last executing test programs: 1m3.44569207s ago: executing program 2 (id=9): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000880)=ANY=[@ANYBLOB="60010000100001000000000000000000ac14144400"/32, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ffffffff0000000000000000000000000000000032000000fc01000000000000000000000000400000000000000000000000000000000000000000000000000004000000000000000000000000000000fcffffffffffffff00000000000000000000000000000000c73b0000000000000700000000000000070000800000000000000000000000000200000054000000ffffffff2abd7000030080000200020057000000000000001c00170000fce52da9549e414a00000000000000000000000000000005002100020000004c0014"], 0x160}}, 0x4004004) 1m3.438675515s ago: executing program 2 (id=10): r0 = syz_open_dev$loop(&(0x7f0000000080), 0x47ffffa, 0x122c42) ioctl$BLKOPENZONE(r0, 0x40101286, &(0x7f0000000000)={0x8001, 0xbc9}) (async) ioctl$BLKOPENZONE(r0, 0x40101286, &(0x7f0000000000)={0x8001, 0xbc9}) 1m3.34509109s ago: executing program 2 (id=11): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/block/nullb0/queue/nr_requests\x00', 0x2, 0x3a) write(r0, &(0x7f00000001c0)='1', 0x1) mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil) (async) mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil) r1 = memfd_create(&(0x7f0000000440)='\xfd\x0fm3#/\x00n\xaa\xaa\xe4\x01U\x8b\xc2\f\x03\x19\x9c\x8e\xcb\x90\x00\x00\xaegQ\x0e\x94\\y\x0fU2@\'\x8a\x80\x00$\x12\xfc\xe4.)\x9b\xf2@\xf0\xe0\xdb\x1f\xe6\xb4gc\x13\xda\xf9\xcd7el\xb7\xe6\b\x00\x00\x00\x00\xef\xff\x00vob/~\xc2\x00\b\x00\x00\x00\x00\x00\x00 \xff\xf1\xdem\x9c;%\xb5\"\xe4\xf1x2\x8a\x19p\x04\\\xaa-\x93\xd1\xc4 )\xbfK\xf7E\xf3\x05\xa0\xd0\xe6%\x97\x15\xf0\xab\x86\x90k\x10\xcer\x14\xe0a\xaf\xab\xfe\xd9V\x19\xa5d\x16\x8e]:3\xff\t\xe6\xf7\xb3\xbf\xa3\b[?\xb5\x14t\xd3\x8e\xc0\xe8\xefd\x88\xddz\xa25)\x17\xef\xfb4\xff\xdb\t\x8e\xeb\x1d\\\xf9\x14\xc7\v\xa8\x89\xdb A\xbaBAj\xfe\x18\xc3-+\xd6\xb0K\xee\x1b+\xc7lA\x84\xa6\xfe\x8bU<&\x1a\xe7m\x86\xb7\xa1A\xf9\x02S;C\x99\a.$K\x833\x82\x7f\x1b\'nj\x06\b\xb7\xe8] \x87A[y\xdc\x14\f\xcet\x00\x1f\x0f\xef\xca\xcfz\x7f\an0\xebB\xb8}&\xdd\xc9\xa7\x1dp\t\x9a\xceb \x81\xaaq{H\x88\xdf\xf8\x80\\\x1c8\xfe\xc4\xe3\xb0\x90\xcb\x8b1r\x94\x9f\x00\xce\xc8\xc3\x84\xa0\xc9\b\x00uKs\xba\xbbC6\xd6\x13\xb5\xe086EzD\x18\xd5\x16\x88E\xc6\xf0A9\xf1u\xb3\x85\x02\x12\\Sp\xf4\x9a\xe8\x96^\xe6\xa8K\x12\b}\xff\xcb{\xc6\xf6\xb4\x8b\xb6\xa8Y\xf2\x91\xeeR\v#\xb5)\xb0\x99\x9b-p\xe3\x17\x04\xb0\xdc\x0fk\x11\xe1\x9a\a\x16\xb7\x9b\x88\xfa\x1e`\x84$\xfc\xd7\xf5^X\xd8[}\x032\xd0\x84\xdby\x94Vp\xa5\xcd(\xab\xb6\x95sR\xab\xfc\x8c\'\x9c\x16Q\xad\xbc\xb04%\xb7\xe5\x141<\xd9\xad\x9f\x12@!\xfaI\x88\xab\xef\x86\xe9\a>\xdd7\xb7\x8e\x9c0-o\xc9\xec_|\x02\xc8Ru\x95\xa8#U\xd6J\x87\xf6X\xb6{\x11$\x00\xc8\x14\xcb\xd1nK\xd8\xb9\x0e\x9bA\xed\xbcs\x1fS\r\x12O\x83\x15\xcb(\xdb\xb1S\x1f%\x04\x9a\xa0l\xa3}\xe7r\xe26 \x19k&.\x7f\x1d~\xdaI\xd4\x99\a+\xdf]\xbc\xa6\xc3\x0f\x99W\x9c-t\v\xc7J\xfd\x91\x853\xd1j;\x19W\x96V\x8az+\xf9\x82#\xfaC\xa3YN:\xe8\xda\xbc\xb2h\x8f\xe0\xc6d\x96\xccy\xb3\xc2\x98\x1c\xca\xde\"\xaeW\x89\x83\xc2sB\xe7\b\x9b9~}\xc2\xb3\x1d\xcc?\xd1\x89\xef\xca\x00\x00\x00\x00\x00\x00\x00\x00\x00J[\xc4\x04\xc1\xa6\x10\xc2\x9d\x11\t|\xc0\t\xd9(\x80\xe6s\xaa\x88\x8a\xd6\xa2\x01\x10W]Z\x8d\xf7\xd1P\xf9d\x01|\xa3\x03hSq\x95\x8f\xe1J\xd3#/fcCz\xff\x80\xe2M\xa3-r\xf6\x1a\xd74\xdc\xe1\xe4\xc3\x9dU t}\x02\xb7>j0S\xf4\x98\x05\xb9\x15}\xfa\"\xdc\xc2r\xf9\a\xadnD\xb6\x06\xd3\'\x10\x9f|\x17\xd6\x89O\f\x98@\x85\xa5m\x9d\\&\x17o\x11Z=l\xfb\x93\x8exZ\x00'/1136, 0x8) fcntl$addseals(r1, 0x409, 0xa) mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x3000008, 0x11, r1, 0x5000) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$netlink(0x10, 0x3, 0xc) (async) r3 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r3, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r4 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000440)=ANY=[@ANYBLOB="14000000040000000800000006"], 0x48) bind$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0x0, 0x3, @empty}, 0x1c) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000200)={r4, &(0x7f0000000140), 0x0}, 0x20) (async) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000200)={r4, &(0x7f0000000140), 0x0}, 0x20) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r3) syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) (async) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) (async) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CONTROL_PORT_FRAME(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000002c0)={0x54, r8, 0x1, 0x70bd2a, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r9}, @val={0xc, 0x99, {0x7fff, 0x5f}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_FRAME={0x18, 0x33, @ctrl_frame=@bar={{}, {0xb}, @device_a, @broadcast, @compressed={{0x1, 0x0, 0x1, 0x0, 0xd}, {0xd, 0x5}}}}, @NL80211_ATTR_CONTROL_PORT_ETHERTYPE={0x6, 0x66, 0x88c7}]}, 0x54}, 0x1, 0x0, 0x0, 0x4008001}, 0x10) r10 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r10, 0x8933, &(0x7f0000001040)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_TID_CONFIG(r10, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f00000001c0)={0x28, r6, 0x1, 0x70bd22, 0x0, {{}, {@void, @void}}, [@NL80211_ATTR_TID_CONFIG={0x14, 0x11d, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0xf0}, @NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}]}]}]}, 0x28}, 0x1, 0x0, 0x0, 0xc081}, 0x4048090) (async) sendmsg$NL80211_CMD_SET_TID_CONFIG(r10, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f00000001c0)={0x28, r6, 0x1, 0x70bd22, 0x0, {{}, {@void, @void}}, [@NL80211_ATTR_TID_CONFIG={0x14, 0x11d, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0xf0}, @NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}]}]}]}, 0x28}, 0x1, 0x0, 0x0, 0xc081}, 0x4048090) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r3, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="200027bd7000fedbdf256200000008000300", @ANYRES32=r11, @ANYBLOB="32e88919fc148fc5"], 0x24}, 0x1, 0x0, 0x0, 0x40c0000}, 0x404c851) (async) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r3, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="200027bd7000fedbdf256200000008000300", @ANYRES32=r11, @ANYBLOB="32e88919fc148fc5"], 0x24}, 0x1, 0x0, 0x0, 0x40c0000}, 0x404c851) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000780)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_DELRULE={0x3c, 0x8, 0xa, 0x301, 0x0, 0x0, {0x0, 0x0, 0x3}, [@NFTA_RULE_ID={0x8}, @NFTA_RULE_POSITION={0xc, 0x6, 0x1, 0x0, 0x3}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x4}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x64}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000000) (async) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000780)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_DELRULE={0x3c, 0x8, 0xa, 0x301, 0x0, 0x0, {0x0, 0x0, 0x3}, [@NFTA_RULE_ID={0x8}, @NFTA_RULE_POSITION={0xc, 0x6, 0x1, 0x0, 0x3}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x4}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x64}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000000) 1m3.211672327s ago: executing program 2 (id=15): openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x40) mount$9p_virtio(&(0x7f0000000140), &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x2210088, 0x0) chdir(&(0x7f0000000100)='./file0\x00') (async) chdir(&(0x7f0000000100)='./file0\x00') r3 = socket$inet(0x2, 0x2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x80) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) (async) r4 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r4, &(0x7f0000000000)='3', 0x4e) r5 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$UI_DEV_SETUP(r5, 0x405c5503, &(0x7f0000000480)={{}, 'syz1\x00'}) ioctl$UI_DEV_CREATE(r5, 0x5501) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f0000000600)=@nat={'nat\x00', 0x670, 0x5, 0x510, 0x0, 0x228, 0xffffffff, 0x2e8, 0x3d0, 0x478, 0x478, 0xffffffff, 0x478, 0x478, 0x5, 0x0, {[{{@uncond, 0x0, 0x1f0, 0x228, 0x48, {}, [@common=@unspec=@string={{0xc0}, {0x5, 0xc, 'bm\x00', "0d01d3e4c6b2bfd892aa7400051624fa86999b13d39b99407a9b7abe75a728baa18da576811985de44110b8602025e1298ea55f1c5087ab16f67b18ca90ac68f0b3d6a068f727f7d23fa5fad26a59a5da2651212bdf9d29248ae63e2349b2470915eea2c39ade5129ff26b6fe772493180cfda2cdd49412e9469d85abdb467ba", 0x79, 0x2, {0x1}}}, @common=@unspec=@conntrack2={{0xc0}, {{@ipv6=@dev={0xfe, 0x80, '\x00', 0x10}, [0xffffff00, 0xffffffff, 0x0, 0xffffff00], @ipv4=@dev={0xac, 0x14, 0x14, 0x29}, [0x0, 0xffffff00, 0xff000000], @ipv6=@local, [0xff000000, 0xff, 0x0, 0xff], @ipv4=@broadcast, [0xffffffff, 0xffffff00, 0xff], 0x7, 0x1, 0x5c, 0x4e20, 0x4e22, 0x4e24, 0x4e24, 0x804, 0x20c0}, 0x80, 0x2}}]}, @REDIRECT={0x38, 'REDIRECT\x00', 0x0, {0x1, {0x2f, @rand_addr=0x64010100, @empty, @gre_key=0x1, @icmp_id=0x67}}}}, {{@uncond, 0x0, 0x98, 0xc0, 0x0, {}, [@common=@icmp={{0x28}, {0x10, "89ce", 0x1}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}, {{@ip={@multicast2, @broadcast, 0x0, 0x0, 'virt_wifi0\x00', 'veth1_vlan\x00', {}, {}, 0x0, 0x0, 0x40}, 0x0, 0xa0, 0xe8, 0x0, {}, [@common=@addrtype={{0x30}, {0x890, 0x218, 0x0, 0x1}}]}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0x16, @ipv6=@ipv4={'\x00', '\xff\xff', @empty}, @ipv6=@private1, @icmp_id=0x65, @port=0x4e21}}}, {{@ip={@private=0xa010100, @rand_addr, 0x0, 0x0, 'nicvf0\x00', 'nr0\x00'}, 0x0, 0x70, 0xa8}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0x0, @rand_addr, @dev={0xac, 0x14, 0x14, 0x2a}, @icmp_id, @icmp_id}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x570) (async) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f0000000600)=@nat={'nat\x00', 0x670, 0x5, 0x510, 0x0, 0x228, 0xffffffff, 0x2e8, 0x3d0, 0x478, 0x478, 0xffffffff, 0x478, 0x478, 0x5, 0x0, {[{{@uncond, 0x0, 0x1f0, 0x228, 0x48, {}, [@common=@unspec=@string={{0xc0}, {0x5, 0xc, 'bm\x00', "0d01d3e4c6b2bfd892aa7400051624fa86999b13d39b99407a9b7abe75a728baa18da576811985de44110b8602025e1298ea55f1c5087ab16f67b18ca90ac68f0b3d6a068f727f7d23fa5fad26a59a5da2651212bdf9d29248ae63e2349b2470915eea2c39ade5129ff26b6fe772493180cfda2cdd49412e9469d85abdb467ba", 0x79, 0x2, {0x1}}}, @common=@unspec=@conntrack2={{0xc0}, {{@ipv6=@dev={0xfe, 0x80, '\x00', 0x10}, [0xffffff00, 0xffffffff, 0x0, 0xffffff00], @ipv4=@dev={0xac, 0x14, 0x14, 0x29}, [0x0, 0xffffff00, 0xff000000], @ipv6=@local, [0xff000000, 0xff, 0x0, 0xff], @ipv4=@broadcast, [0xffffffff, 0xffffff00, 0xff], 0x7, 0x1, 0x5c, 0x4e20, 0x4e22, 0x4e24, 0x4e24, 0x804, 0x20c0}, 0x80, 0x2}}]}, @REDIRECT={0x38, 'REDIRECT\x00', 0x0, {0x1, {0x2f, @rand_addr=0x64010100, @empty, @gre_key=0x1, @icmp_id=0x67}}}}, {{@uncond, 0x0, 0x98, 0xc0, 0x0, {}, [@common=@icmp={{0x28}, {0x10, "89ce", 0x1}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}, {{@ip={@multicast2, @broadcast, 0x0, 0x0, 'virt_wifi0\x00', 'veth1_vlan\x00', {}, {}, 0x0, 0x0, 0x40}, 0x0, 0xa0, 0xe8, 0x0, {}, [@common=@addrtype={{0x30}, {0x890, 0x218, 0x0, 0x1}}]}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0x16, @ipv6=@ipv4={'\x00', '\xff\xff', @empty}, @ipv6=@private1, @icmp_id=0x65, @port=0x4e21}}}, {{@ip={@private=0xa010100, @rand_addr, 0x0, 0x0, 'nicvf0\x00', 'nr0\x00'}, 0x0, 0x70, 0xa8}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0x0, @rand_addr, @dev={0xac, 0x14, 0x14, 0x2a}, @icmp_id, @icmp_id}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x570) r6 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./file0\x00', 0x2c41, 0x0) flock(r6, 0x2) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000180)=ANY=[@ANYBLOB="5a79687f", @ANYRES16=r7, @ANYBLOB="050000000000000000000600000008000300", @ANYRES32=r8, @ANYBLOB="0800050009000000"], 0x24}}, 0x0) prctl$PR_GET_SPECULATION_CTRL(0x35, 0x0, 0x10) r9 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000500)='status\x00') read$FUSE(r9, &(0x7f0000003240)={0x2020}, 0x2020) (async) read$FUSE(r9, &(0x7f0000003240)={0x2020}, 0x2020) sendmsg$NL80211_CMD_START_AP(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=ANY=[@ANYBLOB="80010000", @ANYRES16=r7, @ANYBLOB="050029bd7000000000000f00000008000300", @ANYRES32=r8, @ANYBLOB="4a010e0068000000ffffffffffff080211000000ce99a8ba822800000000000000000000640001002d1a02001d00000000000000a60200080004000000000009000000037206030303030303fb33a0b69e5e4e87ddf48cc4741e81ebc8fe15379b4932630ee3956b712e5b3c9b076b91d715fc2b6a8823ec4ebe63b399b0a9bcafd0f20957ab7ca922872ce9a58375e969b5a93a493572c3692ff88b1a0480a684420a2ea3b346897ccd120532997813beec8dcb46c9d978f6030430c20b68e90b2c5a842dc29cc201a2190ff012d93d20a2c08afcb704b20d664e998db5c10d8ece420dce5a8c585c4b737e7dbfbe2550e52ebae91304a865839503ea1fc39b5206691678c6bd4e95c4f3a23fb1e28581b06cb66316d5d8279579ee6363251a76e9100a9d01823ffa50550ce2bf4f66414eb177ce991c5190aee6a7a1aa66000008000c007f00000008000d000000000008007e00"/356], 0x180}}, 0x20000014) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) (async) r10 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r10, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) (async) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r10, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_NESTED_STATE(r10, 0x4080aebf, &(0x7f0000005700)=@vmx={0x100, 0x0, 0x2080, {0xfec00000, 0x2000, {}, 0x0, 0xfffffffffffffffe}, {"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fadb00", "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fe2d1f2b6255614c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001e0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c955000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000070000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200"}}) ioctl$KVM_RUN(r10, 0xae80, 0x0) (async) ioctl$KVM_RUN(r10, 0xae80, 0x0) 1m2.809182632s ago: executing program 2 (id=20): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10000, 0x5}) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, &(0x7f0000000c00)=ANY=[@ANYBLOB="56c78e3c733d76697274696f2c6e6f657874656e642c6163638173733d616e792c63616368653d667363616368652c76657273696f6e3d3970323030302e75"]) chdir(&(0x7f0000000000)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./file0\x00', 0x101c42, 0x13) write$binfmt_aout(r1, 0x0, 0xfffffee2) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) ioctl$F2FS_IOC_START_VOLATILE_WRITE(r3, 0xf503, 0x0) sendmsg$802154_raw(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)="c1e220d8", 0x4}, 0x1, 0x0, 0x0, 0x10011}, 0x24002094) sendmsg$NFT_BATCH(r2, 0x0, 0x0) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x2000006, 0x204031, 0xffffffffffffffff, 0xec776000) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) sendfile(r4, r4, 0x0, 0x200000) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r1) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r1, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="00022dbd7000fcdbdf25070036021af70000080001002d000000", @ANYRES32=r6, @ANYRES64=0x0], 0x30}, 0x1, 0x0, 0x0, 0x24004000}, 0x24008000) 1m1.266616511s ago: executing program 2 (id=32): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x11, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bf8100000000000007080000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018210000", @ANYRES32=r0, @ANYBLOB="0000000002000000b705000008c0000085000000a900000095"], &(0x7f0000000300)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) 1m1.211619424s ago: executing program 32 (id=32): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x11, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bf8100000000000007080000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018210000", @ANYRES32=r0, @ANYBLOB="0000000002000000b705000008c0000085000000a900000095"], &(0x7f0000000300)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) 30.365883221s ago: executing program 3 (id=466): mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) (async) syz_fuse_handle_req(r0, &(0x7f00000021c0)="56ee0eb18fdc2b4abe3a9adcf5ca937aa998df0e3a5e0cb6606898e1b6be21d543c3f27affd7e5cd83d90eaf1783cf18bfd6f670ccbefc76ce191414512228b25215527bb0754d8381d011100324e4f752ee3198041ed36cb1f36b88e2b808b221d8274e2a6c8aab7502c42d57379345effbf97600d2bb069c9a1b4fa584e026e3808e48672466caa95888ae10a70e63f016e38871f3367c890cfa5b52ae6c234b552967115b0c67d204005e1f2ea267b10295dd2098adbdb35f0caf56c48e6f85a0c66fc0548c17370ecd017f82b5d781d64cb3f3bfb381ebdec8c1aa4ffe70026d27e5059ed45611e6b0929062c2faa41148cc9a8173f0335675b320eb72505845481142760a37ac5a3b75a199f7d60595e1af54c8f4e8f00b1241b488e90171a2f53612c6c3264361de6eb67e2f205dc90456ce9c15fdfac56cf8dea12fd8081878fd55dd42919eef1ca1843cb04620abe484e8cd59bffe3209177025851d1a031a6f992fc760466b5e649832df873abcf59e4efac339940d288f94064ab49a41867987947817b8c57b442865a78cb8ea3b3dc3c5f7ad6924f72793213e359034de075c4a9cfd68c71b509cd4b6c7099430c9ebc0ebaf4f3321ce353a87d6e6cf00a30f49a6b5d01426f5138a4a1bf8f6488293bc6cfbe94c5338a27e9754a9b45566f98db6682356bd48d3939be3025e053bcfccb5385479fac0e03fd7bdf3403088b3f637b796cb749f87ca5844b6773e5eb7ea1424bedf6d5a860325f9466f6371b47c71b8d49804ee5f60f2108ffd24ea4a4023779b69ec7c7c4dff39ff5ed7e1cea10d87ba0a8bb8fd723e8af6ad0251925975c751803edab0217707352e5d7360141817fa990ffee2039f2eb6f91155cda5e627c9df4c1522ba07234b2d36f57633c74713a2bc4013641f098a90b25237830a4631cdd9cd675017faa10a65ebb21149797e7b35fb4c78189023c2cde3262fb64df0d350fd08a487d89f31e25b35756b61b214607905c88076d2df460175cb504250eb64cc79f4b12d9b863eafa6f987165472fa63dfb0e2876a8c3cc6592f093f751db210f63fb6e7392bc51696db34873c54d719ee83a788c0881e502061b3eb16a37acb641539dde57de6ffb244024b328ce0eddc3cdba7d09322563068fd5c979d5aaf3e5ed1f47db7e32a891e97345d4cfb7cde3f48a34a472b7162429140de2fbeaba46fc396cf3fbf44c79d9121218df6df74a7f77c9d17deb13c55fd08230cdbc387cc0510d0ab30231b91cc2a89a74e029352da65ed4f8405918b31c10c7f9b9ae2433c2822038e08307915a8364d6f5e0a189738a5868f4eb90cd048ab8792a520d19532943e326612ed90fdb84f37e830e82cc19494d03055f8af006edaa4f580507d1ab85859cd95eee30907cb308d3121806918d7c402759ea7f13a4b9a8e851de673bc49949810f62d7107906d4ee5ad06c07b69f4b0d6818b83ba5e230d54765a8d58c02b2e9ac61783ff3d998e55ae3132d42d0079bc1f3fec9886c4836c7390855c26f91be3e6d021b355e52d43da41d45382f2b2f63e57ebae580cdcbcb6fc3be47bd0df689af9280c52cf4576fcb47a0e0e9e772fdbc150008fe77ce39aa13eeb0088922ead0ed1a028fa3a237adc950ef5967a643e0867937523ca50928bdac4c53052a69f13eccc9738980d20cd33d625542061a541672974281f7f8120cd6703faf063d124cbe1ba8675a8bfff4c2ca694ff0cf91559dc05645aa2380b77efcb8a46641d40c2a32a1ab759a05908ab6aab9051a03514d7e19997de491b22747ec37614be17256c7047e6069eae0a35892cbac8c7431e45578e76f26c86a6f15dc52a2642e33d981bd828d5d4ed2c6d9ec1a1faeb09676f6409128206dcccb813dda6734335935f92eaa3334efafb1198ec534bed26453e6566dc6cfac17b001898898e2ac593408571fb60633fbcc302ccf0401b8510cc861e335ab0da99f7f50d51bb3227f4dce17cc4b9be4172d10e57b9fa2b0aa66efad83998f56f5a4cf11f1f98fb7366b38ff202099836d622ef36939538e0f11c8a42dc08d0b79d7395691bbef3c662f41f549cc676febde445b4364560d947d7bc7e0d41add0d0f85ccaaf91d8239e002a08f8ac7d9df8c673d01bd196df4c423ec5fcfb96c97c0b3972db0a66496b61463fa3b07582c1a803cd7c83e506c2adff1567b79cd1424967f03fa758c4fc6d7c40be5e1f2e1b3ac18e1a23d64351183c11597953eea585c66b5790ddf510339ff13b340370f4a47d1652441b3470dff9206fc11ac1b644a631fd4a785f2dd6acb34b8973ba3ce5f4c96f0b1aae80f26392c571baf1977cef3166b7589f854d651573e18be2afc6f76ec970fb1ebf7aa164e8384a439d98cb2a3ba0ca4cbefb54281b13dac9c2dc3fa4165eefe721bec06caeb906d41a51f2ce9f2d8e61ec44ebcfb9d9bd4ac5ab110d98f77f43c7f2dc9c373667b4e9be6dd8e3e354327a70d2f7a2881e43dfc58ed62eee993fb61424f5588b375761bdf7c677bbe582ace47ad7d31dc8c99fa1605ad4814bcd72e08965be24d043e9c4a2f3304da7b0e87d3374be27b7e8fee8dd67fc38bdb2a002d2d7e2f66a961de6c507f2376398e67c33f46bf9d35b99103156bdf7c5f1ccf1cc37cf854f25e47367f32a115b40a0e026df270e6f24f7407060f9c48e96a4856423a6b80f19ac99aa1ff0b2ee58479bcb8c689a5ee75e363e912b52c0c00ee95778987abd589bc2a49ee20da68e7d526445983733455536841f7528c6108b2461309415d455c9db75c93340248327a730bbcc12f8c2981c1de30fbbb39f2d72621e2a69b45642bab862c8ca1e7320a96ea156f578d986f81626d20feefaa175480b8f97f7788fd1e4ad6f2a6100f3460626fff1c10d7951f48a5baf9bd79f362757e0a4d4653c350b7b18c748aec29234252b35228e272f78d8399027ef87a4fb41b56cf887e05bb28df8d45b5bb3cb0aca835f94625d91b6e0d98917b0db244230ef01c24f66d2820d612340315312316fe7450710cee740e4760f181eed9ff68d97c3dfb16d5f30b00752888a0421c52382c5e62a546e27c543c6f53f7084ac2405bb88046c25a195210847d1f3aedb93ac9beab2fd18d9f7e3fd42176e7672d406b3f9e98afb688269ed88f4e638d7adba07d0113abea5e5d44eefa4768b3af62c8703903f874d839b685a38ec9387d600b64b631d3a2982d3c4e9deeec10d57d9a0391672512251c69d5cacf5f59d631f6a60b954cf76fa0c5f1183beb3b2b4df05c5db5f6c1f93b8ea10871b8a06e0309dee9a104e42a373980b0fa09e2e6b5b93ea0c4d94075cbc8dc2a15f599c9dc9d4afd74c6e31e17c9214126fd7c06255bbb7f52054572d9bbf0bc39455fc154db8cb62f1c62d578eacf1b311dc77ef94b888f0d470db70321ebf009c2114b4b54eacdd9a4bc62ce8c405298cd6f8a81aec5c041119761afda75fdcbca379181ed81721149e7c5f8ce7fa13c3c0e5aa18fcc0cf25650b03083f3ee2f894569ae376d8f02afb5c6246f7842c7a4a5c7e66ca217caae5de9597c2a637404117a2908b6e62c67d1979d65b286922440b1f51bd0ee626c1d90c907a5266305306a68f0ce58f4cf671977a8dade8d057263179f4bf2a95ca99a93b30e2382aef6e7ec7d8c85df77c502f4e6b893efa7ea93149e4f43154c9b10b6e910c2bb80f408461d46d700464bbda6bab876316a7642b35c04c3fa8311ca10bde92085876febf5416c9314615dfb3dd3796aafabbacdcb9221d0897fc42461fd65bb4464502a325b747b01f4d491401590d46a59862ca20add68c384dd8bf014420b8f597a17c08ae4fb995c7fa50a314573a00fed36919e1287ef497abdd83cd184e25f430cdf01f0c8eb666498212215d2c82ee22ee5dc22846505bab63b5cf82884e3f6ede444cf475ebd2aa215b8d0217bbed661d5e188fdb8768123b821d2d1c17fed7b8bb3c700cfeffb9bc0ad291c0dda2280c5a88f6708bb478da8503829420a805e0394905fae83aaf6df82bd459c364e59b06ca6807e54500eb98a9a476d28255a9e79448126c7e4c84cf576ffaecc66619259beadfc226b68277c7577d59b30a8396967aa10e1e2c28001c6150bb0b2adec519f2289e66a8979deebeb235009cdd7aa8bc2e56d99fb5df2ae6fb5375b15e370fc3954427a905a2c4fa6c9f41352b9ecf8523fb6a2e545115569090b6faf737bfa46f0eecf5960fafd7eb8ffd142121e543194522ee3a8a7481292b9de3c4857910e1ff92d77ba0d222fa4d96a3d73c0aa0c29116889328baf90f5f47e888cba050058f61eca7c8ba69bebb340584f6753aa47903c79f227c30f0dcfca9efb47c0b96710a03c1fb48b58955343d0b833279206be717bfd20a30fcde7d276bab5ac6b0e0c7d047309e62159adb067627742c2e85ffbed647c012c7badda2a767f67b6fd4458addfe22be9f4df26df5250b2b37d634be300f25af28d580e5837856c0106ba8c86759e3558b402a8af1b68d77eaa4ee96f703262cb931de32e5c26fda11f807e50e47eb559e0a93f91232a580c8f9000115b02a281114046d6becea0f2d54180c3932e31daf068f764e0e00f1eb84eda0d2cda65ad1a73cdacd433fedda1687680d10e528c76f2d41097bcd29302e48a7d8d5ad18c792af61c4851397d90f6ad589d84973eea600c3f0371a5ae6cd89b190bc1ff46abc8e9d1e651ef32e3b24e04a6d3acb56e40cc9990fc10bc2fcba8c15e35974377777229bcdab78c97b164bcc8f54927e3c4d5b6bb8a0d0b1838ae82bd532b61d0200f8658fb74fb397983a40f374dc2ac592965de3d802796e8d0194af8fe39b4275ffc77e1b7bb6ec4f0f443392b9d0d1da611fcd7d50a94a1b15c1932d3c18ef26c690bc1f945d2fa5d92ea1a79dff3b87881a7a0a81468f458cb465b7e5426571ac1fae1c8543efaf8279dd08a881c51e880301668b1d4c80410c569434d9bb316d3b6800288f512d853dc08c588fd243195476006e43b4b63d4737f7e07b3c208b79183f626e57d84e4a9ccf1ab809c8dbff940a3692433ebe279f2fda04a5a0f7fab0db8a69d3c21fc13f930b8467d1b0bf04a83838512a5f6abeee63f6f4c8d14f121fa20a54d3362de80553c1ce1b4f5fa56e6e09e003aa74868863f2c524d5260c08a55f137032b1e63ef171520784eedac95cc8b65e375cbd2464b9276e824ad9ee6e7484714ffcdc641938d0808182faf73ce69e030ee14e638e984df8450c7a932d31701a634560f542d7f4f69cee04e84e1a5cee7b21efb46f58dddd2ef010f579558b19228ad723573335d366d12ad9535b78ade0929f8d317d01aaa20059c176f7c515e89af0ab1f7404452323c8e0eacd7de8258864ed458a6e0429dbc35011664b99c485338d96ea0e3633be1e99075b6e59eeff74c5e02ebc7733c7e9a3388aab4f78f10abddee0931bef06fba2c60f577395ec679965b3c0419ef4fef1834ec0b9376f4fe7b6d22336d14d1c3b4fd153fcac0bdb00cce5712fdfd4723c477d73b68d82befa770af289150c4167ef73e9c400eed1dba8ae00ef26ea0dcef897ed97a8a496897b48c6f108910be4b06a2e11873255519c91b0f21b4e2e72c0b7fdeacf9d35e1e2cbe6a964fdac4a45b0bb59463878161345d7ed5b2ca5539ce5b2962f6f95ccde34ea733b11c8136fe8e38dadd11ababf99a9359ae4eda58f3fab87f21424595d025862c9707daa6ac113dbd67bc72cc40e9bcad5df435d3d1a725716c63001ec8011f61fa3e64596a1abd74e293d19d0fb5bbb55e1dba3ddf60bf0d3cb071d46a54d457b342e75c1840bec5cce853f969911005657062431183ddcb05579c02937f7d99614f56c353805fe016f662f63f2f2afafea8c7fa9a7aaa14649dbf5b9d6ad4c2f73dea8cf8abc32dd2cb198fe1cabea84c6e8ccd1c23608863f81dc5f107fb0ae2a93450749c14c016793f97f6f1197401ab0aeef043e653e6f37a9136bacff51c0bd9c7ca0bba75e562699d3a8f0bbd0710652aa5821ed0a2c766987654c5cdc36f5011c5243e9f3ed94f98505a36cbe15ff3687f35a32898a3633f38f192ab894dc298c2e43ba684078b3f2abfb9e6e4404abdbdbdc762136700a03b80537b9d9c791779a08ee78067a9f5ac95e3fe62f99609b22bace62254c944c05cec28c80ba2eff55a4eb827258399a4850f045d5f5a56d869af3864d7aa5b39adf35241f37f1f1af0162641543be4b973c20b55a6407d380d2c98434fdfc1a7228256dcd8394db180098a0bb0ebb24764de114181617337ada3424e8e9907991379af07f68afdb2835cbf5edd9e7901f521da5ad1c1694c703f9bc514f49cca3a5e2e45d56ff7f4200eb701a70048e849b8bd4c4fc041af056482a1d509da4c63106c811d9f5c5931d21dcdb071f1887557347e904ee9909eaec8e89760f424bf6abfdcafaafa1b605e164dfdcd3c4a3813579e6079de08a1812589e225a7ed855609b1b8e495c973423ae9a4d844fdba560635f2d64762931385e0ed259d4443d9a51ae4308487eaf68a07ce00b2ef63b69a779254a6eabdc96ffa7cbb63cf3ab1a60c38060668062706f4e793eb44f65b414677c740b6407182995172f3f5c8d5bc49b9ffba87f5820f2c14ecdf8762d7e074871618be608d364a8d8546171bbc915428ed79b3f663703a927802a8b918ef1f7a49ac81804e6216eae021e87f9e8329a19514f99c604692381b33cbf5255cc71dd00a629e447344b102ada3cd1caffb36dcc8fd6223475dbb54eba4fb0b5ccb1deaab8fc9ca3615eb8672f9738039eda2f0b375b56eb532283f57e53e237c6ad78e9b4e01b44519b88ef3e71a3d3f53682833e9c3177687e38f5026f9425d1a26d39a17d853e4f2504d4e99c38819759604ab7b9132425f208575f78b1fbaf50e5cbfca2b039f3d6b0d49b4821f3fe84a3b278b16544d7775abe6238911a5e646f5c3c43f784a7df597df6b9861e8edcf8f30f1453801ea43571f99d9c748b5dfb3a1d634dba463f559bd3c739bafec17771b62fd28b45bce1729db261019e0be7fb5e3633ed847d4edb1a09c0b6ad29e8954ac97b69fb642df99a5ba8ae4297a1edd221624b3966209b2565e5c0235005b818a7c28402420734a0281ee5e316caa1466a0b471c5e6c2edff2e9a1353560b9d2edc791913a45488681b5ddb0baf1c3d33a55123ca36b50982436c7951cadf82cb4cb8c5ec29f1773dafd7798f23b9c7395e55c95b91cdcbb34755c37ab9832ccbe9f611957451c5b3e107f6a9c47fa53a1a5a2ad9b014aa25623aec5a900868101841518cfaa75771d7d9ad90521843c91c4bee2f9d2d996b7982c35edaecbf37066a61ef463a9599c1aea7dbc406e1d404cb18ef0fd09b63638ee23cf6644b9cdcced37274b84910e30e134240be61d92c6d13311731e6649cdc2c41e6c4e7cc1a7a23bfebc022a80bdd41d2a9ef3fa52e1a4fe13946c5628b76d4ae2934a6c2a41550c8834181253e3ec0995b1919e217a262dda9769a55cf1332772ed66e0aca10ff043de96b97180db98d9d028d1d6d3e8003f3d64d0806ae778ca0b405d9a3fbe35bd56a80feb790339721d542110fcffd76eec7a5445a4fc2a05beca7396c95a384a07d62c6cea420d1555502e686200bfd1be74b39442ae599aa87e55a98cf9c43190809e858de95c3d93b4669d45d6b1a1bee9e61bf173d15c895f206e092d3c1befd5492adc6acfa2264f4978afb6cb22c94d45911db144de06f728316471a496475c816731e73e089a62e76a06bfc4e8fbe6ccb2012e65d7d7849883d79e498ed0d556f7632b27347aa89273454e82947cb2bcb19f4cb0161ead084ed2ff4833848e0af39c43ca461db1adbae58895622308e04c0ee2ad800668c070adc0e30f4d341c075d8f3f0f6e4c9c139a268c3f1ff99f79272e04816f1af14c40cf4d2d39d7bf792ead7f19b8dd61c0e5792556597b0df4ab9c543f2a35fbe495fe41dfa28da2722a8812f5a605347fdee5b9a479e7c8150e1f776ece273ef6faf33b041a45f66871f3694b5d7bb9aabcc99c308129a5d54d23060a35c0693229a49951b932c3e39389650cf9fdf405ca9ee659f7ab09be87141568d5f30ee8dac90e113e258b5611884d8bd95a99ced3120ca6e1eab2a516f7913e8f1c646c7f1f8f6e5d73044a4ddb34865b13165c41ba981c68668def249919d5ff6e19f81a6343e63ed54ed69b1d08f1853bed54ff61ef463d3ac442e1bf12308ad67e7aa71cafe1e6b416102d4307b96724fb8742e0d2562db37ee9ca22aeab5dea0e43b5d5244842497a5d4e4559a2756a6cd3f13ee2e2998fff77e6798f12632408a315f201596e6ccff0e0b43206d0c957760ac3d8d94948e994a651fa005b87b2d68ecf29973b335849f1a7f94897a0fe12dffb337868ebc5604fe9bd748bbb16f969f287f3d890141fd88696235f57d16531011286cb0e7868e0be8f24d76c94be6002e9ee302318f40095296ab9045c70e9999bcc85f1b9ce056a22f50a2f0326c898439d268070408e723425f3f6b9a94230c14e57438ef5bd1f37bde67c821f8a7ed587f1b1916a5af33c3f2549e7c9afe5860c3384676c88dffc0ee8ad6c51c5a4f737a2bfa2f62a20c8ac93714085396c05abc8b367183f921ade3e00a7d2258c6ea22c84aae115f1562854ef5e5392386aa0fbfffa19aafe5b77507db83fd239726670a4839cbab1bfadc311deed2bab5424614fb8ddd38e35386e913a0437edd2250d654f4723e561684df79b4cfc1b0e4891daad8078f628696288ed3ee12c296c502864f40dcf037552ec7bfb728e48e06fe585bfbc2dc6c1585a3c666373e1b5146e81a2f0f2b335290cec72a419a762d5f93926147804f892f7fa5664249eb6127c5a2bc16eb58071c3dac0ef64c8c5c6cc55be64957d6ae65c28e34ddc827a811b27227e232b31badb824cbe70d7cd33fb6f197e6f5b11333332c192bdf7c531bfda78f5d66bd568827c4064d14ad9225564b8edbc5f57c8f7ddc0a4c9da621eccfdb5f3741976f2545ce88dbda9d709b973ce7b2ec656976ee878b7d51ea8764ad59637b2efe0b33dd1b8a0c280afa134e6645ccce24a83428b860adb8c3bd9785fe520da479d5d69187de50a4400d98b4e1969d291be535b3a5122216451920b38fbc5d1989ed3cf5cdf7dc40ec2fc509f4b6d9de1679a5a9091ed74e8b74d3ed66674ee33968ab0d146293c4c2afdfd0228f4eaf30ebddbe37a41cdb1e2952e422acd0dc09b999009da52979c07a1d7dcaa147ee3413b88bd43b27758a156daeb2e45fab8dcc2b7c159e560624d89f98307e00d47039e4e99e24fa75e07f04bf070aea8da15168fa41b5b2e897cb6eb8ddfe217cc75046ca844d8a76f71599396f32b22e1524d82a120f1651732a6adc1bad42b31fff37474e76662459b889b23cdc2b76eeba07e37975e3ee2512cddb75e7633c1d88e208f975c98fa226e432b1084257975bbc4c7c5f20f8654ef41909f783bb8859d043c3e0954ad7184836d630bc0fbe6aeb1afcc898cc25f508c25e2fa2149e81b8b0e2e19ef2b7f667fed59fc2d4aa5787948bb3c42984a06051ca9f4a927a128c5b40934fc615a904d45260d555341055827e095501642bd42aebb20f576232487ceeb077b04ed2f05ccea7918f4352eb6842fd2fb57c787db9aa85b0bbb1137fe1d25ccc61676bc0a9b73fa9343710f8ac03dfcf70a34002a7204e9b3a16d0c11e6093ffae49cf911164e4e98983d39de2d98a9a16d353dae51fa88a88cc7ae7566effc73e0994dcdcf3fdd005cecda75c132573d2f7997f7b4a23d1ec9a11fd23fca54550314110755ac34e1082a5b0a60f369a6711c78d3fb18cce37c416d99846c8ecd71a520ecf6841491b2aadafaeccafcb22bb62af851e892d1169254972a66a2a73538aa26235c95e901fc26ed43aff1999fccb34de44926de77cee704ff5297c97e72c266eb3d843c47840b4142991378fc3ae6de67aff89f14a69c40a94a01f9a1a84df53e748db99349f380664baf153e013dcf5039875a7f8e90be4871a3bab2a5055e410e968ea246c10944476118f11374be32905eeea1004df304020badd9a06243543f11aa4e3afd16eb38a1dc018573d6bb2bcd31dad3c6f622e00f0142c31029dc96f441854e7e70cf4b505fc16a92d1d4af4c2503fa3b745811dab64520c58768634a1833df30c4ed9bf8ded2b9ff9ee638c300570d97034e399bd818cab00ec6273aae36cac40eba76d2a6001853e1a7caaf4691a51f4ee1532c424eb3524ec614a000bdb6108c2e88a485f962166184998f57c2901db584a047ebbc0e10df5d696e9f543392aec9f2611e1e6db3530663783dc2e489487f4bedc0e981be5342726ff485c2574b0d32d6c459f23572d83896d6a2afd502ae7f3bdb95a5802a284d67d200f808d87a84b43c05b9aa220836b8bd30ca0b75127944c3738261bae540e5b12fa75874d39a5222ef96e211fe753588cd72c2cc02f2b4a5c9308b40c03443c167088a4a26f4db67c8ca9faad138a2b052bc4d9c969b1266d67d752e44ce4290961384fcb15408e4ea454a378b5116eb853ff116cd2d95dd7acbca16ec35d15c3e91ebc59bf8da080e567801084fcfc776e43f2bfeb7e9b2404de5222185ca0c326c1ae08039915cbce5ab06f0033269a1dd89505783dea7990a696b0db87b98821e9a7da9ed47b80834e10cf72a4debe1c1cd171a58bfd3c33e59aad71af52be79cde75127cfe18771479103cd4448686da5982b2b0d90cfc031858ce6e2298d3c89c19b1a019daa749f265744e2bdea0e7fd072b114e32afc71f955f8c72ff423b0b4d0f25f240fe5960c869dee0f957cbe701bfd593f3ca3d8c21868b2fc9d2c0f22918b108f2a607ffdc7a488fc350f8c6d2bccaaf8e0cce28e0b968c644f713c592e4f7b404794a3ca8bea3bde490e30689febd01e1844c889f779dfb64268256dc4f6e099662eea18641ba66ab2f04870da5aaf91dcb1e7f5598fd905416f5550e764e17aa1dd31fbad26eaace066ee072f15aefd67d816c136a3b1c6549d2a177eb4f61b06199a850a4d1b9d2a51921e9b644c65f83b842a83332d983b5a5d0878decffbfeb17200174876086d007eabfc93fbf4cccc9633f24ddd5023d9666880a5735d36e13649df15ec6e528f07e21b9f98cd5e8b82850cee3ee80113396c6f98d306ca0631b26f9d7c934e4cb848b99fde6dbc1bcada33bd9d265bbaf17f5349599ece600af65591c62d179a7c3a1a8538c9d9727322829e11a8fbc58d040577007b447b6f030177225f60f0289d70b28ba2786db0422e8a455ec8be958da2350dff178675e8714ad25c9d7e84f58cf0313d3c7ee2e62ba857cceb3ba4eae028012c1e76bc9518e3aaee3116391ebaa89b4ed289202648915fe41e18b6a92c7f93fd91cc7b9f8658127a1a53ae86ea4812ddc7c2caf9585762df76391dfbde1914cd4b5fcba4bf703fa4f68f5d1ce3f779f3f0dd13942863f9393f2ebe76bf95a9c", 