079642][T30503] hid_report_raw_event+0xdd9/0x1720 [ 3608.085005][T30503] hid_input_report+0x44b/0x580 [ 3608.089944][T30503] hid_irq_in+0x47e/0x6d0 [ 3608.094338][T30503] __usb_hcd_giveback_urb+0x376/0x540 [ 3608.099777][T30503] dummy_timer+0x85f/0x45b0 [ 3608.104349][T30503] __hrtimer_run_queues+0x51c/0xc30 [ 3608.109613][T30503] hrtimer_run_softirq+0x187/0x2b0 [ 3608.114788][T30503] handle_softirqs+0x22b/0x7c0 [ 3608.119612][T30503] __irq_exit_rcu+0x60/0x150 [ 3608.124264][T30503] irq_exit_rcu+0x9/0x30 [ 3608.128567][T30503] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 3608.134267][T30503] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 3608.140328][T30503] pv_native_safe_halt+0x13/0x20 [ 3608.145327][T30503] default_idle+0x13/0x20 [ 3608.149719][T30503] default_idle_call+0x73/0xb0 [ 3608.154545][T30503] do_idle+0x1be/0x4d0 [ 3608.158674][T30503] cpu_startup_entry+0x44/0x60 [ 3608.163499][T30503] start_secondary+0x101/0x110 [ 3608.168357][T30503] common_startup_64+0x13e/0x147 [ 3608.173363][T30503] [ 3608.173363][T30503] to a SOFTIRQ-irq-unsafe lock: [ 3608.180375][T30503] (tasklist_lock){.+.+}-{3:3} [ 3608.180393][T30503] [ 3608.180393][T30503] ... which became SOFTIRQ-irq-unsafe at: [ 3608.192988][T30503] ... [ 3608.192994][T30503] lock_acquire+0x107/0x340 [ 3608.200113][T30503] _raw_read_lock+0x36/0x50 [ 3608.204682][T30503] __do_wait+0xde/0x740 [ 3608.208902][T30503] do_wait+0x1e8/0x4f0 [ 3608.213034][T30503] kernel_wait+0xab/0x170 [ 3608.217428][T30503] call_usermodehelper_exec_work+0xbe/0x230 [ 3608.223383][T30503] process_scheduled_works+0xad1/0x1770 [ 3608.228989][T30503] worker_thread+0x8a0/0xda0 [ 3608.233644][T30503] kthread+0x711/0x8a0 [ 3608.237799][T30503] ret_from_fork+0x510/0xa50 [ 3608.242453][T30503] ret_from_fork_asm+0x1a/0x30 [ 3608.247283][T30503] [ 3608.247283][T30503] other info that might help us debug this: [ 3608.247283][T30503] [ 3608.257484][T30503] Chain exists of: [ 3608.257484][T30503] &client->buffer_lock --> &new->fa_lock --> tasklist_lock [ 3608.257484][T30503] [ 3608.270577][T30503] Possible interrupt unsafe locking scenario: [ 3608.270577][T30503] [ 3608.278873][T30503] CPU0 CPU1 [ 3608.284215][T30503] ---- ---- [ 3608.289557][T30503] lock(tasklist_lock); [ 3608.293782][T30503] local_irq_disable(); [ 3608.300509][T30503] lock(&client->buffer_lock); [ 3608.307860][T30503] lock(&new->fa_lock); [ 3608.314596][T30503] [ 3608.318026][T30503] lock(&client->buffer_lock); [ 3608.323027][T30503] [ 3608.323027][T30503] *** DEADLOCK *** [ 3608.323027][T30503] [ 3608.331141][T30503] 7 locks held by syz.2.15997/30503: [ 3608.336397][T30503] #0: ffff888145b1f118 (&evdev->mutex){+.+.}-{4:4}, at: evdev_write+0x1a1/0x480 [ 3608.345506][T30503] #1: ffff888144a93230 (&dev->event_lock#2){..-.}-{3:3}, at: input_inject_event+0xa5/0x340 [ 3608.355573][T30503] #2: ffffffff8df41aa0 (rcu_read_lock){....}-{1:3}, at: input_inject_event+0xb6/0x340 [ 3608.365202][T30503] #3: ffffffff8df41aa0 (rcu_read_lock){....}-{1:3}, at: input_pass_values+0x8d/0x890 [ 3608.374744][T30503] #4: ffffffff8df41aa0 (rcu_read_lock){....}-{1:3}, at: evdev_events+0x79/0x340 [ 3608.383848][T30503] #5: ffff88801fb22028 (&client->buffer_lock){..-.