0x2000, &(0x7f0000004dc0)={&(0x7f00000041c0)={0x50, 0x0, 0x31e, {0x7, 0x2d, 0x401, 0x40000, 0x800, 0x5, 0x6, 0x6, 0x0, 0x0, 0x2, 0x4}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) write$FUSE_NOTIFY_RETRIEVE(r1, &(0x7f0000000140)={0x30, 0x5, 0x0, {0x0, 0x1, 0x3, 0x67ab}}, 0x30) (async) setxattr$trusted_overlay_redirect(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040), &(0x7f00000000c0)='./file0\x00', 0x8, 0x0) (async) r2 = syz_open_dev$sndpcmc(&(0x7f0000000080), 0x0, 0x0) madvise(&(0x7f0000130000/0xd000)=nil, 0xd000, 0x66) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) (async) r3 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) bind$802154_dgram(r3, &(0x7f0000000100)={0x24, @long}, 0x14) (async) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(r2, 0x80184132, &(0x7f0000000340)={0x0, [], '\x00', [{}, {}, {}, {}, {0x0, 0x2}, {}, {}, {}, {0x0, 0x3}]}) 30.365661473s ago: executing program 3 (id=467): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0xff, 0xfe, 0x7fff0006}]}) r2 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000240), 0xa2003, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r2, 0xc0184800, &(0x7f0000000100)={0x20004, r1}) r4 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) syz_ublk_setup_queues(0xffffffffffffffff, r8, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x255, 0x0, r3}, &(0x7f0000000500)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x300, 0x2100, 0x10000004}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1, 0xfffffffd, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf914, 0x0, 0x0, 0x1f0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x587e, 0x1000, 0x2, 0x367}}], 0x1, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r9 = socket(0x400000000010, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffff9, {0x0, 0x0, 0x0, r10, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0xfffe}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001400)=@newtfilter={0x5c, 0x2c, 0xd3b, 0x70bd27, 0x25dfdbfd, {0x0, 0x0, 0x0, r10, {0xc, 0x2}, {}, {0x7, 0xf}}, [@filter_kind_options=@f_basic={{0xa}, {0x2c, 0x2, [@TCA_BASIC_EMATCHES={0x28, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x2}}, @TCA_EMATCH_TREE_LIST={0x1c, 0x2, 0x0, 0x1, [@TCF_EM_META={0x18, 0x1, 0x0, 0x0, {{0x7, 0x4, 0x5}, [@TCA_EM_META_HDR={0xc, 0x1, {{0x2f, 0x84}, {0x5, 0x7, 0x1}}}]}}]}]}]}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x410c4}, 0x4880) r11 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x88040, 0x0) fcntl$setlease(r11, 0x400, 0x0) fchownat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0xee01, 0x0, 0x1000) ioctl$HIDIOCGSTRING(r3, 0x81044804, &(0x7f0000000340)={0xcc, "87123af158b67261c37a460344090cfe07dab05cfb0d9ca5b21d2a7a746a33ad8a630af10bcc2b9eff84b96c90c1b34926926c005ca27a969457576389c81db87e724b526647a7743c96b5ddf106203655d89f5b21c3d9bbb7994f03e9ee077eda91722da9ba3fcac1a9b0bee2520534e3b89f1fdb0df657faf44f46bdda5022281c90a3bd733ff5c6f96d5479fa4226e7e7db4767274abb12fc25fdc89f2b1a6787aca07919c7c220b0c5299ddc18ee9cb214eeb005145ae0c482d777f5e1c11081ddabb92d06302e1d1b95"}) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xe, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="0d0000000000000071118400000000008510000002000000850000000500000095000000000000009500a50500000000"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x6}, 0x70) 30.216153589s ago: executing program 3 (id=468): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x11, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bf8100000000000007080000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018210000", @ANYRES32=r0, @ANYBLOB="0000000002000000b70500000800002085000000a900000095"], &(0x7f0000000300)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) 30.215646156s ago: executing program 3 (id=469): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) (async) getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) (async) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) (async) mount(0x0, &(0x7f0000000040)='./tracing\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) (async) mkdir(&(0x7f00000004c0)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file1/file0\x00', 0x39) (async) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000200), r1) sendmsg$NFC_CMD_GET_TARGET(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000280)={0x14, r2, 0xe14393ba65cdfb2b, 0x70bd25, 0x25dfdbfb}, 0x14}}, 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000280)='./file1/file0\x00', 0x0, 0x1085408, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x0, &(0x7f0000000340)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) (async) chdir(&(0x7f0000000140)='./bus\x00') (async) renameat2(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./tracing/dynamic_events\x00', 0x1, 0x0) write(r3, &(0x7f0000000100)='e:my_rea', 0x8) (async) write(r3, &(0x7f0000000140)='e:my_read_msr2 msr/read_msr', 0x1b) (async) r4 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./tracing/events/eprobes/my_read_msr2/enable\x00', 0x1, 0x0) write(r4, &(0x7f00000002c0)='1', 0x1) (async) getpeername$unix(r3, &(0x7f0000000400)=@abs, &(0x7f0000000480)=0x6e) sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000002c0)=ANY=[@ANYBLOB="14010000290001002dbd7000fcdbdf2503014e8008002f00", @ANYRES32=r0, @ANYBLOB="1400010000"], 0x114}], 0x1, 0x0, 0x0, 0x40004}, 0x0) 29.848156004s ago: executing program 3 (id=480): r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$inet6(0xa, 0x2, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r1 = io_uring_setup(0x19f8, &(0x7f0000000040)={0x0, 0xca71, 0x1cc91, 0x3, 0x22e}) r2 = socket$inet(0x2, 0x80001, 0x84) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)={0x130, 0xffffffffffffffda, 0x2, {0x1, 0x0, 0x0, '\x00', {0x9ca7a16b958dcf33, 0x8001, 0xffffffffffffffff, 0xfffffff3, 0x0, 0x0, 0x2000, '\x00', 0xfffffffffffffffe, 0x0, 0xffffffffffffc2f3, 0x0, {0xfffffffffffffffd, 0xfffffffc}, {0x5}, {0x0, 0x4}, {0x5, 0xfffffffe}, 0x62, 0x0, 0x7fff}}}}) getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000300)=0x8) fchmodat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0xfffffffb) io_uring_enter(r1, 0x2219, 0x7721, 0x16, 0x0, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000003240)=ANY=[@ANYBLOB="24000000262855bb026000090122667008f9ffffff0200000008003e8004002280080003"], 0x24}, 0x1, 0x0, 0x0, 0x1000c957}, 0x0) epoll_create1(0x0) r3 = socket$packet(0x11, 0x2, 0x300) r4 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r4, 0x40345410, &(0x7f00000083c0)={{0x3, 0x0, 0x0, 0x0, 0x2}}) ioctl$SNDRV_TIMER_IOCTL_INFO(r4, 0x80e85411, &(0x7f0000000480)) setsockopt$packet_int(r3, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x84}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r5) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) r8 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r0) sendmsg$DEVLINK_CMD_SB_POOL_SET(r0, &(0x7f0000000b00)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000840)=ANY=[@ANYBLOB="44020000", @ANYRES16=r8, @ANYBLOB="040025bd7000fbdbdf25100000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008000b00000000000600110007000000080013006000000005001400010000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008000b0007000000060011000200000008001300020000000500140000000000080001007063690011000200303030303a30303a31302e300000000008000b00010000000600110001000000080013000200000005001400010000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008000b00010001000600110002000000080013009dac000005001400010000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008000b0000000004060011007c61000008001300ef0000000500140001000000080001007063690011000200303030303a30303a31302e300000000008000b00ff0300000600110009000000080013000000000005001400010000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008000b0002000000060011000800000008001300040000000500140000000000080001007095d10011000200303030303a30303a31302e300000000008000b0000000000060011001000000008001300090000000500140000000000080001007063690011000200303030303a30303a31302e300000000008000b000300000006001100c100000008001300020000000500140000000000"], 0x244}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) sendmsg$NL80211_CMD_FRAME(r5, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000000)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r6, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r7, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x100007ff, 0xf83, 0xd3}, 0x1c) mkdir(&(0x7f0000000040)='./my_configfs\x00', 0x156) mount(0x0, &(0x7f0000000000)='./my_configfs\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) r9 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./my_configfs/target/dbroot\x00', 0x1, 0x0) write$proc_mixer(r9, &(0x7f0000000080)=ANY=[@ANYBLOB="494d495820274e442719b0c9a19f5d0000f000"/31], 0x1f) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000080), 0x0) 29.696478282s ago: executing program 3 (id=481): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000880)=ANY=[@ANYBLOB="600100001000010080ff000000000000ac141444000000000000000000000000ff0100000000000000000000000000010000ecdf000000000a00002000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ffffffff0000000000000000000000000000000032000000fc01000000000000000000000000400000000000000000000000000000000000000000000000000004000000000000000000000000000000fcffffffffffffff00000000000000000000000000000000c73b0000000000000700000000000000070000800000000000000000000000000200000054000000ffffffff2abd7000030080000200020057000000000000001c00170000fce52da9549e414a00000000000000000000000000000005002100020000004c0014"], 0x160}}, 0x4004004) 29.642047442s ago: executing program 33 (id=481): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000880)=ANY=[@ANYBLOB="600100001000010080ff000000000000ac141444000000000000000000000000ff0100000000000000000000000000010000ecdf000000000a00002000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ffffffff0000000000000000000000000000000032000000fc01000000000000000000000000400000000000000000000000000000000000000000000000000004000000000000000000000000000000fcffffffffffffff00000000000000000000000000000000c73b0000000000000700000000000000070000800000000000000000000000000200000054000000ffffffff2abd7000030080000200020057000000000000001c00170000fce52da9549e414a00000000000000000000000000000005002100020000004c0014"], 0x160}}, 0x4004004) 26.265477344s ago: executing program 5 (id=519): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) setfsgid(0x0) r1 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r2 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r2, 0x7a7, &(0x7f0000000000)=0x10000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r2, 0x7a0, &(0x7f0000000100)={@local}) ioctl$IOCTL_VMCI_CTX_SET_CPT_STATE(r2, 0x7b2, &(0x7f0000000140)={&(0x7f0000000300)=[0x4, 0x6, 0x1, 0x9, 0x5, 0x401, 0x200, 0x4, 0x0, 0xcb0d, 0x770f, 0xff, 0x4, 0x81, 0x2, 0x5, 0x1d, 0x0, 0x78, 0xb, 0x5, 0x6, 0x8, 0x9, 0x69, 0x5, 0xfffffff4, 0x7fff, 0x8, 0xe00, 0x0, 0x3, 0x10000, 0x7f, 0x0, 0xfffffff4, 0x15a0, 0xffffff7f, 0x8, 0x5d, 0x800, 0xf94, 0xff, 0x8, 0x2, 0xfffffffd, 0xe, 0xffffbb46, 0x7, 0x4, 0x1, 0x4, 0x5, 0x1000, 0x6, 0x3, 0x1, 0x8, 0x80, 0xc, 0x7, 0x8, 0x2, 0x1, 0x3, 0x1800000, 0x3, 0x5, 0x400, 0x5, 0x9, 0x1, 0x8, 0x2, 0x1000, 0x9, 0x3, 0x6d, 0xfffffffc, 0x1ff, 0xffffffc0, 0x0, 0x5, 0x8, 0x2008, 0x2, 0xf0, 0x5, 0x7, 0x6, 0x4469, 0xb, 0xfffffb4c, 0x80000001, 0xe5f6, 0x0, 0x4, 0xd4, 0xffffffff, 0x200000, 0x9, 0x2, 0x4, 0x5, 0x2, 0x3, 0x8f, 0x7, 0x6, 0x5, 0x4, 0x6d03, 0x8001, 0x9, 0x3, 0x0, 0x8e7a, 0x2, 0x8, 0xfffffff1, 0x5, 0x1000000, 0xfff3, 0x4, 0x1, 0x80000000, 0x3ff, 0x81, 0x100, 0x8, 0xfffffffb, 0x4, 0xfffffffc, 0x1, 0x7, 0x6, 0x3e, 0x43, 0xffff6a70, 0xc, 0xa092, 0x8, 0x877, 0x1, 0x3, 0x800, 0x5, 0x0, 0x8001, 0x48c, 0x7, 0x2, 0x13, 0x3, 0x3, 0x9, 0x0, 0x70000000, 0x2, 0x8, 0x2, 0x1b1c, 0x8, 0xb5, 0x8, 0x401, 0xfff, 0x5, 0x1, 0xa008, 0x9, 0x8, 0xe4, 0x898, 0x7, 0x9, 0x0, 0x1ff, 0x5, 0x80000000, 0x1, 0x8, 0x1, 0x5, 0x4251, 0x6, 0x4, 0x6, 0x4008, 0x200, 0x5, 0x73f7, 0x6, 0x8001, 0x80, 0xd5, 0x6, 0x800000, 0x40, 0xfffffe03, 0x2, 0x80000001, 0x7f, 0xfffffffa, 0xff, 0x4, 0x4b031fcb, 0x7, 0xf3, 0x40, 0xffffffff, 0x1, 0x0, 0x3, 0x6, 0x0, 0x5, 0x6, 0x3, 0x9, 0xfd, 0xd, 0x1000, 0x94, 0xd4f, 0x3, 0xfffffeff, 0xba7, 0x400, 0x4, 0x0, 0x80000001, 0x7, 0x10001, 0xfff, 0x9, 0x2, 0x9, 0x1, 0xfffffff9, 0x6, 0x62, 0x668, 0xffff, 0x0, 0x7, 0x6, 0x0, 0x49, 0x2, 0x5f4, 0x3fd, 0xfffffffe, 0x14, 0x6, 0x9, 0x0, 0x5, 0x4, 0x6, 0x3, 0x1ff, 0xc3f6, 0x7, 0xd8b8, 0xfffffffe, 0xff, 0x8000, 0x7, 0x100, 0x43, 0x2, 0xc7b, 0xe2a0, 0x5, 0x6, 0x81, 0x6, 0x0, 0x3, 0x75c, 0x1, 0x10000, 0x3f, 0x24f7, 0x5, 0x9, 0xd8c, 0x7ffffffd, 0x7, 0xfffff6d2, 0x0, 0x0, 0x3, 0x9, 0x800, 0x5, 0x9, 0x80000000, 0x1, 0x9dcb, 0x8, 0x4, 0x8001, 0x1, 0x7, 0x6, 0x7, 0x81, 0x7ff, 0x0, 0x7, 0x1c00000, 0x5, 0x10, 0x2, 0x1, 0x4, 0xac, 0x8001, 0xb2, 0x4, 0x84f4, 0xf, 0x0, 0x6, 0x6, 0x3ef, 0x7, 0x101, 0x3, 0x4, 0xa, 0x7f, 0x5, 0x2, 0x7ff, 0xffff094f, 0xc, 0x80, 0x6, 0xfffffffd, 0x63, 0xd, 0x7, 0x9, 0x200, 0x9, 0x7, 0x8, 0xa, 0x10001, 0x8, 0xa21, 0x2, 0x9, 0x7, 0xe207, 0xa4, 0x4, 0x5, 0x7, 0x9, 0x0, 0x0, 0x9, 0x1, 0xd, 0x1, 0xf, 0x1, 0x26d1, 0x9, 0x8b000, 0x6, 0x6, 0x5, 0x80000000, 0x800, 0x8, 0x7, 0xfffffff9, 0x7, 0x4, 0x2, 0x0, 0x80, 0xffff6c99, 0x5, 0x6bed988b, 0x7f, 0x6, 0xffffff7f, 0x7, 0x7, 0x8, 0x4, 0xfffe, 0x6, 0x9, 0x40, 0x0, 0x5, 0x0, 0x2, 0x3, 0x10000, 0x8, 0x9, 0x53fa, 0x0, 0x53, 0x9465, 0x9, 0x3, 0x4, 0x36c9, 0x3ff, 0x3, 0x4, 0x8, 0x68, 0x2, 0x2081, 0x8, 0xcd94, 0x75e, 0x1000, 0x5, 0x6, 0x0, 0xfffffff7, 0xe, 0x6, 0x3, 0x7, 0x0, 0x6, 0x80000001, 0x731, 0x6, 0x4, 0x8, 0x3, 0x9, 0x80000001, 0x1, 0xfff, 0x4, 0x6, 0x4, 0x4, 0x2, 0x9, 0x6f9, 0x3, 0x8, 0x475e0e15, 0x80000000, 0x5, 0x4, 0xf3e, 0x9, 0x5, 0x0, 0x3, 0xad64, 0xfffffff9, 0x2, 0x3, 0x10000, 0x4, 0xff, 0x400, 0x7f, 0x7f, 0x7, 0x800, 0x40, 0x7, 0x6, 0x8, 0x1a, 0x0, 0x1000, 0xff, 0x10001, 0x8, 0x2, 0xffff, 0x8, 0x100, 0x100, 0x9, 0x9, 0x37, 0x28, 0xfffffff9, 0x5fffffff, 0x4, 0x83b9, 0xb, 0x2, 0x85f2, 0xd7f, 0x7, 0x3ff, 0x1000000, 0x2387c5a4, 0x3, 0x8, 0xbc4e, 0xffff, 0x1, 0x2, 0x408, 0x5, 0x0, 0x5, 0x6, 0x2, 0x6, 0x0, 0x51, 0x5, 0x3, 0x2, 0xfaf0, 0x4a46, 0x4, 0x10001, 0x9, 0x4921bb4d, 0x5c, 0x6, 0x3, 0x7, 0x7fff, 0x80, 0x3, 0x29dc2fdf, 0x200, 0x1, 0x9, 0xd2c, 0x8, 0x3, 0x3, 0x66f, 0x5, 0x4bb6, 0x258d, 0x101, 0x10000, 0x662f, 0x401, 0x5, 0x4, 0x4, 0xd3f6, 0x4, 0x3, 0x4, 0x1, 0xc, 0xbf2, 0xff, 0x7, 0x8002, 0x9, 0x3ff, 0x80000000, 0x9, 0x9, 0x9, 0xf01a, 0x2, 0x1, 0x9, 0x100, 0x0, 0xffffffff, 0x80000001, 0x3, 0x3, 0x6, 0x240000, 0x0, 0x1, 0xfffffffa, 0x45, 0x0, 0x0, 0x8, 0x5, 0x0, 0x3, 0x8a8, 0xa, 0x9, 0x0, 0x7, 0x9, 0x583, 0x8, 0x8, 0x1, 0x10002, 0x9, 0xffffff81, 0x6, 0x400, 0x227, 0x6, 0x8, 0xc442, 0x0, 0x3, 0x3ff, 0x5, 0x82a, 0x4, 0x72d2, 0x7, 0x5, 0x7, 0x4, 0x8, 0x8, 0xea1, 0x0, 0x566, 0x0, 0xfffffffe, 0x7, 0x737, 0x4, 0x6, 0x2, 0x1000, 0x4, 0x8, 0xff, 0x9, 0x7, 0x5, 0x3, 0x9, 0xbcea, 0x7, 0x8000, 0x0, 0x1, 0x1, 0x3, 0x7fff, 0x8, 0x3, 0x4, 0x9, 0x101, 0x1, 0x8, 0x1, 0x6, 0x6, 0x9, 0x7f800, 0x9, 0xd8a8, 0x3, 0x9, 0xfffffffb, 0x8, 0xd0f, 0x7, 0x8, 0x4, 0x1, 0x7, 0x7, 0x8e, 0x5, 0x0, 0x7, 0xfffffffe, 0x81, 0xad3, 0x4, 0x80000001, 0x7, 0x8, 0x80, 0x8, 0x3ff, 0x6, 0xce1, 0x8, 0x80000001, 0xd, 0x1, 0x400002, 0x8000, 0x4, 0x3, 0xb, 0x2, 0x2, 0x6, 0x1, 0xe30, 0x3ff, 0xa7a, 0x8, 0x8, 0x9, 0x2, 0x401, 0x9, 0x9659, 0x400, 0xa83, 0x6, 0xfffffffe, 0x5082, 0x5, 0x6e82, 0xffff, 0x9, 0x7ff, 0x200800, 0xfffffffb, 0xfffffffb, 0x2, 0xd, 0x1, 0xffffff46, 0x7, 0x8000, 0x5d, 0x70d, 0x7fff, 0x3, 0x4, 0x6, 0x7, 0xa6a0, 0x7, 0x9, 0x1, 0xe8b0c95b, 0x9, 0x3, 0x8a2, 0x4, 0x6, 0x2, 0x3, 0x0, 0x7, 0x3, 0x4, 0x4, 0x5, 0xfffffff9, 0xbffeffff, 0xc, 0xfffffff7, 0x1ff, 0x8, 0x7ffc, 0x9, 0x3, 0xfffffff8, 0x1, 0x434, 0x8, 0x3ab, 0x8, 0x6, 0x0, 0x7, 0x4389, 0x7, 0x800, 0x400, 0x0, 0x0, 0x3, 0x5, 0xc94, 0x9, 0x4, 0x0, 0x4, 0x2, 0x401, 0x6, 0x401, 0x8, 0x1, 0xb, 0xe664, 0x0, 0xc, 0x96, 0x7, 0x101, 0xd, 0x2, 0x6, 0xdc, 0xf, 0x1000, 0x8, 0x7, 0x0, 0x0, 0x10001, 0x9, 0x7, 0x0, 0x42000fff, 0xf9, 0xc8, 0x2400, 0x1, 0x400, 0x9, 0x0, 0x8, 0x8, 0x7, 0x5, 0xfffffffb, 0x6b59b47c, 0x2, 0x4, 0xd64, 0x8, 0xc, 0x0, 0x7, 0x0, 0x9, 0x4, 0x80, 0x3, 0x6, 0x10, 0xc, 0x7, 0x8, 0x8, 0x8000, 0x6, 0x979, 0x385, 0xa0, 0x5, 0x8, 0x3d72e35e, 0xfffffff7, 0x9, 0x80000001, 0x8, 0x1a7, 0x7, 0x8, 0x0, 0x3, 0xe83, 0x3, 0x1, 0x3, 0x0, 0x2, 0x9973, 0x3, 0x4, 0x40, 0x40, 0x4, 0x5, 0x412, 0x4, 0x2, 0x5, 0xb4, 0x1ff, 0xc77c0000, 0xffff2c2c, 0x9, 0x8000, 0x47, 0x9, 0xffffff97, 0xffff, 0x3, 0xffffffc0, 0x10001, 0x2, 0xfffffe01, 0x7fff, 0x78, 0x8, 0x0, 0xf, 0x40, 0x8, 0xed, 0x3, 0x9, 0x8, 0x0, 0x1, 0x1, 0x7, 0x800, 0xb, 0x5, 0x5, 0x9, 0x2, 0xd, 0x2, 0x6, 0x101, 0x4, 0x6, 0xa6d2, 0xd, 0x8000, 0x2, 0x9, 0x2, 0x0, 0x0, 0x3ff, 0x7, 0xffffff00, 0x7, 0x7, 0x40, 0x3, 0x101, 0x20000000, 0xdc000000, 0x2, 0xfffffffb, 0x401, 0x6, 0x1, 0x9, 0x4, 0xffffffa2, 0x5, 0x5, 0x8015, 0x6, 0x5, 0x5, 0x14b, 0x0, 0x336, 0xcf, 0xd, 0x5, 0xbbe7, 0xa8eb, 0xd0, 0xb, 0x800, 0x2b18, 0x3ec3, 0x0, 0x9, 0x5, 0x0, 0x8, 0x200, 0x2, 0x0, 0x5, 0xff, 0xc, 0x8, 0x2, 0x2, 0x7, 0x8, 0x10, 0xb46, 0x8, 0x1, 0x5dc60e00, 0x4, 0x9, 0x8, 0xd2, 0x9, 0xffff4a7a, 0x88f, 0xbd, 0x4, 0x6, 0x5, 0x8, 0x9, 0xffffffff, 0xda, 0xe, 0x8001000, 0x7b, 0x9, 0x10001, 0x6, 0x136, 0x36, 0x3a12, 0x9, 0x8, 0x4, 0xb], 0x1, 0x400, 0x3ff}) close_range(r1, 0xffffffffffffffff, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000880)=ANY=[@ANYBLOB="60010000100001000000000000000000ac141444000000000000000000000000ff0100000000000000000000000000010000ecdf000000000a00002000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ffffffff0000000000000000000000000000000032000000fc01000000000000000000000000400000000000000000000000000000000000000000000000000004000000000000000000000000000000fcffffffffffffff00000000000000000000000000000000c73b0000000000000700000000000000070000800000000000000000000000000200000054000000ffffffff2abd7000030080000200020057000000000000001c00170000fce52da9549e414a00000000000000000000000000000005002100020000004c0014"], 0x160}}, 0x4004004) syz_emit_ethernet(0x22, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaa3caaaaaaaaaaaa81001900000c020000e002030300000000000000397c"], &(0x7f0000000040)={0x1, 0x1, [0xc94, 0xa39, 0x97b, 0xd28]}) 26.186648032s ago: executing program 5 (id=520): r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={0x0, 0x2f35835f86d74907}, 0x1, 0x0, 0x0, 0x20008814}, 0x20000800) (async, rerun: 64) getsockname$packet(r0, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a) (rerun: 64) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000000c0)=ANY=[@ANYBLOB="480000001000390400e9ab00fcffffff00000000", @ANYRES32=r1, @ANYBLOB="01980000000000002800128008000100677265001c00028008000700ac1414bb050013000100000005000a"], 0x48}}, 0x0) (async, rerun: 64) r3 = socket$igmp(0x2, 0x3, 0x2) (async, rerun: 64) r4 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r4) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$inet(r3, &(0x7f00000002c0)={&(0x7f00000000c0)={0x2, 0x4e24, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000200)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r5, @dev={0xac, 0x14, 0x14, 0x3c}, @dev={0xac, 0x14, 0x14, 0x12}}}}], 0x20}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="48000000100001060100000000000000000000000000000000000000000000001000030073797a6b616c6c65723000001800128008000100767266000c00028008000100e8"], 0x48}}, 0x0) (async, rerun: 64) r7 = socket$inet6_udp(0xa, 0x2, 0x0) (rerun: 64) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000200)={'syzkaller0\x00'}) fadvise64(r7, 0x8, 0x7ff, 0x1) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000001880)={0xffffffffffffffff, 0x20, &(0x7f0000001840)={&(0x7f0000000240)=""/91, 0x5b, 0x0, &(0x7f0000000840)=""/4096, 0x1000}}, 0x10) (async) r9 = syz_open_procfs(0x0, &(0x7f0000000b40)='attr/current\x00') read$eventfd(r9, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x18, 0xfa00, {0x1, &(0x7f00000001c0)={0xffffffffffffffff}, 0x106, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_LISTEN(r9, &(0x7f0000000400)={0x7, 0x8, 0xfa00, {r10, 0x3}}, 0x10) r11 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x20, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000580)={r11, 0x0, 0x14, 0x0, &(0x7f0000000480)="f6f4e9a10000502468da5eb1c6b2feff8833c000", 0x0, 0x86, 0x0, 0x31, 0x0, &(0x7f0000000000)="daf9e846ab156efc71b59652333536dbfd26a6d0546366e36eb77dd0aaa2dbe567d168904cf0d5bce1771889c98ffc0abf", 0x0}, 0x50) (async) sendmsg$nl_route(r6, 0x0, 0x0) sendmsg$nl_route(r6, &(0x7f0000000120)={0x0, 0x0, 0x0}, 0x0) (async, rerun: 32) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x188) (async, rerun: 32) r12 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x88040, 0x0) fcntl$setlease(r12, 0x400, 0x0) (async) renameat2(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', 0x2) (async) fcntl$getown(r7, 0x9) 26.126566207s ago: executing program 5 (id=521): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x2, [@struct={0x0, 0x0, 0x0, 0xe, 0x1}, @enum]}}, 0x0, 0x32}, 0x20) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffe, 0x4031, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000140)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x4}) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000080)={&(0x7f00006c6000/0x400000)=nil, &(0x7f000018b000/0x3000)=nil, 0x400000, 0x0, 0x6040000}) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x30, 0xffffffffffffffff, 0x10000000) userfaultfd(0x80001) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x4000874}, 0x4048811) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000300)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x800028, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r1, &(0x7f0000000000)='3', 0x4e) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0), r1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x3, 0x3, &(0x7f0000000340)=ANY=[@ANYBLOB="18020000ffffffff0000002003000000950000000000bb4b64740000a454824744c189000dfcd6de981a0de74dde4c9df43a6e8a996a1804b963c2a5de2e1579"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x25, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6ff}, 0x94) r3 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r3, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r4 = socket$netlink(0x10, 0x3, 0x9) r5 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r5, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000700)=ANY=[@ANYBLOB="280000005e00010000000000000000000c00fe0001000000080000800c000180080004"], 0x28}], 0x1, 0x0, 0x0, 0x40004}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYRES16=r5, @ANYRES32=r6, @ANYRESDEC=r2], 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) r7 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r7, 0x8946, &(0x7f0000000540)={'ip6tnl0\x00', &(0x7f0000000440)=@ethtool_perm_addr={0x20, 0x10, "3f7bba999681fe7d4ec3032aeac19261"}}) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket(0x1, 0x803, 0x0) getsockname$packet(r9, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r8, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYBLOB="4c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00030000000000001c0012800c0001006d6163766c616e000c000280080001000800000008000500", @ANYRES32=r10, @ANYBLOB="3a5492285dacdaf9940ce62fb52a770c256e7571aaa9c164b29a2d91dd75fdf0d3b2a8d10a6f81d3b3bfb76ac21b481edc7fffdf481e212a6ee117f392816042c05d31d1c488170c2419557c9fb8ce4e166e79f0a51543289be917728100"/103, @ANYRES32=r10, @ANYBLOB], 0x4c}}, 0x0) 26.004124616s ago: executing program 5 (id=524): r0 = socket(0x10, 0x3, 0x0) r1 = shmget$private(0x0, 0x3000, 0x2, &(0x7f0000ffd000/0x3000)=nil) shmat(r1, &(0x7f0000ffc000/0x3000)=nil, 0x4000) syz_clone(0x81000000, 0x0, 0x0, 0x0, 0x0, 0x0) syz_usb_disconnect(0xffffffffffffffff) remap_file_pages(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0) write(r0, &(0x7f0000000080)="1400000052004f030e789e7ee2ce2fa4ff612d27", 0x14) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000002000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, &(0x7f0000000040)="0f01cb650f741065666765f36f0f330f09660f3a0cb9000000752066b9800000c00f326635004000000f300f01d7ba4100ed", 0x32}], 0x1, 0x4498bda7e2139f51, 0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000000)={0x1, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f00000003c0)={[0x0, 0x0, 0x8000, 0x40, 0x0, 0x0, 0x2004cb, 0x0, 0xfffffffffffffffe, 0x3, 0x7fff, 0x1000200004, 0x4, 0x2, 0x5, 0x1], 0x8080000}) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./mnt\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='mtd0\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000100)='jffs2\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x42, 0x1ff) mbind(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, &(0x7f0000000200)=0x2, 0xfffffffffffffff2, 0x1) write(r5, &(0x7f0000000200)="090a0b0c0405060708090a0b0c0d0e3a80111213141516175c78", 0x1a) bind$alg(0xffffffffffffffff, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) mount$bpf(0x0, &(0x7f0000000000)='.\x00', &(0x7f0000000180), 0x0, 0x0) mkdir(&(0x7f0000000100)='./file0\x00', 0xa) r7 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r7, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) unshare(0x26020480) umount2(&(0x7f00000001c0)='./mnt\x00', 0x0) unshare(0x20600) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) ioctl$TUNDETACHFILTER(r6, 0x401054d6, 0x0) 25.075598637s ago: executing program 5 (id=529): r0 = add_key$user(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000400)='>', 0x1, 0xffffffffffffffff) r1 = add_key$keyring(&(0x7f0000000100), &(0x7f0000000180)={'syz', 0x2}, 0x0, 0x0, 0xffffffffffffffff) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r1, &(0x7f0000000200)='asymmetric\x00', &(0x7f00000002c0)) keyctl$KEYCTL_MOVE(0x1e, r0, 0xffffffffffffffff, r1, 0x0) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$UI_SET_EVBIT(r2, 0x40045564, 0x11) ioctl$UI_DEV_SETUP(r2, 0x405c5503, &(0x7f0000000100)={{0x100}, 'syz1\x00', 0x19}) ioctl$UI_SET_LEDBIT(r2, 0x40045569, 0x7) ioctl$UI_DEV_CREATE(r2, 0x5501) 24.344258094s ago: executing program 1 (id=538): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x2a2703, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000000)={'ip6_vti0\x00', 0x400}) r1 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000180)={0x4, &(0x7f0000000140)=[{0xb, 0x5, 0x6, 0x1}, {0x7, 0x5, 0x0, 0xf8}, {0x6, 0x2, 0x93, 0x4}, {0x0, 0x0, 0x1, 0x7}]}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)=@getchain={0x24, 0x11, 0x839, 0x70bd27, 0x0, {0x0, 0x0, 0x0, r2, {0x4, 0xe}}}, 0x24}, 0x1, 0x0, 0x0, 0x4040091}, 0x0) 24.246233762s ago: executing program 1 (id=539): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)=@newlink={0x44, 0x10, 0x40d, 0x70bd2d, 0x1ffffffc, {0x0, 0x0, 0x0, 0x0, 0x631df, 0x100}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_MODE={0x5, 0x1, 0x4}, @IFLA_BOND_AD_LACP_RATE={0x5}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x24008045}, 0x0) (async) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x36) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) (async) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1ff) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./tracing\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracing/uprobe_events\x00', 0x401, 0x0) write(r3, &(0x7f0000000180)='p:s/p ./file0:0\f$', 0x11) r4 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r5 = syz_genetlink_get_family_id$devlink(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000200)=ANY=[@ANYBLOB="340000ed11a37b6099ca63df156c1a00", @ANYRES16=r5, @ANYBLOB="010000000000ffdbdf25250000000e0001006e657464657673696d0000000f0002006e657464657673696d300000"], 0x34}, 0x1, 0x0, 0x0, 0x41}, 0x24004804) (async) sendmsg$DEVLINK_CMD_PORT_SPLIT(r2, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x44, r5, 0x4, 0x70bd28, 0x25dfdbfb, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}, {0x8, 0x9, 0x7}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x800) close_range(r0, r0, 0x0) 24.24008514s ago: executing program 1 (id=540): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_tcp_int(r2, 0x6, 0x1e, &(0x7f0000000040), &(0x7f0000000080)=0x4) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000b40)=@newqdisc={0x64, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0x25dfdbfc, {0x0, 0x0, 0x0, r1, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff9, 0xa}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x34, 0x2, {{0x1, 0x2, 0x2, 0x7, 0xffffffff, 0x3}, [@TCA_NETEM_LOSS={0x4}, @TCA_NETEM_DELAY_DIST={0x11, 0x2, "9a70dd09a10c12c8a92f6bb5bb"}]}}}]}, 0x64}, 0x1, 0x0, 0x0, 0x200008c2}, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) r4 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r5 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000180), 0x4) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000200)={0x2, 0x4, 0x8, 0x1, 0x80, r4, 0x8, '\x00', 0x0, r5, 0x3, 0x2, 0x3}, 0x50) sendto$packet(r3, &(0x7f00000005c0)="bad330fbc9b55400040000ea0756", 0xe, 0x40, &(0x7f00000001c0)={0x11, 0x8100, r1, 0x1, 0xd8, 0x6, @random="000863ee0a3d"}, 0x14) 24.126740571s ago: executing program 1 (id=541): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000037c0)={0x0, 0x0, &(0x7f0000003780)={&(0x7f0000000000)=@newtaction={0x898, 0x30, 0x12f, 0x0, 0x0, {}, [{0x884, 0x1, [@m_police={0x880, 0x1, 0x0, 0x0, {{0xb}, {0x854, 0x2, 0x0, 0x1, [[@TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0x0, 0x0, 0x0, 0x0, {0x7, 0x0, 0x0, 0x0, 0x0, 0x7}, {0x7, 0x0, 0x2, 0x0, 0x0, 0x7}}}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x3ff, 0x6d14, 0x3, 0x981, 0x8, 0xbe0c, 0x7, 0x4, 0x5, 0x2, 0x1ff, 0x91f, 0x3, 0x5, 0xfffffff8, 0x6000000, 0x20000, 0x3, 0x0, 0x9, 0x7fff, 0x2, 0x0, 0x0, 0xfffffff3, 0x9, 0x41, 0x8, 0x8c1, 0x7, 0x5, 0x8b5, 0x6, 0x5, 0x9, 0x2, 0x5, 0xdf, 0x1, 0xfffffff7, 0x214c000, 0x9, 0xad3, 0x8000, 0x4, 0x0, 0x0, 0x5, 0x2, 0x5, 0x4, 0xfff, 0x9, 0x5, 0x4, 0x4, 0x6, 0x1, 0x1, 0x5, 0x3, 0x2, 0xca, 0x8, 0x7fffffff, 0x2, 0x1, 0xfffeffff, 0x10, 0x1, 0x3ff, 0xf, 0x9, 0x4, 0x7, 0x3, 0xfffffffc, 0x1, 0x4e, 0x6, 0x8, 0x6, 0xeb5, 0xa, 0x7ffe, 0x8, 0x4, 0x10, 0x1, 0x80000001, 0x0, 0x5, 0x1, 0xfff, 0x3, 0x5, 0x6, 0x5, 0x80000001, 0xc, 0x2, 0xd8f3, 0x3ff, 0x9, 0x3, 0x24000, 0x5, 0x3, 0x200, 0x6, 0x1, 0xfffffff2, 0x1, 0x0, 0xb1, 0x8000000, 0x7, 0x2, 0x81f, 0x7ff, 0x4, 0x65b6, 0x2, 0x315, 0x80, 0x1ff, 0xb, 0x1, 0x800, 0x0, 0x8e, 0x80000000, 0x401, 0x8, 0xff, 0x10000, 0x2, 0xc469, 0x71, 0x1, 0x2b, 0xa, 0x8f, 0xe88c, 0x6, 0x80000001, 0x4, 0xb618, 0xf3, 0xffff8001, 0x51, 0x0, 0x2, 0x5, 0x81, 0xea5, 0x0, 0x9, 0x7, 0x3, 0x80000001, 0x0, 0xe19, 0xd6, 0x3, 0x1, 0x6, 0x7ff, 0x80000001, 0x7, 0x3, 0x80, 0x7fffffff, 0x0, 0x6, 0x9, 0xfffffff7, 0x66, 0xffffffb1, 0x9d1f, 0x7fffffff, 0x8, 0x7fffffff, 0x4, 0x81, 0x6885b8d8, 0x0, 0x3, 0x82, 0x400, 0x70, 0xf9, 0x0, 0x5, 0x1, 0x30b, 0xa, 0x200, 0xfffffffd, 0x5, 0x0, 0x0, 0xa1, 0x9, 0xfff, 0x4, 0x401, 0x3, 0x2, 0x0, 0x0, 0x40, 0x101, 0x7, 0x0, 0xaad, 0x3, 0x0, 0x0, 0x8, 0x0, 0x8, 0x3, 0x10, 0xff, 0x3, 0x2, 0x9, 0x200, 0x5, 0xfffff001, 0x0, 0xfffffffe, 0x3, 0x3, 0x0, 0xfc4, 0x4, 0x296, 0x2, 0x7, 0x1, 0x8000, 0x80000001, 0x7fffffff, 0x7f, 0x4, 0x5, 0x7, 0x6, 0x2, 0x0, 0x4, 0x4, 0xbc4, 0x10000]}, @TCA_POLICE_RATE={0x404, 0x2, [0x9, 0x5, 0x3d4, 0x5, 0x0, 0x2, 0x10, 0x7, 0x9, 0x5, 0x8, 0x7, 0x8, 0x8, 0x9, 0xffff, 0x8f13, 0x1, 0x3, 0x8, 0x8, 0x9, 0x4, 0x8, 0x81, 0x0, 0x7ff, 0x6, 0x10001, 0x6, 0x100, 0xfffffff4, 0x2, 0x8, 0x0, 0x800, 0x0, 0x4, 0x61, 0x7, 0x7, 0xdf4, 0x1ff, 0x80000001, 0xffffffff, 0xffffffc0, 0x7, 0xec3a, 0x80000001, 0x7, 0xe429, 0x8c9, 0x4, 0x8001, 0xc, 0x5, 0x7fff, 0x10001, 0xb436, 0x8001, 0x4, 0x2, 0x5, 0x5, 0x5ba7, 0x5, 0xe3c, 0xfff, 