}-{3:3}, at: evdev_pass_values+0xb9/0xbd0 [ 3608.393996][T30503] #6: ffffffff8df41aa0 (rcu_read_lock){....}-{1:3}, at: kill_fasync+0x53/0x4d0 [ 3608.403137][T30503] [ 3608.403137][T30503] the dependencies between SOFTIRQ-irq-safe lock and the holding lock: [ 3608.413515][T30503] -> (&client->buffer_lock){..-.}-{3:3} { [ 3608.419218][T30503] IN-SOFTIRQ-W at: [ 3608.423171][T30503] lock_acquire+0x107/0x340 [ 3608.429303][T30503] _raw_spin_lock+0x2e/0x40 [ 3608.435437][T30503] evdev_pass_values+0xb9/0xbd0 [ 3608.441913][T30503] evdev_events+0x1e6/0x340 [ 3608.448042][T30503] input_pass_values+0x288/0x890 [ 3608.454608][T30503] input_event_dispose+0x3e5/0x6b0 [ 3608.461344][T30503] input_event+0x89/0xe0 [ 3608.467213][T30503] hidinput_hid_event+0x145e/0x1e50 [ 3608.474039][T30503] hid_process_event+0x4be/0x620 [ 3608.480599][T30503] hid_input_array_field+0x41c/0x5f0 [ 3608.487509][T30503] hid_report_raw_event+0xdd9/0x1720 [ 3608.494419][T30503] hid_input_report+0x44b/0x580 [ 3608.500894][T30503] hid_irq_in+0x47e/0x6d0 [ 3608.506844][T30503] __usb_hcd_giveback_urb+0x376/0x540 [ 3608.513843][T30503] dummy_timer+0x85f/0x45b0 [ 3608.519975][T30503] __hrtimer_run_queues+0x51c/0xc30 [ 3608.526797][T30503] hrtimer_run_softirq+0x187/0x2b0 [ 3608.533544][T30503] handle_softirqs+0x22b/0x7c0 [ 3608.539953][T30503] __irq_exit_rcu+0x60/0x150 [ 3608.546171][T30503] irq_exit_rcu+0x9/0x30 [ 3608.552038][T30503] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 3608.559296][T30503] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 3608.566901][T30503] pv_native_safe_halt+0x13/0x20 [ 3608.573481][T30503] default_idle+0x13/0x20 [ 3608.579436][T30503] default_idle_call+0x73/0xb0 [ 3608.585831][T30503] do_idle+0x1be/0x4d0 [ 3608.591527][T30503] cpu_startup_entry+0x44/0x60 [ 3608.597914][T30503] start_secondary+0x101/0x110 [ 3608.604315][T30503] common_startup_64+0x13e/0x147 [ 3608.610890][T30503] INITIAL USE at: [ 3608.614759][T30503] lock_acquire+0x107/0x340 [ 3608.620799][T30503] _raw_spin_lock+0x2e/0x40 [ 3608.626844][T30503] evdev_pass_values+0xb9/0xbd0 [ 3608.633234][T30503] evdev_events+0x1e6/0x340 [ 3608.639284][T30503] input_pass_values+0x288/0x890 [ 3608.645784][T30503] input_event_dispose+0x330/0x6b0 [ 3608.652444][T30503] input_inject_event+0x1dd/0x340 [ 3608.659017][T30503] evdev_write+0x2fc/0x480 [ 3608.664977][T30503] vfs_write+0x27e/0xb30 [ 3608.670761][T30503] ksys_write+0x145/0x250 [ 3608.676630][T30503] do_syscall_64+0xec/0xf80 [ 3608.682669][T30503] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 3608.690102][T30503] } [ 3608.692580][T30503] ... key at: [] evdev_open.__key.26+0x0/0x20 [ 3608.700709][T30503] [ 3608.700709][T30503] the dependencies between the lock to be acquired [ 3608.700716][T30503] and SOFTIRQ-irq-unsafe lock: [ 3608.714182][T30503] -> (tasklist_lock){.+.