0x2, 0x0, 0x8, 0xd9a1, 0x4, 0x3, 0x8, 0x4, 0xd6fa, 0x2, 0x9, 0x4, 0x31c00000, 0x6, 0x7f, 0x0, 0x67, 0x2, 0x400, 0x10, 0x0, 0xfd, 0x9, 0x8, 0x1ff, 0x9, 0x1, 0xa, 0x4, 0x80000000, 0x2, 0x1, 0x81, 0xfffffffb, 0x6, 0x1, 0x4e, 0x9, 0x3, 0x2, 0x6, 0x8, 0x2b3, 0xb003, 0x3, 0x8001, 0x1, 0x2, 0xec, 0x41, 0x9, 0x0, 0x8, 0x7, 0xa, 0x5, 0xc21, 0x8000, 0x401, 0x3, 0x8, 0x24c8000, 0x2, 0x7c9, 0x5, 0x400, 0xd2, 0xfffff8a1, 0x80, 0x2, 0xf1, 0x76d0, 0x5ab, 0xfff, 0x7, 0x1, 0xfffffffe, 0x52d, 0x401, 0x0, 0x200, 0x5, 0x66fc6967, 0x4d5d, 0x79f, 0x0, 0x3, 0x680, 0x9, 0x4, 0xb460, 0x7, 0x3d4, 0x9, 0x0, 0x5, 0xb, 0x0, 0x9, 0x4, 0x80000001, 0x9, 0x4, 0x5, 0xff, 0x8, 0x5, 0xe, 0x0, 0x2, 0x3, 0xfffffffc, 0x9, 0x401, 0x1602, 0x2, 0x337162be, 0x1, 0x90, 0xfffff475, 0xffc00000, 0x4, 0x80, 0x2, 0x7, 0xf6, 0x1, 0xa196, 0x6, 0xb28, 0x6b, 0x1c0, 0xc, 0x2, 0x7, 0x8, 0x10000, 0x6, 0x0, 0x7, 0x8, 0x7f, 0x7, 0x9, 0x9, 0x32, 0x0, 0xb7, 0x2, 0x2, 0x7, 0x8, 0x0, 0x0, 0x4, 0xd, 0x7, 0x5, 0x3, 0x7ff, 0x2ab, 0x7c, 0x9, 0x2, 0xe, 0x8f9, 0xb, 0xd6de, 0x10, 0x10, 0x10001, 0xe7, 0x8, 0x5, 0x9, 0x0, 0x9, 0x0, 0x4, 0x32788e81, 0xc, 0x3, 0x81, 0xfffffffa, 0x1, 0x5, 0x5, 0x6]}], [@TCA_POLICE_PEAKRATE64={0xc, 0x9, 0xffffffffffffffca}]]}, {0x4}, {0xc, 0xb}, {0xc, 0xa}}}]}]}, 0x898}}, 0x0) r1 = socket(0x1, 0x803, 0x0) r2 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000100)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io(r2, 0x0, &(0x7f0000000780)={0x84, &(0x7f00000004c0)=ANY=[@ANYBLOB="00000100000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$sierra_net(r2, &(0x7f00000003c0)={0x14, &(0x7f0000000080)=ANY=[], 0x0}, 0x0) r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$EVIOCGMASK(r3, 0x5b02, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) socket$nl_route(0x10, 0x3, 0x0) setsockopt$inet_int(r1, 0x0, 0x8, &(0x7f00000008c0)=0x6, 0x4) 23.416839846s ago: executing program 5 (id=548): socket(0x2, 0x80805, 0x0) (async) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) (async) r0 = dup(0xffffffffffffffff) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='devices.list\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000100), 0x208e24b) (async, rerun: 32) write$6lowpan_enable(r0, &(0x7f0000000000)='0', 0xcabd8245) (async, rerun: 32) socket$nl_netfilter(0x10, 0x3, 0xc) (async, rerun: 32) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) (rerun: 32) sendmsg$NFT_BATCH(r2, 0x0, 0x40040c0) (async) keyctl$set_reqkey_keyring(0xe, 0x7) (async) unshare(0x6a040000) (async, rerun: 64) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2, 0xc3072, 0xffffffffffffffff, 0x200000) (async, rerun: 64) ioctl$DRM_IOCTL_DROP_MASTER(r0, 0x641f) (async) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) (async) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r3) ptrace$poke(0x4, r3, &(0x7f0000000200), 0x0) 23.305690832s ago: executing program 34 (id=548): socket(0x2, 0x80805, 0x0) (async) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) (async) r0 = dup(0xffffffffffffffff) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='devices.list\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000100), 0x208e24b) (async, rerun: 32) write$6lowpan_enable(r0, &(0x7f0000000000)='0', 0xcabd8245) (async, rerun: 32) socket$nl_netfilter(0x10, 0x3, 0xc) (async, rerun: 32) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) (rerun: 32) sendmsg$NFT_BATCH(r2, 0x0, 0x40040c0) (async) keyctl$set_reqkey_keyring(0xe, 0x7) (async) unshare(0x6a040000) (async, rerun: 64) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2, 0xc3072, 0xffffffffffffffff, 0x200000) (async, rerun: 64) ioctl$DRM_IOCTL_DROP_MASTER(r0, 0x641f) (async) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) (async) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r3) ptrace$poke(0x4, r3, &(0x7f0000000200), 0x0) 21.995060951s ago: executing program 1 (id=558): r0 = socket$nl_route(0x10, 0x3, 0x0) setns(0xc9, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./proc\x00', 0x8f) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r1, &(0x7f0000000000)='3', 0x4e) mkdirat(r1, 0x0, 0xa2) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r2, 0x3ba0, &(0x7f0000000980)={0x48, 0x5, r3, 0x0, 0x0, 0x1}) ioctl$F2FS_IOC_GET_PIN_FILE(r0, 0x8004f50e, &(0x7f0000000040)) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) r4 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r4) ptrace$poke(0x1, r4, &(0x7f0000000000), 0xfffffffefffffffd) socket$inet(0x2, 0x2, 0x1) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)=@newlink={0x44, 0x10, 0x1, 0x70bd2d, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x3dd88, 0x17200}, [@IFLA_IFNAME={0x14, 0x3, 'bridge_slave_0\x00'}, @IFLA_VFINFO_LIST={0x4}, @IFLA_ADDRESS={0xa, 0x1, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1c}}]}, 0x44}, 0x1, 0x8100, 0x0, 0x4010}, 0x2800804c) r5 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000100), 0x200000, 0x0) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r5, 0x4048587b, &(0x7f0000000600)={{r0, &(0x7f0000000200)='/[:\\!)\x00', 0x560500, &(0x7f0000000280)={@_ha_fsid={[0x7680, 0xffffffff]}, {0xf5ea, 0x4, 0x800, 0x1000}}, 0x3, &(0x7f00000002c0)={@_ha_fsid}, &(0x7f0000000300)=0x1}, 0x2, &(0x7f00000005c0)=[{0x2, 0x8, &(0x7f0000000340)='/dev/iommu\x00', &(0x7f0000000380)="4956121690", 0x5, 0xa}, {0x3, 0x8, &(0x7f0000000480)='/dev/iommu\x00', &(0x7f00000004c0)="1c7146dbfb471a889c7f3f1126397b12323f0f123b19450cd65ece058b9f208f2683fa0cf81ec7ffc908715dec1ccba703414ba5adb20c0a738bab9b6e4cbc64e56a1fe9ea1d8f56251140533af9dac9b8146e9740ff403186cd4daa8e978864c9fadc1e2c573165a6dbdd4a44e2f861f54ac0ac2e1d86ba0deb94b6c07edf46bac3457d8a64333576e5b6bfa2b78a9c492ade548af06f2bc2204904b7cd91d94b5a7d315ab1d10bddd3b67aec701d8740659213ea234a21b11b17ab03af14779da8c9b8a1717f257680894c20f19f", 0xcf, 0x12}]}) 21.920406487s ago: executing program 1 (id=559): r0 = syz_create_resource$binfmt(&(0x7f0000000040)='./file1\x00') bpf$PROG_LOAD(0x5, &(0x7f0000002a40)={0x3, 0x0, 0x0, &(0x7f0000002a00)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x18}, 0x94) r1 = syz_create_resource$binfmt(&(0x7f0000001400)='./file0\x00') r2 = openat$binfmt(0xffffffffffffff9c, r1, 0x42, 0x1ff) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e22, 0x39, @private0, 0x2}, 0x1c) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x29, 0x0, &(0x7f0000000000)) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$SNDRV_TIMER_IOCTL_INFO(0xffffffffffffffff, 0x80e85411, 0x0) ioctl$DRM_IOCTL_MODE_ADDFB(0xffffffffffffffff, 0xc01c64ae, 0x0) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x101041) openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x400, 0x0) write$sndseq(r5, &(0x7f0000000080)=[{0x10, 0x81, 0xfc, 0xfd, @tick=0x1, {0x8, 0x4a}, {0xe}, @note={0xa8, 0x8, 0x1, 0x1e}}], 0x1c) r6 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f00000003c0)={[0x60000000004, 0x7, 0x1, 0x41, 0xc3d, 0x0, 0x2004cb, 0xffffffffffffffff, 0xa1d, 0x7, 0x5, 0x7d, 0x83, 0x2], 0x3332d000, 0x202}) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$KVM_SET_SREGS(r6, 0x4138ae84, &(0x7f0000000100)={{0xd000, 0xe000, 0x0, 0x77, 0x7, 0x3, 0xcb, 0x2, 0x0, 0x6, 0x6, 0x19}, {0x8080000, 0x9000, 0xd, 0x1, 0x2, 0x0, 0x7, 0xff, 0x7, 0x0, 0x3}, {0xeeee0000, 0x1000, 0x0, 0x0, 0x7, 0xc7, 0x40, 0x1, 0x45, 0x3, 0x4, 0xfd}, {0x1, 0x0, 0x9, 0x4, 0x81, 0x0, 0x9, 0x0, 0x3, 0x0, 0x9, 0x2}, {0x0, 0xffff1000, 0x4, 0x4, 0x0, 0x4, 0x0, 0x6, 0x2, 0x34, 0x4, 0xff}, {0x3000, 0xffffffff, 0x0, 0x78, 0x8, 0x0, 0x2, 0x1c, 0xa3, 0xff, 0x5}, {0xeeee0000, 0x80a0000, 0xa, 0x4, 0x0, 0x0, 0x7, 0x21}, {0x0, 0x6000, 0x8, 0x0, 0xa4, 0x7, 0x8, 0x40, 0x26, 0x0, 0x0, 0xfe}, {0xf000, 0x3}, {0x3000, 0xfffd}, 0xddf8ffdb, 0x0, 0x0, 0x120, 0x0, 0x0, 0xdddd1000, [0x80000001, 0x0, 0xffffffffffffffff, 0xfffffffffffffffe]}) openat$sequencer(0xffffffffffffff9c, &(0x7f0000001000), 0x880, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) write$binfmt_elf64(r2, &(0x7f0000000040)=ANY=[@ANYBLOB="7f454c4602010103fcffffffffffffff03003e005666d37500010000000000004000000000000000df01200004"], 0x509) close(r2) r7 = socket(0x2, 0x80805, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @mcast2={0xff, 0x5}}, 0x1c) read$FUSE(0xffffffffffffffff, &(0x7f00000009c0)={0x2020}, 0x2020) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000001040)={0x9, 0x0, 0x10000}) ioctl$DRM_IOCTL_AGP_UNBIND(0xffffffffffffffff, 0x40106437, &(0x7f00000010c0)={r8, 0x8}) getsockopt$bt_hci(r7, 0x84, 0x75, &(0x7f0000000000)=""/4071, &(0x7f0000001080)=0xfe7) mount$9p_fd(0x0, &(0x7f0000002b00)='./file1/../file0\x00', 0x0, 0x8d804, 0x0) execveat$binfmt(0xffffffffffffff9c, r0, 0x0, 0x0, 0x0) 6.472685284s ago: executing program 35 (id=559): r0 = syz_create_resource$binfmt(&(0x7f0000000040)='./file1\x00') bpf$PROG_LOAD(0x5, &(0x7f0000002a40)={0x3, 0x0, 0x0, &(0x7f0000002a00)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x18}, 0x94) r1 = syz_create_resource$binfmt(&(0x7f0000001400)='./file0\x00') r2 = openat$binfmt(0xffffffffffffff9c, r1, 0x42, 0x1ff) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e22, 0x39, @private0, 0x2}, 0x1c) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x29, 0x0, &(0x7f0000000000)) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$SNDRV_TIMER_IOCTL_INFO(0xffffffffffffffff, 0x80e85411, 0x0) ioctl$DRM_IOCTL_MODE_ADDFB(0xffffffffffffffff, 0xc01c64ae, 0x0) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x101041) openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x400, 0x0) write$sndseq(r5, &(0x7f0000000080)=[{0x10, 0x81, 0xfc, 0xfd, @tick=0x1, {0x8, 0x4a}, {0xe}, @note={0xa8, 0x8, 0x1, 0x1e}}], 0x1c) r6 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f00000003c0)={[0x60000000004, 0x7, 0x1, 0x41, 0xc3d, 0x0, 0x2004cb, 0xffffffffffffffff, 0xa1d, 0x7, 0x5, 0x7d, 0x83, 0x2], 0x3332d000, 0x202}) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$KVM_SET_SREGS(r6, 0x4138ae84, &(0x7f0000000100)={{0xd000, 0xe000, 0x0, 0x77, 0x7, 0x3, 0xcb, 0x2, 0x0, 0x6, 0x6, 0x19}, {0x8080000, 0x9000, 0xd, 0x1, 0x2, 0x0, 0x7, 0xff, 0x7, 0x0, 0x3}, {0xeeee0000, 0x1000, 0x0, 0x0, 0x7, 0xc7, 0x40, 0x1, 0x45, 0x3, 0x4, 0xfd}, {0x1, 0x0, 0x9, 0x4, 0x81, 0x0, 0x9, 0x0, 0x3, 0x0, 0x9, 0x2}, {0x0, 0xffff1000, 0x4, 0x4, 0x0, 0x4, 0x0, 0x6, 0x2, 0x34, 0x4, 0xff}, {0x3000, 0xffffffff, 0x0, 0x78, 0x8, 0x0, 0x2, 0x1c, 0xa3, 0xff, 0x5}, {0xeeee0000, 0x80a0000, 0xa, 0x4, 0x0, 0x0, 0x7, 0x21}, {0x0, 0x6000, 0x8, 0x0, 0xa4, 0x7, 0x8, 0x40, 0x26, 0x0, 0x0, 0xfe}, {0xf000, 0x3}, {0x3000, 0xfffd}, 0xddf8ffdb, 0x0, 0x0, 0x120, 0x0, 0x0, 0xdddd1000, [0x80000001, 0x0, 0xffffffffffffffff, 0xfffffffffffffffe]}) openat$sequencer(0xffffffffffffff9c, &(0x7f0000001000), 0x880, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) write$binfmt_elf64(r2, &(0x7f0000000040)=ANY=[@ANYBLOB="7f454c4602010103fcffffffffffffff03003e005666d37500010000000000004000000000000000df01200004"], 0x509) close(r2) r7 = socket(0x2, 0x80805, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @mcast2={0xff, 0x5}}, 0x1c) read$FUSE(0xffffffffffffffff, &(0x7f00000009c0)={0x2020}, 0x2020) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000001040)={0x9, 0x0, 0x10000}) ioctl$DRM_IOCTL_AGP_UNBIND(0xffffffffffffffff, 0x40106437, &(0x7f00000010c0)={r8, 0x8}) getsockopt$bt_hci(r7, 0x84, 0x75, &(0x7f0000000000)=""/4071, &(0x7f0000001080)=0xfe7) mount$9p_fd(0x0, &(0x7f0000002b00)='./file1/../file0\x00', 0x0, 0x8d804, 0x0) execveat$binfmt(0xffffffffffffff9c, r0, 0x0, 0x0, 0x0) 2.90926271s ago: executing program 7 (id=774): mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) (async) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) (async) r0 = syz_open_dev$video(&(0x7f0000000180), 0x6fdc, 0x6000) (async) ioctl$DVB_DVR_DMX_EXPBUF(0xffffffffffffffff, 0xc00c6f3e, &(0x7f00000001c0)={0xb370, 0x80000, 0xffffffffffffffff}) ioctl$XFS_IOC_OPEN_BY_HANDLE(r0, 0xc038586b, &(0x7f0000000380)={r1, &(0x7f0000000200)='!]-[\x00', 0x0, &(0x7f0000000240)={@align=0x2, {0xfffc, 0x0, 0x4, 0xa}}, 0x3, &(0x7f00000002c0), &(0x7f0000000300)=0xdd}) chdir(&(0x7f0000000140)='./file0\x00') (async) r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dev/mapper/control\x00', 0x2, 0x0) ioctl(r2, 0xc138fd08, &(0x7f0000000340)="0400000032000000000000006c01000038010000010000000000000000000000000000000000000000000000000000006d795f7a6f6e65645f646d") (async) open_tree(r2, &(0x7f0000000000)='./file1\x00', 0x100) r3 = openat(r2, &(0x7f0000000040)='./file1\x00', 0x400, 0x1ff) write$RDMA_USER_CM_CMD_REJECT(r3, &(0x7f0000000800)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0xe7, '\x00', "2be13c086884449291376aaab3f822cd1bdbd211505af9305ee8860e3fc002d87075eb79567bf5e0f4bca7106ac01c1b57c35ccad9b9765784fe87f45f7b6ef77fcada488fe7c88173f2687e291ed1e74833989a34a16d57c4508c550aed75460c8aad5ebd53d001d243d723077e65f7eac17e396e4aa9874d8d3757ac66e098a79f7d22aa5d83bedf4f31f298f54dda92c6ee66dd0e13e386adcaa66cc9d7d1dff800863de8b5caf4be5c38aa64f5a0f1857c4c6a5b733bd56c0bdbd3dbae6638c0f5ff090885017b72e0ae8dc09619923e3cb4df3039fa91b969e5d31077ce8438f5c4f0f747dd43d62de3e408d8aaafed238cee632bfd7a14d1dd0a1f96e6"}}, 0xffffffd0) 2.857805837s ago: executing program 7 (id=776): r0 = socket$kcm(0x10, 0x2, 0x0) recvmsg(r0, &(0x7f0000000500)={0x0, 0x0, 0x0}, 0x40000000) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="3c0000001000810500000000fcdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="00010100020200001c0012800900010069706970000000000c00026b0500090029000000"], 0x3c}, 0x1, 0x0, 0x0, 0x20004002}, 0x0) r2 = creat(&(0x7f0000000580)='./file0\x00', 0x0) file_getattr(r2, 0x0, &(0x7f0000000080), 0x18, 0x1000) rename(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='./file0\x00') ioctl$BTRFS_IOC_ADD_DEV(r2, 0x5000940a, &(0x7f0000000540)={{r0}, "2e1910069e3d6fa87e2db7253e02608602a70479fc4d15cec87158c77ac6a4eee951d15511acdb7fe4a133483825302f1ad16d87f3ec9866764c7276dedff157828b6d3de5ce51fa13836d714b0aa547455cb05e122b77a2fefe8178bbca14038c6e1252fe5299b61e6070aece70225a7af9fa84d6ccfb672f8bccdcf4d485c2ba95e595f1140fe36856d978e5dcf85f6d59787dcf9698560c26c47eae914c2c1fd0acf10482ba78fba066cc31fd3f57c7be727dba5ca7e8f484a722e01e77d7c289abefb02696dbc2602861ff3fd0e01511e6bc2a017b197a8f04d42633d785d9265975a192b2f52406924a1878ed9c5971b7bb83834e522d0ab29fa79a8428e2ad5f4ce37ad7766ff6bf4ee9a6cb54c47ba247c5b07b17d766a9bb0ea814c942370a24a011df8635b9df6bb7eed229534d3d6a14cf7134451d75f33f3dc0d0c882e2063cbf2e7a6fa0c633df50d2cf6daef6d09e95b845bcbcb5b6b2a6c6d811c2ae73916e0ec504b7d49fb1147e8ac5a4c311c0d6eef0b196d84317e17f83f8c87eb1da87793a24e232f421064469f0c047096ee8ef4cc5513a55995254cef157993e4a473d526e412b2be6847718bd8f2742606d358b84586ca3003500c95d745b0abc1d9df5f4eba3aed2ca9ac20d86d93210efe002bbdee74714de39db8862058c734d097b1b7b1163a28e795d87a865800a50f78f14069b1e07844084e99ab624cf9f2909ea0ad456a25cd741aa7e7718a579272b13ed73622b5d13738f4384adcecc2539040c8833c40161c86231e627083fdefb1e17de426f4cf115082c65670b80e39106c8178fc08e588ee39568d32c761b4ac754c1208f4bea00e87eb5950d0e3e377273e1f3b9122cc980163cabc0a63dd6375c7f4f65560367dc96f9d4bd9b56d292e5de106848119a556650729e73edf087975911d4135dc6f55dfe2dd8bfe202cf33c385603e9a992aa1b6ac69c1e93b50efb9e7f6fb870487d0e22695f92453ecf4073b1323907bc257f931d7b885cd80c0c79883578c5458f31ccb4720d248589557cd240c3ea63400e0d4220ca415a1e0f9c0f5efba982d349a6a02c5c9f22f7ad2cd1c47db08425b18718177881d8d912db474193499ca556d283f3b55ea8c3c4e73a2fc3e28857500afaf49e5a0c908e1af669b873beebca788babb350202b062f7bb5de84b87bfe7e8ea5ad3109cb867be2945b63a3b42e24c4d04ec8a4087a3abc65aa0af7c8bc57a468925159d1c2ff09bcedc6f008b3adcbca02d728f16c8373d387f56b519010da42fcf9cf007d91e4d2918d91d376d8c32cced5d914dca3861a6e3cb75ec2d9cc390049ebe84ea752b2617ab5cd915471a7787eef3258e6bfb74864ca84ae2a2fd83ead6eac5381e1d93a688444109d4b951f2a9b0b2b5e99ec7c17c159ffd8ab3366d989a92eaf01f78db2ffecd3f2a1b5f5e1356cd0ce0446d0778285576fbd738504d4b9c1ed3031d11387d9e66d48e1f6c7c093140ff7e0fdc421fa3887e171f3e11c974836351dbd7c68a8a0173fdb8c5011cda6c833de0f80fe4543cb1d8b14a49099ecf6a7bfbe1d2e53de4b7871363be1b700f091b008660b8b35b87c674300077b4eace09d9ce2ff2013994476bc22922264ff3f1fd963ea1e7b3431c9a9c4b8a6e5837832f4e87821a800c8e87c0d56408969aaca6b7fc6f860a9a024d17b5b1536d5a844ca7cc492a813baa01c87712a077a48858ef97c29884d6ee574ebe4b7274f4c1ffdc62e2a11f9f3e54567cbcc9d5a0672e2efbef94b3a747a7417a410ac489fcfc8eb6da14cdd54995393ccc5d184a2fb91206d1b479a8eb059baf0210b402dccb718e490a7c0cf5fb8b3d4253d731f79398d48f76d03e8c13ecec3dd0c9c4570b6334353c6ecf9eea6896a62041a8708f820bc76b5e2480a1ce67e1169b6173f77826437ebe3f77a2a37ac4db6bebb15604242efdaf652e1031f14f48248423509a50b626dc9ac21b5fbd3cc6278cca470153a4f2b0e8de2c0c8b3203d5b58f793885fb486f6dfe519d9efcec6613956b7ad5466a036b6762985c8eccc7c0df63e0f23f51d3589fefd7573d54fe34b424fb23570fa5c7c4d01765934190137265c7f022fd7541761bc9ded413a9b22d4155917ce4afc3cf0df1468495e823ca80084b335d21e5743504d2c70c43252fdfc804a208b090664d34f8c1b6d3437146656fdfe6fc932073f38ed4917bb076621819d92bac7a90e0d276027a72f5c59d1cdc15994a898f7fbd9d9ff2b9688b188779d432c622060b820229911161214bbf81d906957a83deb42534edf6dfce7b70a17bba7a9578c8efef17e2af6f09c38f81c295d23d849b8c3a239048a393ff92baf43fa4f3b9002d2831c0297868a10e8cdda666ada1a32d28669e87129688881cd937fa481e499ba63ccc57e10f763e5f132a218b7eca20b3cd9dd5e3c166c499a69bd899cdcfef4f0b2722080e8254ee2590a3ec3387f9398be235821008a369d8d54091dc1266534c2d4b2de17bc8d8abfcf13d4a8fe3554e1a2f95c9817c77d13ef724338bebb5253566c772d7ab122e24445b912ec54698395a5b9c61dd270764bceaeb6e313f0148863daf52c4fbbbf8cbeacee65c8e3fd81bd923f3990c71c9409230d0f9fea7637bb5651acf628da1070fb740484e5f41db401b3351903553af817f1f8db735e8efd2ab400ab9abf8c76f9103053142ef14a602a1971ff792d35f507188c90aec549faef734c8f6630e43de2197d34973689908eaadd6f73ccae64f6f0a0f3e0100fb090fafcc9b987771eac2c45f82a7b80938139b6c5dc290509bb0bc70fcf221f9335bb77abf82359bb52c8c2b1533b3ed5010d5f8e1d67981193f132b3d6198c5fb498e9eb148433fe379b06340b241e0985b500f42af6858a0e3ec722116db0ff8aa74bcc9a49697130ae3280a23691aec6dfb0321d4ec092ca8945887284cccc0635100257da63305b44c0652abfbb37e05e340df6bbb9af8bf2de12327fce5592b3ecd6992afb5c834a2c10aeb89ab942d1e726a3e316e5dec38090532854d8680a3317732e7d0f573ae6249b1986635c35ae3e45772574f637a08abb4e4da441e7eacb8421c63de0e0f27bcc355e0b8367008fbbd85154f6123c0645ad489e4c86c87dc8db74ec504943ffc35e1cf767ab02a86152eef39dab1dc423117c1ccc7955e0130ff15eb27ebdf004495b5f8c516abb96476ef9be254beec3eac1b8f5e9cb39e48831a24476879cac4732e4d846567d6ac9161887e20ec2f98945157d7bb633a643ae622c097b910f7f99c75bc441a57a13e6366035aee4f2d2b789d405c2094c4c01f9026e1203abcaa5dd564cc29d6650f82456c0899349ed8dc2e46de8f3dd0a9062adc157cfc53bcc666d5a3100c61b7e241b3eac7f671b2fb82403f4d97ae9ac29c2232d1425f8e21ae64a8aa95341cd23e26b2b0abcfee48b8f9bf15dbb042403eacf1b9e0c78d08cddd2aef76f9d54c33d80db78b3779bafa8898fea902cd3d5598b08302409befbd3658a1da8c0f366d53bcca28eb078d0f80335b224e85bff33f0cf4cb56d8196263e68cf0d48f508774f1f5cb55e343ac2d8e0c0fc8a8541132b69d3154d8b4063c3494f0682fd38a2f56a67bcabf7d3dfc5000004e1d7c234ddea394e7a1cc65f2431825cbb4d597de3093ab32f02cf82c37049d8c3cf490f32f6f22021a7c8872393df60d45d95fa3521e81d381a6a663037e7219a4f2fcf6d0484c757e71377f56203ea52849e9164f3692d763b570da926cb5a2f8caed24dcf4eb608b9f697d43602183b7c66a307bbaf98f2c4f85ff64cd283b6722868b2d055ba6826c4d9c3a9e80964a3b006b8d15e1ddace7340cab948225ae9d81d69917a215e20ee819fa033cda712a298ea2b5b5888e22706067d0d4c25c04aa1cb5057bc0523d51696318b294a5d5236d47b7a8b0301c38e1109ecf0d386e5e969badb921359c7a1d3589ca94ddf7b635f31bf806debd7c72c41122a7b7f4d71f6f52db5d9935f7ed27d7162e3e5756d52920d4aba86e94fa50444825e0a0fd82bd31d741e7e9f20fd8f068137cd8d7e4b11baece1ea9da2526d7867a286a20c71d1ce3f401cf2b0ccbda2a037a2d711ce3ffe0e1c6d648f2e29085788c4b0980d05f2e8b74d971b5f4e90ef3065fce47132b2117d828e0c59dd725e2a248ec4c50b577a4ed01b352293a3337bead8e8f2561a43382b1b32b2c786e299c741815e78a699ea312bdd71db7f63a07f0516b9e90895510644e286792b2d69d0d4d5c5fe51544aa3c86190bfd04f0949b2b5dcc60d469080b36107f3ec8f5d5e3811527287f36b8fefa63d18798a45a6b466c4d27e533dc3024131bde8c97d2338f66b8f65c93f59cf3d5149f9d32de244893e9973ee3eaa8b62b494a259bee329762c9f477adc50bd27b874119d7756714ef788986bb859416801ce8b910688d0b8d81e270868225e60fb91740b54db29a776d98e6a2713fcc7b0dcb29487f9e7a50bf78e782ad2bc98c0b085b3a4e242a3a137c921fb76d06a8b992764be89652fdb6352e3b93609b190394e46abc02ec3e6bd188f94b9364b7d19c54d82abaa35ed872d723a5b9300a4c6a1e9773868b674c7a61cc5314ed4f44d25aee04f4142d5f89f014f57ae2918988156a9d083dc816597441932f3cebe633396b121b265863270657d656a771ae00d51330d64f0f2b09052b1dec0aa5f753ac4641db42e084f03dc841c54a1f1657b9fdc2fbc1311b6e7eeab566fc5ba5e861f9368941fd98645790203b121943fcdfcb70119fde1a72a5a8c9fdece219564f5146d4feb09d32abbc57ffb14c09e67d96081fc2ffa979e94e44ff97aa21dcbff7a925d109c949f680d8692df35323f967a0d674a37194248ff042251ad0532d3cda4ca6e86cebbd7a09aa7cde9921a6f223bf7b041865034de46e85c2f18a0f0dd5ddc9095b4ec68ac876a03091fb9fcf059bd7875eb9539df9edac139ad2e3abe27d065cc77a05d6a5c5c9e23952c6614dd23c285881a1c83dd5407f69ae6bb8b28a548e7e8dfe614246826626196af719a1aa4cba075b89088a82d3e91d2a718849ec379994a7a83edac4275dee8db4369247e0700d454e2c8fedb1b1c92e570a0f57201630b229263c7f0859a9d9f69462e60d5e6dce609b574b91580cf1b5aef227c70699a95ea6c361bd69b2fba9bd8c404cd8826587ed7c12cc2b957d4fca97857af5050ddeea38d5ac49be0e9d1cf2b9bba0082de0288f94763e78bfe79937383e98e841e99ac2bdad5cea2ba3a4ef3b1f72f3a7430e1f2a98c752320e802f4dfce788ec8672cb7d3fd9323f5dc06f5437a241f138ca95f2adfbba441e6d80ec97ff453b01c9c379b71bf60c32cf0cb71ad9599abd43ab6e8274af9eaef8a0d0f35d87bc3429d9ef44144d1927ba9ec9c060078649f5a7fe53027af194b2bd0083be912a00423994ce3e08b49df713b038b1fb61fbbc2b2a09fab7dc92a94bc0a76a60213ac80e21773ac733cb5f48d86e7a8b7245586327663b9215ec11bbbb493564c5a5b743c9fa912d20228bfe0252d00cc5c74bb169581116f83d84ff6dc53c154aa64c389b2924e5923f4b8cc9a1e974efc245e7937a95aab845275def521ff8984e1b3ba8d8721d432ff9391553b03d900be787a5d703ab3c7178a29fd8511db0fe42c06c337e44e93a2d422ef676d0d7308609759e1b982ae98292781d8198c2caa1f78945d0f522e4f5e1235d2c23"}) recvmsg$unix(r0, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x10102) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x6, 0x3, &(0x7f0000000480)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x94) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000580)={'netdevsim0\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000000c0)={r3, r5, 0x25, 0x0, @val=@netkit}, 0x1c) r6 = syz_genetlink_get_family_id$nl802154(&(0x7f00000001c0), 0xffffffffffffffff) r7 = syz_open_dev$sndpcmc(&(0x7f00000001a0), 0x0, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r7, 0xc2604111, &(0x7f0000000c00)={0xe9, [[0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0x81, 0x3], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffdfff, 0xffffffff, 0xffffffff]], '\x00', [{0xd, 0x10, 0x0, 0x0, 0x1}, {0x20, 0x20, 0x0, 0x0, 0x1}, {0x2, 0x4, 0x0, 0x0, 0x1}, {0xac44, 0xac44, 0x0, 0x0, 0x1}, {0x1388, 0x186a0, 0x0, 0x0, 0x1}, {0x100, 0x400, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x2, 0x8, 0x0, 0x0, 0x1}, {0x2710, 0xf4240, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x1000, 0x4000, 0x0, 0x0, 0x1}, {0x0, 0xf4240, 0x0, 0x0, 0x1}]}) ioctl$SNDRV_PCM_IOCTL_PREPARE(r7, 0x4140, 0x0) ioctl$SNDRV_PCM_IOCTL_REWIND(r7, 0x40084146, &(0x7f0000000040)=0x7) ioctl$SNDRV_PCM_IOCTL_FORWARD(r7, 0x40084149, &(0x7f0000000100)=0x80) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, r6, 0x100, 0x70bd28, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x40}, 0x0) bind$packet(r2, &(0x7f0000000100)={0x11, 0xd, r5, 0x1, 0x27, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1a}}, 0x14) r8 = socket(0x11, 0xa, 0x5) write$FUSE_INIT(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_inet_SIOCSIFDSTADDR(r8, 0x8918, &(0x7f0000000040)={'ipvlan0\x00', {0x2, 0x4e20, @multicast2}}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) sendto$inet(r8, &(0x7f0000000140)="9c91d7798c7f1b4ca046b42f0c3d", 0x5ee, 0x800, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="364000002600913e"], 0xfe33) 2.026862006s ago: executing program 7 (id=794): r0 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VIDIOC_CREATE_BUFS(r0, 0xc100565c, &(0x7f00000000c0)={0x6, 0x9, 0x1, {0x9, @raw_data="7d15fe993425c996d1f223a3988974c82cefdc44595bea6e37af9bec965692679a29d34a3c308f6f0d47c7bad8af46ed4e2f2f83024cf808fe81530cdc12b0dbe2dbee455ccac25e44dcac046411c808f2009858953f457718befaf28baed00d9a1426a6063be563238dbe36e45c9f1cac204cecee4bc50a9399a7e5be59710f5e97f4c788c928ee7def16c42a48e2d97121c975f1fed356b794aa058902fab1a1b436d29f73cbf2cb91fc835fa35e5551edc4c0e70a329561f6487535b2b8787b5e3b4ed32eea7d"}, 0x8000}) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYRES64=0x0], 0x90}, 0x1, 0x0, 0x0, 0x4804}, 0x0) (async) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, 0x0, 0x1, 0x301, 0x0, 0x0, {0xa, 0x0, 0x2}, [@CTA_ZONE={0x6, 0x12, 0x1, 0x0, 0x4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40800}, 0x20000010) 1.959595161s ago: executing program 7 (id=795): bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb01001800000000000000340000003400000006000000040000000000000e0400000000000000000000000000000d03000000000000000000000400000000000000000000000b030000000000000063"], 0x0, 0x52, 0x0, 0x0, 0x7}, 0x28) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x3, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}}, &(0x7f0000000080)='GPL\x00', 0x7}, 0x94) 1.958072127s ago: executing program 6 (id=796): r0 = syz_create_resource$binfmt(&(0x7f0000001400)='./file0\x00') openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], 0x0, 0x0, 0x0, 0x0, 0x100, 0x76, '\x00', 0x0, @fallback=0x1d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/class/rtc/rtc0/wakealarm\x00', 0x2, 0x0) write(r1, &(0x7f0000000040)='+5', 0x2) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40e00, 0x4, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000240)={r2, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f00000001c0)=[0x0], 0x0, 0x0, 0x1, 0x1}}, 0x40) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x20846, 0x2) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000016000/0x18000)=nil, &(0x7f0000000300)=[@text64={0x40, &(0x7f0000000240)="3e66366466420f788152ea65d38aa6e67f420f0666b89d000f00d8c4820993a46b5c1e0000660f4a1cb8010000000f01d942c1d20d2e653ef623b805000000b9faffffff0f01d9", 0x47}], 0x1, 0x18, 0x0, 0x0) r4 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_group_source_req(r4, 0x29, 0x2f, &(0x7f0000000180)={0x8, {{0xa, 0x4e22, 0xfff, @mcast2, 0xb}}, {{0xa, 0x4e20, 0x3ff, @private0={0xfc, 0x0, '\x00', 0x1}, 0xcd004ef}}}, 0x108) syz_emit_ethernet(0x6e, &(0x7f0000000300)={@local, @empty, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0x38, 0x3a, 0xff, @remote, @local, {[], @pkt_toobig={0x2, 0x0, 0x0, 0x500, {0x0, 0x6, '\x00', 0x0, 0x6c, 0x40, @local, @remote, [], "3b00123400000000"}}}}}}}, 0x0) setsockopt$inet6_group_source_req(r4, 0x29, 0x2e, &(0x7f00000002c0)={0x8, {{0xa, 0x4e20, 0x4, @mcast1, 0x6}}, {{0xa, 0x4c21, 0x4e11, @empty, 0x1000}}}, 0x108) getsockopt$inet6_buf(r4, 0x29, 0x30, &(0x7f0000000180)=""/214, &(0x7f0000000080)=0xd6) r5 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000000)='source', &(0x7f0000000180)='4,.:\x00\x8e\xf7\xd4\t\xe1\xae\x19\xe5\xf7c\x84\x9c\x06\x00\x00\x00\x11\x01\xf2 \xec\xbe#\'S\xc4\xbd\xb5\x1e\x98MM\x06\x1a\x7f5U\x18\x90\x99\xb2\xfa\')Z\x9ew\xae\xe8\xdd\b\t\xf0\xc4\xbfj\xb6\x88/)~\x93E\x1d4\xa7\xcb\xeb\x0f\xd4(\xb6>\x87\xc3\t\xb0\x80\xf7\xe6\x8b?\xa4\xb3\b\x00\x81\xbe\xea\x1f\xfe\xed\x9d\x1a\x8aQ\xafQ\x06\x0fJ\xc0\xc0=}\x7f\xaeB\xb1\xed\xa4\xf3c#\xbe\b\x1f\xa4L[\xfa\x01Uu\xe0\x8b\x94E\xda\xd9j\x93\xc8~\xd9\x82\x8f\xcam\x17\xa2\xed\xf3\xc3_h\xfc6\t\x96@\xaf\xe6\xd0!)\xc3\xcfe\xe1g\xe7\xe5F\xbdC\xd9$\x9b@\xaf\xc2j1p\xa9\xb2d\x92\x8fo\xcbg\x9fZ\xd7\xef\xb2z\xf5\x0fq\x7f\b\xc2\xa7\x90\xc5\xf5Y\xbc\xf1s\x93X\xb6\xeb\x86&\xa7\x14%B', 0x0) write$P9_RLERRORu(r3, &(0x7f0000000240)=ANY=[], 0x10) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r3, 0x0) 1.957298813s ago: executing program 7 (id=797): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x11, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bf8100000000000007080000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018210000", @ANYRES32=r0, @ANYBLOB="0000000002000000b70500000800000085b0ff00a900000095"], &(0x7f0000000300)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) 1.895897118s ago: executing program 7 (id=798): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r1, 0x400454da, &(0x7f0000000080)={'batadv0\x00'}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'erspan0\x00', 0x1}) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x20000000ec071, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xd) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r2, &(0x7f0000000000)='3', 0x1) getsockname$packet(r2, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000200)=0x14) futex(&(0x7f0000000500), 0x20a, 0x2, 0x0, 0x0, 0x1) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route_sched(r3, 0x0, 0x0) r4 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r4, 0x0, 0x0) syz_usb_control_io$hid(r4, &(0x7f0000000840)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00220f000000540b4550182195f51584b3"], 0x0}, 0x0) r5 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x2400) ioctl$HIDIOCGUCODE(r5, 0xc018480d, &(0x7f0000000040)={0x3, 0x0, 0x1, 0xfffffffc, 0x1, 0xfffffffb}) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0026}]}) close_range(r6, 0xffffffffffffffff, 0x0) r7 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x739cc2, 0x0) ioctl$TUNSETIFF(r7, 0x400454da, &(0x7f0000000140)={'batadv0\x00'}) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000100)={'pimreg0\x00', 0x411}) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000240)={'\x00', 0x52d35ce30131f272}) openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x802, 0x0) 1.818802752s ago: executing program 6 (id=801): r0 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1={0xfc, 0x1, '\x00', 0x1}, 0x7}, 0x1c) sendto$inet6(r0, &(0x7f0000000000)="19", 0x1, 0x80, &(0x7f0000000280)={0xa, 0x0, 0x0, @private2}, 0x1c) shutdown(r0, 0x1) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f00000002c0)={0x0, 0x1}, 0x8) mkdir(&(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000140)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/kernel/osrelease\x00', 0x0, 0x0) read(r1, 0x0, 0xeffd) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7c, &(0x7f00000000c0), &(0x7f0000000180)=0x8) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="cd00000000040000610000000000000072264da4c62de0d2e6bd001000"/42], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sock_ops}, 0x48) 1.818316666s ago: executing program 6 (id=802): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$FUSE_NOTIFY_DELETE(r1, &(0x7f0000001fc0)={0x45, 0x6, 0x0, {0x0, 0x0, 0x1c, 0x0, '/sys/kernel/debug/sync/info\x00'}}, 0x45) (async) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) sendmsg$NL80211_CMD_REGISTER_FRAME(r0, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="0000000000bd703e95edce07bb539b00000000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x2800}, 0x4000800) (async) socket$unix(0x1, 0x2, 0x0) (async) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) (async) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0x9, &(0x7f0000000000)=0x4800, 0x4) (async) r5 = socket$netlink(0x10, 0x3, 0x4) write(r5, &(0x7f0000005c00)="2700000014000707030e0000120f0a0011000100f5fe004681000000078a151f75080039000500", 0x27) (async) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) (async) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) (async, rerun: 32) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) (async, rerun: 32) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) (async) chdir(&(0x7f0000000140)='./file0\x00') r7 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x80042, 0x4d) fallocate(r7, 0x100000000000011, 0x2000, 0x2f93) sendmsg$NL80211_CMD_EXTERNAL_AUTH(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000240)={0x0}, 0x1, 0x0, 0x0, 0x20000000}, 0x4010) (async) r8 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x109142, 0x5) pwrite64(r8, &(0x7f0000000100)='\n', 0x1, 0x8000c5b) fallocate(r8, 0x20, 0x0, 0x4000) (async) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000540)={&(0x7f00000005c0)={0x134, r3, 0x300, 0x70bd2c, 0x25dfdbfc, {{}, {@void, @val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_IFNAME={0x14, 0x4, 'vxcan1\x00'}, @mon_options=[@NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "bae82644a887c99fbd3edc2fec6b2e4711f913ccac6c0708"}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "eb53e02e43284a9c4f1f01948f88f55bf4e850639723a78a"}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @device_b}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "0ed1e116383f3ef4dac1d9d1ec93d6efad2a760f5b6aa0f1"}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "b6c19f7bddd59dd0e985a8cc60cf049ed9124b693f529c60"}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "bea8eea4856e2689a4cdf49fcc0718af58c135c77ea70df4"}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "489a092a86cf3107269413d43523361be53e89ff48c9a39e"}, @NL80211_ATTR_MNTR_FLAGS={0x10, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}]}], @mon_options=[@NL80211_ATTR_MNTR_FLAGS={0x8, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_COOK_FRAMES={0x4}]}, @NL80211_ATTR_MNTR_FLAGS={0x14, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}]}], @mon_options=[@NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @device_b}], @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_4ADDR={0x5}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x7}]}, 0x134}, 0x1, 0x0, 0x0, 0x10}, 0x20004004) r9 = fsopen(&(0x7f00000003c0)='befs\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r9, 0x1, &(0x7f0000000280)='uid', &(0x7f00000008c0)='0\x00#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xea\\bb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D-\x98\x9f\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xd7\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6\xd7\x80=\x8a\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\xa7\xfa\xdb\x1ce\xc1\x03\x86J\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\x81\x14l7u\x95\x96t\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xe39\xc6b\x905\x1f\x03\x00\x00\x00\x00\x00\x00\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?\x839\x85N\x1c\xc1\xcb\xfc\x85\xd2\n\x02\"\xf2\x81g\x90\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9ak\x00\x00\x00\x00\x00\x00\x00\n\xa72\xa3\xef^\xe7\x8f', 0x0) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r10, &(0x7f0000000140)={0xa, 0x4e22}, 0x1d) 1.666751198s ago: executing program 6 (id=805): r0 = socket$inet6(0xa, 0x5, 0x200000a) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) r2 = dup(r1) write$UHID_INPUT(r2, &(0x7f0000002080)={0xf, {"a2e3ad21ed0d09f91b3d090987f70e06d038e7ff7fc6e5539b0d3a0e8b089b3f360068090890e0878f0e1ac6e7049b3341959b759a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b3b070d07720936cd3b78130daa61d8e8040000005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15ffffffffffffffff1243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b23b8a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f423500c7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195523c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180000000002cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285ed889156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0663ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9cc8036cbd65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53000100000000000064b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f90000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400", 0x1000}}, 0x1006) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bind$inet(0xffffffffffffffff, 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'veth1_to_bridge\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r4, 0x890b, &(0x7f0000000540)={@rand_addr=' \x01\x00', @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @private1, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x4400046, r5}) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'veth1_to_bridge\x00', 0x0}) r8 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$sock_inet6_SIOCADDRT(r8, 0x890b, &(0x7f0000000540)={@empty, @rand_addr=' \x01\x00', @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, r7}) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=@ipv6_delroute={0x1c, 0x19, 0x1, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc8, 0x9}}, 0x1c}}, 0x0) r9 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x103000, 0x0) syz_open_dev$usbmon(&(0x7f00000000c0), 0x10001, 0x408080) ioctl$CDROM_SELECT_DISK(r9, 0x5322, 0x3) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000980)=@raw={'raw\x00', 0x3c1, 0x3, 0x3d0, 0x1f0, 0x111, 0x4b4, 0x1f0, 0xd4feffff, 0x300, 0x20a, 0x278, 0x300, 0x278, 0x3, 0x0, {[{{@ipv6={@empty, @empty, [0xffffffff, 0x0, 0xffffff00], [0x0, 0xff000000], 'ipvlan0\x00', 'caif0\x00', {}, {}, 0x6, 0xfe}, 0x0, 0x190, 0x1f0, 0x0, {}, [@common=@hl={{0x28}, {0x2, 0x6}}, @common=@unspec=@string={{0xc0}, {0x0, 0xfffd, 'bm\x00', "6d93eb04697dfa39de04767f46614613a407abbf4ed2e83a63b484dbb3bf6b2a850e79009e2905d2f98ba19f91f3c9faee6d3686e9bee067f4e77d9ad66238750c4100d7ee97ec7646259d90edece6e9787a97bc956c01754c34c5c9518c46178ed5f9194454980e579c80eca35a58dc47d1d5e4ff6e216c724e88c702448587", 0x59, 0x0, {0xfff}}}]}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv4=@loopback, [0x0, 0xff, 0xff], 0x4e21, 0x4e23, 0x4e21, 0x4e24, 0x4917, 0x4, 0x4, 0x6, 0x9}}}, {{@uncond, 0x0, 0xa8, 0x110}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x8, 0x9, 0x8, 0x6, 'snmp_trap\x00', 'syz1\x00', {0x87bf}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x430) socket$inet6(0xa, 0x5, 0x200000a) (async) syz_open_dev$tty1(0xc, 0x4, 0x1) (async) dup(r1) (async) write$UHID_INPUT(r2, &(0x7f0000002080)={0xf, {"a2e3ad21ed0d09f91b3d090987f70e06d038e7ff7fc6e5539b0d3a0e8b089b3f360068090890e0878f0e1ac6e7049b3341959b759a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b3b070d07720936cd3b78130daa61d8e8040000005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15ffffffffffffffff1243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b23b8a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f423500c7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195523c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180000000002cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285ed889156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0663ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9cc8036cbd65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53000100000000000064b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f90000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400", 0x1000}}, 0x1006) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) (async) bind$inet(0xffffffffffffffff, 0x0, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) socket$inet6_mptcp(0xa, 0x1, 0x106) (async) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'veth1_to_bridge\x00'}) (async) ioctl$sock_inet6_SIOCADDRT(r4, 0x890b, &(0x7f0000000540)={@rand_addr=' \x01\x00', @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @private1, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x4400046, r5}) (async) socket$inet6_mptcp(0xa, 0x1, 0x106) (async) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'veth1_to_bridge\x00'}) (async) socket$inet6_mptcp(0xa, 0x1, 0x106) (async) ioctl$sock_inet6_SIOCADDRT(r8, 0x890b, &(0x7f0000000540)={@empty, @rand_addr=' \x01\x00', @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, r7}) (async) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=@ipv6_delroute={0x1c, 0x19, 0x1, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc8, 0x9}}, 0x1c}}, 0x0) (async) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x103000, 0x0) (async) syz_open_dev$usbmon(&(0x7f00000000c0), 0x10001, 0x408080) (async) ioctl$CDROM_SELECT_DISK(r9, 0x5322, 0x3) (async) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000980)=@raw={'raw\x00', 0x3c1, 0x3, 0x3d0, 0x1f0, 0x111, 0x4b4, 0x1f0, 0xd4feffff, 0x300, 0x20a, 0x278, 0x300, 0x278, 0x3, 0x0, {[{{@ipv6={@empty, @empty, [0xffffffff, 0x0, 0xffffff00], [0x0, 0xff000000], 'ipvlan0\x00', 'caif0\x00', {}, {}, 0x6, 0xfe}, 0x0, 0x190, 0x1f0, 0x0, {}, [@common=@hl={{0x28}, {0x2, 0x6}}, @common=@unspec=@string={{0xc0}, {0x0, 0xfffd, 'bm\x00', "6d93eb04697dfa39de04767f46614613a407abbf4ed2e83a63b484dbb3bf6b2a850e79009e2905d2f98ba19f91f3c9faee6d3686e9bee067f4e77d9ad66238750c4100d7ee97ec7646259d90edece6e9787a97bc956c01754c34c5c9518c46178ed5f9194454980e579c80eca35a58dc47d1d5e4ff6e216c724e88c702448587", 0x59, 0x0, {0xfff}}}]}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv4=@loopback, [0x0, 0xff, 0xff], 0x4e21, 0x4e23, 0x4e21, 0x4e24, 0x4917, 0x4, 0x4, 0x6, 0x9}}}, {{@uncond, 0x0, 0xa8, 0x110}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x8, 0x9, 0x8, 0x6, 'snmp_trap\x00', 'syz1\x00', {0x87bf}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x430) (async) 1.60849271s ago: executing program 6 (id=808): openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fda000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f00000001c0)="f3430fc733c441d0c6df00430f01350000010066baf80cb84d83ef88ef7a7abafc0cb007ee67260f555efef0fe45f30f78f50f4a3492660f38817809440fc7bd0e000000", 0x44}], 0x1, 0x10, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fd6000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, 0x0}], 0x1, 0x6c, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = syz_open_dev$video(&(0x7f00000002c0), 0x20000000005, 0x244980) ioctl$VIDIOC_G_PARM(r3, 0xc0cc5615, &(0x7f0000000180)={0x1, @capture={0x0, 0x1, {0x3, 0x1}, 0x1, 0x1}}) socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_udp(0xa, 0x2, 0x0) syz_open_procfs$pagemap(0x0, &(0x7f0000000200)) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) dup(0xffffffffffffffff) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) dup(r4) epoll_create1(0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/diskstats\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) pipe2(&(0x7f0000000080), 0x84080) socket$inet6(0xa, 0x2, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r5 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000640)='/sys/power/pm_test', 0x88002, 0x0) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x2, 0x1000, @multicast2}, {0x2, 0x4e23, @rand_addr=0x64010100}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x8, 0x8}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES16=0x0, @ANYRES8=r5], 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x48885) 1.418330131s ago: executing program 6 (id=811): openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$zero(0xffffffffffffff9c, &(0x7f00000000c0), 0x2000, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) r1 = syz_ublk_setup_io_uring(0x1d, 0x0, 0x0, 0x0, 0x0) sendmsg$OSF_MSG_ADD(0xffffffffffffffff, 0x0, 0x20040000) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) socket$inet6(0xa, 0xa, 0x9) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x44, 0x6, 0x470, 0x310, 0x168, 0x0, 0x310, 0x98, 0x3d8, 0x3d8, 0x3d8, 0x3d8, 0x3d8, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x24, '\x00', 0x0, 0x98}}, {{@ip={@remote, @local, 0x0, 0x0, 'vcan0\x00', 'veth0_virt_wifi\x00'}, 0x0, 0x70, 0xd0}, @common=@SET={0x60, 'SET\x00', 0x0, {{}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}}}}, {{@uncond, 0x0, 0x98, 0xc0, 0x0, {}, [@common=@unspec=@pkttype={{0x28}}]}, @ECN={0x28}}, {{@ip={@rand_addr, @multicast2, 0x0, 0x0, 'syzkaller0\x00', 'bond0\x00'}, 0x0, 0xc0, 0xe8, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}, {{@ip={@remote, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0xa0, 0xc8, 0x0, {}, [@common=@ah={{0x30}}]}, @TTL={0x28, 'TTL\x00', 0x0, {0x3, 0x2}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x4d0) r4 = openat$cgroup_freezer_state(r2, &(0x7f0000000140), 0x2, 0x0) write$cgroup_freezer_state(r4, &(0x7f0000000040)='FROZEN\x00', 0x7) r5 = openat$cgroup_procs(r2, &(0x7f00000002c0)='tasks\x00', 0x2, 0x0) write$cgroup_pid(r5, &(0x7f0000000300), 0x12) write$cgroup_freezer_state(r4, &(0x7f0000000080)='THAWED\x00', 0x7) syz_ublk_add_dev(r0, 0x0, 0x0, 0x0, &(0x7f0000000340)={0x2e, 0x40, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0xfffffffffbffffff, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000140)=@any_dev={0x3, 0x5b3, 0x0, 0x0, 0x1000, 0x861, 0x0, 0x0, 0x87}}}, &(0x7f0000000080)=0x0) syz_ublk_setup_queues(r0, r6, &(0x7f0000000200)={0x0, 0x3399, 0x100, 0xfffffffe, 0x34a}, &(0x7f0000000580)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe706, 0x40040, 0x1000002, 0x91, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xa5, 0x80, 0x3, 0x98, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x1, 0x28d, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5, 0x4000, 0x43, 0xffffffff}}], 0x1, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r7 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r7, &(0x7f0000000000)={0x0, 0x4, &(0x7f0000000080)=[{&(0x7f0000000200)="2e0400001c008103e00f80ecdb4cb9f207c804a00d000000880802fb0a0002000a0ada1b40d80800c500c50083b8", 0xfec9}], 0x1, 0x0, 0x0, 0x5865}, 0x0) r8 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$sock_inet_SIOCSIFFLAGS(r8, 0x8914, &(0x7f0000000000)={'dummy0\x00', 0x800}) syz_open_dev$dri(&(0x7f00000002c0), 0x1, 0x2100) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r9 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r9, 0x0, 0x0) syz_usb_control_io$hid(r9, &(0x7f0000000840)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00220f000000540b4550182195f51584b3"], 0x0}, 0x0) r10 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x2400) ioctl$HIDIOCGUCODE(r10, 0xc018480d, &(0x7f0000000040)={0x3, 0x0, 0x1, 0xfffffffc, 0x1, 0xfffffffb}) 778.326186ms ago: executing program 0 (id=825): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$PIO_CMAP(r0, 0x4b71, &(0x7f0000000000)={0x5, 0x2, 0x0, 0x2, 0x400, 0x800000000000}) r1 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000140), 0x82084, 0x0) ioctl$INCFS_IOC_GET_FILLED_BLOCKS(r1, 0x80286722, &(0x7f00000001c0)={&(0x7f00000000c0)=""/74, 0x4a, 0xff, 0x3}) ioctl$TCSETSF2(r1, 0x402c542d, &(0x7f0000000080)={0xfff, 0x4, 0x4, 0x8007, 0x7, "ea710000000000f9000000024200000200", 0x4000000, 0x8000400}) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000180)=0x2) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000040)=0x4b) ioctl$KDGKBMODE(r0, 0x4bfa, &(0x7f0000000080)) 766.810704ms ago: executing program 0 (id=826): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000380), 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0, {r0}}, './file0\x00'}) sendmsg$WG_CMD_SET_DEVICE(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB, @ANYRES16=r1, @ANYBLOB="0100000000ffffff800001000000060006000000000024000300a0cb879a47f5bc644c0e693fa6d031c74a1553b6e901b9ff2f518c78042fb5426c010880f4000020060005000180000024000100dbffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff240002001bc715ee4868b12a49f4df11bc05475489f6a27c4d6483ad2fa5e45903b0ce8514000400e76a686bac1414aa00000000000000008c00098028000080060001000a00000014000200ff020000000000000000000000000001050003000000000028000080060001000a000000140002000000000000000000000000000000000105000300030000001c000080060001000200da0008000200e000000105000300000000001c000080060001000200000008000200ac141400050003000000000074000080200004000a004e2200000000fc0000000000000000000000000000000400000024000100dbffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff080003000100000024000200cde20bc0d9b90ac13642d7b66459dd9db5e20b4b16d3d23f2cb03a8aa417dce6080007000000000014000200776730"], 0x1c8}}, 0x0) 707.327148ms ago: executing program 0 (id=827): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x11, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bf8100000000000007080000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018210000", @ANYRES32=r0, @ANYBLOB="0000000002000000b70500000800000085000000d300000095"], &(0x7f0000000300)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) 706.541529ms ago: executing program 0 (id=828): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000100)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000003c0), 0x3) getsockopt$bt_hci(r0, 0x11a, 0x2, 0x0, &(0x7f0000000040)) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000001c0), r1) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x68, r2, 0xa11642b31614ca1f, 0x70bd2c, 0x25dfdbfc, {{}, {0x0, 0x4108}, {0x4c, 0x18, {0x1f, @media='ib\x00'}}}}, 0x68}, 0x1, 0x0, 0x0, 0x10}, 0x20000080) 637.47491ms ago: executing program 0 (id=829): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0x1ff) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f0000000240)=0x0) mount$nfs4(&(0x7f0000000000)='configfs\x00', &(0x7f0000000180)='./config/usb_gadget/g1/functions/midi2.usb0/ep.0/block.0/direction/file0\x00', &(0x7f0000000200), 0x0, &(0x7f0000000540)={[{'#/'}, {'['}, {'-/'}, {'configfs\x00'}, {'configfs\x00'}, {'configfs\x00'}, {')\x81+--'}], [{@uid_gt={'uid>', r0}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'configfs\x00'}}, {@smackfsroot={'smackfsroot', 0x3d, '#\'\x00'}}]}) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/midi2.usb0\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/midi2.usb0/ep.0/block.0/direction\x00', 0x2, 0x0) write(r1, &(0x7f0000000400)='1', 0x1) symlinkat(&(0x7f0000000440)='./config/usb_gadget/g1/functions/midi2.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/configs/c.1/midi2.usb0\x00') r2 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0) write(r2, &(0x7f0000000500)='dummy_udc.0', 0xb) 446.724881ms ago: executing program 4 (id=831): r0 = accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, &(0x7f0000000040)=0x1c) recvfrom$inet6(r0, &(0x7f0000000100)=""/246, 0xf6, 0xef0f27948a9e0384, &(0x7f0000000200)={0xa, 0x4e23, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0xff}, 0x1c) r1 = userfaultfd(0x80801) sched_setscheduler(0x0, 0x1, 0x0) r2 = syz_open_dev$mtd(&(0x7f0000000900), 0x46, 0x1) ioctl$MEMREADOOB64(r2, 0x1269, &(0x7f00000000c0)={0x1}) close_range(r1, 0xffffffffffffffff, 0x0) 359.055123ms ago: executing program 0 (id=832): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000540)={{0x14}, [@NFT_MSG_NEWRULE={0x34, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2, 0x0, 0xfffe}, [@NFTA_RULE_ID={0x8, 0x9, 0x1, 0x0, 0x1}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x5c}, 0x1, 0x0, 0x0, 0x840}, 0x0) r1 = syz_clone(0x82020000, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x2200, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = userfaultfd(0x1) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000380)) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f00000001c0)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) r5 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r5, 0x11b, 0x4, &(0x7f0000000340)={&(0x7f0000000000)=""/59, 0x312000, 0x800, 0x0, 0x2}, 0x20) ioctl$UFFDIO_COPY(r4, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000}) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) ioctl$KVM_GET_VCPU_EVENTS(r6, 0x4048aecb, &(0x7f0000000300)) ioctl$KVM_RUN(r6, 0xae80, 0x0) r7 = syz_open_procfs(0x0, &(0x7f0000000480)='task\x00') fchdir(r7) mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000000)='proc\x00', 0x80, 0x0) r8 = syz_open_procfs(r1, &(0x7f0000009b40)='pagemap\x00') syz_usb_disconnect(0xffffffffffffffff) pread64(r8, 0x0, 0x0, 0x4) 358.579531ms ago: executing program 4 (id=833): r0 = syz_open_dev$sndpcmp(&(0x7f0000000100), 0x1, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r0, 0xc2604111, &(0x7f0000000200)={0x0, [[0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff], [0x39a8, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xfffffff7, 0xffffffff], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xe8e1, 0xffffffff, 0xffffffff]], '\x00', [{0x10, 0x10, 0x0, 0x0, 0x1}, {0x1c, 0x20, 0x0, 0x0, 0x1}, {0x2, 0x2, 0x0, 0x0, 0x1}, {0xac44, 0xac44, 0x0, 0x0, 0x1}, {0x1388, 0x186a0, 0x0, 0x0, 0x1}, {0x100, 0x400, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x2, 0xd3, 0x0, 0x0, 0x1}, {0x2710, 0xf4240, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x1000, 0x4000, 0x0, 0x0, 0x1}, {0x0, 0xf4240, 0x0, 0x0, 0x1}]}) ioctl$SNDRV_PCM_IOCTL_PREPARE(r0, 0x4140, 0x0) ioctl$SNDRV_PCM_IOCTL_FORWARD(r0, 0x40084149, &(0x7f0000000080)=0xfd8) syz_emit_ethernet(0xbe, &(0x7f0000000500)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaa000800450000b00000000000019078ac1e0001ac1414aa0300907800000000450000000065000000890000ac141400ac1414aa01860dc045d45768dc37efa0fc58440c00037f00000100890f0000000000ffffffffffffffff444c0001000000000000000000000000000000000000000000000000ac1414aa000000047f000001000000000000000000000000ac1414bb00000000ffffffff00000000ffffffff00000000860858185dd6611e000000983fe326cdd7c2d442"], 0x0) ioctl$SNDRV_PCM_IOCTL_START(r0, 0x4142, 0x0) ioctl$SNDRV_PCM_IOCTL_PAUSE(r0, 0x40044145, &(0x7f0000001540)=0x2) ioctl$SNDRV_PCM_IOCTL_PREPARE(r0, 0x4140, 0x0) r1 = ioctl$KVM_GET_STATS_FD_vm(0xffffffffffffffff, 0xaece) r2 = socket$nl_generic(0x10, 0x3, 0x10) close_range(r2, 0xffffffffffffffff, 0x0) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_DAEMON(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000000000000000900000030000380140002007369743000000000000000000000000006000400ffff00000800030000000000080001"], 0x44}}, 0x0) sendmsg$IPVS_CMD_GET_CONFIG(r1, &(0x7f00000004c0)={&(0x7f0000000000), 0xc, &(0x7f0000000480)={&(0x7f0000000140)={0xa4, r3, 0x400, 0x70bd2d, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DEST={0x34, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x10}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x1}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x9}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1d1e98a0}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x2}, @IPVS_CMD_ATTR_DEST={0x40, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@multicast2}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e23}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x3450e38c}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x1}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x8}]}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x1}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x10}, 0x1) 249.767456ms ago: executing program 4 (id=834): r0 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) write$selinux_load(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="8cff7cf9080000005345204c696e757813"], 0xfebc) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$sock(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)="1c2c838c0f3df02c3364633c5e7674b1ee3268c50f093bd0a30bfd36c4118b0861e18a66636985881694074b556935f5b81a73f2ea917552fcecd04a141021051092c9955dba9415e525f5e193753e5a2a123847ec4438ae489dc9740c9e790253ae422cb51d7424140851754cc7f063e39c5b5ef685b38307f52fef4265d165cf176fb73f59c4c8b57efdaa0bb799de6a0396e043848d9166", 0x99}, {&(0x7f0000000140)="bfc1c780bb8eb86aab4afa1e3976a3ba5e93887c644f31fcfa814f072efcc492f4043e84b9cdc05fd726ad2ca3f184a1a6d7e8a51a76c781548d7dfe5f801e1cb91b5633fdabb524d7606c095645e53fbbb9dee75cda9247f807ffb9a71a20cd5fd0824d9dbaaba12ece254bcea49efcecc4c0705f26f2c69d2fa5747f4b49695ad562", 0x83}], 0x2, &(0x7f0000000240)=[@txtime={{0x18, 0x1, 0x3d, 0x6}}, @timestamping={{0x14, 0x1, 0x25, 0x7}}], 0x30}, 0x20004004) 223.342894ms ago: executing program 4 (id=835): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001400)=ANY=[@ANYBLOB="2400000020000103000000000000000002000020"], 0x24}, 0x1, 0x0, 0x0, 0x240480d4}, 0x0) (async) r1 = inotify_init() inotify_add_watch(r1, &(0x7f0000000340)='.\x00', 0x850003d1) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) (async) madvise(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x16) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0)) (async) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0x19) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100fefffffffbdbdf25010000002800018014000400fe8000000000000000000000000000bb0600cb39d57d0000060001000a000000"], 0x3c}, 0x1, 0x0, 0x0, 0xaa34a4cfdf933201}, 0x20000844) (async) socket$pptp(0x18, 0x1, 0x2) syz_open_dev$ttys(0xc, 0x2, 0x1) 79.19322ms ago: executing program 4 (id=836): mount(&(0x7f0000000000)=@md0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='tmpfs\x00', 0x1000000, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f00000000c0)=0x0) capset(&(0x7f0000000100)={0x19980330, r0}, &(0x7f0000000140)={0x1, 0x7, 0x40, 0x3, 0xee, 0x7fff}) capget(&(0x7f0000000180)={0x20071026, r0}, &(0x7f00000001c0)={0x8, 0x75f, 0x36b, 0x7, 0x7fffffff, 0x800000}) ioctl$KVM_CAP_X86_USER_SPACE_MSR(0xffffffffffffffff, 0x4068aea3, &(0x7f0000000200)) r1 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(r1, 0x7a5, &(0x7f00000002c0)={{@hyper, 0x701b}, 0x2, 0x2, 0x3b4}) rename(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='./file0\x00') r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = socket$pppl2tp(0x18, 0x1, 0x1) fstat(r3, &(0x7f00000003c0)) r4 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000440), 0x20000, 0x0) capset(&(0x7f0000000480)={0x19980330}, &(0x7f00000004c0)={0x0, 0x4, 0x5, 0x7, 0xc, 0x5}) syz_open_procfs(r0, &(0x7f0000000500)='personality\x00') ioctl$IOCTL_VMCI_NOTIFICATIONS_RECEIVE(r4, 0x7a6, &(0x7f0000000540)={0x3ff, 0x7, 0xfffffffffffffffc, 0x9, 0x4c, 0x2afb}) r5 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r5, &(0x7f0000000580)={0xa, 0x0, 0x1, @dev={0xfe, 0x80, '\x00', 0x3b}, 0x8}, 0x20) sendmsg$nl_generic(r4, &(0x7f0000000800)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000007c0)={&(0x7f0000000600)={0x18c, 0x40, 0x8, 0x70bd2c, 0x25dfdbfb, {0x17}, [@typed={0x14, 0xab, 0x0, 0x0, @ipv6=@mcast2}, @typed={0x12, 0x96, 0x0, 0x0, @str='/dev/ubi_ctrl\x00'}, @typed={0x4, 0xfc}, @generic="11ce1a71d5d82ef67e65535441aa2622f864f944d4b404b02e99264cb82d20dcdf446bc721460b487ecea5ada5f38fd87a44a146f4d88c292be8e6551b2b5e75dcc1e7c473b6b68fd9f149df857d15b62f042c8f511f4b255bdd6ee6da3f8c3060b8d42d3a7943ff114ecb8c0b2c4e734c54acc93aae1fb407789f079fb5442aae9bec4df488c96c24ae9f7806ed5eeb6967032d0d9b3d8b331694a60ac81d108a856a638ac9b9cceb7ce785e2ea8a760ed4950f3afc87514717e3b312e490425bb84849c00889db17f5ec8982a62ab842a1c1afac", @generic="6252447089aa93ba21d973efb879456df7822106b22ee3521e0067c3af8ede4fc722513b98b696693bbde954863a42c6a8a7bc4f58168659c357bf743bad75233796018edf0863861f6107cbcf5695d88ffc4e64ba3643c25dd2f0491b8f0c21287229e6611f435ee636de18e8fa42ef3970186b"]}, 0x18c}, 0x1, 0x0, 0x0, 0x4850}, 0x4000015) ioctl$NILFS_IOCTL_GET_SUSTAT(r3, 0x80306e85, &(0x7f0000000840)) ioctl$KVM_GET_MSRS_cpu(r4, 0xc008ae88, &(0x7f0000000880)={0x7, 0x0, [{0x370, 0x0, 0x8}, {0x40000098, 0x0, 0xf992}, {0x94f, 0x0, 0x3}, {0x314}, {0x4000009d}, {0x395, 0x0, 0x6}, {0xa18, 0x0, 0x1}]}) ioctl$OCFS2_IOC_RESVSP64(r1, 0x4030582a, &(0x7f0000000900)={0x1, 0x0, 0x1000, 0xfffffffffffffffd, 0x1, 0x8}) r6 = syz_ublk_setup_io_uring(0x7aa6, &(0x7f0000000940)={0x0, 0x91fb, 0x0, 0x3, 0x2fc, 0x0, r4}, &(0x7f00000009c0), &(0x7f0000000a00), &(0x7f0000000a40)) readv(r6, &(0x7f0000000d80)=[{&(0x7f0000000a80)=""/10, 0xa}, {&(0x7f0000000ac0)=""/73, 0x49}, {&(0x7f0000000b40)=""/203, 0xcb}, {&(0x7f0000000c40)=""/189, 0xbd}, {&(0x7f0000000d00)=""/65, 0x41}], 0x5) write(r5, &(0x7f0000000e00)="00789c85065dca5c593bc3ab343406e4f3b41ff9e2f75f01b6d80d0f4897084f4d84747caa5ef369044922299324fbaae70fa3468d3dfe079b76fd4d2374b557b008a8c506e1b77c200646019ed5ef59bae13ff0e234590a810400c89cb959b5136f510838b7787c0eadc292", 0x6c) fallocate(0xffffffffffffffff, 0x0, 0x6b0a5c42, 0x1000) ioctl$FS_IOC_FSGETXATTR(r2, 0x801c581f, &(0x7f0000000e80)={0x9, 0x5, 0xfa52, 0x7ff, 0x2cc69bf2}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r1, 0x81f8943c, &(0x7f0000000ec0)={0x0, ""/256, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(r3, 0xd000943d, &(0x7f00000010c0)={0x3, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0}], 