+}-{3:3} { [ 3608.719461][T30503] HARDIRQ-ON-R at: [ 3608.723591][T30503] lock_acquire+0x107/0x340 [ 3608.730072][T30503] _raw_read_lock+0x36/0x50 [ 3608.736555][T30503] __do_wait+0xde/0x740 [ 3608.742689][T30503] do_wait+0x1e8/0x4f0 [ 3608.748735][T30503] kernel_wait+0xab/0x170 [ 3608.755074][T30503] call_usermodehelper_exec_work+0xbe/0x230 [ 3608.762940][T30503] process_scheduled_works+0xad1/0x1770 [ 3608.770458][T30503] worker_thread+0x8a0/0xda0 [ 3608.777020][T30503] kthread+0x711/0x8a0 [ 3608.783065][T30503] ret_from_fork+0x510/0xa50 [ 3608.789629][T30503] ret_from_fork_asm+0x1a/0x30 [ 3608.796372][T30503] SOFTIRQ-ON-R at: [ 3608.800513][T30503] lock_acquire+0x107/0x340 [ 3608.806992][T30503] _raw_read_lock+0x36/0x50 [ 3608.813480][T30503] __do_wait+0xde/0x740 [ 3608.819613][T30503] do_wait+0x1e8/0x4f0 [ 3608.825657][T30503] kernel_wait+0xab/0x170 [ 3608.831968][T30503] call_usermodehelper_exec_work+0xbe/0x230 [ 3608.839839][T30503] process_scheduled_works+0xad1/0x1770 [ 3608.847363][T30503] worker_thread+0x8a0/0xda0 [ 3608.853928][T30503] kthread+0x711/0x8a0 [ 3608.859979][T30503] ret_from_fork+0x510/0xa50 [ 3608.866538][T30503] ret_from_fork_asm+0x1a/0x30 [ 3608.873278][T30503] INITIAL USE at: [ 3608.877340][T30503] lock_acquire+0x107/0x340 [ 3608.883734][T30503] _raw_write_lock_irq+0x3d/0x50 [ 3608.890561][T30503] copy_process+0x2185/0x3950 [ 3608.897126][T30503] kernel_clone+0x21e/0x820 [ 3608.903541][T30503] user_mode_thread+0xdd/0x140 [ 3608.910192][T30503] rest_init+0x23/0x300 [ 3608.916238][T30503] start_kernel+0x381/0x3d0 [ 3608.922627][T30503] x86_64_start_reservations+0x24/0x30 [ 3608.929979][T30503] x86_64_start_kernel+0x143/0x1c0 [ 3608.936979][T30503] common_startup_64+0x13e/0x147 [ 3608.943808][T30503] INITIAL READ USE at: [ 3608.948288][T30503] lock_acquire+0x107/0x340 [ 3608.955111][T30503] _raw_read_lock+0x36/0x50 [ 3608.961940][T30503] __do_wait+0xde/0x740 [ 3608.968419][T30503] do_wait+0x1e8/0x4f0 [ 3608.974813][T30503] kernel_wait+0xab/0x170 [ 3608.981466][T30503] call_usermodehelper_exec_work+0xbe/0x230 [ 3608.989676][T30503] process_scheduled_works+0xad1/0x1770 [ 3608.997542][T30503] worker_thread+0x8a0/0xda0 [ 3609.004453][T30503] kthread+0x711/0x8a0 [ 3609.010842][T30503] ret_from_fork+0x510/0xa50 [ 3609.017750][T30503] ret_from_fork_asm+0x1a/0x30 [ 3609.024838][T30503] } [ 3609.027487][T30503] ... key at: [] tasklist_lock+0x18/0x40 [ 3609.035355][T30503] ... acquired at: [ 3609.039306][T30503] _raw_read_lock+0x36/0x50 [ 3609.043962][T30503] send_sigio+0x101/0x370 [ 3609.048442][T30503] kill_fasync+0x24d/0x4d0 [ 3609.053015][T30503] lease_break_callback+0x26/0x30 [ 3609.058191][T30503] __break_lease+0x730/0x1620 [ 3609.063060][T30503] vfs_truncate+0x428/0x520 [ 3609.067709][T30503] do_sys_truncate+0xdb/0x190 [ 3609.072533][T30503] __x64_sys_truncate+0x5b/0x70 [ 3609.077532][T30503] do_syscall_64+0xec/0xf80 [ 3609.082183][T30503] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 3609.088225][T30503] [ 3609.090533][T30503] -> (&f_owner->lock){....}-{3:3} { [ 3609.095805][T30503] INITIAL USE at: [ 3609.099758][T30503] lock_acquire+0x107/0x340 [ 3609.105972][T30503] _raw_write_lock_irq+0x3d/0x50 [ 3609.112620][T30503] __f_setown+0x67/0x370 [ 3609.118577][T30503] f_setown+0x23a/0x300 [ 3609.124447][T30503] sock_ioctl+0x5c5/0x790 [ 3609.130490][T30503] __se_sys_ioctl+0xfc/0x170 [ 3609.136796][T30503] do_syscall_64+0xec/0xf80 [ 3609.143015][T30503] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 3609.150623][T30503] INITIAL READ USE at: [ 3609.155017][T30503] lock_acquire+0x107/0x340 [ 3609.161666][T30503] _raw_read_lock_irqsave+0x48/0x60 [ 3609.169040][T30503] send_sigurg+0x55/0x420 [ 3609.175521][T30503] sk_send_sigurg+0x6c/0x2e0 [ 3609.182262][T30503] tcp_check_urg+0x200/0x760 [ 3609.189001][T30503] tcp_urg+0x164/0x3f0 [ 3609.195244][T30503] tcp_rcv_established+0xf4c/0x2580 [ 3609.202593][T30503] tcp_v4_do_rcv+0xa90/0x1430 [ 3609.209418][T30503] __release_sock+0x265/0x3a0 [ 3609.216245][T30503] release_sock+0x5f/0x1f0 [ 3609.222805][T30503] tcp_sendmsg+0x39/0x50 [ 3609.229199][T30503] __sock_sendmsg+0x19c/0x270 [ 3609.236025][T30503] __sys_sendto+0x3bd/0x520 [ 3609.242674][T30503] __x64_sys_sendto+0xde/0x100 [ 3609.249582][T30503] do_syscall_64+0xec/0xf80 [ 3609.256232][T30503] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 3609.264272][T30503] } [ 3609.266832][T30503] ... key at: [] file_f_owner_allocate.__key+0x0/0x20 [ 3609.275750][T30503] ... acquired at: [ 3609.279613][T30503] _raw_read_lock_irqsave+0x48/0x60 [ 3609.284967][T30503] send_sigio+0x38/0x370 [ 3609.289363][T30503] kill_fasync+0x24d/0x4d0 [ 3609.293932][T30503] lease_break_callback+0x26/0x30 [ 3609.299107][T30503] __break_lease+0x730/0x1620 [ 3609.303933][T30503] vfs_truncate+0x428/0x520 [ 3609.308607][T30503] do_sys_truncate+0xdb/0x190 [ 3609.313431][T30503] __x64_sys_truncate+0x5b/0x70 [ 3609.318436][T30503] do_syscall_64+0xec/0xf80 [ 3609.323090][T30503] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 3609.329143][T30503] [ 3609.331443][T30503] -> (&new->fa_lock){...-}-{3:3} { [ 3609.336542][T30503] IN-SOFTIRQ-R at: [ 3609.340510][T30503] lock_acquire+0x107/0x340 [ 3609.346650][T30503] _raw_read_lock_irqsave+0x48/0x60 [ 3609.353496][T30503] kill_fasync+0x199/0x4d0 [ 3609.359551][T30503] sock_wake_async+0x137/0x160 [ 3609.365949][T30503] sock_def_readable+0x3c1/0x530 [ 3609.372516][T30503] packet_rcv+0x11e1/0x1730 [ 3609.378649][T30503] __netif_receive_skb+0x164/0x380 [ 3609.385391][T30503] process_backlog+0x54f/0x1340 [ 3609.391868][T30503] __napi_poll+0xae/0x320 [ 3609.397824][T30503] net_rx_action+0x64a/0xe00 [ 3609.404041][T30503] handle_softirqs+0x22b/0x7c0 [ 3609.410431][T30503] do_softirq+0x76/0xd0 [ 3609.416209][T30503] __local_bh_enable_ip+0xf8/0x130 [ 3609.422942][T30503] __dev_queue_xmit+0x19cb/0x31c0 [ 3609.429595][T30503] batadv_send_skb_packet+0x418/0x690 [ 3609.436592][T30503] batadv_iv_send_outstanding_bat_ogm_packet+0x62f/0x7e0 [ 3609.445245][T30503] process_scheduled_works+0xad1/0x1770 [ 3609.452415][T30503] worker_thread+0x8a0/0xda0 [ 3609.458627][T30503] kthread+0x711/0x8a0 [ 3609.464326][T30503] ret_from_fork+0x510/0xa50 [ 3609.470539][T30503] ret_from_fork_asm+0x1a/0x30 [ 3609.476931][T30503] INITIAL USE at: [ 3609.480800][T30503] lock_acquire+0x107/0x340 [ 3609.486851][T30503] _raw_write_lock_irq+0x3d/0x50 [ 3609.493351][T30503] fasync_remove_entry+0xf1/0x1c0 [ 3609.499915][T30503] pipe_fasync+0xa9/0x1e0 [ 3609.505785][T30503] __fput+0x8a2/0xa70 [ 3609.511306][T30503] task_work_run+0x1d4/0x260 [ 3609.517436][T30503] exit_to_user_mode_loop+0xef/0x4e0 [ 3609.524259][T30503] do_syscall_64+0x2c1/0xf80 [ 3609.530385][T30503] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 3609.537814][T30503] INITIAL READ USE at: [ 3609.542119][T30503] lock_acquire+0x107/0x340 [ 3609.548595][T30503] _raw_read_lock_irqsave+0x48/0x60 [ 3609.555771][T30503] kill_fasync+0x199/0x4d0 [ 3609.562162][T30503] sock_wake_async+0x137/0x160 [ 3609.568900][T30503] sock_def_write_space+0x390/0x430 [ 3609.576074][T30503] kcm_sendmsg+0x2851/0x2ad0 [ 3609.582637][T30503] __sock_sendmsg+0x21c/0x270 [ 3609.589292][T30503] sock_write_iter+0x279/0x360 [ 3609.596035][T30503] io_write+0xb33/0x16d0 [ 3609.602249][T30503] __io_issue_sqe+0x181/0x4b0 [ 3609.608898][T30503] io_issue_sqe+0x165/0x1060 [ 3609.615462][T30503] io_submit_sqes+0xbf4/0x2140 [ 3609.622200][T30503] __se_sys_io_uring_enter+0x2e0/0x2b60 [ 3609.629725][T30503] do_syscall_64+0xec/0xf80 [ 3609.636203][T30503] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 3609.644068][T30503] } [ 3609.646544][T30503] ... key at: [] fasync_insert_entry.__key+0x0/0x20 [ 3609.655191][T30503] ... acquired at: [ 3609.658970][T30503] _raw_read_lock_irqsave+0x48/0x60 [ 3609.664343][T30503] kill_fasync+0x199/0x4d0 [ 3609.668914][T30503] evdev_pass_values+0x627/0xbd0 [ 3609.674000][T30503] evdev_events+0x1e6/0x340 [ 3609.678649][T30503] input_pass_values+0x288/0x890 [ 3609.683745][T30503] input_event_dispose+0x330/0x6b0 [ 3609.689010][T30503] input_inject_event+0x1dd/0x340 [ 3609.694189][T30503] evdev_write+0x2fc/0x480 [ 3609.698769][T30503] vfs_write+0x27e/0xb30 [ 3609.703158][T30503] ksys_write+0x145/0x250 [ 3609.707635][T30503] do_syscall_64+0xec/0xf80 [ 3609.712290][T30503] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 3609.718328][T30503] [ 3609.720629][T30503] [ 3609.720629][T30503] stack backtrace: [ 3609.726497][T30503] CPU: 1 UID: 0 PID: 30503 Comm: syz.2.15997 Tainted: G L syzkaller #0 PREEMPT(full) [ 3609.726514][T30503] Tainted: [L]=SOFTLOCKUP [ 3609.726518][T30503] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 3609.726526][T30503] Call Trace: [ 3609.726532][T30503] [ 3609.726539][T30503] dump_stack_lvl+0xe8/0x150 [ 3609.726553][T30503] __lock_acquire+0x2a95/0x2cf0 [ 3609.726569][T30503] ? kill_fasync+0x199/0x4d0 [ 3609.726583][T30503] lock_acquire+0x107/0x340 [ 3609.726593][T30503] ? kill_fasync+0x199/0x4d0 [ 3609.726608][T30503] ? do_raw_spin_lock+0x121/0x290 [ 3609.726622][T30503] ? evdev_pass_values+0xb9/0xbd0 [ 3609.726633][T30503] _raw_read_lock_irqsave+0x48/0x60 [ 3609.726650][T30503] ? kill_fasync+0x199/0x4d0 [ 3609.726664][T30503] kill_fasync+0x199/0x4d0 [ 3609.726679][T30503] ? kill_fasync+0x53/0x4d0 [ 3609.726693][T30503] evdev_pass_values+0x627/0xbd0 [ 3609.726704][T30503] ? evdev_pass_values+0x5e1/0xbd0 [ 3609.726715][T30503] evdev_events+0x1e6/0x340 [ 3609.726724][T30503] ? evdev_events+0x79/0x340 [ 3609.726733][T30503] ? input_pass_values+0x8d/0x890 [ 3609.726748][T30503] input_pass_values+0x288/0x890 [ 3609.726765][T30503] ? input_handle_event+0x70c/0xf30 [ 3609.726778][T30503] input_event_dispose+0x330/0x6b0 [ 3609.726792][T30503] input_inject_event+0x1dd/0x340 [ 3609.726805][T30503] ? input_inject_event+0xb6/0x340 [ 3609.726831][T30503] evdev_write+0x2fc/0x480 [ 3609.726842][T30503] ? __pfx_evdev_write+0x10/0x10 [ 3609.726852][T30503] ? bpf_lsm_file_permission+0x9/0x20 [ 3609.726863][T30503] ? security_file_permission+0x75/0x290 [ 3609.726874][T30503] ? rw_verify_area+0x255/0x4d0 [ 