0x3, "ae0e4b2a560861"}) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, &(0x7f00000020c0)={r7, r8, "8e51414e333225c6ae43a6e75e6cd9796b55f19ce3e3901bff6493fb88fcf44e6823643f6869b93cd960fc2b5bbca9d13db76ad0b5bbbf7918b592958386e5cdb10d4ddf2a4873c498f2cc0b5c88b25743df7f1925d999a98ae4a0c47aea9c4413ee06e31e8c0e3e46a9b5e890007bff6565c5cd6e9fdcda8e874140ac16d86fc7ebb81fe8fb9e71afb99bf33b88b05ec8bfb875a3fc5f3a38fb771a825bc89b256157b78af7e517329d044dcae516c12daaac92dbe8e2d8e890979ba934c01d7a66024dc41f9bd0f559eac9b8420fa772e41b6098fe182b50df0a12df79ad3026dc88dd449196dd40aa5ab3faed4be628a8d1fca7f5971193385ea48f80795d", "407a215dbdb4a2639f41ce98742d2af10428330485e6b2571d4de93be22ddc898043bc8f5e3505401ac18db8c43b06bc97a6831ed63667783485353f23a125592c0afff989e4b96c905d91e6e09be98b5bc2e0357236b54d4045584b4f3e98012697375342a32770ca097627aa715c877db07fac90d9b562a2eac8e40ba97df40836c5db6f968e675cfbd7bd09457b0808df2d2522f0b7b91e5f39bcb4b3df762541c5eaaef2883454ab9d04b2ff5d69248c2dc4f323b99dce891939998b758159aa4ca03aeef8f4cfb9484a6de2fd2d45e2ada3e650c39463ece5d07c364e2047f146d5d48852c6ad6ae1ab80fa838e7470cfeedc0ddffd989bcecacfbc4b6e4e37e65c0f4b5b26f4ef0933f69d902b95630db7da50c5180fbd38cf024b3bef35884257a79d10d396bb19884625a65f1b531efb4556e8e77cca511a7c3c3ca1ae2edf6156f8c47a9a50a414f520584998da194b24e0ed1b53abc0497532dd38bf8ee8a7e4b5dc9dabad1ed1b6a52f35e409285352a73622f8c7fdc58fced69cefe66abb85f0d6e0bd5f939922c3144daac4f53ff3242823ebe2e0a56f16935b325152f2bd15bdc215a61190ff9332f89bfedb6e7592934dae3e48e217a0054187b19a6b0b9dd8a22dcf04189ffe5043eff887272fc22f38a0e692b712589b1c1641811e53a0ecb7cfec9c44983cefc4c34451810dd0ff6c4909337dd0e1513a196b56e7207a112dc87db18ff77969de493619bf449fe3f7cf28b026ad5c9fddf0b4ffdead333a8ed151cce041e6669c8734a06da787a822b310684aae23ae84a4adeafc3bf0b09ce269163743250e3848a3c6f0f58e5668091aca02b8408799c3ba38d700c7438c5c224435779f23e160f2926d8d960dfaea95e801ff922fb078a099878958e751e4867fc200968a6d42730441f2ec690a66f39fb73a471c4058aabd7f24ad91b9817cc8c14158a2ee1d1286c5287262fe086df161ce97945990d3521d119c025d562566f353742882f2075d2a45c0ff7b8cf6b310c21df35979b5d4f7bdbe2a8c3478a39bfd8d61a4fc4466a30f0a5a0a1608a851f777b21405882eff7495045318e60de57c2e4a76c6462f4a0ada17e0b6e1b74b1b6cfbc38996d754ad3d94b2b017731e09ab8ae5bf9d58e52e70c79e7ab62149179006ad8ece0a75f5f94d568d94bbe94431b222f4739bc7091aed4937b133e6f48e935c6f2e00d63c50b54a58124ec19f486b1cfcd0721227c6e0524995f14680b28e596aa24a390b9e6aa4b6041d2f26a6f14a04969cdfdd7140641b35a0fcfe3c38399c21d45b39b766035b0a0794d79391b51b72f5e25f12c8e46541c53ef41e90617c05b96b7a05100eab273fa707fecc7963b927a5c448bffb2454eaf5c22a1018695cc3e21b1ba1bddb208fd6d3d66a9e1d6ff4c71be6e1166e151d12b190e893f54f3623b8cdcd6fb02899a7e52a704e13e0f6a39207e3b29260c82586816fd22761b23ae7e37c45afbafa57496cb0eabb11bd0617dd75359842ce8577a4c8a12640bcab861a27968a17fab9850754caf1df4f1745f566975fc0128cca966ccb8d4a5abc411b47b5c7e9402a605d6ddc9288ed45751f4784730938fc1d3f255bd0fbae20466154b1a31676332de74f168e0b10f1c0b3c01db41e4ecc52d42a96f8ef93d7cf8e0d22cd326de3210c7581dd6311c9ea8f20701e260cbfd45e2c55705349f6aaa39f2506a9773ddd1700f0530f7247018800faa393283f3a36af451afd40b0feac99a381a416ea8c4d97528b6e9db6cf842607b07ad7ca1eef17c349dbee1975ad9f629237d75f6b547f05a57c145f961bcbd5dda28a683f7a84002166fe0840956439d7f8531c9aae0461da858cf8fbe75e093b63cabc743dc5299f90087bc44169aaae3cdecb13d849c4e68ce4ccb6e0243e9f3269f230371c595220dfc3ad49487e7e6da68eba150d3312bd95659659fbfe977f345b975b20f7726add9b820ad2f89be72742a7a824e5f928e1dd910dffcf68c5608ec33495dde4988005eb0e0a4db1700792fd05f71f0993b79cf1bdd745d300186172b468e4afdd394e1a9fda78826de7ac08407a2925e26671bc8af5e9bbf8eff8ef6c716a939d487de56b2cb6ffc1c24fe62c81b3dbb6dc1e223e11b5d922a01427c486347460cad76d36888111b70faf5eafa533353fbe4d2b3d9104a45875cb7dfbb5fc0a5fe78f65a62976fd1d4a91670cf3e7ba490bc351ff90888ec2ee1647aac76ebe9d68a7139ca43a2acb399e93dfdce39894582462a658d7bfcb4e905cfc6b3e141db09c998350d56738da4e1da085303a49c471ca90fcdade47932c1029e83494c4f87c48139eabb891d67ec84745dc083071f478f83f6a3b6a6c9ee76f4a4a26b5d467f7b9a48ae7637ee59517fe87bd33afc5fa52a6690ec4fcd2286ad0846a644ff8b739739f2e142b78bfdf91fb6d9d22af6d62234e82bb6904eb2e9b4b25d403acd2113c99ff312b1ddf3f82ff75a38f0931a688e1d54e8d152410c279a36f8dabac3061dee74606c1219c456397852ab4678da6a6a81e77e30d8b0415877f3569f0ca6398ae1b9553e37dec080b7da7e91765a1cd0a255d84c816510ee4faf90970eba3122ca4ad7a63dffd52dd5c53372c3aa354b50196578daba225bf86adcdd10209ea0e962bb9e4db0111bb287c47b865592d77f1a119c9a1a1a796385204072fcad4d232632ddb158bc2ba21bdf363a71cd90e834e4abb8e71e56c10ac3535e1a2eda719368077303430d70a828a481bf843bc5055af1cb27151a79cf75d0f43d024d7b452b7e8359de341ffcae651b3370a1e6270c3d3e0d604664a39a4b93f5abf35a9fd10ad1013957406b194bad2e1a45e5fbfef51741c6698f5a97b183bf43a52dde08b1a1b30cc0d5a0b7f69847535dfffa878758a81f541d1d44554410628138fca7f2388b52af8eef0f1f3e6b41e919e1385bf54e87fa654fa8c54441ca18ecc7543b14aca2dc4c0181b4881a07c34ccb9d43fe91371b3a733c06db4bcb50cc4b0f40732ded8647ed4d90a6307ad438461a8b599d70c71a3b7e1eee1db574bc1830825bd885bf0a2fca30497b75896c148abd8a2834a5f22c9d19008e246a54821e12a98710a79c4340edc8db861b9f6a9927ce26f484d87a71c0e98f05f7c979f7250a2e2ac9a6b0ec1ed0b1daf6b6ae063e0d06a32a83a7b12f9f05ef09cf4e0380a19bcde34d73fb19cf9aa952aa248e480f75a394b496ea94e5f5cc807dc45550650fcda9a47bba4cdbfa502fe4fb009f5eb9f9a315d52c2b9dc23a34a0b7867580786ef93638041a7789088e47c94b6adbfd4dafffb9bc303307fb34fbcbbf2c542545d22355d2c33dd26f2ef1ce2995474c36d9c526cc54ba95f88c33a8eda71854dabf7de5c9b4e135a64d484a7be800b48665899e7c5a46efbb5c8d9d74426a1a1e28a188ccf4790afe67ca8464b1e77cb6d56e9ab6c8ea7aae4fc433cab8ad5f561a7b359f50b335d97483ba0af8ccdbd319126910510e578c7f7e4b08d6d7df42b71cacf5f8168c668511db06814f14979e4ec7015f0b7dff0e2cf98bc786c932553652ddfba16c96c74ea3f9cc67cfe29efe00d74923ee652af6022bf15b5273243cdd3b6c546a219195d8c620878a1a47791a4cae79ee37db65106983f92cee199fb43a476f1e74206bace4c472f0bec3acc083a810137c532e18d41c6c15449e0b1905596e4d4de130fab0c67e2a9ec53cbb07668271778cfd0a7fcb48440d0c7a7d1d549c1df3f886bb30465f27b8e7ccb23b0dc543c6ef39f04cb4735364054488bdbab588c8c53dc5f97990f21483685a5e01364313eb2f1ebf895e8a4902d6e05f4ed2f24dfb1b6187b959d47a908db74c7a9c8e9695bf930a7e26ba521af65009c681793bc4c598d6526448a65ce28acbd415dbf122ad425d6269c4d391be19074ada80f76b12b7a705efcb6f3471c36bee89c5c6fb595cc6934388677ee23efe9024ba0a04858f29ea284fe75baeae9e24fb6a51fb0b8d0dc04eb243b0f865392d5054d4fe897b4e769aac5761b150e3c95d4e18336e7f3d965040d3fc3797da5332c9762677bc60e3921fa9f924f5adeb5f3acdcba5965b25c64bc43340e6f7d350e2916c87fd99de8541e722d1a6a8ab26d65294a00d30b0bebe20ef2fc0dca286cdc20eb8755b28a1c0f353cef0c8e0b2b0cdc490ecf24d9ed6c437d94b1d9be3a56205a958b3f6c595540e29a33519d4db7e81a3f908a00e2483e876476c2db042cbeed02b8b0b32ad1fdbb972ba40a64cd5b95239eb407c827147e5bf8f44df0433cba7120444df10aa323c74d1e1b578d0cbaedd60546535d5da6a11241f14533a5aa55455936f26a179e8028ffcf7b139785f8e6601c97b06f3f894a6b4b161ef63c6121e4cd4e6409287f9b444ab5f6301f80532d54fdcf18dc49f5c9525e41556e7684b955642dfc20d0ee10e41a7f46c28a3bdcc461543e6d66051f25570cc53946bb6e2afe0833d5d8d8571b198be067cf181930b735b86d71bee07b99af6be3194c1b3a16d71cdbfa368fcc60320e0279c91c73df65f0e6cc45a272e00920ebf51b360683d9bf0f2d0a1900d5b326f002923fc3ad2a1ce8b3707d127d8c3f53cd44f57c7b70c50aaa1452161773205df1ceffe6e96b25464672d7fc97f12038f4ba37c328105d99243b0b587f2ef62ea669b62df281381229bb3a4d40373ec2d3696ca28dfc66391b68bc09dbaf8f9edafc27c4dc14197d9e1c911762375ff0135d0ca4a7fd7e98eb478bc80b2848cb623847811b887feab8f449ed5a2ba75b9af1b2290af016351207de66afcdf6eb3adfb9f2dcdb1b2010b9f05c84bac79fb528dd61c2d60e29574855d5cb77bd7e0922c0594f3a17b9286bad5c696973771cb682c3f52e51ce7cae53b55d1de653d7f2b21f48569a9559a06abc63c29a89c987023e6e7ff73f41abfa951fbcc47951a7789bc3c70dcd7fab40282aec7ba5ca9f7a93e21f5836533e22ea77a6d73f27d94fe15f8a62c117753dbff3385ea7b3a4591bf51fa71552d57e0209733b2f07199424306c8ef14bfdfa46af9f898bb9e5d60f833364d2467a59870428517e535d6a4eebcc84caafdd43c036999d91568bb05196dacfb1a84327f6e4becd838ec865d5cbbb7bd990df957b0c47e2baeba786398bbeac4637d70fa17a66e695329f3706876897b74754f9239954784b309316ab5cf37a9c4910896c6f1c40bf851544741132169873c2946bf4c1b31f9feef00ebd596297556db563529988f4cb490a7f920e0a9bc34500b2f6b38b5cd89048164d45776b836984843baa8424c5a54c6392aced5d4560d151a2e5f60b35bfd276a3f79ce6a5d7c75ab30a534abde3d031c99b8d"}) 0s ago: executing program 4 (id=837): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x11, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bf8100000000000007080000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018210000", @ANYRES32=r0, @ANYBLOB="0000000002000000b70500000800000085001800a900000095"], &(0x7f0000000300)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) kernel console output (not intermixed with test programs): 70.857570][ T13] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 70.857668][ T13] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 70.857803][ T13] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 70.937559][ T5833] usb 8-1: new full-speed USB device number 9 using dummy_hcd [ 71.088105][ T5833] usb 8-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 71.089512][ T5833] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 71.089528][ T5833] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 71.089559][ T5833] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 71.092233][ T5833] usb 8-1: config 0 descriptor?? [ 71.097110][ T5833] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 71.097188][ T5833] dvb-usb: bulk message failed: -22 (3/0) [ 71.101069][ T5833] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 71.101629][ T5833] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 71.101653][ T5833] usb 8-1: media controller created [ 71.102779][ T5833] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 71.114228][ T5833] dvb-usb: bulk message failed: -22 (6/0) [ 71.114285][ T5833] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 71.119081][ T5833] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.3/usb8/8-1/input/input14 [ 71.121153][ T5833] dvb-usb: schedule remote query interval to 150 msecs. [ 71.121164][ T5833] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 71.280182][ T5833] dvb-usb: bulk message failed: -22 (1/0) [ 71.280277][ T5833] dvb-usb: error while querying for an remote control event. [ 71.301763][ T71] usb 8-1: USB disconnect, device number 9 [ 71.320955][ T71] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 71.584647][ T1443] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.585174][ T1443] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.600997][ T6890] bridge0: port 3(syz_tun) entered blocking state [ 71.601250][ T6890] bridge0: port 3(syz_tun) entered disabled state [ 71.601412][ T6890] syz_tun: entered allmulticast mode [ 71.602794][ T6890] syz_tun: entered promiscuous mode [ 71.603184][ T6890] bridge0: port 3(syz_tun) entered blocking state [ 71.603229][ T6890] bridge0: port 3(syz_tun) entered forwarding state [ 71.817972][ T6662] usb 9-1: 1:1: usb_set_interface failed (-110) [ 71.840268][ T5838] usb 9-1: USB disconnect, device number 2 [ 71.865043][ T6900] xt_NFQUEUE: number of total queues is 0 [ 71.935320][ T6911] gfs2: path_lookup on c::: returned error -2 [ 71.936881][ T66] Bluetooth: hci2: Malformed HCI Event: 0x22 [ 71.968106][ T6904] syzkaller0: entered promiscuous mode [ 71.968184][ T6904] syzkaller0: entered allmulticast mode [ 72.026523][ T6917] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=40192 sclass=netlink_route_socket pid=6917 comm=syz.4.257 [ 72.138488][ T6921] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 72.635141][ T6933] trusted_key: encrypted_key: master key parameter is missing [ 72.816516][ T6947] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 72.867558][ T66] Bluetooth: hci3: command 0x0419 tx timeout [ 72.867735][ T10] Bluetooth: hci3: Opcode 0x0c1a failed: -110 [ 72.867746][ T10] Bluetooth: hci3: Error when powering off device on rfkill (-110) [ 73.087364][ T71] usb 5-1: new full-speed USB device number 5 using dummy_hcd [ 73.238916][ T71] usb 5-1: not running at top speed; connect to a high speed hub [ 73.238973][ T71] usb 5-1: New USB device found, idVendor=06cd, idProduct=0131, bcdDevice= 1.00 [ 73.239835][ T71] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 73.241930][ T71] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 73.241943][ T71] usb 5-1: Product: syz [ 73.241951][ T71] usb 5-1: Manufacturer: syz [ 73.241959][ T71] usb 5-1: SerialNumber: syz [ 73.251627][ T71] keyspan 5-1:1.0: Keyspan 4 port adapter converter detected [ 73.251778][ T71] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 81 [ 73.251815][ T71] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 88 [ 73.253341][ T71] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 1 [ 73.261799][ T71] usb 5-1: Keyspan 4 port adapter converter now attached to ttyUSB0 [ 73.264401][ T71] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 2 [ 73.267889][ T71] usb 5-1: Keyspan 4 port adapter converter now attached to ttyUSB1 [ 73.268713][ T71] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 4 [ 73.269996][ T71] usb 5-1: Keyspan 4 port adapter converter now attached to ttyUSB2 [ 73.271140][ T71] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 6 [ 73.277094][ T71] usb 5-1: Keyspan 4 port adapter converter now attached to ttyUSB3 [ 73.294995][ T6961] __nla_validate_parse: 120 callbacks suppressed [ 73.295353][ T6961] netlink: 8 bytes leftover after parsing attributes in process `syz.4.273'. [ 73.521263][ T6972] FAULT_INJECTION: forcing a failure. [ 73.521263][ T6972] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 73.521372][ T6972] CPU: 3 UID: 0 PID: 6972 Comm: syz.4.278 Not tainted syzkaller #0 PREEMPT(full) [ 73.521405][ T6972] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 73.521417][ T6972] Call Trace: [ 73.521424][ T6972] [ 73.521431][ T6972] dump_stack_lvl+0x100/0x190 [ 73.521492][ T6972] should_fail_ex.cold+0x5/0xa [ 73.521516][ T6972] _copy_from_user+0x2e/0xd0 [ 73.521548][ T6972] copy_msghdr_from_user+0x9f/0x4c0 [ 73.521575][ T6972] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 73.521601][ T6972] ? lock_acquire+0x1d1/0x380 [ 73.521617][ T6972] ? get_pid_task+0x2a/0x250 [ 73.521641][ T6972] ___sys_sendmsg+0x106/0x1e0 [ 73.521662][ T6972] ? __pfx____sys_sendmsg+0x10/0x10 [ 73.521681][ T6972] ? get_pid_task+0x106/0x250 [ 73.521708][ T6972] ? find_held_lock+0x2b/0x80 [ 73.521742][ T6972] __sys_sendmsg+0x160/0x210 [ 73.521758][ T6972] ? __pfx___sys_sendmsg+0x10/0x10 [ 73.521784][ T6972] do_syscall_64+0x123/0x790 [ 73.521811][ T6972] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 73.521828][ T6972] RIP: 0033:0x7f2e2bf9e159 [ 73.521842][ T6972] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 73.521857][ T6972] RSP: 002b:00007f2e2cdbc028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 73.521874][ T6972] RAX: ffffffffffffffda RBX: 00007f2e2c225fa0 RCX: 00007f2e2bf9e159 [ 73.521885][ T6972] RDX: 0000000004004004 RSI: 0000200000000180 RDI: 0000000000000003 [ 73.521894][ T6972] RBP: 00007f2e2cdbc090 R08: 0000000000000000 R09: 0000000000000000 [ 73.521904][ T6972] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 73.521913][ T6972] R13: 00007f2e2c226038 R14: 00007f2e2c225fa0 R15: 00007ffec07f3ae8 [ 73.521934][ T6972] [ 73.602810][ T71] usb 5-1: USB disconnect, device number 5 [ 73.618093][ T71] keyspan_4 ttyUSB0: Keyspan 4 port adapter converter now disconnected from ttyUSB0 [ 73.625485][ T71] keyspan_4 ttyUSB1: Keyspan 4 port adapter converter now disconnected from ttyUSB1 [ 73.631870][ T71] keyspan_4 ttyUSB2: Keyspan 4 port adapter converter now disconnected from ttyUSB2 [ 73.643269][ T71] keyspan_4 ttyUSB3: Keyspan 4 port adapter converter now disconnected from ttyUSB3 [ 73.644007][ T71] keyspan 5-1:1.0: device disconnected [ 73.859779][ T6976] lo: entered allmulticast mode [ 73.862736][ T6976] bond0: entered allmulticast mode [ 73.863412][ T6976] dummy0: entered allmulticast mode [ 73.863709][ T6976] eql: entered allmulticast mode [ 73.863873][ T6976] ifb0: entered allmulticast mode [ 73.864185][ T6976] ifb1: entered allmulticast mode [ 73.868809][ T6976] e1000 0000:00:06.0 eth0: entered allmulticast mode [ 73.873345][ T6976] e1000e 0000:00:02.0 eth1: entered allmulticast mode [ 73.877781][ T6976] mac80211_hwsim hwsim0 wlan0: entered allmulticast mode [ 73.877965][ T6976] mac80211_hwsim hwsim1 wlan1: entered allmulticast mode [ 73.878370][ T6976] hwsim0: entered allmulticast mode [ 73.878556][ T6976] ieee802154 phy0 wpan0: entered allmulticast mode [ 73.879127][ T6976] ieee802154 phy1 wpan1: entered allmulticast mode [ 73.879444][ T6976] teql0: entered allmulticast mode [ 73.879764][ T6976] tunl0: entered allmulticast mode [ 73.879911][ T6976] gre0: entered allmulticast mode [ 73.879991][ T6976] gretap0: entered allmulticast mode [ 73.880084][ T6976] erspan0: entered allmulticast mode [ 73.880165][ T6976] ip_vti0: entered allmulticast mode [ 73.880260][ T6976] ip6_vti0: entered allmulticast mode [ 73.880342][ T6976] sit0: entered allmulticast mode [ 73.880413][ T6976] ip6tnl0: entered allmulticast mode [ 73.880482][ T6976] ip6gre0: entered allmulticast mode [ 73.880551][ T6976] lapb0: entered allmulticast mode [ 73.880721][ T6976] lapb1: entered allmulticast mode [ 73.880877][ T6976] lapb2: entered allmulticast mode [ 73.881045][ T6976] lapb3: entered allmulticast mode [ 73.881216][ T6976] lapb4: entered allmulticast mode [ 73.881377][ T6976] lapb5: entered allmulticast mode [ 73.881449][ T6976] lapb6: entered allmulticast mode [ 73.883071][ T6976] lowpan0: entered allmulticast mode [ 73.883353][ T6976] netdevsim netdevsim2 eth2: entered allmulticast mode [ 73.884546][ T6976] netdevsim netdevsim2 eth3: entered allmulticast mode [ 73.884943][ T6976] netdevsim netdevsim2 eth4: entered allmulticast mode [ 73.885719][ T6976] netdevsim netdevsim2 eth5: entered allmulticast mode [ 73.886493][ T6976] lapb7: entered allmulticast mode [ 73.891074][ T6976] netlink: 112 bytes leftover after parsing attributes in process `syz.4.280'. [ 73.958736][ T6980] netlink: 'syz.4.282': attribute type 2 has an invalid length. [ 73.958805][ T6980] netlink: 4 bytes leftover after parsing attributes in process `syz.4.282'. [ 73.960163][ T1175] IPVS: starting estimator thread 0... [ 73.961079][ T6980] ªªªªªª: renamed from vlan0 (while UP) [ 73.965213][ T6980] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 73.965718][ T6982] IPVS: dh: FWM 3 0x00000003 - no destination available [ 73.965811][ C3] IPVS: dh: FWM 3 0x00000003 - no destination available [ 73.969425][ T43] kauditd_printk_skb: 18 callbacks suppressed [ 73.969435][ T43] audit: type=1400 audit(1788554619.524:570): avc: denied { ioctl } for pid=6979 comm="syz.4.282" path="socket:[16109]" dev="sockfs" ino=16109 ioctlcmd=0x6e84 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 74.014357][ T6987] netlink: 12 bytes leftover after parsing attributes in process `syz.4.284'. [ 74.024194][ T6987] netlink: 12 bytes leftover after parsing attributes in process `syz.4.284'. [ 74.039938][ T6985] process 'syz.3.283' launched './file0' with NULL argv: empty string added [ 74.047581][ T6984] IPVS: using max 43 ests per chain, 103200 per kthread [ 74.047826][ T13] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 74.047851][ T13] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 74.047870][ T13] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 74.047888][ T13] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 74.134292][ T43] audit: type=1400 audit(1788554619.694:571): avc: denied { shutdown } for pid=6993 comm="syz.3.286" laddr=::1 lport=20003 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 74.141413][ T6994] netlink: 112 bytes leftover after parsing attributes in process `syz.3.286'. [ 74.249211][ T43] audit: type=1400 audit(1788554619.814:572): avc: denied { write } for pid=7001 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 74.306174][ T43] audit: type=1400 audit(1788554619.864:573): avc: denied { write } for pid=7004 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 74.965738][ T43] audit: type=1400 audit(1788554620.524:574): avc: denied { write } for pid=7011 comm="syz.0.290" name="fb0" dev="devtmpfs" ino=638 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 75.018128][ T66] Bluetooth: hci2: command 0x0c1a tx timeout [ 75.020129][ T10] Bluetooth: hci2: Opcode 0x0c1a failed: -110 [ 75.020149][ T10] Bluetooth: hci2: Error when powering off device on rfkill (-110) [ 75.062950][ T43] audit: type=1400 audit(1788554620.624:575): avc: denied { ioctl } for pid=7021 comm="syz.0.294" path="socket:[17761]" dev="sockfs" ino=17761 ioctlcmd=0x8914 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 75.170008][ T43] audit: type=1400 audit(1788554620.734:576): avc: denied { read } for pid=7028 comm="syz.0.296" lport=7 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 75.180011][ T43] audit: type=1400 audit(1788554620.744:577): avc: denied { watch } for pid=7035 comm="syz.4.295" path="/59/control" dev="tmpfs" ino=334 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 75.184923][ T43] audit: type=1400 audit(1788554620.744:578): avc: denied { mount } for pid=7035 comm="syz.4.295" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 75.185596][ T43] audit: type=1400 audit(1788554620.744:579): avc: denied { search } for pid=7035 comm="syz.4.295" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 75.297208][ T7045] FAULT_INJECTION: forcing a failure. [ 75.297208][ T7045] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 75.298687][ T7045] CPU: 1 UID: 0 PID: 7045 Comm: syz.4.298 Not tainted syzkaller #0 PREEMPT(full) [ 75.298708][ T7045] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 75.298718][ T7045] Call Trace: [ 75.298724][ T7045] [ 75.298731][ T7045] dump_stack_lvl+0x100/0x190 [ 75.298759][ T7045] should_fail_ex.cold+0x5/0xa [ 75.298779][ T7045] _copy_from_iter+0x1f4/0x1690 [ 75.298797][ T7045] ? __asan_memset+0x23/0x50 [ 75.298814][ T7045] ? __pfx__copy_from_iter+0x10/0x10 [ 75.298831][ T7045] ? __pfx___alloc_skb+0x10/0x10 [ 75.298853][ T7045] netlink_sendmsg+0x808/0xda0 [ 75.298878][ T7045] ? __pfx_netlink_sendmsg+0x10/0x10 [ 75.298904][ T7045] ? selinux_socket_sendmsg+0x198/0x2f0 [ 75.298933][ T7045] ____sys_sendmsg+0xa4d/0xbe0 [ 75.298952][ T7045] ? __pfx_netlink_sendmsg+0x10/0x10 [ 75.298977][ T7045] ? __pfx_____sys_sendmsg+0x10/0x10 [ 75.298998][ T7045] ? lock_acquire+0x1d1/0x380 [ 75.299009][ T7045] ? get_pid_task+0x2a/0x250 [ 75.299024][ T7045] ___sys_sendmsg+0x190/0x1e0 [ 75.299039][ T7045] ? __pfx____sys_sendmsg+0x10/0x10 [ 75.299053][ T7045] ? get_pid_task+0x106/0x250 [ 75.299072][ T7045] ? find_held_lock+0x2b/0x80 [ 75.299101][ T7045] __sys_sendmsg+0x160/0x210 [ 75.299118][ T7045] ? __pfx___sys_sendmsg+0x10/0x10 [ 75.299152][ T7045] do_syscall_64+0x123/0x790 [ 75.299173][ T7045] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 75.299191][ T7045] RIP: 0033:0x7f2e2bf9e159 [ 75.299205][ T7045] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 75.299232][ T7045] RSP: 002b:00007f2e2cdbc028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 75.299244][ T7045] RAX: ffffffffffffffda RBX: 00007f2e2c225fa0 RCX: 00007f2e2bf9e159 [ 75.299251][ T7045] RDX: 0000000004004004 RSI: 0000200000000180 RDI: 0000000000000003 [ 75.299258][ T7045] RBP: 00007f2e2cdbc090 R08: 0000000000000000 R09: 0000000000000000 [ 75.299264][ T7045] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 75.299271][ T7045] R13: 00007f2e2c226038 R14: 00007f2e2c225fa0 R15: 00007ffec07f3ae8 [ 75.299285][ T7045] [ 75.542607][ T7057] netlink: 'syz.4.301': attribute type 10 has an invalid length. [ 75.542732][ T7057] netlink: 40 bytes leftover after parsing attributes in process `syz.4.301'. [ 75.542876][ T7057] dummy0: entered promiscuous mode [ 76.030113][ T7061] netlink: 24 bytes leftover after parsing attributes in process `syz.0.302'. [ 76.089945][ T7061] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=7061 comm=syz.0.302 [ 76.702460][ T852] cfg80211: failed to load regulatory.db [ 77.147571][ T852] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 77.156399][ T7074] /dev/sr0: Can't open blockdev [ 77.173045][ T7076] /dev/sr0: Can't open blockdev [ 77.188875][ T66] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 77.195297][ T5727] Bluetooth: hci4: command 0x1003 tx timeout [ 77.229140][ T7082] FAULT_INJECTION: forcing a failure. [ 77.229140][ T7082] name failslab, interval 1, probability 0, space 0, times 0 [ 77.229237][ T7082] CPU: 1 UID: 0 PID: 7082 Comm: syz.4.308 Not tainted syzkaller #0 PREEMPT(full) [ 77.229270][ T7082] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 77.229282][ T7082] Call Trace: [ 77.229289][ T7082] [ 77.229298][ T7082] dump_stack_lvl+0x100/0x190 [ 77.229345][ T7082] should_fail_ex.cold+0x5/0xa [ 77.229369][ T7082] ? __netlink_lookup+0x652/0x900 [ 77.229395][ T7082] should_failslab+0xc2/0x120 [ 77.229418][ T7082] kmem_cache_alloc_noprof+0x92/0x6a0 [ 77.229444][ T7082] ? skb_clone+0x190/0x400 [ 77.229465][ T7082] skb_clone+0x190/0x400 [ 77.229483][ T7082] netlink_deliver_tap+0xaed/0xcc0 [ 77.229514][ T7082] netlink_unicast+0x62b/0x850 [ 77.229543][ T7082] ? __pfx_netlink_unicast+0x10/0x10 [ 77.229575][ T7082] netlink_sendmsg+0x8b0/0xda0 [ 77.229603][ T7082] ? __pfx_netlink_sendmsg+0x10/0x10 [ 77.229630][ T7082] ? selinux_socket_sendmsg+0x198/0x2f0 [ 77.229662][ T7082] ____sys_sendmsg+0xa4d/0xbe0 [ 77.229681][ T7082] ? __pfx_netlink_sendmsg+0x10/0x10 [ 77.229708][ T7082] ? __pfx_____sys_sendmsg+0x10/0x10 [ 77.229735][ T7082] ? lock_acquire+0x1d1/0x380 [ 77.229755][ T7082] ? get_pid_task+0x2a/0x250 [ 77.229781][ T7082] ___sys_sendmsg+0x190/0x1e0 [ 77.229803][ T7082] ? __pfx____sys_sendmsg+0x10/0x10 [ 77.229825][ T7082] ? get_pid_task+0x106/0x250 [ 77.229855][ T7082] ? find_held_lock+0x2b/0x80 [ 77.229892][ T7082] __sys_sendmsg+0x160/0x210 [ 77.229912][ T7082] ? __pfx___sys_sendmsg+0x10/0x10 [ 77.229940][ T7082] do_syscall_64+0x123/0x790 [ 77.229964][ T7082] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 77.229983][ T7082] RIP: 0033:0x7f2e2bf9e159 [ 77.229997][ T7082] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 77.230014][ T7082] RSP: 002b:00007f2e2cdbc028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 77.230033][ T7082] RAX: ffffffffffffffda RBX: 00007f2e2c225fa0 RCX: 00007f2e2bf9e159 [ 77.230045][ T7082] RDX: 0000000004004004 RSI: 0000200000000180 RDI: 0000000000000003 [ 77.230054][ T7082] RBP: 00007f2e2cdbc090 R08: 0000000000000000 R09: 0000000000000000 [ 77.230064][ T7082] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 77.230075][ T7082] R13: 00007f2e2c226038 R14: 00007f2e2c225fa0 R15: 00007ffec07f3ae8 [ 77.230097][ T7082] [ 77.343010][ T7094] CIFS: VFS: Unknown vers= option specified: -òBÓÑ]Ä…RB š,éûˆØgâúWyø‚ã‹ 2"/›­>å4Z Ò„Fö¹YcßIGQ B±*0Ðâ‘’ãÔV&‹S…«“ÉåØmZîÓö)`sååÓAík!OwëìØåë¶zª»ôª‰"õ°RãLÆLñ°|ZuWG4&Þº²á[G [ 77.350263][ T852] usb 5-1: Using ep0 maxpacket: 32 [ 77.353962][ T852] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 77.360630][ T852] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 77.367905][ T852] usb 5-1: Product: syz [ 77.369571][ T852] usb 5-1: Manufacturer: o [ 77.371583][ T852] usb 5-1: SerialNumber: syz [ 77.394914][ T7096] netlink: 4 bytes leftover after parsing attributes in process `syz.4.313'. [ 77.395130][ T7096] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 77.395145][ T7096] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 77.400168][ T7096] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 77.400182][ T7096] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 77.519226][ T7100] netlink: 'syz.3.314': attribute type 1 has an invalid length. [ 77.519288][ T7100] netlink: 232 bytes leftover after parsing attributes in process `syz.3.314'. [ 77.519412][ T7100] netlink: 'syz.3.314': attribute type 1 has an invalid length. [ 77.543226][ T7100] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.550767][ T7100] bridge_slave_1 (unregistering): left allmulticast mode [ 77.551109][ T7100] bridge_slave_1 (unregistering): left promiscuous mode [ 77.551216][ T7100] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.590602][ T852] usb 5-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 77.664133][ T7105] jffs2: notice: (7105) jffs2_build_xattr_subsystem: complete building xattr subsystem, 3 of xdatum (0 unchecked, 0 orphan) and 4 of xref (0 dead, 0 orphan) found. [ 77.677490][ T71] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 77.753052][ T7116] FAULT_INJECTION: forcing a failure. [ 77.753052][ T7116] name failslab, interval 1, probability 0, space 0, times 0 [ 77.753131][ T7116] CPU: 3 UID: 0 PID: 7116 Comm: syz.3.320 Not tainted syzkaller #0 PREEMPT(full) [ 77.753166][ T7116] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 77.753180][ T7116] Call Trace: [ 77.753186][ T7116] [ 77.753193][ T7116] dump_stack_lvl+0x100/0x190 [ 77.753227][ T7116] should_fail_ex.cold+0x5/0xa [ 77.753249][ T7116] ? __netlink_lookup+0x652/0x900 [ 77.753279][ T7116] should_failslab+0xc2/0x120 [ 77.753303][ T7116] kmem_cache_alloc_noprof+0x92/0x6a0 [ 77.753324][ T7116] ? skb_clone+0x190/0x400 [ 77.753347][ T7116] skb_clone+0x190/0x400 [ 77.753366][ T7116] netlink_deliver_tap+0xaed/0xcc0 [ 77.753399][ T7116] netlink_unicast+0x62b/0x850 [ 77.753431][ T7116] ? __pfx_netlink_unicast+0x10/0x10 [ 77.753466][ T7116] netlink_sendmsg+0x8b0/0xda0 [ 77.753499][ T7116] ? __pfx_netlink_sendmsg+0x10/0x10 [ 77.753528][ T7116] ? selinux_socket_sendmsg+0x198/0x2f0 [ 77.753561][ T7116] ____sys_sendmsg+0xa4d/0xbe0 [ 77.753582][ T7116] ? __pfx_netlink_sendmsg+0x10/0x10 [ 77.753610][ T7116] ? __pfx_____sys_sendmsg+0x10/0x10 [ 77.753641][ T7116] ? lock_acquire+0x1d1/0x380 [ 77.753662][ T7116] ? get_pid_task+0x2a/0x250 [ 77.753700][ T7116] ___sys_sendmsg+0x190/0x1e0 [ 77.753728][ T7116] ? __pfx____sys_sendmsg+0x10/0x10 [ 77.753755][ T7116] ? get_pid_task+0x106/0x250 [ 77.753810][ T7116] ? find_held_lock+0x2b/0x80 [ 77.753858][ T7116] __sys_sendmsg+0x160/0x210 [ 77.753878][ T7116] ? __pfx___sys_sendmsg+0x10/0x10 [ 77.753915][ T7116] do_syscall_64+0x123/0x790 [ 77.753943][ T7116] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 77.753965][ T7116] RIP: 0033:0x7fc70db9e159 [ 77.753983][ T7116] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 77.754005][ T7116] RSP: 002b:00007fc70eb3e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 77.754026][ T7116] RAX: ffffffffffffffda RBX: 00007fc70de25fa0 RCX: 00007fc70db9e159 [ 77.754040][ T7116] RDX: 0000000004004004 RSI: 0000200000000180 RDI: 0000000000000003 [ 77.754053][ T7116] RBP: 00007fc70eb3e090 R08: 0000000000000000 R09: 0000000000000000 [ 77.754066][ T7116] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 77.754079][ T7116] R13: 00007fc70de26038 R14: 00007fc70de25fa0 R15: 00007ffec0c5f1d8 [ 77.754108][ T7116] [ 77.789747][ T852] usb 5-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 77.810926][ T852] usb 5-1: USB disconnect, device number 6 [ 77.840431][ T7123] kAFS: bad VL server IP address [ 77.843672][ T5725] udevd[5725]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 77.860286][ T71] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 77.866362][ T71] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 77.866417][ T71] usb 6-1: Product: syz [ 77.866444][ T71] usb 6-1: Manufacturer: syz [ 77.866469][ T71] usb 6-1: SerialNumber: syz [ 77.918530][ T5817] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 78.086030][ T7133] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 78.099121][ T7140] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 78.411464][ T5833] usb 6-1: USB disconnect, device number 4 [ 78.604734][ T7163] FAULT_INJECTION: forcing a failure. [ 78.604734][ T7163] name failslab, interval 1, probability 0, space 0, times 0 [ 78.604785][ T7163] CPU: 0 UID: 0 PID: 7163 Comm: syz.4.330 Not tainted syzkaller #0 PREEMPT(full) [ 78.604809][ T7163] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 78.604818][ T7163] Call Trace: [ 78.604823][ T7163] [ 78.604828][ T7163] dump_stack_lvl+0x100/0x190 [ 78.604850][ T7163] should_fail_ex.cold+0x5/0xa [ 78.604868][ T7163] should_failslab+0xc2/0x120 [ 78.604884][ T7163] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 78.604898][ T7163] ? __alloc_skb+0x140/0x710 [ 78.604918][ T7163] __alloc_skb+0x140/0x710 [ 78.604934][ T7163] ? __alloc_skb+0x5b7/0x710 [ 78.604962][ T7163] ? __pfx___alloc_skb+0x10/0x10 [ 78.604987][ T7163] netlink_ack+0x117/0xb80 [ 78.605005][ T7163] ? trace_contention_end+0x126/0x160 [ 78.605022][ T7163] netlink_rcv_skb+0x333/0x420 [ 78.605038][ T7163] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 78.605050][ T7163] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 78.605075][ T7163] xfrm_netlink_rcv+0x71/0x90 [ 78.605093][ T7163] netlink_unicast+0x585/0x850 [ 78.605111][ T7163] ? __pfx_netlink_unicast+0x10/0x10 [ 78.605131][ T7163] netlink_sendmsg+0x8b0/0xda0 [ 78.605149][ T7163] ? __pfx_netlink_sendmsg+0x10/0x10 [ 78.605166][ T7163] ? selinux_socket_sendmsg+0x198/0x2f0 [ 78.605186][ T7163] ____sys_sendmsg+0xa4d/0xbe0 [ 78.605199][ T7163] ? __pfx_netlink_sendmsg+0x10/0x10 [ 78.605216][ T7163] ? __pfx_____sys_sendmsg+0x10/0x10 [ 78.605232][ T7163] ? lock_acquire+0x1d1/0x380 [ 78.605243][ T7163] ? get_pid_task+0x2a/0x250 [ 78.605260][ T7163] ___sys_sendmsg+0x190/0x1e0 [ 78.605275][ T7163] ? __pfx____sys_sendmsg+0x10/0x10 [ 78.605289][ T7163] ? get_pid_task+0x106/0x250 [ 78.605308][ T7163] ? find_held_lock+0x2b/0x80 [ 78.605332][ T7163] __sys_sendmsg+0x160/0x210 [ 78.605343][ T7163] ? __pfx___sys_sendmsg+0x10/0x10 [ 78.605361][ T7163] do_syscall_64+0x123/0x790 [ 78.605376][ T7163] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 78.605389][ T7163] RIP: 0033:0x7f2e2bf9e159 [ 78.605399][ T7163] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 78.605410][ T7163] RSP: 002b:00007f2e2cdbc028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 78.605423][ T7163] RAX: ffffffffffffffda RBX: 00007f2e2c225fa0 RCX: 00007f2e2bf9e159 [ 78.605430][ T7163] RDX: 0000000004004004 RSI: 0000200000000180 RDI: 0000000000000003 [ 78.605436][ T7163] RBP: 00007f2e2cdbc090 R08: 0000000000000000 R09: 0000000000000000 [ 78.605443][ T7163] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 78.605449][ T7163] R13: 00007f2e2c226038 R14: 00007f2e2c225fa0 R15: 00007ffec07f3ae8 [ 78.605463][ T7163] [ 78.783431][ T7176] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 78.822252][ T7183] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 78.937812][ T5817] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 78.940031][ T5817] ath9k_htc: Failed to initialize the device [ 78.943050][ T5833] usb 6-1: ath9k_htc: USB layer deinitialized [ 78.992891][ T43] kauditd_printk_skb: 68 callbacks suppressed [ 78.992950][ T43] audit: type=1400 audit(1788554624.554:648): avc: denied { unlink } for pid=5724 comm="syz-executor" name="file1" dev="tmpfs" ino=368 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 79.159258][ T7201] netlink: 'syz.4.345': attribute type 11 has an invalid length. [ 79.171136][ T7203] __nla_validate_parse: 1 callbacks suppressed [ 79.171807][ T7203] netlink: 104 bytes leftover after parsing attributes in process `syz.1.346'. [ 79.223243][ T7205] X.509: Couldn't decode AuthKeyIdentifier [ 79.229511][ T43] audit: type=1400 audit(1788554624.794:649): avc: denied { bind } for pid=7204 comm="syz.1.347" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 79.341743][ T7218] FAULT_INJECTION: forcing a failure. [ 79.341743][ T7218] name failslab, interval 1, probability 0, space 0, times 0 [ 79.341827][ T7218] CPU: 2 UID: 0 PID: 7218 Comm: syz.0.349 Not tainted syzkaller #0 PREEMPT(full) [ 79.341849][ T7218] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 79.341860][ T7218] Call Trace: [ 79.341875][ T7218] [ 79.341883][ T7218] dump_stack_lvl+0x100/0x190 [ 79.341922][ T7218] should_fail_ex.cold+0x5/0xa [ 79.341947][ T7218] should_failslab+0xc2/0x120 [ 79.341975][ T7218] kmem_cache_alloc_noprof+0x92/0x6a0 [ 79.341992][ T7218] ? skb_clone+0x190/0x400 [ 79.342018][ T7218] skb_clone+0x190/0x400 [ 79.342037][ T7218] netlink_deliver_tap+0xaed/0xcc0 [ 79.342069][ T7218] netlink_unicast+0x6a5/0x850 [ 79.342098][ T7218] ? __pfx_netlink_unicast+0x10/0x10 [ 79.342132][ T7218] netlink_ack+0x655/0xb80 [ 79.342172][ T7218] netlink_rcv_skb+0x333/0x420 [ 79.342199][ T7218] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 79.342219][ T7218] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 79.342262][ T7218] xfrm_netlink_rcv+0x71/0x90 [ 79.342290][ T7218] netlink_unicast+0x585/0x850 [ 79.342322][ T7218] ? __pfx_netlink_unicast+0x10/0x10 [ 79.342357][ T7218] netlink_sendmsg+0x8b0/0xda0 [ 79.342390][ T7218] ? __pfx_netlink_sendmsg+0x10/0x10 [ 79.342422][ T7218] ? selinux_socket_sendmsg+0x198/0x2f0 [ 79.342457][ T7218] ____sys_sendmsg+0xa4d/0xbe0 [ 79.342479][ T7218] ? __pfx_netlink_sendmsg+0x10/0x10 [ 79.342510][ T7218] ? __pfx_____sys_sendmsg+0x10/0x10 [ 79.342540][ T7218] ? lock_acquire+0x1d1/0x380 [ 79.342562][ T7218] ? get_pid_task+0x2a/0x250 [ 79.342592][ T7218] ___sys_sendmsg+0x190/0x1e0 [ 79.342642][ T7218] ? __pfx____sys_sendmsg+0x10/0x10 [ 79.342670][ T7218] ? get_pid_task+0x106/0x250 [ 79.342703][ T7218] ? find_held_lock+0x2b/0x80 [ 79.342743][ T7218] __sys_sendmsg+0x160/0x210 [ 79.342761][ T7218] ? __pfx___sys_sendmsg+0x10/0x10 [ 79.342792][ T7218] do_syscall_64+0x123/0x790 [ 79.342822][ T7218] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 79.342841][ T7218] RIP: 0033:0x7f0b1339e159 [ 79.342856][ T7218] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 79.342873][ T7218] RSP: 002b:00007f0b142d2028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 79.342896][ T7218] RAX: ffffffffffffffda RBX: 00007f0b13625fa0 RCX: 00007f0b1339e159 [ 79.342908][ T7218] RDX: 0000000004004004 RSI: 0000200000000180 RDI: 0000000000000003 [ 79.342918][ T7218] RBP: 00007f0b142d2090 R08: 0000000000000000 R09: 0000000000000000 [ 79.342927][ T7218] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 79.342937][ T7218] R13: 00007f0b13626038 R14: 00007f0b13625fa0 R15: 00007fff93c0b548 [ 79.342961][ T7218] [ 79.360486][ T43] audit: type=1400 audit(1788554624.924:650): avc: denied { read } for pid=7219 comm="syz.1.350" name="msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 79.360798][ T43] audit: type=1400 audit(1788554624.924:651): avc: denied { open } for pid=7219 comm="syz.1.350" path="/dev/cpu/0/msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 79.361256][ T43] audit: type=1400 audit(1788554624.924:652): avc: denied { ioctl } for pid=7219 comm="syz.1.350" path="/dev/cpu/0/msr" dev="devtmpfs" ino=87 ioctlcmd=0x63a0 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 79.658376][ T7252] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 79.713632][ T7256] FAULT_INJECTION: forcing a failure. [ 79.713632][ T7256] name failslab, interval 1, probability 0, space 0, times 0 [ 79.713676][ T7256] CPU: 3 UID: 0 PID: 7256 Comm: syz.4.358 Not tainted syzkaller #0 PREEMPT(full) [ 79.713700][ T7256] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 79.713709][ T7256] Call Trace: [ 79.713715][ T7256] [ 79.713719][ T7256] dump_stack_lvl+0x100/0x190 [ 79.713742][ T7256] should_fail_ex.cold+0x5/0xa [ 79.713757][ T7256] should_failslab+0xc2/0x120 [ 79.713771][ T7256] kmem_cache_alloc_lru_noprof+0x8e/0x6a0 [ 79.713789][ T7256] ? __d_alloc+0x35/0xa50 [ 79.713806][ T7256] __d_alloc+0x35/0xa50 [ 79.713821][ T7256] d_alloc_pseudo+0x1c/0xc0 [ 79.713832][ T7256] alloc_file_pseudo+0x118/0x290 [ 79.713848][ T7256] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 79.713863][ T7256] ? alloc_fd+0x471/0x7a0 [ 79.713877][ T7256] sock_alloc_file+0x50/0x210 [ 79.713890][ T7256] __sys_socket+0x1c0/0x260 [ 79.713904][ T7256] ? __pfx___sys_socket+0x10/0x10 [ 79.713922][ T7256] __x64_sys_socket+0x72/0xb0 [ 79.713936][ T7256] ? lockdep_hardirqs_on+0x7d/0x110 [ 79.713948][ T7256] do_syscall_64+0x123/0x790 [ 79.713962][ T7256] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 79.713973][ T7256] RIP: 0033:0x7f2e2bf9e159 [ 79.713983][ T7256] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 79.713994][ T7256] RSP: 002b:00007f2e2cdbc028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 79.714005][ T7256] RAX: ffffffffffffffda RBX: 00007f2e2c225fa0 RCX: 00007f2e2bf9e159 [ 79.714012][ T7256] RDX: 000000000000000c RSI: 0000000000000003 RDI: 0000000000000010 [ 79.714019][ T7256] RBP: 00007f2e2c035024 R08: 0000000000000000 R09: 0000000000000000 [ 79.714025][ T7256] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 79.714032][ T7256] R13: 00007f2e2c226038 R14: 00007f2e2c225fa0 R15: 00007ffec07f3ae8 [ 79.714045][ T7256] [ 79.836102][ C3] Remote OS is not known: 127.0.0.1:55984 -> 127.0.0.1:4420 [ 79.836102][ C3] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=127.0.0.1 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=45111 DF PROTO=TCP SPT=55984 DPT=4420 SEQ=3033606514 ACK=0 WINDOW=65495 RES=0x00 SYN URGP=0 OPT (0204FFD70402080AF38E144B0000000001030309) [ 79.838844][ T7261] netlink: 112 bytes leftover after parsing attributes in process `syz.0.359'. [ 79.884290][ T7266] FAULT_INJECTION: forcing a failure. [ 79.884290][ T7266] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 79.884354][ T7266] CPU: 2 UID: 0 PID: 7266 Comm: syz.0.361 Not tainted syzkaller #0 PREEMPT(full) [ 79.884379][ T7266] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 79.884387][ T7266] Call Trace: [ 79.884392][ T7266] [ 79.884397][ T7266] dump_stack_lvl+0x100/0x190 [ 79.884418][ T7266] should_fail_ex.cold+0x5/0xa [ 79.884436][ T7266] _copy_to_user+0x32/0xd0 [ 79.884455][ T7266] simple_read_from_buffer+0xcb/0x170 [ 79.884470][ T7266] proc_fail_nth_read+0x1af/0x230 [ 79.884484][ T7266] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 79.884499][ T7266] ? rw_verify_area+0xce/0x6d0 [ 79.884515][ T7266] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 79.884529][ T7266] vfs_read+0x1e4/0xb40 [ 79.884539][ T7266] ? lock_acquire+0x1d1/0x380 [ 79.884551][ T7266] ? __fget_files+0x34/0x3d0 [ 79.884564][ T7266] ? __pfx_vfs_read+0x10/0x10 [ 79.884581][ T7266] ? find_held_lock+0x2b/0x80 [ 79.884596][ T7266] ? __fget_files+0x215/0x3d0 [ 79.884612][ T7266] ? __fget_files+0x21f/0x3d0 [ 79.884631][ T7266] ksys_read+0x12a/0x250 [ 79.884643][ T7266] ? __pfx_ksys_read+0x10/0x10 [ 79.884660][ T7266] do_syscall_64+0x123/0x790 [ 79.884677][ T7266] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 79.884691][ T7266] RIP: 0033:0x7f0b1335e98e [ 79.884768][ T7266] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 79.884783][ T7266] RSP: 002b:00007f0b142d1fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 79.884799][ T7266] RAX: ffffffffffffffda RBX: 00007f0b142d26c0 RCX: 00007f0b1335e98e [ 79.884816][ T7266] RDX: 000000000000000f RSI: 00007f0b142d20a0 RDI: 0000000000000004 [ 79.884828][ T7266] RBP: 00007f0b142d2090 R08: 0000000000000000 R09: 0000000000000000 [ 79.884836][ T7266] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 79.884844][ T7266] R13: 00007f0b13626038 R14: 00007f0b13625fa0 R15: 00007fff93c0b548 [ 79.884862][ T7266] [ 79.943099][ T43] audit: type=1400 audit(1788554625.504:653): avc: denied { setopt } for pid=7268 comm="syz.0.363" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 80.112261][ T7284] netlink: 204 bytes leftover after parsing attributes in process `syz.3.367'. [ 80.169666][ T5817] bridge0: entered promiscuous mode [ 80.208440][ T7282] netlink: 4 bytes leftover after parsing attributes in process `syz.4.365'. [ 80.300767][ T43] audit: type=1400 audit(1788554625.864:654): avc: denied { mount } for pid=7296 comm="syz.4.369" name="/" dev="nfsd" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=filesystem permissive=1 [ 80.301576][ T43] audit: type=1400 audit(1788554625.864:655): avc: denied { search } for pid=7296 comm="syz.4.369" name="/" dev="nfsd" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=dir permissive=1 [ 80.301789][ T43] audit: type=1400 audit(1788554625.864:656): avc: denied { write } for pid=7296 comm="syz.4.369" name="versions" dev="nfsd" ino=12 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=file permissive=1 [ 80.302102][ T43] audit: type=1400 audit(1788554625.864:657): avc: denied { open } for pid=7296 comm="syz.4.369" path="/85/nfsd/versions" dev="nfsd" ino=12 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=file permissive=1 [ 80.478266][ T7303] netlink: 'syz.4.371': attribute type 11 has an invalid length. [ 80.777395][ T5817] usb 9-1: new high-speed USB device number 3 using dummy_hcd [ 80.929960][ T5817] usb 9-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00 [ 80.933427][ T5817] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 80.933450][ T5817] usb 9-1: Product: syz [ 80.933462][ T5817] usb 9-1: Manufacturer: syz [ 80.933472][ T5817] usb 9-1: SerialNumber: syz [ 81.023671][ T7295] syz.3.368 (7295) used greatest stack depth: 18824 bytes left [ 81.061029][ T7321] netlink: 104 bytes leftover after parsing attributes in process `syz.1.377'. [ 81.101616][ T7325] netlink: 'syz.3.378': attribute type 1 has an invalid length. [ 81.145287][ T7330] netlink: 'syz.0.381': attribute type 1 has an invalid length. [ 81.175587][ T7330] 8021q: adding VLAN 0 to HW filter on device bond4 [ 81.200173][ T5817] rtl8150 9-1:1.0: couldn't reset the device [ 81.200484][ T5817] rtl8150 9-1:1.0: probe with driver rtl8150 failed with error -5 [ 81.201627][ T7330] bond4: (slave dummy0): Enslaving as a backup interface with an up link [ 81.203167][ T7330] netlink: 'syz.0.381': attribute type 10 has an invalid length. [ 81.203184][ T7330] netlink: 40 bytes leftover after parsing attributes in process `syz.0.381'. [ 81.203242][ T7330] dummy0: entered promiscuous mode [ 81.213285][ T7327] binder: BINDER_SET_CONTEXT_MGR already set [ 81.213307][ T7327] binder: 7326:7327 ioctl 4018620d 2000000001c0 returned -16 [ 81.216063][ T7327] binder: 7326:7327 unknown command 169877795 [ 81.216085][ T7327] binder: 7326:7327 ioctl c0306201 2000000002c0 returned -22 [ 81.216892][ T5817] usb 9-1: USB disconnect, device number 3 [ 81.219712][ T7327] binder: BINDER_SET_CONTEXT_MGR already set [ 81.219724][ T7327] binder: 7326:7327 ioctl 4018620d 200000003280 returned -16 [ 81.221523][ T7327] binder: 7326:7327 ioctl c0306201 200000000080 returned -14 [ 81.229550][ T7330] bond4: (slave dummy0): Releasing backup interface [ 81.324899][ T7339] netlink: 'syz.0.383': attribute type 4 has an invalid length. [ 81.559618][ T7355] xt_socket: unknown flags 0x48 [ 81.563748][ T7355] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 81.726221][ T7359] virtio-fs: tag not found [ 81.817872][ C2] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 81.830398][ T7377] netlink: 204 bytes leftover after parsing attributes in process `syz.4.397'. [ 81.839160][ T7379] macsec2: entered allmulticast mode [ 81.839220][ T7379] netdevsim netdevsim0 netdevsim0: entered allmulticast mode [ 81.842297][ T7379] 8021q: adding VLAN 0 to HW filter on device macsec2 [ 81.882254][ T7389] netlink: 24 bytes leftover after parsing attributes in process `syz.4.400'. [ 81.998399][ T7400] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 82.084547][ T7404] MTRR 1 not used [ 82.084961][ T7404] netlink: 8 bytes leftover after parsing attributes in process `syz.0.404'. [ 82.093904][ T7404] bridge0: port 3(syz_tun) entered disabled state [ 82.094106][ T7404] bridge0: port 2(bridge_slave_1) entered disabled state [ 82.095437][ T7404] bridge0: port 1(bridge_slave_0) entered disabled state [ 82.225764][ T7420] bridge: RTM_NEWNEIGH with unconfigured vlan 1 on bridge0 [ 82.303603][ T7426] kvm: emulating exchange as write [ 82.329966][ T7424] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=7424 comm=syz.1.412 [ 82.443877][ T7443] SELinux: Context system_u:object_r:dlm_control_device_t:s0 is not valid (left unmapped). [ 82.605548][ T7458] team_slave_1: entered promiscuous mode [ 82.634015][ T7466] syz_tun: entered allmulticast mode [ 82.643639][ T7466] pim6reg: entered allmulticast mode [ 82.664553][ T7466] syz_tun (unregistering): left allmulticast mode [ 82.669018][ T7467] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=7467 comm=syz.0.424 [ 82.669281][ T7467] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=7467 comm=syz.0.424 [ 82.671429][ T7467] netlink: 108 bytes leftover after parsing attributes in process `syz.0.424'. [ 82.684655][ T7456] team_slave_1: left promiscuous mode [ 82.899899][ T7484] virtio_blk virtio3: 1/0/0 default/read/poll queues [ 82.903691][ T7484] virtio_blk virtio3: [vda] 262144 512-byte logical blocks (134 MB/128 MiB) [ 83.091964][ T7499] ALSA: seq fatal error: cannot create timer (-16) [ 83.523828][ C0] unchecked MSR access error: WRMSR to 0x404 (tried to write 0x0000000000000001) at rIP: 0xffffffff81b2f8ea (__mcheck_cpu_init_prepare_banks+0x18a/0x380) [ 83.523914][ C0] Call Trace: [ 83.523922][ C0] [ 83.523933][ C0] ? __pfx___mcheck_cpu_init_prepare_banks+0x10/0x10 [ 83.523957][ C0] ? sched_clock_cpu+0x6c/0x570 [ 83.523977][ C0] ? __pfx_sched_clock_cpu+0x10/0x10 [ 83.524007][ C0] ? __pfx_mce_cpu_restart+0x10/0x10 [ 83.524027][ C0] mce_cpu_restart+0xd5/0x1f0 [ 83.524048][ C0] __flush_smp_call_function_queue+0x289/0x8c0 [ 83.524076][ C0] __sysvec_call_function+0x81/0x420 [ 83.524103][ C0] sysvec_call_function+0x9e/0xc0 [ 83.524128][ C0] [ 83.524134][ C0] [ 83.524142][ C0] asm_sysvec_call_function+0x1a/0x20 [ 83.524159][ C0] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 83.524178][ C0] Code: b8 9b 02 e9 c3 4f 03 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa eb 07 0f 00 2d c3 e6 1b 00 fb f4 cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 [ 83.524194][ C0] RSP: 0018:ffffffff8ea07cf0 EFLAGS: 00000202 [ 83.524210][ C0] RAX: 00000000000f46b9 RBX: ffffffff8ea91500 RCX: ffffffff8bcfd115 [ 83.524222][ C0] RDX: 0000000000000001 RSI: ffffffff8e3eb72f RDI: ffffffff8c620f80 [ 83.524233][ C0] RBP: fffffbfff1d522a0 R08: 0000000000000001 R09: ffffed100d4867bd [ 83.524244][ C0] R10: ffff88806a433deb R11: 0000000000000001 R12: 0000000000000000 [ 83.524255][ C0] R13: 0000000000000000 R14: 1ffffffff1d40fa2 R15: dffffc0000000000 [ 83.524272][ C0] ? ct_kernel_exit+0x125/0x180 [ 83.524296][ C0] default_idle+0x9/0x10 [ 83.524315][ C0] default_idle_call+0x6c/0xb0 [ 83.524335][ C0] do_idle+0x3ae/0x5b0 [ 83.524354][ C0] ? __pfx_do_idle+0x10/0x10 [ 83.524373][ C0] ? finish_task_switch.isra.0+0x149/0x10d0 [ 83.524399][ C0] cpu_startup_entry+0x4f/0x60 [ 83.524420][ C0] rest_init+0x2d3/0x2e0 [ 83.524442][ C0] ? __pfx_rest_init+0x10/0x10 [ 83.524471][ C0] ? __pfx_kernel_init+0x10/0x10 [ 83.524495][ C0] ? acpi_ut_status_exit+0x111/0x1c0 [ 83.524524][ C0] ? acpi_ut_status_exit+0x111/0x1c0 [ 83.524549][ C0] ? acpi_enable_subsystem+0x4d9/0x4f0 [ 83.524567][ C0] ? __pfx_x86_late_time_init+0x10/0x10 [ 83.524589][ C0] start_kernel+0x48e/0x490 [ 83.524609][ C0] x86_64_start_reservations+0x24/0x30 [ 83.524628][ C0] x86_64_start_kernel+0x12b/0x130 [ 83.524647][ C0] common_startup_64+0x13e/0x158 [ 83.524680][ C0] [ 83.575470][ T7527] FAULT_INJECTION: forcing a failure. [ 83.575470][ T7527] name failslab, interval 1, probability 0, space 0, times 0 [ 83.575494][ T7527] CPU: 1 UID: 0 PID: 7527 Comm: syz.1.443 Not tainted syzkaller #0 PREEMPT(full) [ 83.575509][ T7527] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 83.575516][ T7527] Call Trace: [ 83.575521][ T7527] [ 83.575526][ T7527] dump_stack_lvl+0x100/0x190 [ 83.575546][ T7527] should_fail_ex.cold+0x5/0xa [ 83.575564][ T7527] should_failslab+0xc2/0x120 [ 83.575579][ T7527] __kmalloc_cache_noprof+0x91/0x6d0 [ 83.575597][ T7527] ? led_tg_check+0x1de/0x4a0 [ 83.575621][ T7527] ? __pfx_led_tg_check+0x10/0x10 [ 83.575633][ T7527] led_tg_check+0x1de/0x4a0 [ 83.575645][ T7527] ? __pfx_led_tg_check+0x10/0x10 [ 83.575656][ T7527] xt_check_target+0x117/0x1c0 [ 83.575670][ T7527] find_check_entry.isra.0+0x808/0xa00 [ 83.575692][ T7527] ? __pfx_find_check_entry.isra.0+0x10/0x10 [ 83.575715][ T7527] ? kasan_quarantine_put+0x104/0x240 [ 83.575729][ T7527] ? translate_table+0xb53/0x16c0 [ 83.575747][ T7527] ? kfree+0x22b/0x6d0 [ 83.575761][ T7527] ? xt_check_table_hooks+0x206/0x330 [ 83.575774][ T7527] translate_table+0xc31/0x16c0 [ 83.575796][ T7527] ? __pfx_translate_table+0x10/0x10 [ 83.575815][ T7527] do_ip6t_set_ctl+0x689/0xd00 [ 83.575832][ T7527] ? nf_sockopt_find.isra.0+0x222/0x290 [ 83.575843][ T7527] ? nf_sockopt_find.isra.0+0x222/0x290 [ 83.575856][ T7527] ? __pfx_do_ip6t_set_ctl+0x10/0x10 [ 83.575872][ T7527] ? __mutex_unlock_slowpath+0x35d/0x930 [ 83.575886][ T7527] ? futex_wait+0x11e/0x370 [ 83.575903][ T7527] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 83.575921][ T7527] ? nf_sockopt_find.isra.0+0x222/0x290 [ 83.575934][ T7527] nf_setsockopt+0x8d/0xf0 [ 83.575945][ T7527] ipv6_setsockopt+0x135/0x170 [ 83.575958][ T7527] udpv6_setsockopt+0x64/0xb0 [ 83.575970][ T7527] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 83.575985][ T7527] do_sock_setsockopt+0xf3/0x1d0 [ 83.575999][ T7527] __sys_setsockopt+0x195/0x220 [ 83.576018][ T7527] __x64_sys_setsockopt+0xbd/0x160 [ 83.576034][ T7527] ? do_syscall_64+0xae/0x790 [ 83.576046][ T7527] ? lockdep_hardirqs_on+0x7d/0x110 [ 83.576058][ T7527] do_syscall_64+0x123/0x790 [ 83.576071][ T7527] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 83.576082][ T7527] RIP: 0033:0x7f1a3f39e159 [ 83.576092][ T7527] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 83.576102][ T7527] RSP: 002b:00007f1a40235028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 83.576114][ T7527] RAX: ffffffffffffffda RBX: 00007f1a3f625fa0 RCX: 00007f1a3f39e159 [ 83.576123][ T7527] RDX: 0000000000000040 RSI: 0000000000000029 RDI: 0000000000000006 [ 83.576129][ T7527] RBP: 00007f1a3f435024 R08: 0000000000000428 R09: 0000000000000000 [ 83.576136][ T7527] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 83.576142][ T7527] R13: 00007f1a3f626038 R14: 00007f1a3f625fa0 R15: 00007fffa5c197e8 [ 83.576156][ T7527] [ 83.593415][ T7527] bridge0: port 3(ipvlan2) entered blocking state [ 83.593501][ T7527] bridge0: port 3(ipvlan2) entered disabled state [ 83.593570][ T7527] ipvlan2: entered allmulticast mode [ 83.593584][ T7527] bridge0: entered allmulticast mode [ 83.598112][ T7527] ipvlan2: left allmulticast mode [ 83.598125][ T7527] bridge0: left allmulticast mode [ 83.703954][ T7530] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=7530 comm=syz.3.444 [ 83.994543][ T7554] netlink: 'syz.1.452': attribute type 23 has an invalid length. [ 84.152774][ T7559] faux_driver vgem: [drm] Unknown color mode 135162; guessing buffer size. [ 84.153612][ T43] kauditd_printk_skb: 28 callbacks suppressed [ 84.153677][ T43] audit: type=1400 audit(1788554629.714:686): avc: denied { map } for pid=7558 comm="syz.3.455" path="/dev/dri/card0" dev="devtmpfs" ino=635 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 84.153992][ T43] audit: type=1400 audit(1788554629.714:687): avc: denied { execute } for pid=7558 comm="syz.3.455" path="/dev/dri/card0" dev="devtmpfs" ino=635 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 84.421302][ T7581] Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 84.421302][ T7581] [ 84.421503][ T7581] CIFS: VFS: Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 84.421539][ T7581] CIFS: Attempting to mount //127.0.0.1/share [ 84.424760][ T7581] CIFS: VFS: Error connecting to socket. Aborting operation. [ 84.424786][ T7581] CIFS: VFS: cifs_mount failed w/return code = -111 [ 84.818321][ T7608] netlink: 'syz.3.469': attribute type 1 has an invalid length. [ 84.821632][ T7608] __nla_validate_parse: 2 callbacks suppressed [ 84.823896][ T7608] netlink: 228 bytes leftover after parsing attributes in process `syz.3.469'. [ 85.006993][ T7616] team0: Device vlan0 is already an upper device of the team interface [ 85.192767][ T7636] overlayfs: missing 'lowerdir' [ 85.254703][ T7638] netlink: 8 bytes leftover after parsing attributes in process `syz.4.479'. [ 85.254789][ T7638] netlink: 8 bytes leftover after parsing attributes in process `syz.4.479'. [ 85.354162][ T13] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 85.430957][ T43] audit: type=1400 audit(1788554886.994:688): avc: denied { append } for pid=7643 comm="syz.1.483" name="pfkey" dev="proc" ino=4026533059 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 85.433965][ T43] audit: type=1400 audit(1788554886.994:689): avc: denied { module_request } for pid=7640 comm="syz.4.484" kmod="crypto-hmac(md5)-all" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 85.449270][ T13] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 85.513486][ T13] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 85.515909][ T5727] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 85.518130][ T5727] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 85.521423][ T5727] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 85.522267][ T5727] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 85.522725][ T5727] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 85.547487][ T66] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 85.551632][ T66] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 85.556240][ T66] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 85.559211][ T66] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 85.560151][ T66] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 85.604696][ T13] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 85.717372][ T852] usb 9-1: new high-speed USB device number 4 using dummy_hcd [ 85.784590][ T13] bridge_slave_0: left allmulticast mode [ 85.784659][ T13] bridge_slave_0: left promiscuous mode [ 85.784833][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 85.819138][ T43] audit: type=1400 audit(1788554887.384:690): avc: denied { write } for pid=7681 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 85.867565][ T852] usb 9-1: Using ep0 maxpacket: 8 [ 85.868303][ T852] usb 9-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 85.869324][ T852] usb 9-1: config index 0 descriptor too short (expected 74, got 45) [ 85.869351][ T852] usb 9-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 85.869367][ T852] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 85.869380][ T852] usb 9-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 85.869393][ T852] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 0 [ 85.869404][ T852] usb 9-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 85.869425][ T852] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 85.876803][ T852] usbtmc 9-1:16.0: probe with driver usbtmc failed with error -22 [ 85.892492][ T43] audit: type=1400 audit(1788554887.454:691): avc: denied { write } for pid=7689 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 85.947942][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 85.962172][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 85.966193][ T13] bond0 (unregistering): Released all slaves [ 85.969747][ T13] bond1 (unregistering): Released all slaves [ 85.982664][ T5440] 8021q: adding VLAN 0 to HW filter on device eth6 [ 86.105120][ T43] audit: type=1400 audit(1788554887.664:692): avc: denied { write } for pid=7702 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 86.165007][ T43] audit: type=1400 audit(1788554887.724:693): avc: denied { write } for pid=7711 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 86.281891][ T5440] 8021q: adding VLAN 0 to HW filter on device eth7 [ 86.443006][ T43] audit: type=1400 audit(1788554887.994:694): avc: denied { read } for pid=7640 comm="syz.4.484" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 86.451072][ T43] audit: type=1400 audit(1788554888.014:695): avc: denied { write } for pid=7720 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 86.486055][ T13] hsr_slave_0: left promiscuous mode [ 86.497485][ T13] hsr_slave_1: left promiscuous mode [ 86.498213][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 86.498234][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 86.507402][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 86.507431][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 86.524073][ T7726] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 [ 86.532540][ T13] veth1_macvtap: left promiscuous mode [ 86.532645][ T13] veth0_macvtap: left promiscuous mode [ 86.532778][ T13] veth1_vlan: left promiscuous mode [ 86.532860][ T13] veth0_vlan: left promiscuous mode [ 86.751382][ T13] team0 (unregistering): Port device team_slave_1 removed [ 86.775771][ T13] team0 (unregistering): Port device team_slave_0 removed [ 86.874477][ T5440] 8021q: adding VLAN 0 to HW filter on device eth8 [ 86.931262][ T7652] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.934602][ T7652] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.938826][ T7652] bridge_slave_0: entered allmulticast mode [ 86.943726][ T7652] bridge_slave_0: entered promiscuous mode [ 86.951398][ T7652] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.951581][ T7652] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.951687][ T7652] bridge_slave_1: entered allmulticast mode [ 86.952967][ T7652] bridge_slave_1: entered promiscuous mode [ 86.986114][ T7652] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 86.988019][ T7652] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 87.000885][ T7652] team0: Port device team_slave_0 added [ 87.002285][ T7652] team0: Port device team_slave_1 added [ 87.014648][ T7652] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 87.014697][ T7652] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 87.014742][ T7652] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 87.015504][ T7652] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 87.015512][ T7652] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 87.015525][ T7652] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 87.060424][ T7652] hsr_slave_0: entered promiscuous mode [ 87.062774][ T7652] hsr_slave_1: entered promiscuous mode [ 87.063134][ T7652] debugfs: 'hsr0' already exists in 'hsr' [ 87.063149][ T7652] Cannot create hsr debugfs directory [ 87.142232][ T7748] mac80211_hwsim hwsim3 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 87.241663][ T7755] bridge0: port 2(bridge_slave_1) entered disabled state [ 87.274724][ T5440] 8021q: adding VLAN 0 to HW filter on device eth9 [ 87.310264][ T7652] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 87.316130][ T7652] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 87.318625][ T7652] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 87.324495][ T7652] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 87.325344][ T7652] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 87.330728][ T7652] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 87.331855][ T7652] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 87.338496][ T7652] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 87.409935][ T7652] 8021q: adding VLAN 0 to HW filter on device bond0 [ 87.422168][ T7652] 8021q: adding VLAN 0 to HW filter on device team0 [ 87.431662][ T1182] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.431796][ T1182] bridge0: port 1(bridge_slave_0) entered forwarding state [ 87.451818][ T6262] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.451988][ T6262] bridge0: port 2(bridge_slave_1) entered forwarding state [ 87.579594][ T7775] FAULT_INJECTION: forcing a failure. [ 87.579594][ T7775] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 87.579684][ T7775] CPU: 1 UID: 0 PID: 7775 Comm: syz.1.502 Not tainted syzkaller #0 PREEMPT(full) [ 87.579723][ T7775] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 87.579734][ T7775] Call Trace: [ 87.579742][ T7775] [ 87.579750][ T7775] dump_stack_lvl+0x100/0x190 [ 87.579783][ T7775] should_fail_ex.cold+0x5/0xa [ 87.579814][ T7775] _copy_from_user+0x2e/0xd0 [ 87.579845][ T7775] do_handle_open+0x6ba/0xf20 [ 87.579866][ T7775] ? __pfx_do_handle_open+0x10/0x10 [ 87.579891][ T7775] ? xfd_validate_state+0x129/0x190 [ 87.579921][ T7775] ? do_syscall_64+0x123/0x790 [ 87.579943][ T7775] do_syscall_64+0x123/0x790 [ 87.579969][ T7775] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.579989][ T7775] RIP: 0033:0x7f1a3f39e159 [ 87.580004][ T7775] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 87.580021][ T7775] RSP: 002b:00007f1a40235028 EFLAGS: 00000246 ORIG_RAX: 0000000000000130 [ 87.580042][ T7775] RAX: ffffffffffffffda RBX: 00007f1a3f625fa0 RCX: 00007f1a3f39e159 [ 87.580056][ T7775] RDX: 0000000000422001 RSI: 0000200000000400 RDI: 0000000000000006 [ 87.580069][ T7775] RBP: 00007f1a3f435024 R08: 0000000000000000 R09: 0000000000000000 [ 87.580082][ T7775] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 87.580102][ T7775] R13: 00007f1a3f626038 R14: 00007f1a3f625fa0 R15: 00007fffa5c197e8 [ 87.580128][ T7775] [ 87.658122][ T66] Bluetooth: hci1: command tx timeout [ 87.754242][ T7652] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 87.894638][ T7792] netlink: 4 bytes leftover after parsing attributes in process `syz.1.505'. [ 87.933355][ T7652] veth0_vlan: entered promiscuous mode [ 87.939186][ T7652] veth1_vlan: entered promiscuous mode [ 87.958686][ T7652] veth0_macvtap: entered promiscuous mode [ 87.961741][ T7652] veth1_macvtap: entered promiscuous mode [ 87.975289][ T7652] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 87.984222][ T7652] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 87.989711][ T7801] netlink: 4 bytes leftover after parsing attributes in process `syz.1.505'. [ 87.991093][ T5776] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.134969][ T1182] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.135052][ T1182] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.140629][ T5776] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.140959][ T5776] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.141138][ T5776] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.165152][ T1182] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.169771][ T1182] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.272928][ T7808] netlink: 8 bytes leftover after parsing attributes in process `syz.1.506'. [ 88.423227][ T7816] Bluetooth: hci3: Opcode 0x0c20 failed: -22 [ 88.424743][ T62] usb 9-1: USB disconnect, device number 4 [ 88.602230][ T7833] netlink: 8 bytes leftover after parsing attributes in process `syz.4.512'. [ 88.603788][ T7833] netlink: 8 bytes leftover after parsing attributes in process `syz.4.512'. [ 88.660560][ T7840] netlink: 'syz.5.515': attribute type 1 has an invalid length. [ 88.660635][ T7840] netlink: 'syz.5.515': attribute type 2 has an invalid length. [ 88.663682][ T7840] netlink: 'syz.5.515': attribute type 3 has an invalid length. [ 88.663698][ T7840] netlink: 4 bytes leftover after parsing attributes in process `syz.5.515'. [ 88.766635][ T7850] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 88.770899][ T7850] netlink: 16 bytes leftover after parsing attributes in process `syz.1.518'. [ 88.987000][ T5838] usb 9-1: new high-speed USB device number 5 using dummy_hcd [ 89.040555][ T7874] netlink: 'syz.1.525': attribute type 32 has an invalid length. [ 89.069376][ T7874] bond1: option coupled_control: invalid value (115) [ 89.072654][ T7874] bond1 (unregistering): Released all slaves [ 89.093129][ T7879] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 89.147995][ T5838] usb 9-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice= 0.01 [ 89.152750][ T5838] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 89.152776][ T5838] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 89.152788][ T5838] usb 9-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 89.154983][ T5838] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 89.154999][ T5838] usb 9-1: Product: syz [ 89.155008][ T5838] usb 9-1: Manufacturer: syz [ 89.171096][ T7852] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 89.176470][ T5838] garmin_gps 9-1:1.0: Garmin GPS usb/tty converter detected [ 89.197866][ T5838] usb 9-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 89.225328][ T43] kauditd_printk_skb: 11 callbacks suppressed [ 89.225560][ T43] audit: type=1400 audit(1788554890.785:707): avc: denied { write } for pid=7884 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 89.240140][ T7875] mmap: syz.5.524 (7875) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 89.263842][ T7875] jffs2: notice: (7875) jffs2_build_xattr_subsystem: complete building xattr subsystem, 3 of xdatum (0 unchecked, 0 orphan) and 4 of xref (0 dead, 0 orphan) found. [ 89.272922][ T43] audit: type=1400 audit(1788554890.835:708): avc: denied { write } for pid=7872 comm="syz.5.524" name="/" dev="jffs2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 89.289114][ T43] audit: type=1400 audit(1788554890.855:709): avc: denied { write } for pid=7887 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 89.336015][ T43] audit: type=1400 audit(1788554890.895:710): avc: denied { mount } for pid=7872 comm="syz.5.524" name="/" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 89.384238][ T10] usb 9-1: USB disconnect, device number 5 [ 89.390806][ T43] audit: type=1400 audit(1788554890.955:711): avc: denied { write } for pid=7897 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 89.394300][ T43] audit: type=1400 audit(1788554890.955:712): avc: denied { bpf } for pid=7851 comm="syz.4.517" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 89.394597][ T10] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 89.394962][ T10] garmin_gps 9-1:1.0: device disconnected [ 89.452291][ T43] audit: type=1400 audit(1788554891.015:713): avc: denied { write } for pid=7901 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 89.526940][ T43] audit: type=1400 audit(1788554891.085:714): avc: denied { write } for pid=7903 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 89.592771][ T43] audit: type=1400 audit(1788554891.155:715): avc: denied { write } for pid=7906 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 89.680676][ T43] audit: type=1400 audit(1788554891.245:716): avc: denied { write } for pid=7909 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 89.739316][ T66] Bluetooth: hci1: command tx timeout [ 90.074949][ T7917] tipc: Enabling of bearer rejected, media not registered [ 90.176991][ T5833] usb 9-1: new high-speed USB device number 6 using dummy_hcd [ 90.289492][ T7931] 0x000000000006-0x000000020000 : "" [ 90.310592][ T7931] ftl_cs: FTL header corrupt! [ 90.333848][ T5833] usb 9-1: Using ep0 maxpacket: 32 [ 90.337949][ T5833] usb 9-1: New USB device found, idVendor=05ac, idProduct=027c, bcdDevice= 0.40 [ 90.339091][ T5833] usb 9-1: config 1 interface 0 has no altsetting 0 [ 90.341146][ T5833] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 90.341167][ T5833] usb 9-1: Product: à ‡ [ 90.341180][ T5833] usb 9-1: Manufacturer: 汬棠륡î§å‰½æ·¦æ¢˜ãŸˆç·—ì–ᷔ죯艇ã³î¥…놸ឞ藳쳧瞷䲋盘êå°°ä•á‰ƒä›ƒìŸ‰ê°ï§šä«ƒí”¨ë†å¯œî­¶ë‡©â®ê‚Ÿë…¦áŒŒå¯³ï© å§ ä”¡â†‘랓쿆ìžâ³…렰⢽棡ᕑ哂䂋秄蘉䓣ê…曨㳦㽈㿒侾૾â±â¹å¼»Ã’谖áì§æ¦žÖ€âŸ£ç“’᤿຦얪ë¯ç”•ë²–䉚ﱴ骓뻭ݪç¦Ê§ë‚ å›ªï“ƒÛ¾ [ 90.341206][ T5833] usb 9-1: SerialNumber: ꥌ쎥漲♔旳澠໛첕ན಩힀﴿힭ã¼î¢Žç“㠕쩕꺻ൿ圯밵섗潼摄鹿꿿屫ﴷ꭪㟄窑禷ʼⷤ伫땕æªâ­½ãŒŽæ”»á¸µêŽ°â±€ê± ïŠ¾ïª¬é¶¡á„›à¬£æ±¯îŒ¼ä«¯ç”™ãŠ¸è¬†ïª—밡櫆➭嚎⟤颸袵畊âŒâ£˜ä•˜é¦·á§‡ê»€ç¤¨ïº‘鼛뀆愲฿ᷥ [ 90.571334][ T5833] usbhid 9-1:1.0: can't add hid device: -71 [ 90.571453][ T5833] usbhid 9-1:1.0: probe with driver usbhid failed with error -71 [ 90.587033][ T5833] usb 9-1: USB disconnect, device number 6 [ 90.712864][ T7960] __nla_validate_parse: 66 callbacks suppressed [ 90.713164][ T7960] netlink: 4 bytes leftover after parsing attributes in process `syz.1.538'. [ 90.772653][ T7962] bond1: entered promiscuous mode [ 91.116788][ T5833] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 91.286872][ T5833] usb 6-1: Using ep0 maxpacket: 8 [ 91.287818][ T5833] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 91.289284][ T5833] usb 6-1: config index 0 descriptor too short (expected 301, got 45) [ 91.289395][ T5833] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 91.289428][ T5833] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 91.289458][ T5833] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 91.289485][ T5833] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 91.289531][ T5833] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 91.503814][ T5833] usb 6-1: usb_control_msg returned -32 [ 91.503909][ T5833] usbtmc 6-1:16.0: can't read capabilities [ 91.616453][ T5776] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 91.664244][ T7990] tipc: Started in network mode [ 91.664311][ T7990] tipc: Node identity 2000004, cluster identity 4711 [ 91.664520][ T7990] tipc: Node number set to 33554436 [ 91.707722][ T5776] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 91.806904][ T5776] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 91.833274][ T5727] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 91.837500][ T5727] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 91.843393][ T5727] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 91.850002][ T5727] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 91.851516][ T5727] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 91.901339][ T5776] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 92.036760][ T5832] usb 9-1: new low-speed USB device number 7 using dummy_hcd [ 92.114715][ T5776] bridge_slave_1: left allmulticast mode [ 92.114781][ T5776] bridge_slave_1: left promiscuous mode [ 92.114940][ T5776] bridge0: port 2(bridge_slave_1) entered disabled state [ 92.121070][ T5776] bridge_slave_0: left allmulticast mode [ 92.121094][ T5776] bridge_slave_0: left promiscuous mode [ 92.121287][ T5776] bridge0: port 1(bridge_slave_0) entered disabled state [ 92.197562][ T5832] usb 9-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 92.198527][ T5832] usb 9-1: config 168 descriptor has 1 excess byte, ignoring [ 92.198587][ T5832] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 92.198606][ T5832] usb 9-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 92.198627][ T5832] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 92.198647][ T5832] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 92.199616][ T5832] usb 9-1: config 168 descriptor has 1 excess byte, ignoring [ 92.199649][ T5832] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 92.199672][ T5832] usb 9-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 92.199693][ T5832] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 92.199717][ T5832] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 92.200605][ T5832] usb 9-1: config 168 descriptor has 1 excess byte, ignoring [ 92.200636][ T5832] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 92.200653][ T5832] usb 9-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 92.200670][ T5832] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 92.200691][ T5832] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 92.203476][ T5832] usb 9-1: string descriptor 0 read error: -22 [ 92.203571][ T5832] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 92.230333][ T8014] usbtmc 6-1:16.0: usb_clear_halt returned -32 [ 92.270399][ T5832] adutux 9-1:168.0: ADU100 now attached to /dev/usb/adutux1 [ 92.341863][ T5776] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 92.352501][ T5776] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 92.360279][ T5776] bond0 (unregistering): Released all slaves [ 92.381586][ T5440] 8021q: adding VLAN 0 to HW filter on device eth10 [ 92.431299][ T7996] usbtmc 6-1:16.0: send_request_dev_dep_msg_in returned -90 [ 92.450772][ T5833] usb 6-1: USB disconnect, device number 5 [ 92.545401][ T912] usb 9-1: USB disconnect, device number 7 [ 92.710835][ T5440] 8021q: adding VLAN 0 to HW filter on device eth11 [ 92.744803][ T5776] hsr_slave_0: left promiscuous mode [ 92.747953][ T5776] hsr_slave_1: left promiscuous mode [ 92.748464][ T5776] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 92.748478][ T5776] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 92.759360][ T5776] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 92.762782][ T5776] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 92.779373][ T5776] veth1_macvtap: left promiscuous mode [ 92.782045][ T5776] veth0_macvtap: left promiscuous mode [ 92.785091][ T5776] veth1_vlan: left promiscuous mode [ 92.786776][ T5776] veth0_vlan: left promiscuous mode [ 92.964809][ T5776] team0 (unregistering): Port device team_slave_1 removed [ 92.983335][ T5776] team0 (unregistering): Port device team_slave_0 removed [ 93.008054][ T8052] FAULT_INJECTION: forcing a failure. [ 93.008054][ T8052] name failslab, interval 1, probability 0, space 0, times 0 [ 93.008124][ T8052] CPU: 1 UID: 0 PID: 8052 Comm: syz.1.558 Not tainted syzkaller #0 PREEMPT(full) [ 93.008159][ T8052] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.008171][ T8052] Call Trace: [ 93.008178][ T8052] [ 93.008194][ T8052] dump_stack_lvl+0x100/0x190 [ 93.008227][ T8052] should_fail_ex.cold+0x5/0xa [ 93.008251][ T8052] should_failslab+0xc2/0x120 [ 93.008276][ T8052] kmem_cache_alloc_noprof+0x92/0x6a0 [ 93.008293][ T8052] ? security_file_alloc+0x34/0x2c0 [ 93.008314][ T8052] security_file_alloc+0x34/0x2c0 [ 93.008335][ T8052] init_file+0x95/0x480 [ 93.008361][ T8052] alloc_empty_file+0x79/0x1c0 [ 93.008388][ T8052] alloc_file_pseudo+0x183/0x290 [ 93.008413][ T8052] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 93.008439][ T8052] ? __kasan_kmalloc+0xaa/0xb0 [ 93.008461][ T8052] __anon_inode_getfile+0xe8/0x280 [ 93.008510][ T8052] iommufd_test+0xa29/0x6600 [ 93.008532][ T8052] ? __lock_acquire+0x4c5/0x1ec0 [ 93.008555][ T8052] ? __lock_acquire+0x4c5/0x1ec0 [ 93.008576][ T8052] ? __pfx_iommufd_test+0x10/0x10 [ 93.008593][ T8052] ? tomoyo_path_number_perm+0x188/0x580 [ 93.008624][ T8052] ? lock_acquire+0x1d1/0x380 [ 93.008642][ T8052] ? __might_fault+0xc5/0x140 [ 93.008667][ T8052] ? find_held_lock+0x2b/0x80 [ 93.008691][ T8052] ? __might_fault+0xc5/0x140 [ 93.008713][ T8052] ? __might_fault+0xc5/0x140 [ 93.008746][ T8052] iommufd_fops_ioctl+0x358/0x520 [ 93.008768][ T8052] ? __pfx_iommufd_fops_ioctl+0x10/0x10 [ 93.008787][ T8052] ? __fget_files+0x34/0x3d0 [ 93.008817][ T8052] ? selinux_file_ioctl+0x13b/0x290 [ 93.008834][ T8052] ? selinux_file_ioctl+0xb6/0x290 [ 93.008852][ T8052] ? __pfx_iommufd_fops_ioctl+0x10/0x10 [ 93.008874][ T8052] __x64_sys_ioctl+0x18e/0x210 [ 93.008899][ T8052] do_syscall_64+0x123/0x790 [ 93.008922][ T8052] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.008942][ T8052] RIP: 0033:0x7f1a3f39e159 [ 93.008958][ T8052] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 93.008975][ T8052] RSP: 002b:00007f1a40235028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 93.008994][ T8052] RAX: ffffffffffffffda RBX: 00007f1a3f625fa0 RCX: 00007f1a3f39e159 [ 93.009006][ T8052] RDX: 0000200000000980 RSI: 0000000000003ba0 RDI: 0000000000000005 [ 93.009020][ T8052] RBP: 00007f1a3f435024 R08: 0000000000000000 R09: 0000000000000000 [ 93.009030][ T8052] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 93.009042][ T8052] R13: 00007f1a3f626038 R14: 00007f1a3f625fa0 R15: 00007fffa5c197e8 [ 93.009064][ T8052] [ 93.287917][ T7997] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.288063][ T7997] bridge0: port 1(bridge_slave_0) entered disabled state [ 93.288216][ T7997] bridge_slave_0: entered allmulticast mode [ 93.292594][ T7997] bridge_slave_0: entered promiscuous mode [ 93.297381][ T7997] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.299677][ T7997] bridge0: port 2(bridge_slave_1) entered disabled state [ 93.299802][ T7997] bridge_slave_1: entered allmulticast mode [ 93.301527][ T7997] bridge_slave_1: entered promiscuous mode [ 93.361798][ T7997] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 93.373227][ T7997] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 93.381051][ T8063] tipc: Failed to remove unknown binding: 66,0,0/33554436:363370362/363370363 [ 93.384287][ T8063] tipc: Failed to remove unknown binding: 66,0,0/33554436:363370362/363370363 [ 93.425044][ T7997] team0: Port device team_slave_0 added [ 93.429520][ T7997] team0: Port device team_slave_1 added [ 93.479616][ T7997] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 93.479675][ T7997] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 93.479709][ T7997] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 93.481845][ T7997] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 93.481857][ T7997] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 93.481871][ T7997] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 93.550567][ T8069] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=8069 comm=syz.4.564 [ 93.559081][ T7997] hsr_slave_0: entered promiscuous mode [ 93.566906][ T7997] hsr_slave_1: entered promiscuous mode [ 93.567549][ T7997] debugfs: 'hsr0' already exists in 'hsr' [ 93.567567][ T7997] Cannot create hsr debugfs directory [ 93.679029][ T5440] 8021q: adding VLAN 0 to HW filter on device eth12 [ 93.881427][ T8101] Bluetooth: hci0: unsupported parameter 76 [ 93.881514][ T8101] Bluetooth: hci0: unsupported parameter 76 [ 93.906458][ T66] Bluetooth: hci1: command tx timeout [ 93.960578][ T7997] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 93.969298][ T7997] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 93.969801][ T7997] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 93.987104][ T7997] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 93.987715][ T7997] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 93.998262][ T7997] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 94.002416][ T7997] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 94.014706][ T7997] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 94.046728][ T7997] bridge0: port 2(bridge_slave_1) entered blocking state [ 94.046809][ T7997] bridge0: port 2(bridge_slave_1) entered forwarding state [ 94.047037][ T7997] bridge0: port 1(bridge_slave_0) entered blocking state [ 94.047098][ T7997] bridge0: port 1(bridge_slave_0) entered forwarding state [ 94.082197][ T5440] 8021q: adding VLAN 0 to HW filter on device eth13 [ 94.112153][ T7997] 8021q: adding VLAN 0 to HW filter on device bond0 [ 94.129472][ T6262] bridge0: port 1(bridge_slave_0) entered disabled state [ 94.132101][ T6262] bridge0: port 2(bridge_slave_1) entered disabled state [ 94.154974][ T7997] 8021q: adding VLAN 0 to HW filter on device team0 [ 94.173651][ T1182] bridge0: port 1(bridge_slave_0) entered blocking state [ 94.173788][ T1182] bridge0: port 1(bridge_slave_0) entered forwarding state [ 94.185142][ T6262] bridge0: port 2(bridge_slave_1) entered blocking state [ 94.185220][ T6262] bridge0: port 2(bridge_slave_1) entered forwarding state [ 94.483456][ T43] kauditd_printk_skb: 31 callbacks suppressed [ 94.486087][ T43] audit: type=1400 audit(1788554896.045:748): avc: denied { mount } for pid=8156 comm="syz.0.579" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 94.505386][ T43] audit: type=1400 audit(1788554896.065:749): avc: denied { unmount } for pid=5735 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 94.544631][ T43] audit: type=1400 audit(1788554896.105:750): avc: denied { ioctl } for pid=8159 comm="syz.4.581" path="socket:[25239]" dev="sockfs" ino=25239 ioctlcmd=0x940d scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 94.613441][ T8168] nbd: socks must be embedded in a SOCK_ITEM attr [ 94.619643][ T8168] block nbd0: shutting down sockets [ 94.632964][ T8168] gadgetfs: bound to dummy_udc driver [ 94.662961][ T7997] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 94.835265][ T7997] veth0_vlan: entered promiscuous mode [ 94.842202][ T7997] veth1_vlan: entered promiscuous mode [ 94.868357][ T7997] veth0_macvtap: entered promiscuous mode [ 94.872755][ T7997] veth1_macvtap: entered promiscuous mode [ 94.885618][ T7997] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 94.892318][ T7997] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 94.950467][ T5803] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.950559][ T5803] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.950611][ T5803] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.950632][ T5803] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.397397][ T8163] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 95.397547][ T8163] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 95.404591][ T8163] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 95.438821][ T6262] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.438888][ T6262] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.473135][ T7210] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.473222][ T7210] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.510135][ T8191] overlayfs: missing 'lowerdir' [ 95.512214][ T43] audit: type=1804 audit(1788554897.075:751): pid=8191 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz.0.585" name="/newroot/152/file0" dev="tmpfs" ino=854 res=1 errno=0 [ 95.562655][ T66] Bluetooth: hci1: unexpected event for opcode 0x2011 [ 95.597919][ T8202] overlayfs: failed to resolve './file1/file0': -2 [ 95.613999][ T8205] IPv6: Can't replace route, no match found [ 95.614984][ T8205] netlink: 228 bytes leftover after parsing attributes in process `syz.0.588'. [ 95.682217][ T43] audit: type=1400 audit(1788554897.245:752): avc: denied { write } for pid=8213 comm="syz.6.589" name="/" dev="9p" ino=72377363 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 95.692729][ T43] audit: type=1400 audit(1788554897.255:753): avc: denied { ioctl } for pid=8213 comm="syz.6.589" path="/1/file0/hugetlb.2MB.usage_in_bytes" dev="9p" ino=72377457 ioctlcmd=0x8b34 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 95.791376][ T8227] ieee802154 phy1 wpan1: encryption failed: -22 [ 95.791400][ T43] audit: type=1400 audit(1788554897.355:754): avc: denied { write } for pid=8226 comm="syz.4.594" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 95.919806][ T43] audit: type=1400 audit(1788554897.485:755): avc: denied { create } for pid=8235 comm="syz.0.595" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_scsitransport_socket permissive=1 [ 95.922358][ T43] audit: type=1400 audit(1788554897.485:756): avc: denied { write } for pid=8235 comm="syz.0.595" path="socket:[26424]" dev="sockfs" ino=26424 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_scsitransport_socket permissive=1 [ 95.930961][ T8237] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=8237 comm=syz.0.595 [ 96.022597][ T43] audit: type=1400 audit(1788554897.585:757): avc: denied { mount } for pid=8243 comm="syz.0.600" name="/" dev="securityfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=filesystem permissive=1 [ 96.031473][ T8243] ima: policy update failed [ 96.099521][ T8251] xt_hl: Unknown TTL match mode: 255 [ 96.163738][ T8255] netlink: 'syz.6.602': attribute type 1 has an invalid length. [ 97.038612][ T8270] fuse: Bad value for 'group_id' [ 97.039112][ T8270] fuse: Bad value for 'group_id' [ 97.410443][ T8288] netlink: 9740 bytes leftover after parsing attributes in process `syz.0.610'. [ 97.433535][ T8291] netlink: 9740 bytes leftover after parsing attributes in process `syz.0.610'. [ 97.507047][ T8297] loop5: detected capacity change from 0 to 7 [ 97.517446][ T8297] Dev loop5: unable to read RDB block 7 [ 97.523837][ T8297] loop5: AHDI p1 p3 p4 [ 97.528337][ T8297] loop5: partition table partially beyond EOD, truncated [ 97.532559][ T8297] loop5: p1 size 100663296 extends beyond EOD, truncated [ 97.537582][ T8297] loop5: p3 size 4261412863 extends beyond EOD, truncated [ 97.577319][ T5725] udevd[5725]: inotify_add_watch(7, /dev/loop5p3, 10) failed: No such file or directory [ 97.579331][ T7882] udevd[7882]: inotify_add_watch(7, /dev/loop5p1, 10) failed: No such file or directory [ 97.602425][ T8301] netlink: 28 bytes leftover after parsing attributes in process `syz.6.613'. [ 97.602907][ T8301] netlink: 28 bytes leftover after parsing attributes in process `syz.6.613'. [ 97.675343][ T8313] netlink: 36 bytes leftover after parsing attributes in process `syz.6.615'. [ 97.701058][ T8266] FAULT_INJECTION: forcing a failure. [ 97.701058][ T8266] name failslab, interval 1, probability 0, space 0, times 0 [ 97.701164][ T8266] CPU: 3 UID: 0 PID: 8266 Comm: syz.4.606 Not tainted syzkaller #0 PREEMPT(full) [ 97.701202][ T8266] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 97.701215][ T8266] Call Trace: [ 97.701223][ T8266] [ 97.701232][ T8266] dump_stack_lvl+0x100/0x190 [ 97.701288][ T8266] should_fail_ex.cold+0x5/0xa [ 97.701318][ T8266] should_failslab+0xc2/0x120 [ 97.701353][ T8266] __kmalloc_cache_noprof+0x91/0x6d0 [ 97.701380][ T8266] ? kobject_uevent_env+0x263/0x18b0 [ 97.701426][ T8266] kobject_uevent_env+0x263/0x18b0 [ 97.701462][ T8266] ? kvm_uevent_notify_change.part.0+0x321/0x450 [ 97.701491][ T8266] ? kfree+0x22b/0x6d0 [ 97.701527][ T8266] kvm_uevent_notify_change.part.0+0x3a6/0x450 [ 97.701556][ T8266] ? __pfx_kvm_vcpu_release+0x10/0x10 [ 97.701580][ T8266] kvm_put_kvm+0xf9/0xc10 [ 97.701604][ T8266] ? __pfx___might_resched+0x10/0x10 [ 97.701626][ T8266] ? lock_acquire+0x1d1/0x380 [ 97.701648][ T8266] ? __pfx_kvm_vcpu_release+0x10/0x10 [ 97.701672][ T8266] kvm_vcpu_release+0x4b/0x70 [ 97.701694][ T8266] __fput+0x3ff/0xb50 [ 97.701723][ T8266] ? _raw_spin_unlock_irq+0x23/0x50 [ 97.701744][ T8266] task_work_run+0x150/0x240 [ 97.701776][ T8266] ? __pfx_task_work_run+0x10/0x10 [ 97.701832][ T8266] get_signal+0x1bd/0x21e0 [ 97.701870][ T8266] ? __pfx_get_signal+0x10/0x10 [ 97.701895][ T8266] ? task_work_add+0x201/0x3b0 [ 97.701933][ T8266] arch_do_signal_or_restart+0x91/0x7e0 [ 97.701965][ T8266] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 97.702011][ T8266] exit_to_user_mode_loop+0x139/0x700 [ 97.702038][ T8266] ? rcu_is_watching+0x13/0xc0 [ 97.702066][ T8266] do_syscall_64+0x661/0x790 [ 97.702096][ T8266] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 97.702117][ T8266] RIP: 0033:0x7f2e2bf9e159 [ 97.702136][ T8266] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 97.702156][ T8266] RSP: 002b:00007f2e2cdbc028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 97.702176][ T8266] RAX: fffffffffffffffc RBX: 00007f2e2c225fa0 RCX: 00007f2e2bf9e159 [ 97.702190][ T8266] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000007 [ 97.702201][ T8266] RBP: 00007f2e2c035024 R08: 0000000000000000 R09: 0000000000000000 [ 97.702212][ T8266] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 97.702224][ T8266] R13: 00007f2e2c226038 R14: 00007f2e2c225fa0 R15: 00007ffec07f3ae8 [ 97.702261][ T8266] [ 97.796738][ T8315] Unsupported ieee802154 address type: 0 [ 97.860779][ T8324] loop5: detected capacity change from 0 to 2640 [ 97.874579][ T7882] Buffer I/O error on dev loop5, logical block 0, async page read [ 97.874928][ T7882] Buffer I/O error on dev loop5, logical block 0, async page read [ 97.875155][ T7882] Buffer I/O error on dev loop5, logical block 0, async page read [ 97.875372][ T7882] Buffer I/O error on dev loop5, logical block 0, async page read [ 97.875616][ T7882] Buffer I/O error on dev loop5, logical block 0, async page read [ 97.884001][ T8324] Buffer I/O error on dev loop5, logical block 0, async page read [ 97.884037][ T8324] Buffer I/O error on dev loop5, logical block 0, async page read [ 97.884065][ T8324] Buffer I/O error on dev loop5, logical block 0, async page read [ 97.884091][ T8324] Buffer I/O error on dev loop5, logical block 0, async page read [ 97.884116][ T8324] Buffer I/O error on dev loop5, logical block 0, async page read [ 97.884222][ T8324] ldm_validate_partition_table(): Disk read failed. [ 97.884289][ T8324] Dev loop5: unable to read RDB block 0 [ 97.884708][ T8324] loop5: unable to read partition table [ 97.884910][ T8324] loop_reread_partitions: partition scan of loop5 (3„ ¾‚³˜) failed (rc=-5) [ 97.936117][ T8328] UHID_CREATE from different security context by process 474 (syz.4.620), this is not allowed. [ 98.629367][ T8369] bond0: option ad_select: unable to set because the bond device is up [ 98.977777][ T8397] netlink: 12 bytes leftover after parsing attributes in process `syz.6.635'. [ 99.077643][ T8216] usb 9-1: new high-speed USB device number 8 using dummy_hcd [ 99.122387][ T8409] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 99.142843][ T8413] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 99.142916][ T8413] CIFS mount error: No usable UNC path provided in device string! [ 99.142916][ T8413] [ 99.143531][ T8413] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 99.167715][ T8413] netlink: 20 bytes leftover after parsing attributes in process `syz.6.637'. [ 99.225800][ T8216] usb 9-1: Using ep0 maxpacket: 16 [ 99.226668][ T8216] usb 9-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 99.228610][ T8216] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 99.231256][ T8216] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 99.231277][ T8216] usb 9-1: Product: syz [ 99.231290][ T8216] usb 9-1: Manufacturer: syz [ 99.231304][ T8216] usb 9-1: SerialNumber: syz [ 99.234025][ T8216] usb 9-1: config 0 descriptor?? [ 99.238816][ T8216] em28xx 9-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 99.238834][ T8216] em28xx 9-1:0.0: DVB interface 0 found: bulk [ 99.559897][ T8430] netlink: 'syz.0.641': attribute type 1 has an invalid length. [ 99.670122][ T8435] /dev/sr0: Can't open blockdev [ 99.714277][ T8440] netlink: 12 bytes leftover after parsing attributes in process `syz.6.644'. [ 99.714353][ T8440] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 99.845195][ T8216] em28xx 9-1:0.0: unknown em28xx chip ID (0) [ 99.859178][ T8445] xt_socket: unknown flags 0x58 [ 100.234988][ T8462] XFS (nullb0): Invalid superblock magic number [ 100.263438][ T43] kauditd_printk_skb: 34 callbacks suppressed [ 100.263584][ T43] audit: type=1400 audit(1788554901.826:792): avc: denied { ioctl } for pid=8458 comm="syz.0.652" path="cgroup:[4026532881]" dev="nsfs" ino=4026532881 ioctlcmd=0x640a scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 100.279557][ T8216] em28xx 9-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 100.279633][ T8216] em28xx 9-1:0.0: board has no eeprom [ 100.555525][ T8216] em28xx 9-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 100.555595][ T8216] em28xx 9-1:0.0: dvb set to bulk mode. [ 100.557085][ T5832] em28xx 9-1:0.0: Binding DVB extension [ 100.573920][ T8216] usb 9-1: USB disconnect, device number 8 [ 100.582711][ T8481] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 100.582800][ T8481] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 100.588145][ T8216] em28xx 9-1:0.0: Disconnecting em28xx [ 100.665239][ T5832] em28xx 9-1:0.0: Registering input extension [ 100.671498][ T8216] em28xx 9-1:0.0: Closing input extension [ 100.807036][ T8216] em28xx: Freeing device [ 101.065073][ T43] audit: type=1400 audit(1788554902.626:793): avc: denied { watch watch_reads } for pid=8499 comm="syz.0.662" path="/190/file0" dev="9p" ino=72377363 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 101.065159][ T43] audit: type=1400 audit(1788554902.626:794): avc: denied { getattr } for pid=8499 comm="syz.0.662" name="/" dev="9p" ino=72377363 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 101.068911][ T43] audit: type=1400 audit(1788554902.636:795): avc: denied { write } for pid=8499 comm="syz.0.662" name="/" dev="9p" ino=72377363 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 101.073575][ T8502] netlink: 'syz.4.663': attribute type 4 has an invalid length. [ 101.079226][ T43] audit: type=1400 audit(1788554902.646:796): avc: denied { read write } for pid=8499 comm="syz.0.662" path="/190/file0/file0" dev="9p" ino=72377459 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 101.080169][ T8502] netlink: 'syz.4.663': attribute type 9 has an invalid length. [ 101.092624][ T8500] 9p: Bad value for 'wfdno' [ 101.401882][ T8518] xt_CT: No such helper "pptp" [ 101.433412][ T43] audit: type=1400 audit(1788554902.996:797): avc: denied { bind } for pid=8519 comm="syz.4.670" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 101.785506][ T8216] usb 11-1: new high-speed USB device number 2 using dummy_hcd [ 101.915382][ T8216] usb 11-1: device descriptor read/64, error -71 [ 102.157191][ T8216] usb 11-1: new high-speed USB device number 3 using dummy_hcd [ 102.285406][ T8216] usb 11-1: device descriptor read/64, error -71 [ 102.340005][ T8546] FAULT_INJECTION: forcing a failure. [ 102.340005][ T8546] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 102.340065][ T8546] CPU: 0 UID: 0 PID: 8546 Comm: syz.0.676 Not tainted syzkaller #0 PREEMPT(full) [ 102.340092][ T8546] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 102.340100][ T8546] Call Trace: [ 102.340105][ T8546] [ 102.340109][ T8546] dump_stack_lvl+0x100/0x190 [ 102.340141][ T8546] should_fail_ex.cold+0x5/0xa [ 102.340156][ T8546] ? prepare_alloc_pages+0x16d/0x5b0 [ 102.340174][ T8546] should_fail_alloc_page+0xeb/0x140 [ 102.340190][ T8546] prepare_alloc_pages+0x1f0/0x5b0 [ 102.340203][ T8546] ? __memcg_kmem_charge_page+0x373/0x4d0 [ 102.340221][ T8546] __alloc_frozen_pages_noprof+0x1e9/0x3300 [ 102.340242][ T8546] ? __lock_acquire+0x4c5/0x1ec0 [ 102.340257][ T8546] ? update_cfs_rq_load_avg+0x51/0x550 [ 102.340274][ T8546] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 102.340290][ T8546] ? lock_acquire+0x1d1/0x380 [ 102.340300][ T8546] ? finish_task_switch.isra.0+0x149/0x10d0 [ 102.340313][ T8546] ? find_held_lock+0x2b/0x80 [ 102.340327][ T8546] ? finish_task_switch.isra.0+0x2bd/0x10d0 [ 102.340339][ T8546] ? finish_task_switch.isra.0+0x2bd/0x10d0 [ 102.340352][ T8546] ? rcu_is_watching+0x13/0xc0 [ 102.340379][ T8546] ? finish_task_switch.isra.0+0x2c2/0x10d0 [ 102.340392][ T8546] ? lockdep_hardirqs_on+0x7d/0x110 [ 102.340411][ T8546] ? finish_task_switch.isra.0+0x2c2/0x10d0 [ 102.340431][ T8546] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 102.340445][ T8546] ? policy_nodemask+0xed/0x4f0 [ 102.340459][ T8546] alloc_pages_mpol+0x201/0x550 [ 102.340474][ T8546] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 102.340493][ T8546] ? avc_has_perm_noaudit+0x145/0x3b0 [ 102.340517][ T8546] alloc_pages_noprof+0x1a/0x160 [ 102.340544][ T8546] anon_pipe_prefill_and_lock+0x102/0x580 [ 102.340573][ T8546] ? __pfx_avc_has_perm+0x10/0x10 [ 102.340589][ T8546] ? __pfx_anon_pipe_prefill_and_lock+0x10/0x10 [ 102.340606][ T8546] ? inode_has_perm+0x16d/0x1d0 [ 102.340624][ T8546] anon_pipe_write+0x164/0x1b50 [ 102.340642][ T8546] ? __pfx_anon_pipe_write+0x10/0x10 [ 102.340655][ T8546] ? selinux_file_permission+0x8f/0x6d0 [ 102.340674][ T8546] ? bpf_lsm_file_permission+0x9/0x10 [ 102.340688][ T8546] ? security_file_permission+0x76/0x210 [ 102.340702][ T8546] ? rw_verify_area+0xce/0x6d0 [ 102.340719][ T8546] vfs_write+0x6af/0x1050 [ 102.340729][ T8546] ? __pfx_anon_pipe_write+0x10/0x10 [ 102.340743][ T8546] ? __pfx_vfs_write+0x10/0x10 [ 102.340751][ T8546] ? find_held_lock+0x2b/0x80 [ 102.340775][ T8546] ksys_write+0x1f8/0x250 [ 102.340785][ T8546] ? __pfx_ksys_write+0x10/0x10 [ 102.340798][ T8546] do_syscall_64+0x123/0x790 [ 102.340812][ T8546] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.340823][ T8546] RIP: 0033:0x7f0b1339e159 [ 102.340833][ T8546] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 102.340845][ T8546] RSP: 002b:00007f0b142d2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 102.340856][ T8546] RAX: ffffffffffffffda RBX: 00007f0b13625fa0 RCX: 