3609.726890][T30503] ? __pfx_evdev_write+0x10/0x10 [ 3609.726900][T30503] vfs_write+0x27e/0xb30 [ 3609.726911][T30503] ? __pfx_vfs_write+0x10/0x10 [ 3609.726920][T30503] ? __fget_files+0x2a/0x420 [ 3609.726934][T30503] ? __fget_files+0x2a/0x420 [ 3609.726946][T30503] ? __fget_files+0x3a0/0x420 [ 3609.726957][T30503] ? __fget_files+0x2a/0x420 [ 3609.726971][T30503] ksys_write+0x145/0x250 [ 3609.726981][T30503] ? __pfx_ksys_write+0x10/0x10 [ 3609.726992][T30503] do_syscall_64+0xec/0xf80 [ 3609.727002][T30503] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 3609.727013][T30503] ? trace_irq_disable+0x37/0x100 [ 3609.727026][T30503] ? clear_bhb_loop+0x60/0xb0 [ 3609.727038][T30503] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 3609.727048][T30503] RIP: 0033:0x7fb20758f749 [ 3609.727060][T30503] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 3609.727069][T30503] RSP: 002b:00007fb2083a0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 3609.727086][T30503] RAX: ffffffffffffffda RBX: 00007fb2077e5fa0 RCX: 00007fb20758f749 [ 3609.727094][T30503] RDX: 0000000000001068 RSI: 0000200000000040 RDI: 0000000000000005 [ 3609.727101][T30503] RBP: 00007fb207613f91 R08: 0000000000000000 R09: 0000000000000000 [ 3609.727108][T30503] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 3609.727115][T30503] R13: 00007fb2077e6038 R14: 00007fb2077e5fa0 R15: 00007fb20790fa28 [ 3609.727126][T30503] [ 3610.157921][T29930] usb 6-1: USB disconnect, device number 87 [ 3610.165917][T29930] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 3610.191029][T29930] cp210x 6-1:0.0: device disconnected [ 3610.243141][T30487] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3610.254499][T30487] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3610.316633][T30507] netlink: 6 bytes leftover after parsing attributes in process `syz.8.15990'. [ 3610.325786][T30507] A link change request failed with some changes committed already. Interface vxcan1 may have been left with an inconsistent configuration, please check. [ 3610.333663][T27097] usb 4-1: new high-speed USB device number 112 using dummy_hcd [ 3610.503557][T27097] usb 4-1: Using ep0 maxpacket: 8 [ 3610.512315][T27097] usb 4-1: New USB device found, idVendor=0ccd, idProduct=10a3, bcdDevice=23.a2 [ 3610.521480][T27097] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3610.529596][T27097] usb 4-1: Product: syz [ 3610.533938][T27097] usb 4-1: Manufacturer: syz [ 3610.538540][T27097] usb 4-1: SerialNumber: syz [ 3610.545640][T27097] usb 4-1: config 0 descriptor?? [ 3610.802918][T27097] usb 4-1: dvb_usb_v2: found a 'Terratec H7' in warm state [ 3611.425832][T23180] usb 9-1: USB disconnect, device number 121 [ 3611.655503][T27097] usb write operation failed. (-71) [ 3611.664039][T27097] usb 4-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 3611.674659][T27097] dvbdev: DVB: registering new adapter (Terratec H7) [ 3611.681343][T27097] usb 4-1: media controller created [ 3611.687211][T27097] usb read operation failed. (-71) [ 3611.692569][T27097] usb write operation failed. (-71) [ 3611.699606][T27097] dvb_usb_az6007 4-1:0.0: probe with driver dvb_usb_az6007 failed with error -5 [ 3611.711223][T27097] usb 4-1: USB disconnect, device number 112