00007f0b1339e159 [ 102.340863][ T8546] RDX: 00000000ffffff9a RSI: 0000200000000000 RDI: 0000000000000006 [ 102.340870][ T8546] RBP: 00007f0b13435024 R08: 0000000000000000 R09: 0000000000000000 [ 102.340876][ T8546] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 102.340882][ T8546] R13: 00007f0b13626038 R14: 00007f0b13625fa0 R15: 00007fff93c0b548 [ 102.340896][ T8546] [ 102.393978][ T8548] comedi comedi4: bad chanlist[0]=0x0000000a chan=10 range length=2 [ 102.486416][ T8216] usb usb11-port1: attempt power cycle [ 102.504826][ T8552] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 102.563418][ T43] audit: type=1400 audit(1788554904.126:798): avc: denied { bind } for pid=8556 comm="syz.4.681" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmpvc_socket permissive=1 [ 102.639097][ T8567] binder: BINDER_SET_CONTEXT_MGR already set [ 102.639155][ T8567] binder: 8566:8567 ioctl 4018620d 2000000000c0 returned -16 [ 102.640748][ T43] audit: type=1400 audit(1788554904.206:799): avc: denied { map } for pid=8566 comm="syz.0.683" path="/dev/binderfs/binder0" dev="binder" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 102.648960][ T8568] binder: BINDER_SET_CONTEXT_MGR already set [ 102.648972][ T8568] binder: 8566:8568 ioctl 4018620d 200000000040 returned -16 [ 102.657504][ T8567] binder: 8566:8567 unknown command 0 [ 102.657515][ T8567] binder: 8566:8567 ioctl c0306201 200000000280 returned -22 [ 102.706126][ T8573] netlink: 8 bytes leftover after parsing attributes in process `syz.0.684'. [ 102.706180][ T8573] netlink: 12 bytes leftover after parsing attributes in process `syz.0.684'. [ 102.790411][ T43] audit: type=1400 audit(1788554904.356:800): avc: denied { setopt } for pid=8576 comm="syz.4.686" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 102.836554][ T8216] usb 11-1: new high-speed USB device number 4 using dummy_hcd [ 102.839795][ T8583] fuse: fd is not a fuse device [ 102.885641][ T8216] usb 11-1: device descriptor read/8, error -71 [ 103.022983][ T43] audit: type=1400 audit(1788554904.586:801): avc: denied { mounton } for pid=8586 comm="syz.4.688" path="/174/tracing" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 103.156542][ T8216] usb 11-1: new high-speed USB device number 5 using dummy_hcd [ 103.185619][ T8216] usb 11-1: device descriptor read/8, error -71 [ 103.215216][ T8596] netlink: 'syz.4.692': attribute type 11 has an invalid length. [ 103.258860][ T8599] netlink: 8 bytes leftover after parsing attributes in process `syz.4.693'. [ 103.295932][ T8216] usb usb11-port1: unable to enumerate USB device [ 103.637288][ T8602] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 104.189287][ T8641] netlink: 104 bytes leftover after parsing attributes in process `syz.4.702'. [ 104.198126][ T8641] netlink: 12 bytes leftover after parsing attributes in process `syz.4.702'. [ 104.215106][ T5833] usb 5-1: new low-speed USB device number 7 using dummy_hcd [ 104.376885][ T5833] usb 5-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 104.378351][ T5833] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 104.378401][ T5833] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 104.378427][ T5833] usb 5-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 104.378450][ T5833] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 104.378474][ T5833] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 104.379619][ T5833] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 104.379657][ T5833] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 104.379681][ T5833] usb 5-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 104.379704][ T5833] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 104.379727][ T5833] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 104.380821][ T5833] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 104.380859][ T5833] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 104.380883][ T5833] usb 5-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 104.380906][ T5833] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 104.380930][ T5833] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 104.384432][ T5833] usb 5-1: string descriptor 0 read error: -22 [ 104.384544][ T5833] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 104.410563][ T5833] adutux 5-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 105.524236][ T43] kauditd_printk_skb: 17 callbacks suppressed [ 105.524319][ T43] audit: type=1400 audit(1788555163.085:819): avc: denied { write } for pid=8683 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 105.620458][ T43] audit: type=1400 audit(1788555163.185:820): avc: denied { write } for pid=8688 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 105.643256][ T8687] syzkaller0: entered promiscuous mode [ 105.643323][ T8687] syzkaller0: entered allmulticast mode [ 105.653760][ T43] audit: type=1400 audit(1788555163.215:821): avc: denied { relabelfrom } for pid=8686 comm="syz.6.710" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 105.656760][ T43] audit: type=1400 audit(1788555163.215:822): avc: denied { relabelto } for pid=8686 comm="syz.6.710" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 105.678529][ T8687] xt_CT: You must specify a L4 protocol and not use inversions on it [ 107.013253][ T5833] usb 5-1: USB disconnect, device number 7 [ 107.669761][ T43] audit: type=1400 audit(1788555165.235:823): avc: denied { write } for pid=8698 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 107.680995][ T43] audit: type=1400 audit(1788555165.245:824): avc: denied { write } for pid=8701 comm="syz.6.714" name="core" dev="configfs" ino=3543 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 107.686862][ T43] audit: type=1400 audit(1788555165.255:825): avc: denied { lock } for pid=8700 comm="syz.4.713" path="/dev/uinput" dev="devtmpfs" ino=941 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 107.687268][ T43] audit: type=1400 audit(1788555165.255:826): avc: denied { map } for pid=8700 comm="syz.4.713" path="socket:[29226]" dev="sockfs" ino=29226 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 107.687503][ T43] audit: type=1400 audit(1788555165.255:827): avc: denied { read } for pid=8700 comm="syz.4.713" path="socket:[29226]" dev="sockfs" ino=29226 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 107.710215][ T8703] netlink: 'syz.6.714': attribute type 1 has an invalid length. [ 107.732356][ T43] audit: type=1400 audit(1788555165.295:828): avc: denied { write } for pid=8705 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 107.832884][ T8713] bond1: (slave geneve2): making interface the new active one [ 107.836219][ T8713] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 107.854688][ T5776] netdevsim netdevsim6 netdevsim3: set [1, 1] type 2 family 0 port 20004 - 0 [ 107.854785][ T5776] netdevsim netdevsim6 netdevsim2: set [1, 1] type 2 family 0 port 20004 - 0 [ 107.854855][ T5776] netdevsim netdevsim6 netdevsim1: set [1, 1] type 2 family 0 port 20004 - 0 [ 107.854877][ T5776] netdevsim netdevsim6 netdevsim0: set [1, 1] type 2 family 0 port 20004 - 0 [ 107.998750][ T8725] mac80211_hwsim hwsim12 wlan1: entered allmulticast mode [ 107.999608][ T8725] tmpfs: Bad value for 'mpol' [ 108.044641][ T1351] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 108.194670][ T1351] usb 5-1: Using ep0 maxpacket: 8 [ 108.195601][ T1351] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 108.196632][ T1351] usb 5-1: config index 0 descriptor too short (expected 74, got 45) [ 108.196674][ T1351] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 108.196699][ T1351] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 108.196721][ T1351] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 30768, setting to 1024 [ 108.196745][ T1351] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 108.196763][ T1351] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 108.196803][ T1351] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 108.407534][ T1351] usb 5-1: usb_control_msg returned -71 [ 108.407612][ T1351] usbtmc 5-1:16.0: can't read capabilities [ 108.415104][ T1351] usb 5-1: USB disconnect, device number 8 [ 108.646192][ T5727] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 108.647314][ T5727] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 108.648785][ T8733] netlink: 40 bytes leftover after parsing attributes in process `syz.6.721'. [ 108.660872][ T5727] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 108.666359][ T5727] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 108.671505][ T5727] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 108.747810][ T8739] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 108.757359][ T8739] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 109.076656][ T8729] bridge0: port 1(bridge_slave_0) entered blocking state [ 109.076777][ T8729] bridge0: port 1(bridge_slave_0) entered disabled state [ 109.077067][ T8729] bridge_slave_0: entered allmulticast mode [ 109.078160][ T8729] bridge_slave_0: entered promiscuous mode [ 109.082089][ T8729] bridge0: port 2(bridge_slave_1) entered blocking state [ 109.082133][ T8729] bridge0: port 2(bridge_slave_1) entered disabled state [ 109.082196][ T8729] bridge_slave_1: entered allmulticast mode [ 109.082970][ T8729] bridge_slave_1: entered promiscuous mode [ 109.117123][ T8729] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 109.121435][ T8729] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 109.136532][ T8729] team0: Port device team_slave_0 added [ 109.138116][ T8729] team0: Port device team_slave_1 added [ 109.152238][ T8729] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 109.152290][ T8729] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 109.152511][ T8729] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 109.153872][ T8729] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 109.153882][ T8729] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 109.153898][ T8729] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 109.186602][ T8729] hsr_slave_0: entered promiscuous mode [ 109.187130][ T8729] hsr_slave_1: entered promiscuous mode [ 109.187462][ T8729] debugfs: 'hsr0' already exists in 'hsr' [ 109.187474][ T8729] Cannot create hsr debugfs directory [ 109.299473][ T8729] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 109.302111][ T8729] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 109.302539][ T8729] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 109.312097][ T8729] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 109.312670][ T8729] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 109.331407][ T8729] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 109.336079][ T8729] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 109.343478][ T8729] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 109.360660][ T8729] bridge0: port 2(bridge_slave_1) entered blocking state [ 109.360756][ T8729] bridge0: port 2(bridge_slave_1) entered forwarding state [ 109.360874][ T8729] bridge0: port 1(bridge_slave_0) entered blocking state [ 109.360922][ T8729] bridge0: port 1(bridge_slave_0) entered forwarding state [ 109.400748][ T8729] 8021q: adding VLAN 0 to HW filter on device bond0 [ 109.412671][ T6262] bridge0: port 1(bridge_slave_0) entered disabled state [ 109.417471][ T6262] bridge0: port 2(bridge_slave_1) entered disabled state [ 109.443344][ T8729] 8021q: adding VLAN 0 to HW filter on device team0 [ 109.455164][ T6262] bridge0: port 1(bridge_slave_0) entered blocking state [ 109.455293][ T6262] bridge0: port 1(bridge_slave_0) entered forwarding state [ 109.469298][ T6262] bridge0: port 2(bridge_slave_1) entered blocking state [ 109.469416][ T6262] bridge0: port 2(bridge_slave_1) entered forwarding state [ 109.495741][ T8789] ima: policy update failed [ 109.782429][ T8729] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 109.996749][ T8729] veth0_vlan: entered promiscuous mode [ 110.002201][ T8729] veth1_vlan: entered promiscuous mode [ 110.031534][ T8729] veth0_macvtap: entered promiscuous mode [ 110.036090][ T8729] veth1_macvtap: entered promiscuous mode [ 110.050353][ T8729] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 110.056958][ T8729] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 110.118267][ T5803] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.118369][ T5803] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.119271][ T5803] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.119307][ T5803] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.169612][ T1182] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 110.169678][ T1182] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 110.205887][ T1182] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 110.205966][ T1182] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 110.335894][ T8848] netlink: 'syz.0.747': attribute type 12 has an invalid length. [ 110.388287][ T8847] netlink: 88 bytes leftover after parsing attributes in process `syz.7.746'. [ 110.405124][ T8847] netlink: 4 bytes leftover after parsing attributes in process `syz.7.746'. [ 110.405200][ T8847] bridge_slave_1: left allmulticast mode [ 110.405236][ T8847] bridge_slave_1: left promiscuous mode [ 110.405376][ T8847] bridge0: port 2(bridge_slave_1) entered disabled state [ 110.418499][ T8847] bridge_slave_0: left allmulticast mode [ 110.418558][ T8847] bridge_slave_0: left promiscuous mode [ 110.418724][ T8847] bridge0: port 1(bridge_slave_0) entered disabled state [ 110.437580][ T8853] ALSA: seq fatal error: cannot create timer (-19) [ 110.460645][ T8856] fuse: fd is not a fuse device [ 110.475207][ T8854] input: syz1 as /devices/virtual/input/input20 [ 110.691994][ T43] kauditd_printk_skb: 12 callbacks suppressed [ 110.692235][ T43] audit: type=1400 audit(1788555168.255:841): avc: denied { connect } for pid=8860 comm="syz.6.751" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 110.695844][ T43] audit: type=1400 audit(1788555168.265:842): avc: denied { write } for pid=8860 comm="syz.6.751" path="socket:[32886]" dev="sockfs" ino=32886 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 110.770915][ T8863] netlink: 56 bytes leftover after parsing attributes in process `syz.6.752'. [ 110.774634][ T66] Bluetooth: hci4: command tx timeout [ 110.791800][ T8863] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 111.259795][ T8872] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 111.473157][ T8884] 9pnet: Limiting 'msize' to 512000 as this is the maximum supported by transport virtio [ 111.473372][ T43] audit: type=1400 audit(1788555169.035:843): avc: denied { mounton } for pid=8883 comm="syz.0.758" path="/217/mnt_trace/trace_pipe" dev="tracefs" ino=5344 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 111.528001][ T8891] loop5: detected capacity change from 0 to 7 [ 111.529653][ T8891] Dev loop5: unable to read RDB block 7 [ 111.529675][ T8891] loop5: AHDI p1 [ 111.529693][ T8891] loop5: partition table partially beyond EOD, truncated [ 111.550765][ T8893] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 111.697728][ T43] audit: type=1400 audit(1788555169.265:844): avc: denied { append } for pid=8902 comm="syz.6.764" name="uprobe_events" dev="tracefs" ino=7 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 111.698088][ T43] audit: type=1400 audit(1788555169.265:845): avc: denied { open } for pid=8902 comm="syz.6.764" path="/48/tracing/uprobe_events" dev="tracefs" ino=7 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 111.852895][ T43] audit: type=1400 audit(1788555169.415:846): avc: denied { getopt } for pid=8912 comm="syz.6.768" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 111.878312][ T43] audit: type=1400 audit(1788555169.445:847): avc: denied { write } for pid=8912 comm="syz.6.768" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 112.011281][ T8922] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 112.038875][ T43] audit: type=1400 audit(1788555169.605:848): avc: denied { connect } for pid=8919 comm="syz.0.770" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 112.084390][ T8927] befs: (loop6): No write support. Marking filesystem read-only [ 112.084922][ T8927] befs: (loop6): unable to read superblock [ 112.097733][ T8927] bridge1: entered promiscuous mode [ 112.102128][ T8929] befs: (loop6): No write support. Marking filesystem read-only [ 112.102302][ T8929] befs: (loop6): unable to read superblock [ 112.109086][ T8932] bridge2: entered promiscuous mode [ 112.234302][ T43] audit: type=1400 audit(1788555169.805:849): avc: denied { nlmsg_read } for pid=8943 comm="syz.6.778" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 112.271986][ T8945] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=8192 sclass=netlink_route_socket pid=8945 comm=syz.7.776 [ 112.490794][ T43] audit: type=1400 audit(1788555170.056:850): avc: denied { write } for pid=8962 comm="syz.4.783" name="cachefiles" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cachefiles_device_t tclass=chr_file permissive=1 [ 112.640787][ T8968] netlink: 'syz.6.785': attribute type 4 has an invalid length. [ 112.738687][ T8973] netlink: 'syz.6.787': attribute type 13 has an invalid length. [ 112.843374][ T8977] netlink: 20 bytes leftover after parsing attributes in process `syz.0.789'. [ 112.867017][ T66] Bluetooth: hci4: command tx timeout [ 113.003115][ T8995] CIFS: bad ip= option (127k·E'.1) [ 113.003349][ T8995] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 113.016265][ T8997] netlink: 'syz.6.793': attribute type 11 has an invalid length. [ 113.116460][ T9004] libceph: resolve '4' (ret=-3): failed [ 113.384214][ T10] usb 12-1: new high-speed USB device number 2 using dummy_hcd [ 113.433415][ T9042] netlink: 'syz.4.807': attribute type 3 has an invalid length. [ 113.433543][ T9042] netlink: 'syz.4.807': attribute type 1 has an invalid length. [ 113.433575][ T9042] netlink: 224 bytes leftover after parsing attributes in process `syz.4.807'. [ 113.433598][ T9042] NCSI netlink: No device for ifindex 0 [ 113.523981][ T10] usb 12-1: device descriptor read/64, error -71 [ 113.551132][ T9046] netlink: 32 bytes leftover after parsing attributes in process `syz.0.809'. [ 113.622260][ T9055] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 113.661496][ T9062] vhci_hcd vhci_hcd.0: failed to lookup sock [ 113.694414][ T9057] x_tables: ip_tables: .0 target: invalid size 8 (kernel) != (user) 4 [ 113.696587][ T9057] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=3 sclass=netlink_route_socket pid=9057 comm=syz.6.811 [ 113.696652][ T9057] netlink: 830 bytes leftover after parsing attributes in process `syz.6.811'. [ 113.774213][ T10] usb 12-1: new high-speed USB device number 3 using dummy_hcd [ 113.857255][ T9069] ip_tables: iptables: counters copy to user failed while replacing table [ 113.906115][ T10] usb 12-1: device descriptor read/64, error -71 [ 113.918511][ T9072] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 113.943869][ T30] usb 11-1: new high-speed USB device number 6 using dummy_hcd [ 114.014180][ T10] usb usb12-port1: attempt power cycle [ 114.086735][ T9086] netlink: 8 bytes leftover after parsing attributes in process `syz.0.821'. [ 114.086799][ T9086] netlink: 8 bytes leftover after parsing attributes in process `syz.0.821'. [ 114.094505][ T30] usb 11-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 114.096779][ T30] usb 11-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 114.096817][ T30] usb 11-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 114.096858][ T30] usb 11-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 114.100455][ T30] usb 11-1: config 0 descriptor?? [ 114.354020][ T10] usb 12-1: new high-speed USB device number 4 using dummy_hcd [ 114.374652][ T10] usb 12-1: device descriptor read/8, error -71 [ 114.560334][ T30] plantronics 0003:047F:FFFF.0003: hiddev0,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.6-1/input0 [ 114.560341][ T9119] 0x000000000000-0x000000020000 : "" [ 114.572710][ T9119] ftl_cs: FTL header not found. [ 114.635680][ T10] usb 12-1: new high-speed USB device number 5 using dummy_hcd [ 114.655090][ T10] usb 12-1: device descriptor read/8, error -71 [ 114.773300][ T9134] SELinux: policydb table sizes (0,0) do not match mine (8,7) [ 114.774059][ T10] usb usb12-port1: unable to enumerate USB device [ 114.777295][ T9134] SELinux: failed to load policy [ 114.823795][ T71] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 114.832818][ T9139] netlink: 8 bytes leftover after parsing attributes in process `syz.4.835'. [ 114.934200][ T66] Bluetooth: hci4: command tx timeout [ 114.984340][ T71] usb 5-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 7.03 [ 114.989402][ T71] usb 5-1: Dual-Role OTG device on HNP port [ 114.993142][ T71] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 115.022848][ T71] gspca_main: spca501-2.14.0 probing 0000:0000 [ 115.026508][ T71] gspca_spca501: reg write: error -32 [ 115.026553][ T71] spca501 5-1:1.0: Reg write failed for 0x02,0x0f,0x05 [ 115.026651][ T71] spca501 5-1:1.0: probe with driver spca501 failed with error -22 [ 115.030355][ C2] Oops: general protection fault, probably for non-canonical address 0xdffffc00000000e6: 0000 [#1] SMP KASAN NOPTI SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 115.044985][ C2] KASAN: null-ptr-deref in range [0x0000000000000730-0x0000000000000737] [ 115.049267][ C2] CPU: 2 UID: 0 PID: 71 Comm: kworker/2:2 Tainted: G L syzkaller #0 PREEMPT(full) [ 115.054201][ C2] Tainted: [L]=SOFTLOCKUP [ 115.056050][ C2] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 115.061106][ C2] Workqueue: usb_hub_wq hub_event [ 115.063699][ C2] RIP: 0010:f_midi2_free_ep_reqs+0x56/0x2b0 [ 115.066429][ C2] Code: 85 6a 02 00 00 49 8b 45 00 48 89 44 24 18 48 05 30 07 00 00 48 89 c2 48 89 44 24 20 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e b5 01 00 00 48 8b 44 24 18 31 [ 115.074604][ C2] RSP: 0018:ffffc900006589d8 EFLAGS: 00010002 [ 115.077394][ C2] RAX: dffffc0000000000 RBX: ffff88804fe08000 RCX: 0000000000000103 [ 115.080947][ C2] RDX: 00000000000000e6 RSI: ffffffff87f53a76 RDI: ffff88804fe08128 [ 115.083756][ C2] RBP: ffff88804fe08128 R08: 0000000000000004 R09: 0000000000000020 [ 115.086308][ C2] R10: 0000000000000020 R11: 000000000000761b R12: ffff88804fe080f0 [ 115.088971][ C2] R13: ffff88804fe08128 R14: ffff88804fe08740 R15: 0000000000000001 [ 115.092386][ C2] FS: 0000000000000000(0000) GS:ffff8880d5d60000(0000) knlGS:0000000000000000 [ 115.095974][ C2] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 115.098417][ C2] CR2: 00007f2e2cdbbff8 CR3: 0000000036e6b000 CR4: 0000000000352ef0 [ 115.101381][ C2] Call Trace: [ 115.102618][ C2] [ 115.103854][ C2] f_midi2_set_alt+0x444/0x5f0 [ 115.105750][ C2] composite_setup+0x16f8/0x9290 [ 115.107907][ C2] ? __lock_acquire+0x4c5/0x1ec0 [ 115.110157][ C2] ? kcov_remote_stop+0x202/0x560 [ 115.112326][ C2] ? __pfx_composite_setup+0x10/0x10 [ 115.114878][ C2] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 115.117358][ C2] ? do_raw_spin_lock+0x128/0x260 [ 115.119565][ C2] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 115.121852][ C2] ? configfs_composite_setup+0xfb/0x130 [ 115.124426][ C2] configfs_composite_setup+0xfb/0x130 [ 115.126878][ C2] dummy_timer+0x2039/0x3700 [ 115.129162][ C2] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 115.132147][ C2] ? debug_object_deactivate+0x2e4/0x3b0 [ 115.134605][ C2] ? __pfx_dummy_timer+0x10/0x10 [ 115.136659][ C2] ? mark_held_locks+0x40/0x70 [ 115.138651][ C2] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 115.141205][ C2] ? __pfx_dummy_timer+0x10/0x10 [ 115.143312][ C2] __hrtimer_run_queues+0x462/0x9c0 [ 115.145531][ C2] hrtimer_run_softirq+0x1ca/0x360 [ 115.148114][ C2] handle_softirqs+0x1e6/0x9d0 [ 115.150530][ C2] ? __pfx_handle_softirqs+0x10/0x10 [ 115.152958][ C2] ? _raw_spin_unlock+0x28/0x50 [ 115.154644][ C2] ? __hrtimer_rearm_deferred+0x9b/0x7b0 [ 115.156468][ C2] __irq_exit_rcu+0x194/0x210 [ 115.158070][ C2] irq_exit_rcu+0x9/0x30 [ 115.159609][ C2] sysvec_apic_timer_interrupt+0xa3/0xc0 [ 115.161555][ C2] [ 115.162827][ C2] [ 115.164249][ C2] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 115.166936][ C2] RIP: 0010:_raw_spin_unlock_irq+0x29/0x50 [ 115.170014][ C2] Code: 90 f3 0f 1e fa 53 48 8b 74 24 08 48 89 fb 48 83 c7 18 e8 2a 6e 14 f6 48 89 df e8 52 c4 14 f6 e8 7d 84 41 f6 fb bf 01 00 00 00 32 cb 03 f6 65 48 83 3d f1 45 b9 08 00 74 06 5b c3 cc cc cc cc [ 115.178554][ C2] RSP: 0018:ffffc90000c0e750 EFLAGS: 00000206 [ 115.181200][ C2] RAX: 0000000000028b7b RBX: ffff88806a63ae40 RCX: 0000000000000040 [ 115.184686][ C2] RDX: 0000000000000001 RSI: ffffffff8e3eb72f RDI: 0000000000000001 [ 115.188173][ C2] RBP: 1ffff92000181cec R08: 0000000000000001 R09: 0000000000000000 [ 115.192029][ C2] R10: 0000000000000001 R11: 0000000000000000 R12: ffff88806a63ae40 [ 115.196148][ C2] R13: 0000000000000001 R14: ffff8880313d2580 R15: dffffc0000000000 [ 115.199619][ C2] wq_worker_sleeping+0x276/0x2d0 [ 115.201704][ C2] ? __pfx_wq_worker_sleeping+0x10/0x10 [ 115.204160][ C2] ? __lock_acquire+0x4c5/0x1ec0 [ 115.206319][ C2] schedule+0x244/0x2c0 [ 115.208285][ C2] schedule_timeout+0x127/0x280 [ 115.210682][ C2] ? __pfx_schedule_timeout+0x10/0x10 [ 115.213286][ C2] ? __pfx_process_timeout+0x10/0x10 [ 115.215590][ C2] ? mark_held_locks+0x40/0x70 [ 115.217607][ C2] __wait_for_common+0x2e7/0x4c0 [ 115.219410][ C2] ? __pfx_schedule_timeout+0x10/0x10 [ 115.221233][ C2] ? __pfx___wait_for_common+0x10/0x10 [ 115.223253][ C2] usb_start_wait_urb+0x2ae/0x580 [ 115.225641][ C2] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 115.228569][ C2] ? __asan_memset+0x23/0x50 [ 115.230666][ C2] usb_control_msg+0x328/0x4b0 [ 115.232799][ C2] ? __pfx_usb_control_msg+0x10/0x10 [ 115.235002][ C2] ? lockdep_hardirqs_on+0x7d/0x110 [ 115.237192][ C2] usb_control_msg_send+0xca/0x130 [ 115.239488][ C2] usb_set_interface+0x9b6/0xe20 [ 115.241804][ C2] snd_usb_midi_v2_create+0x629/0x4070 [ 115.244424][ C2] ? __mutex_unlock_slowpath+0x35d/0x930 [ 115.246924][ C2] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 115.249485][ C2] ? snd_info_create_entry+0x6f/0x400 [ 115.251751][ C2] ? lockdep_init_map_type+0x5c/0x250 [ 115.254029][ C2] ? __pfx_snd_usb_midi_v2_create+0x10/0x10 [ 115.256706][ C2] ? lockdep_init_map_type+0x5c/0x250 [ 115.259414][ C2] ? snd_info_create_entry+0x314/0x400 [ 115.262007][ C2] ? usb_ifnum_to_if+0x16f/0x1d0 [ 115.264256][ C2] snd_usb_create_stream.isra.0+0x386/0x4d0 [ 115.266760][ C2] usb_audio_probe+0xf0b/0x3b10 [ 115.268795][ C2] ? __pfx_usb_audio_probe+0x10/0x10 [ 115.271068][ C2] ? do_raw_spin_lock+0x128/0x260 [ 115.273184][ C2] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 115.275460][ C2] ? mark_held_locks+0x40/0x70 [ 115.277614][ C2] ? _raw_spin_lock_irqsave+0x52/0x60 [ 115.280306][ C2] ? find_held_lock+0x2b/0x80 [ 115.282588][ C2] ? mark_held_locks+0x40/0x70 [ 115.284683][ C2] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 115.287218][ C2] usb_probe_interface+0x386/0x9b0 [ 115.289345][ C2] ? __pfx_usb_probe_interface+0x10/0x10 [ 115.291722][ C2] ? kernfs_put+0x3f/0x60 [ 115.293553][ C2] ? sysfs_create_link+0x68/0xc0 [ 115.295804][ C2] ? __pfx_usb_probe_interface+0x10/0x10 [ 115.298758][ C2] really_probe+0x241/0xa60 [ 115.301073][ C2] __driver_probe_device+0x210/0x460 [ 115.303540][ C2] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 115.306089][ C2] driver_probe_device+0x4a/0x140 [ 115.308324][ C2] __device_attach_driver+0x1df/0x320 [ 115.310603][ C2] ? __pfx___device_attach_driver+0x10/0x10 [ 115.313035][ C2] bus_for_each_drv+0x159/0x1e0 [ 115.315183][ C2] ? __pfx_bus_for_each_drv+0x10/0x10 [ 115.317985][ C2] ? lockdep_hardirqs_on+0x7d/0x110 [ 115.320375][ C2] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 115.322801][ C2] __device_attach+0x1e4/0x4d0 [ 115.324856][ C2] ? __pfx___device_attach+0x10/0x10 [ 115.327139][ C2] ? do_raw_spin_unlock+0x145/0x1e0 [ 115.329364][ C2] device_initial_probe+0xaf/0xd0 [ 115.331826][ C2] bus_probe_device+0x64/0x160 [ 115.334259][ C2] device_add+0x121d/0x1970 [ 115.336406][ C2] ? __pfx_device_add+0x10/0x10 [ 115.337971][ C2] ? mark_held_locks+0x40/0x70 [ 115.339915][ C2] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 115.342375][ C2] usb_set_configuration+0xd97/0x1c60 [ 115.344615][ C2] ? __pfx_usb_generic_driver_probe+0x10/0x10 [ 115.347130][ C2] usb_generic_driver_probe+0xa1/0xe0 [ 115.350001][ C2] usb_probe_device+0xef/0x400 [ 115.352028][ C2] ? __pfx_usb_probe_device+0x10/0x10 [ 115.354211][ C2] really_probe+0x241/0xa60 [ 115.356163][ C2] __driver_probe_device+0x210/0x460 [ 115.358324][ C2] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 115.360808][ C2] driver_probe_device+0x4a/0x140 [ 115.363005][ C2] __device_attach_driver+0x1df/0x320 [ 115.365407][ C2] ? __pfx___device_attach_driver+0x10/0x10 [ 115.367963][ C2] bus_for_each_drv+0x159/0x1e0 [ 115.370069][ C2] ? __pfx_bus_for_each_drv+0x10/0x10 [ 115.372281][ C2] ? lockdep_hardirqs_on+0x7d/0x110 [ 115.374300][ C2] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 115.376275][ C2] __device_attach+0x1e4/0x4d0 [ 115.378166][ C2] ? __pfx___device_attach+0x10/0x10 [ 115.380289][ C2] ? do_raw_spin_unlock+0x145/0x1e0 [ 115.382648][ C2] device_initial_probe+0xaf/0xd0 [ 115.384462][ C2] bus_probe_device+0x64/0x160 [ 115.386717][ C2] device_add+0x121d/0x1970 [ 115.388979][ C2] ? __pfx_device_add+0x10/0x10 [ 115.391239][ C2] ? usb_detect_static_quirks+0x335/0x3e0 [ 115.393389][ C2] usb_new_device.part.0+0xcc2/0x1686 [ 115.395348][ C2] ? __pfx_usb_new_device.part.0+0x10/0x10 [ 115.397773][ C2] ? mark_held_locks+0x40/0x70 [ 115.399863][ C2] hub_event.cold+0x1e3/0xe90 [ 115.402035][ C2] ? __pfx_hub_event+0x10/0x10 [ 115.404318][ C2] ? mark_lock+0xea0/0x1020 [ 115.406670][ C2] ? lock_acquire+0x1d1/0x380 [ 115.408702][ C2] ? process_one_work+0xa2c/0x1b10 [ 115.410967][ C2] ? process_one_work+0x906/0x1b10 [ 115.413172][ C2] ? process_one_work+0x906/0x1b10 [ 115.415458][ C2] process_one_work+0xac7/0x1b10 [ 115.417786][ C2] ? __pfx_process_one_work+0x10/0x10 [ 115.420473][ C2] ? lock_acquire+0x1d1/0x380 [ 115.422689][ C2] ? __pfx_hub_event+0x10/0x10 [ 115.424813][ C2] worker_thread+0x5ef/0xe50 [ 115.426745][ C2] ? kthread+0x13a/0x450 [ 115.428570][ C2] ? __pfx_worker_thread+0x10/0x10 [ 115.430807][ C2] kthread+0x373/0x450 [ 115.432757][ C2] ? __pfx_kthread+0x10/0x10 [ 115.435221][ C2] ret_from_fork+0x730/0xd60 [ 115.437280][ C2] ? __pfx_ret_from_fork+0x10/0x10 [ 115.439398][ C2] ? __switch_to+0x800/0x10f0 [ 115.441384][ C2] ? __pfx_kthread+0x10/0x10 [ 115.443365][ C2] ret_from_fork_asm+0x1a/0x30 [ 115.445217][ C2] [ 115.446276][ C2] Modules linked in: [ 115.447843][ C2] ---[ end trace 0000000000000000 ]--- [ 115.450348][ C2] RIP: 0010:f_midi2_free_ep_reqs+0x56/0x2b0 [ 115.450387][ C2] Code: 85 6a 02 00 00 49 8b 45 00 48 89 44 24 18 48 05 30 07 00 00 48 89 c2 48 89 44 24 20 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e b5 01 00 00 48 8b 44 24 18 31 [ 115.450410][ C2] RSP: 0018:ffffc900006589d8 EFLAGS: 00010002 [ 115.450428][ C2] RAX: dffffc0000000000 RBX: ffff88804fe08000 RCX: 0000000000000103 [ 115.450466][ C2] RDX: 00000000000000e6 RSI: ffffffff87f53a76 RDI: ffff88804fe08128 [ 115.450480][ C2] RBP: ffff88804fe08128 R08: 0000000000000004 R09: 0000000000000020 [ 115.450494][ C2] R10: 0000000000000020 R11: 000000000000761b R12: ffff88804fe080f0 [ 115.450507][ C2] R13: ffff88804fe08128 R14: ffff88804fe08740 R15: 0000000000000001 [ 115.450520][ C2] FS: 0000000000000000(0000) GS:ffff8880d5d60000(0000) knlGS:0000000000000000 [ 115.450557][ C2] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 115.450573][ C2] CR2: 00007f2e2cdbbff8 CR3: 0000000036e6b000 CR4: 0000000000352ef0 [ 115.450590][ C2] Kernel panic - not syncing: Fatal exception in interrupt [ 115.494753][ C2] Kernel Offset: disabled [ 115.496627][ C2] Rebooting in 86400 seconds..